@yemi33/minions 0.1.2448 → 0.1.2449

package/engine/{watchdog.js → recovery/watchdog.js}

@@ -1,7 +1,7 @@
-// engine/watchdog.js — out-of-process recovery scheduled by the OS.
+// engine/recovery/watchdog.js — out-of-process recovery scheduled by the OS.
 //
 // PROBLEM (cluster-kill):
-//   The in-process supervisor (engine/supervisor.js) respawns engine/dashboard
+//   The in-process supervisor (engine/recovery/supervisor.js) respawns engine/dashboard
 //   when one of them dies in isolation, but it can't respawn ITSELF. When
 //   something kills all three at once — Windows job-object teardown when a
 //   parent terminal closes (RDP disconnect, Windows Terminal auto-update,
@@ -41,6 +41,7 @@ const WIN_TASK_NAME = 'MinionsWatchdog';
 const MAC_PLIST_LABEL = 'io.minions.watchdog';
 const LINUX_UNIT_NAME = 'minions-watchdog';
 const TICK_SPAWN_TIMEOUT_MS = 120000;
+const WIN_TASK_EXECUTION_LIMIT_MIN = 2;
 const WATCHDOG_LOG_NAME = 'watchdog-stdio.log';
 // Cap the watchdog log so a misbehaving scheduler can't fill the disk
 // over months. Truncates to half-size on overflow (oldest lines dropped).
@@ -53,9 +54,13 @@ const WATCHDOG_LOG_MAX_BYTES = 2 * 1024 * 1024;
 // "dead", and fire a SECOND `minions start` before the first finished binding
 // — re-introducing the documented duplicate-engine/dashboard storm class. The
 // in-process supervisor avoids this with an in-memory POST_SPAWN_GRACE_MS
-// (engine/supervisor.js:76); the watchdog can't keep state across ticks, so it
+// (engine/recovery/supervisor.js:76); the watchdog can't keep state across ticks, so it
 // persists a tiny timestamp beacon to disk and stands down inside the window.
 const WATCHDOG_SPAWN_BEACON_NAME = 'watchdog-spawn.json';
+const WATCHDOG_PARTIAL_BEACON_NAME = 'watchdog-partial.json';
+const PARTIAL_RECOVERY_GRACE_MS = 90 * 1000;
+const FRESH_ENGINE_HEARTBEAT_MS = Number(process.env.MINIONS_WATCHDOG_FRESH_HEARTBEAT_MS) || 60 * 1000;
+const STALE_ENGINE_HEARTBEAT_MS = Number(process.env.MINIONS_WATCHDOG_STALE_HEARTBEAT_MS) || 180 * 1000;
 // Floor for the grace window. The effective window is max(2 × interval, floor)
 // so a fast cadence (e.g. --interval=1) still leaves a slow cold-start time to
 // finish, while a long cadence scales the window up with the interval.
@@ -65,6 +70,10 @@ function watchdogSpawnBeaconPath(minionsHome) {
   return path.join(minionsHome, 'engine', WATCHDOG_SPAWN_BEACON_NAME);
 }
 
+function watchdogPartialBeaconPath(minionsHome) {
+  return path.join(minionsHome, 'engine', WATCHDOG_PARTIAL_BEACON_NAME);
+}
+
 // Effective grace window: max(2 × interval, 90s). intervalMin defaults to the
 // scheduler's default cadence when the caller doesn't thread one through.
 function resolvePostSpawnGraceMs(intervalMin) {
@@ -94,6 +103,28 @@ function writeSpawnBeacon(minionsHome, nowMs, action) {
   } catch { /* fail-open — recovery still proceeds */ }
 }
 
+function readPartialBeacon(minionsHome) {
+  try {
+    const obj = JSON.parse(fs.readFileSync(watchdogPartialBeaconPath(minionsHome), 'utf8'));
+    const ts = Number(obj?.ts);
+    const state = typeof obj?.state === 'string' ? obj.state : '';
+    return Number.isFinite(ts) && state ? { ts, state } : null;
+  } catch { return null; }
+}
+
+function writePartialBeacon(minionsHome, nowMs, state) {
+  try {
+    const dir = path.join(minionsHome, 'engine');
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(watchdogPartialBeaconPath(minionsHome), JSON.stringify({ ts: nowMs, state }));
+    return true;
+  } catch { return false; }
+}
+
+function clearPartialBeacon(minionsHome) {
+  try { fs.unlinkSync(watchdogPartialBeaconPath(minionsHome)); } catch { /* absent/unremovable: best effort */ }
+}
+
 function logLine(minionsHome, msg) {
   try {
     const dir = path.join(minionsHome, 'engine');
@@ -118,6 +149,16 @@ function isPidAlive(pid) {
   try { process.kill(pid, 0); return true; } catch { return false; }
 }
 
