@yemi33/minions 0.1.2453 → 0.1.2455

package/bin/install-internal-minions.js

@@ -1143,7 +1143,47 @@ const BACKUP_COPIED_FILES = ['config.json', 'routing.md', 'pinned.md'];
 /** Subdirectory of the backup holding the ORIGINAL, byte-for-byte state files. */
 const RETAINED_ORIGINAL_DIR = 'original';
 
-const QUIESCE_TIMEOUT_MS = 60000;
+/**
+ * The FLOOR of the wait budget, and the fixed window this gate used to have.
+ *
+ * The budget is now derived from the runtime being stopped (see
+ * `resolveQuiesceTimeoutMs`), but it may only ever WIDEN from here: a runtime
+ * configured with a very short drain must not make the migration gate stricter
+ * than it has always been. It is also `stop-stack.js#DEFAULT_STOP_TIMEOUT_MS`,
+ * so the wait after a stop is never shorter than the stop's own budget.
+ */
+const QUIESCE_TIMEOUT_FLOOR_MS = 60000;
+
+/**
+ * The absolute CEILING on the wait budget.
+ *
+ * The derived budget is operator-supplied data read from a file this gate does
+ * not own, so it is bounded: a corrupt or hostile `config.json` must not be able
+ * to hang a migration indefinitely on an unattended machine. 15 minutes is ~3x
+ * the default runtime's own budget, so it clamps nothing a real stack needs.
+ */
+const QUIESCE_TIMEOUT_CEILING_MS = 900000;
+
+/**
+ * Grace added on top of the engine's own drain budget, mirroring
+ * `engine/recovery/stop-stack.js#DRAIN_GRACE_MS` — the SAME number `minions
+ * restart` applies when it derives a teardown deadline the same way. It covers
+ * the fixed work either side of the drain: stop intent, the supervisor and
+ * dashboard, the verified reap, and the WAL-index release.
+ */
+const QUIESCE_DRAIN_GRACE_MS = 5000;
+
+/**
+ * Mirror of `engine/core/shared.js#ENGINE_DEFAULTS.shutdownTimeout` — the drain
+ * budget a runtime uses when its config does not name one.
+ *
+ * Mirrored rather than imported because this script is deliberately standalone
+ * (it must run before any Minions exists to import from). A drift test in
+ * `test/unit/install-internal-minions.test.js` binds both this and the grace
+ * above to their engine-side originals, so the copies cannot silently diverge.
+ */
+const ENGINE_SHUTDOWN_TIMEOUT_FALLBACK_MS = 300000;
+
 const QUIESCE_POLL_MS = 500;
 const CLI_STOP_TIMEOUT_MS = 120000;
 /** Budget for the read-only capability probe: `minions help` prints and exits. */
@@ -1251,7 +1291,9 @@ function probeStopCapability({ cliPath, run, env, timeoutMs = CLI_HELP_TIMEOUT_M
  * Reports which stop contract ran and the exact argv it issued — without that,
  * "the runtime did not release the database" is indistinguishable between a
  * whole-stack teardown that genuinely could not finish and a legacy fallback
- * that only ever asked the engine to stand down.
+ * that only ever asked the engine to stand down. It also reports the budget that
+ * expired and where that budget came from, so "it gave up too early" is an
+ * answerable question rather than a guess.
  */
 function formatQuiescenceRefusal(quiescence = {}) {
   const stopPath = quiescence.stopPath || 'none';
@@ -1262,6 +1304,9 @@ function formatQuiescenceRefusal(quiescence = {}) {
     ? ` (exit code ${quiescence.stopExitCode})`
     : '';
   const lines = [`  Stop path: ${STOP_PATH_LABELS[stopPath] || STOP_PATH_LABELS.none}${issued}${exit}`];
+  if (quiescence.budget) {
+    lines.push(`  Waited ${quiescence.waitedMs}ms of ${describeQuiesceBudget(quiescence.budget)}`);
+  }
   const holders = Array.isArray(quiescence.holders) ? quiescence.holders : [];
   if (holders.length) {
     lines.push('  Still holding the database:');
@@ -1356,6 +1401,68 @@ function assessDatabaseQuiescence({ running = [], shm = { present: false, bytes:
   return { quiesced: true, holders: [], shmHeld: false, reason: 'no service holds engine/state.db' };
 }
 