+function readEngineHeartbeat(minionsHome) {
+  try {
+    const control = JSON.parse(fs.readFileSync(path.join(minionsHome, 'engine', 'control.json'), 'utf8'));
+    const heartbeat = Number(control?.heartbeat);
+    return Number.isFinite(heartbeat) && heartbeat > 0 ? heartbeat : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Probe engine + dashboard and recover if needed. Always resolves (never
  * throws). Returns { healthy, action, exitCode? } describing what was done.
@@ -127,9 +168,8 @@ function isPidAlive(pid) {
  *                                respawning would undo `minions stop`)
  *   - both alive                → no-op
  *   - both dead                 → `minions start` (idempotent fast path)
- *   - one alive one dead        → `minions restart` (only restart can
- *                                reconcile partial state — start refuses
- *                                by design)
+ *   - engine dead, dashboard up → start only engine after recovery grace
+ *   - engine up, dashboard dead → start only dashboard after recovery grace
  */
 async function tick(opts) {
   opts = opts || {};
@@ -149,6 +189,7 @@ async function tick(opts) {
   // loop is briefly blocked, so it stays accurate exactly when netstat fails.
   const confirmPortUp = opts.confirmPortUp;
   const isStopIntentSet = opts.isStopIntentSet;
+  const readHeartbeat = opts.readEngineHeartbeat || readEngineHeartbeat;
   const spawner = opts.spawner || spawn;
   const now = opts.now || (() => new Date());
 
@@ -173,13 +214,34 @@ async function tick(opts) {
     try { stopWanted = !!isStopIntentSet(); } catch { stopWanted = false; }
   }
   if (stopWanted) {
+    clearPartialBeacon(minionsHome);
     logLine(minionsHome, `stop-intent set → standing down (no probe, no recovery)`);
     return { healthy: false, action: 'stand-down' };
   }
 
   let enginePid = null;
   try { enginePid = readEnginePid(minionsHome); } catch { enginePid = null; }
-  const engineAlive = isPidAlive(enginePid);
+  let engineAlive = isPidAlive(enginePid);
+  if (enginePid) {
+    let heartbeat = null;
+    try { heartbeat = readHeartbeat(minionsHome); } catch { heartbeat = null; }
+    const heartbeatAgeMs = heartbeat ? now().getTime() - heartbeat : null;
+    if (!engineAlive && heartbeatAgeMs !== null && heartbeatAgeMs < FRESH_ENGINE_HEARTBEAT_MS) {
+      logLine(
+        minionsHome,
+        `engine=${enginePid} reported dead but heartbeat is ${Math.round(heartbeatAgeMs / 1000)}s old ` +
+        '— treating as alive (false-negative suppressed)',
+      );
+      engineAlive = true;
+    } else if (engineAlive && heartbeatAgeMs !== null && heartbeatAgeMs >= STALE_ENGINE_HEARTBEAT_MS) {
+      logLine(
+        minionsHome,
+        `engine=${enginePid} PID exists but heartbeat is ${Math.round(heartbeatAgeMs / 1000)}s old ` +
+        '— treating as dead (stale identity)',
+      );
+      engineAlive = false;
+    }
+  }
   let dashUp = false;
   try { dashUp = !!isPortListening(dashPort); } catch { dashUp = false; }
 
@@ -197,12 +259,38 @@ async function tick(opts) {
   }
 
   if (engineAlive && dashUp) {
+    clearPartialBeacon(minionsHome);
     logLine(minionsHome, `ok engine=${enginePid} port=${dashPort} ts=${now().toISOString()}`);
     return { healthy: true, action: 'none' };
   }
 
   const partial = engineAlive || dashUp;
-  const action = partial ? 'restart' : 'start';
+  const action = !partial ? 'start' : (engineAlive ? 'dashboard' : 'engine');
+  const nowMs = now().getTime();
+
+  // The dashboard watchdog and supervisor both repair partial state. Give
+  // those in-process mechanisms time to converge before the external watchdog
+  // launches a destructive full restart. The first observation is persisted
+  // because every OS-scheduled tick is a fresh process.
+  if (partial) {
+    const partialState = `${engineAlive ? 'engine-up' : 'engine-down'}:${dashUp ? 'dashboard-up' : 'dashboard-down'}`;
+    const observed = readPartialBeacon(minionsHome);
+    if (!observed || observed.state !== partialState) {
+      if (writePartialBeacon(minionsHome, nowMs, partialState)) {
+        logLine(minionsHome, `partial state ${partialState} first observed → standing down for ${PARTIAL_RECOVERY_GRACE_MS}ms in-process recovery grace`);
+        return { healthy: false, action: 'skip', reason: 'partial-recovery-grace' };
+      }
+    } else {
+      const ageMs = nowMs - observed.ts;
+      if (ageMs >= 0 && ageMs < PARTIAL_RECOVERY_GRACE_MS) {
+        logLine(minionsHome, `partial state ${partialState} persists ${ageMs}ms (< ${PARTIAL_RECOVERY_GRACE_MS}ms) → standing down for in-process recovery`);
+        return { healthy: false, action: 'skip', reason: 'partial-recovery-grace' };
+      }
+    }
+    clearPartialBeacon(minionsHome);
+  } else {
+    clearPartialBeacon(minionsHome);
+  }
 
   // Post-spawn grace: if a previous tick already issued a spawn within the
   // grace window, stand down instead of double-firing. Each tick is a fresh
@@ -210,7 +298,6 @@ async function tick(opts) {
   // the slow-cold-start race where control.json's late PID write lets the next
   // scheduled tick spawn a second daemon stack.
   const graceMs = resolvePostSpawnGraceMs(opts.intervalMin);
-  const nowMs = now().getTime();
   const lastSpawnTs = readSpawnBeaconTs(minionsHome);
   if (lastSpawnTs != null && nowMs - lastSpawnTs < graceMs) {
     logLine(
@@ -224,7 +311,7 @@ async function tick(opts) {
   logLine(
     minionsHome,
     `unhealthy engine=${enginePid || '-'}(${engineAlive ? 'alive' : 'dead'}) ` +
-    `port=${dashPort}(${dashUp ? 'up' : 'down'}) → invoking minions ${action}`
+    `port=${dashPort}(${dashUp ? 'up' : 'down'}) → invoking ${action === 'start' ? 'minions start' : `targeted ${action} recovery`}`
   );
 
   try {
@@ -236,7 +323,15 @@ async function tick(opts) {
     // Detach the child so its lifetime is independent of this tick process.
     // The OS scheduler closes our stdio shortly after exit; we don't want
     // that closure to cascade into the new daemon stack.
-    const child = spawner(process.execPath, [minionsBin, action], {
+    let spawnArgs;
+    if (action === 'engine') {
+      spawnArgs = [path.join(minionsHome, 'engine.js'), 'start'];
+    } else if (action === 'dashboard') {
+      spawnArgs = [path.join(minionsHome, 'dashboard.js'), String(dashPort)];
+    } else {
+      spawnArgs = [minionsBin, 'start'];
+    }
+    const child = spawner(process.execPath, spawnArgs, {
       detached: true,
       stdio: 'ignore',
       windowsHide: true,
@@ -245,10 +340,14 @@ async function tick(opts) {
       // user action), so the post-restart hook MUST NOT pop a browser tab.
       // The CLI's spawnFullStackAndVerify reads this env var as a hard
       // kill-switch via MINIONS_NO_AUTO_OPEN=1.
-      env: { ...process.env, MINIONS_NO_AUTO_OPEN: '1' },
+      env: {
+        ...process.env,
+        MINIONS_NO_AUTO_OPEN: '1',
+        ...(action === 'dashboard' ? { MINIONS_REQUIRE_DASHBOARD_PORT: '1' } : {}),
+      },
     });
     if (child && typeof child.unref === 'function') child.unref();
-    logLine(minionsHome, `spawned minions ${action} pid=${child && child.pid} (detached)`);
+    logLine(minionsHome, `spawned ${action === 'start' ? 'minions start' : `targeted ${action}`} pid=${child && child.pid} (detached)`);
     // Crash-loop counter (W-mr2c46590003e3ee) — best-effort, injected so this
     // module stays dependency-free of shared.js (matches isStopIntentSet /
     // confirmPortUp above). Caller (bin/minions.js) wires opts.recordRespawn
@@ -324,6 +423,7 @@ REM Minions watchdog launcher — auto-generated by 'minions watchdog install'.\
 REM Re-run 'minions watchdog install' to regenerate after moving MINIONS_HOME.\r
 set "MINIONS_HOME=${opts.minionsHome}"\r
 "${opts.nodeBin}" "${opts.minionsBin}" watchdog tick\r
+exit /b %ERRORLEVEL%\r
 `;
 }
 