+/**
+ * The wait budget, DERIVED from the runtime this gate is stopping.
+ *
+ * A fixed window cannot be right: it is the *runtime* that decides how long a
+ * teardown legitimately takes, through `engine.shutdownTimeout` — the budget the
+ * engine gives itself to drain pooled leases before exiting. The old fixed 60s
+ * was shorter than the DEFAULT drain budget of five minutes, so a busy stack was
+ * declared stuck while it was still shutting down exactly as designed, and the
+ * migration refused a runtime that was working.
+ *
+ * `minions restart` already derives its teardown deadline this way; this reads
+ * the same key, from the PINNED root, and adds the same grace — one contract,
+ * two callers, no second number.
+ *
+ * Bounded on BOTH sides, because the input is operator-supplied data read from a
+ * file this gate does not own:
+ *   - FLOOR   never stricter than the fixed window it replaces
+ *   - CEILING a corrupt or hostile value cannot hang a migration indefinitely
+ *
+ * Never throws: a missing, unreadable, malformed, or nonsensical config is a
+ * fallback to the engine default, not a failure. A value that is neither a
+ * number nor a numeric string is rejected outright — `Number(true)` is `1` and
+ * `Number([30000])` is `30000`, and silently accepting either would produce a
+ * budget nobody configured.
+ *
+ * @param {object}   opts
+ * @param {string}   opts.runtimeRoot  the PINNED root, not the installer's own
+ * @param {object}   [opts.deps]       `{ readFileSync }` injection seam
+ * @returns {{timeoutMs:number, shutdownTimeoutMs:number, source:'config'|'default', clamped:'floor'|'ceiling'|null}}
+ */
+function resolveQuiesceTimeoutMs({ runtimeRoot, deps = {} } = {}) {
+  const readFile = deps.readFileSync || (p => fs.readFileSync(p, 'utf8'));
+  let shutdownTimeoutMs = ENGINE_SHUTDOWN_TIMEOUT_FALLBACK_MS;
+  let source = 'default';
+  try {
+    const parsed = JSON.parse(String(readFile(path.join(runtimeRoot, 'config.json'))));
+    const engine = parsed && typeof parsed === 'object' ? parsed.engine : null;
+    const raw = engine && typeof engine === 'object' ? engine.shutdownTimeout : undefined;
+    const configured = (typeof raw === 'number' || typeof raw === 'string') ? Number(raw) : NaN;
+    if (Number.isFinite(configured) && configured > 0) {
+      shutdownTimeoutMs = configured;
+      source = 'config';
+    }
+  } catch { /* missing, unreadable, or malformed — the engine default is the safe answer */ }
+  const derived = shutdownTimeoutMs + QUIESCE_DRAIN_GRACE_MS;
+  const timeoutMs = Math.min(QUIESCE_TIMEOUT_CEILING_MS, Math.max(QUIESCE_TIMEOUT_FLOOR_MS, derived));
+  let clamped = null;
+  if (timeoutMs !== derived) clamped = timeoutMs === QUIESCE_TIMEOUT_CEILING_MS ? 'ceiling' : 'floor';
+  return { timeoutMs, shutdownTimeoutMs, source, clamped };
+}
+
+/** One operator-facing line for how long this gate will wait, and why. */
+function describeQuiesceBudget(budget = {}) {
+  const ms = Number(budget.timeoutMs) || 0;
+  if (budget.source === 'explicit') return `${ms}ms (caller-supplied)`;
+  const from = budget.source === 'config'
+    ? `engine.shutdownTimeout=${budget.shutdownTimeoutMs}`
+    : `the engine default drain of ${budget.shutdownTimeoutMs}ms`;
+  const bound = budget.clamped ? `, clamped to the ${budget.clamped}` : '';
+  return `${ms}ms (${from} + ${QUIESCE_DRAIN_GRACE_MS}ms grace${bound})`;
+}
+
 /** Block the calling thread. The installer is deliberately spawnSync-only. */
 function sleepSync(ms) {
   try { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, Number(ms) || 0); }
@@ -1376,6 +1483,11 @@ function sleepSync(ms) {
  * `stop`. Both paths then run the same wait loop, because the CLI's own verdict
  * is never trusted — the `-shm` evidence below is.
  *
+ * The wait budget is DERIVED from the pinned runtime's own drain budget (see
+ * `resolveQuiesceTimeoutMs`) so a stack that is legitimately slow to shut down
+ * is waited out rather than declared stuck. An explicit `timeoutMs` is a
+ * deliberate caller instruction and wins verbatim.
+ *
  * FAILS CLOSED: when the handles are not released inside the timeout the caller
  * gets `ok: false`, the path that was taken, and the exact PIDs still holding
  * the database.
@@ -1386,18 +1498,21 @@ function quiesceServices({
   run,
   env,
   log = console.log,
-  timeoutMs = QUIESCE_TIMEOUT_MS,
+  timeoutMs = null,
   pollMs = QUIESCE_POLL_MS,
   probeTimeoutMs = CLI_HELP_TIMEOUT_MS,
   deps = {},
   sleep = sleepSync,
   now = () => Date.now(),
 } = {}) {
+  const explicit = Number(timeoutMs);
+  const budget = Number.isFinite(explicit) && explicit > 0
+    ? { timeoutMs: explicit, shutdownTimeoutMs: null, source: 'explicit', clamped: null }
+    : resolveQuiesceTimeoutMs({ runtimeRoot, deps });
   const probeState = () => assessDatabaseQuiescence({
     running: detectRunningServices(runtimeRoot, deps),
     shm: readStateShm(runtimeRoot, deps),
   });
-  const startedAt = now();
   const initial = probeState();
   if (initial.quiesced) {
     return {
@@ -1409,10 +1524,12 @@ function quiesceServices({
       capabilityProbe: null,
       holders: [],
       waitedMs: 0,
+      budget,
       reason: initial.reason,
     };
   }
   log(`    ${initial.reason}`);
+  log(`    Waiting up to ${describeQuiesceBudget(budget)}.`);
   let stopped = false;
   let stopPath = 'none';
   let stopArgs = null;
@@ -1439,7 +1556,13 @@ function quiesceServices({
   } else {
     log('    WARNING: no installed CLI was found to run `minions stop`; waiting for the handles to be released.');
   }
-  const deadline = now() + timeoutMs;
+  // The budget bounds THIS loop only — the capability probe and the stop
+  // subprocess above run before it and are reported separately. Measuring the
+  // wait from any earlier point would let a slow stop print a wait larger than
+  // the budget that allowed it, i.e. a refusal that accuses the gate of
+  // overrunning a deadline it actually honoured.
+  const waitStartedAt = now();
+  const deadline = waitStartedAt + budget.timeoutMs;
   let verdict = probeState();
   while (!verdict.quiesced && now() < deadline) {
     sleep(pollMs);
@@ -1453,7 +1576,8 @@ function quiesceServices({
     stopExitCode,
     capabilityProbe,
     holders: verdict.holders,
-    waitedMs: now() - startedAt,
+    waitedMs: now() - waitStartedAt,
+    budget,
     reason: verdict.reason,
   };
 }
@@ -2960,6 +3084,12 @@ module.exports = {
   detectRunningServices,
   readStateShm,
   assessDatabaseQuiescence,
+  QUIESCE_TIMEOUT_FLOOR_MS,
+  QUIESCE_TIMEOUT_CEILING_MS,
+  QUIESCE_DRAIN_GRACE_MS,
+  ENGINE_SHUTDOWN_TIMEOUT_FALLBACK_MS,
+  resolveQuiesceTimeoutMs,
+  describeQuiesceBudget,
   WHOLE_STACK_STOP_ARGS,
   LEGACY_STOP_ARGS,
   CLI_CAPABILITY_PROBE_ARGS,