@@ -350,6 +450,24 @@ function installWindows(opts) {
   if (r.status !== 0) {
     throw new Error(`schtasks /Create failed (exit ${r.status}): ${(r.stderr || r.stdout || '').trim()}`);
   }
+  // schtasks defaults one-shot tasks to IgnoreNew + a 72-hour execution
+  // limit. A stranded cmd.exe then blocks every later watchdog tick. Allow a
+  // later tick to run in parallel and bound every instance to two minutes.
+  const settingsScript = [
+    '$settings = New-ScheduledTaskSettingsSet -MultipleInstances Parallel ' +
+      `-ExecutionTimeLimit (New-TimeSpan -Minutes ${WIN_TASK_EXECUTION_LIMIT_MIN}) ` +
+      '-StartWhenAvailable',
+    `Set-ScheduledTask -TaskName '${WIN_TASK_NAME}' -Settings $settings | Out-Null`,
+  ].join('; ');
+  const settingsResult = sp('powershell.exe', [
+    '-NoProfile', '-NonInteractive', '-Command', settingsScript,
+  ], { encoding: 'utf8', windowsHide: true });
+  if (settingsResult.status !== 0) {
+    throw new Error(
+      `Set-ScheduledTask watchdog settings failed (exit ${settingsResult.status}): ` +
+      `${(settingsResult.stderr || settingsResult.stdout || '').trim()}`
+    );
+  }
   return { ok: true, scheduler: 'Task Scheduler', taskName: WIN_TASK_NAME, intervalMin: opts.intervalMin, launcherPath };
 }
 
@@ -626,8 +744,13 @@ module.exports = {
   LINUX_UNIT_NAME,
   WATCHDOG_LOG_NAME,
   WATCHDOG_SPAWN_BEACON_NAME,
+  WATCHDOG_PARTIAL_BEACON_NAME,
+  PARTIAL_RECOVERY_GRACE_MS,
+  FRESH_ENGINE_HEARTBEAT_MS,
+  STALE_ENGINE_HEARTBEAT_MS,
   POST_SPAWN_GRACE_FLOOR_MS,
   watchdogSpawnBeaconPath,
+  watchdogPartialBeaconPath,
   resolvePostSpawnGraceMs,
   buildMacPlist,
   buildLinuxService,

package/engine/runtimes/claude.js

@@ -14,8 +14,8 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { FAILURE_CLASS, safeWrite, ts, resolveEngineCacheDir, staleResumeSessionCwdReason } = require('../shared');
-const { wrapUntrusted, buildSource } = require('../untrusted-fence');
+const { FAILURE_CLASS, safeWrite, ts, resolveEngineCacheDir, staleResumeSessionCwdReason } = require('../core/shared');
+const { wrapUntrusted, buildSource } = require('../core/untrusted-fence');
 
 const ENGINE_DIR = __dirname.replace(/[\\/]runtimes$/, '');
 const MINIONS_DIR = path.resolve(ENGINE_DIR, '..');
@@ -26,7 +26,7 @@ const RUNTIME_NAME = 'claude';
 const SPAWN_STARTUP_SUBTYPES = new Set(['init', 'hook_started', 'hook_response']);
 
 // ── Binary Resolution ────────────────────────────────────────────────────────
-// Mirrors engine/spawn-agent.js:26-91. Cached at engine/claude-caps.json so the
+// Mirrors engine/agents/spawn-agent.js:26-91. Cached at engine/claude-caps.json so the
 // repeated path-probe (PATH / npm-global / npm-root-g) only happens once per
 // install.
 
@@ -184,7 +184,7 @@ const MODELS_CACHE = path.join(_CACHE_DIR, 'claude-models.json');
  *
  * Mirrors the union of:
  *   - engine.js:817-844 (agent dispatch)
- *   - engine/llm.js:68-76 (CC / doc-chat direct spawn)
+ *   - engine/agents/llm.js:68-76 (CC / doc-chat direct spawn)
  *   - spawn-agent.js:118-128 (--system-prompt-file injection on first turn)
  *
  * Per the plan: emits `--dangerously-skip-permissions` (the modern Claude flag)
@@ -203,6 +203,7 @@ function buildArgs(opts = {}) {
     model,
     maxTurns,
     allowedTools,
+    disableTools,
     effort,
     sessionId,
     sysPromptFile,
@@ -231,6 +232,7 @@ function buildArgs(opts = {}) {
     }
   }
   if (allowedTools) args.push('--allowedTools', allowedTools);
+  if (disableTools === true) args.push('--tools', '');
   if (effort) args.push('--effort', String(effort));
   args.push('--dangerously-skip-permissions');
   if (maxBudget != null) args.push('--max-budget-usd', String(maxBudget));
@@ -535,7 +537,7 @@ function parseOutput(raw, { maxTextLength = 0 } = {}) {
  * Parse a single line from the stream-json stdout. Returns the parsed event
  * object, or null when the line is empty / non-JSON.
  *
- * Used by the streaming accumulator in engine/llm.js to react to assistant
+ * Used by the streaming accumulator in engine/agents/llm.js to react to assistant
  * text blocks, tool-use blocks, and the terminal `result` event without
  * waiting for the whole process to exit.
  */
@@ -672,7 +674,7 @@ function parseError(rawOutput) {
 
 // ── Stream Consumer ─────────────────────────────────────────────────────────
 //
-// Per-stream consumer factory invoked by engine/llm.js's accumulator. The
+// Per-stream consumer factory invoked by engine/agents/llm.js's accumulator. The
 // accumulator owns global stream state (stdout/stderr/text dedup/tool dedup)
 // and exposes the `ctx` API below; the consumer owns Claude-specific per-stream
 // state (joined-text accumulator, content-block Map for tool/thinking
@@ -738,7 +740,7 @@ function createStreamConsumer(ctx) {
       // reset the hot-path accumulator so the NEXT text block starts fresh
       // instead of welding onto text from before this block. `ctx.pushText`
       // already opens a new segment when the pushed value doesn't extend
-      // `lastTextSent` (see engine/llm.js), so this reset is sufficient to
+      // `lastTextSent` (see engine/agents/llm.js), so this reset is sufficient to
       // both stop the weld and trigger the segment boundary.
       if (block.type !== 'text') claudeJoinedText = '';
       // Out-of-order block landing: rebuild from the Map. Common case is
@@ -831,7 +833,7 @@ function createStreamConsumer(ctx) {
       // each block is {type:'tool_result', tool_use_id, is_error, content}.
       // Flip the previously-pushed chip to completed (success) or failed
       // (is_error). This is the Claude-direct analogue of Copilot's ACP
-      // tool_call_update; engine/llm.js stays runtime-agnostic — the chip
+      // tool_call_update; engine/agents/llm.js stays runtime-agnostic — the chip
       // turns green/red only because this adapter calls ctx.updateToolUse.
       for (const block of obj.message.content) {
         if (block?.type === 'tool_result' && block.tool_use_id) {
@@ -884,7 +886,7 @@ const capabilities = {
   bareMode: true,
   // The Claude Code CLI reads repo-authored CLAUDE.md files itself at startup
   // (unless `--bare`). TRUE here tells the engine's CLAUDE.md-propagation layer
-  // (engine/claude-md-context.js, injected in engine/playbook.js) to SKIP this
+  // (engine/agents/claude-md-context.js, injected in engine/agents/playbook.js) to SKIP this
   // runtime — re-injecting CLAUDE.md content into the prompt would double it.
   // Copilot/Codex set this false because they have no native CLAUDE.md auto-load.
   claudeMdNativeDiscovery: true,
@@ -908,7 +910,7 @@ const capabilities = {
 };
 
 // Install hint surfaced when `resolveBinary()` returns null. Consumed by
-// `engine/preflight.js` (per-runtime binary check) and `engine/spawn-agent.js`
+// `engine/agents/preflight.js` (per-runtime binary check) and `engine/agents/spawn-agent.js`
 // (fatal error message). Multi-line so all platforms see actionable guidance.
 const INSTALL_HINT = 'install from https://claude.ai/download or: npm install -g @anthropic-ai/claude-code';
 
@@ -949,7 +951,7 @@ function getSkillWriteTargets({ homeDir = os.homedir(), project = null } = {}) {
 // Slash-command roots. Mirrors getSkillRoots' shape so consumers can iterate
 // runtimes generically. Plugin-installed command dirs are NOT enumerated here
 // — those are discovered dynamically from `~/.claude/plugins/installed_plugins.json`
-// in engine/queries.js#collectCommandFiles and stay there because they require
+// in engine/core/queries.js#collectCommandFiles and stay there because they require
 // a registry read, not a fixed dir.
 function getCommandRoots({ homeDir = os.homedir(), project = null } = {}) {
   const roots = [
@@ -1076,7 +1078,7 @@ module.exports = {
   capsFile: CAPS_FILE,
   listModels,
   modelsCache: MODELS_CACHE,
-  spawnScript: path.join(ENGINE_DIR, 'spawn-agent.js'),
+  spawnScript: path.join(ENGINE_DIR, 'agents', 'spawn-agent.js'),
   installHint: INSTALL_HINT,
   resolveInvocationOptions,
   buildSpawnFlags,

package/engine/runtimes/codex.js

@@ -18,7 +18,7 @@ const {
   resolveEngineCacheDir,
   staleResumeSessionCwdReason,
   resolveCodexCcSandbox,
-} = require('../shared');
+} = require('../core/shared');
 
 const ENGINE_DIR = __dirname.replace(/[\\/]runtimes$/, '');
 const MINIONS_DIR = path.resolve(ENGINE_DIR, '..');
@@ -345,6 +345,7 @@ function buildArgs(opts = {}) {
     sessionId,
     outputLastMessage,
     sandbox = 'workspace-write',
+    disableTools,
     skipGitRepoCheck = true,
     configOverrides,
     images,
@@ -356,7 +357,8 @@ function buildArgs(opts = {}) {
   // parser rejects flags such as --color and --sandbox after the subcommand.
   args.push('--json', '--color', 'never');
   if (model) args.push('--model', String(model));
-  if (sandbox) args.push('--sandbox', String(sandbox));
+  const effectiveSandbox = disableTools === true ? 'read-only' : sandbox;
+  if (effectiveSandbox) args.push('--sandbox', String(effectiveSandbox));
   if (skipGitRepoCheck === true) args.push('--skip-git-repo-check');
   if (outputLastMessage) args.push('--output-last-message', String(outputLastMessage));
 
@@ -370,7 +372,7 @@ function buildArgs(opts = {}) {
   if (sessionId) args.push('resume', String(sessionId));
 
   // Codex accepts repeatable --image paths on fresh and resumed turns. The
-  // call-scoped tmpDir is removed by engine/llm.js after the process exits.
+  // call-scoped tmpDir is removed by engine/agents/llm.js after the process exits.
   if (Array.isArray(images) && images.length && tmpDir) {
     for (let i = 0; i < images.length; i++) {
       const img = images[i];
@@ -469,7 +471,7 @@ function getResumeSessionId({ agentId, branchName, agentsDir, cwd = null, maxAge
       try { fs.unlinkSync(sessionPath); } catch {}
       return null;
     }
-    // Stale-workdir invalidation (W-ms0vk9nv000z985b) — see engine/shared.js
+    // Stale-workdir invalidation (W-ms0vk9nv000z985b) — see engine/core/shared.js
     // staleResumeSessionCwdReason. A session anchored to a worktree the engine
     // has since removed/recycled cannot be resumed.
     const staleCwdReason = staleResumeSessionCwdReason(sessionFile.cwd, cwd);
@@ -1001,7 +1003,7 @@ const capabilities = {
   bareMode: false,
   fallbackModel: false,
   // Codex has no native CLAUDE.md auto-load — FALSE opts it into the engine's
-  // CLAUDE.md-propagation layer (engine/claude-md-context.js) so repo-authored
+  // CLAUDE.md-propagation layer (engine/agents/claude-md-context.js) so repo-authored
   // CLAUDE.md guidance reaches the agent prompt.
   claudeMdNativeDiscovery: false,
   sessionPersistenceControl: false,
@@ -1022,7 +1024,7 @@ module.exports = {
   listModels,
   getModelCacheKey,
   modelsCache: MODELS_CACHE,
-  spawnScript: path.join(ENGINE_DIR, 'spawn-agent.js'),
+  spawnScript: path.join(ENGINE_DIR, 'agents', 'spawn-agent.js'),
   installHint: INSTALL_HINT,
   buildSpawnFlags,
   resolveInvocationOptions,

package/engine/runtimes/copilot.js

@@ -32,7 +32,7 @@ const https = require('https');
 const os = require('os');
 const path = require('path');
 const { execSync } = require('child_process');
-const { ENGINE_DEFAULTS, FAILURE_CLASS, safeWrite, ts, resolveEngineCacheDir, staleResumeSessionCwdReason } = require('../shared');
+const { ENGINE_DEFAULTS, FAILURE_CLASS, safeWrite, ts, resolveEngineCacheDir, staleResumeSessionCwdReason } = require('../core/shared');
 
 const ENGINE_DIR = __dirname.replace(/[\\/]runtimes$/, '');
 const _CACHE_DIR = resolveEngineCacheDir(ENGINE_DIR);
@@ -52,7 +52,7 @@ const SPAWN_STARTUP_TYPES = new Set([
 //   1. Standalone `copilot` (preferred) — WinGet, scoop, or manual install. PATH
 //      probe finds it; we cache the resolved path with `leadingArgs: []`.
 //   2. `gh copilot` extension fallback — invoked as `gh copilot ...`. We return
-//      `leadingArgs: ['copilot']` so engine/spawn-agent.js prepends "copilot"
+//      `leadingArgs: ['copilot']` so engine/agents/spawn-agent.js prepends "copilot"
 //      to the gh binary invocation. NOTE: the older gh-copilot extension is
 //      the explain/suggest UX, NOT the v1.0.36 agent CLI; flag support varies.
 //      We surface it as best-effort and let preflight warn.
@@ -93,7 +93,7 @@ function _execSyncCapture(cmd, env, timeoutMs = 10000) {
  *   C:\Users\<u>\AppData\Roaming\npm\copilot.cmd     (Windows cmd shim)
  *   C:\Users\<u>\AppData\Roaming\npm\copilot.ps1     (PowerShell shim)
  * The legacy resolver took `.split('\n')[0]` (the extensionless shim) and
- * marked it `native: false`, which made engine/llm.js spawn `node.exe <shim>`.
+ * marked it `native: false`, which made engine/agents/llm.js spawn `node.exe <shim>`.
  * Node parsed the bash script as JS and exit-1'd in <1s, silently breaking
  * every Copilot dispatch.
  *
@@ -120,7 +120,7 @@ function _pickStandaloneCopilotFromOutput(rawOutput, { existsSync = fs.existsSyn
   if (!_isWin) {
     // POSIX `which` returns one line; first existing entry wins. Mark native
     // when there's no extension or an executable extension — but since
-    // engine/llm.js only checks `.exe` for native on Windows and otherwise
+    // engine/agents/llm.js only checks `.exe` for native on Windows and otherwise
     // routes through process.execPath on non-native, we keep native:true on
     // POSIX (matches legacy behavior — spawn(<bin>) works directly).
     return { bin: existing[0], native: true };
@@ -398,7 +398,7 @@ function resolveModel(input) {
 }
 
 // Heuristic: does `model` look like a Copilot-namespace identifier? Mirrors
-// engine/runtimes/claude.js#modelLooksFamiliar so engine/cli.js#_modelLooksIncompatible
+// engine/runtimes/claude.js#modelLooksFamiliar so engine/operations/cli.js#_modelLooksIncompatible
 // can warn when a fleet/CC switch strands an incompatible model. Accepts the
 // three Minions short aliases (`sonnet`/`opus`/`haiku`) since the adapter
 // translates them to valid Copilot IDs at argv-build time. Returning false
@@ -440,7 +440,7 @@ function _mapEffort(level) {
 // Copilot has no --verbose flag — never emit it. The `bare` / `maxBudget` /
 // `fallbackModel` opts are silently ignored (their capability flags are false
 // so engine code shouldn't pass them, but we tolerate them gracefully).
-// Do not emit --log-level: Copilot CLI 1.0.76-1 exits silently with code 1
+// Do not emit --log-level: Copilot CLI 1.0.76-1 and 1.0.76-2 exit with code 1
 // when given an explicit non-default level. Omitting it preserves the CLI's
 // compatible default while --output-format json keeps stdout machine-readable.
 
@@ -466,6 +466,7 @@ function buildArgs(opts = {}) {
     disableBuiltinMcps,
     reasoningSummaries,
     disabledMcpServers,
+    disableTools,
     images,
     tmpDir,
   } = opts;
@@ -475,10 +476,9 @@ function buildArgs(opts = {}) {
     '-s',
     '--no-color',
     '--plain-diff',
-    '--autopilot',
-    '--allow-all',
     '--no-ask-user',
   ];
+  if (disableTools !== true) args.push('--autopilot', '--allow-all');
 
   if (Array.isArray(addDirs)) {
     for (const d of addDirs) {
@@ -491,6 +491,7 @@ function buildArgs(opts = {}) {
   }
 
   if (model) args.push('--model', String(model));
+  if (disableTools === true) args.push('--available-tools=');
 
   const mappedEffort = _mapEffort(effort);
   if (mappedEffort) args.push('--effort', mappedEffort);
@@ -785,7 +786,7 @@ const KNOWN_EVENT_TYPES = new Set([
 /**
  * Parse the full JSONL output of a Copilot CLI invocation.
  * Returns { text, usage, sessionId, model } — same shape as the Claude adapter
- * so engine/lifecycle.js can consume both transparently.
+ * so engine/orchestration/lifecycle.js can consume both transparently.
  *
  *   - text:      the TRAILING text segment of the turn — answer
  *                `assistant.message.data.content` values plus trailing deltas,
@@ -796,7 +797,7 @@ const KNOWN_EVENT_TYPES = new Set([
  *                tool text never welds onto the post-tool answer. This mirrors
  *                the stream consumer's `_resetTrailingSegment` and Claude's
  *                result-carries-last-message shape, so the terminal
- *                reconciliation in engine/llm.js#finalize agrees with the live
+ *                reconciliation in engine/agents/llm.js#finalize agrees with the live
  *                stream instead of re-welding split blocks (W-mrw87290000b2965).
  *   - usage:     mapped from the terminal `result` event. Copilot doesn't
  *                report cost/tokens — those fields are NULL, not 0, so the
@@ -859,7 +860,7 @@ function parseOutput(raw, { maxTextLength = 0 } = {}) {
       // assistant.message or as raw deltas — does not weld onto the post-tool
       // answer. Without this, `text = messageContents.join('') + pendingDeltaContent`
       // re-welds `<pre-tool><post-tool>` in the terminal reconciliation
-      // (engine/llm.js#finalize -> runtime.parseOutput), and the CC SSE `done`
+      // (engine/agents/llm.js#finalize -> runtime.parseOutput), and the CC SSE `done`
       // payload re-introduces the weld the stream consumer already split apart
       // (W-mrw87290000b2965). Mirrors the stream consumer's _resetTrailingSegment
       // and Claude, whose result event carries only the last assistant message.
@@ -1088,7 +1089,7 @@ function _resolveCachedModelIds() {
   // In-memory cache (seeded by `_warmModelCache()` or test `_resetModelCache`)
   // wins over disk so unit tests stay hermetic. Production code that hasn't
   // warmed the in-memory cache still gets the catalog via the disk file that
-  // `engine/model-discovery.js#getRuntimeModels` populates during preflight.
+  // `engine/agents/model-discovery.js#getRuntimeModels` populates during preflight.
   if (Array.isArray(_modelDiscoveryResults) && _modelDiscoveryResults.length > 0) {
     return _modelDiscoveryResults.map(m => m && m.id ? String(m.id) : null).filter(Boolean);
   }
@@ -1230,7 +1231,7 @@ async function listModels({ env = process.env, timeoutMs = 10000 } = {}) {
 
 // ── Stream Consumer ─────────────────────────────────────────────────────────
 //
-// Per-stream consumer factory invoked by engine/llm.js's accumulator. Owns
+// Per-stream consumer factory invoked by engine/agents/llm.js's accumulator. Owns
 // Copilot-specific per-stream state (delta-content buffer, task_complete
 // signal). Translates Copilot event shapes into ctx callbacks.
 //
@@ -1451,7 +1452,7 @@ const capabilities = {
   // Copilot has NO native CLAUDE.md auto-load — it only reads its own AGENTS.md
   // (native custom-instruction discovery owned by the CLI itself). FALSE
   // here opts this runtime INTO the engine's CLAUDE.md-propagation layer
-  // (engine/claude-md-context.js) so repo-authored CLAUDE.md guidance is
+  // (engine/agents/claude-md-context.js) so repo-authored CLAUDE.md guidance is
   // surfaced in the prompt. This is orthogonal to AGENTS.md discovery —
   // CLAUDE.md carries no split-brain risk because Copilot never reads it itself.
   claudeMdNativeDiscovery: false,
@@ -1469,7 +1470,7 @@ const capabilities = {
   imageInput: true,
   // P-9b3d5f61: `copilot --acp` speaks the Agent Client Protocol, so per-agent
   // dispatches can route through a persistent ACP worker pool
-  // (engine/agent-worker-pool.js) instead of cold-spawning per dispatch.
+  // (engine/agents/agent-worker-pool.js) instead of cold-spawning per dispatch.
   // Claude/Codex do not implement ACP — this flag is absent (falsy) there.
   acpWorkerPool: true,
 };
@@ -1553,7 +1554,7 @@ module.exports = {
   listModels,
   modelsCache: MODELS_CACHE,
   // Use the same wrapper as Claude — spawn-agent.js is runtime-agnostic per P-9c4f2d6a
-  spawnScript: path.join(ENGINE_DIR, 'spawn-agent.js'),
+  spawnScript: path.join(ENGINE_DIR, 'agents', 'spawn-agent.js'),
   installHint: INSTALL_HINT,
   workerErrorHint: 'copilot --acp failed -- ensure copilot CLI >=1.0.46 and copilot login is complete',
   resolveInvocationOptions,