package/bin/minions.js

@@ -85,7 +85,7 @@ const {
   stopStackExitCode,
   holderIsLiveDaemon,
   STOP_STACK_EXIT,
-  DEFAULT_STOP_TIMEOUT_MS: STOP_STACK_DEFAULT_TIMEOUT_MS,
+  DRAIN_GRACE_MS: STOP_STACK_DRAIN_GRACE_MS,
 } = require(path.join(PKG_ROOT, 'engine', 'recovery', 'stop-stack'));
 // Dev-mode dashboard port. `--dev` mode (see argv parser below) retargets
 // MINIONS_HOME at PKG_ROOT and routes the dashboard onto this port so a dev
@@ -681,13 +681,30 @@ function stopWholeRuntimeStack({ source, timeoutMs, waitForRelease = false }) {
   return verdict;
 }
 
-/** `--timeout <ms>` / `--timeout=<ms>` for `minions stop --all`. Defaults to
- *  the shared module's budget, which matches the internal installer's
- *  quiescence window so a stop can never be shorter than the wait after it. */
+/** The pinned runtime's configured graceful-drain budget, falling back to the
+ *  engine default when config.json is missing, unreadable, or does not name a
+ *  positive one. Shared by `restart` and `stop --all` so both teardown paths
+ *  hand the engine the SAME drain window its own graceful handler expects. */
+function _resolveConfiguredShutdownTimeoutMs() {
+  try {
+    const cfg = JSON.parse(fs.readFileSync(path.join(MINIONS_HOME, 'config.json'), 'utf8'));
+    return Number(cfg?.engine?.shutdownTimeout) || shared.ENGINE_DEFAULTS.shutdownTimeout;
+  } catch { return shared.ENGINE_DEFAULTS.shutdownTimeout; }
+}
+
+/** `--timeout <ms>` / `--timeout=<ms>` for `minions stop --all`. With no flag it
+ *  DERIVES the budget from the pinned runtime's `engine.shutdownTimeout` plus the
+ *  drain grace — exactly as `minions restart` does — so a whole-stack stop is
+ *  given the engine's own drain window rather than a flat default that would
+ *  force-reap a slow drain mid-flight (the internal installer's quiescence gate
+ *  shells `stop --all --wait` with no `--timeout` and depends on that budget
+ *  reaching the teardown). Never shorter than the installer's quiescence floor:
+ *  the shared module's default is that floor, and the engine drain default is
+ *  larger still. */
 function _resolveStopAllTimeoutMs(argv) {
   const flagIdx = argv.indexOf('--timeout');
   const inline = argv.find(a => typeof a === 'string' && a.startsWith('--timeout='));
-  if (flagIdx < 0 && !inline) return STOP_STACK_DEFAULT_TIMEOUT_MS;
+  if (flagIdx < 0 && !inline) return _resolveConfiguredShutdownTimeoutMs() + STOP_STACK_DRAIN_GRACE_MS;
   const raw = flagIdx >= 0 ? argv[flagIdx + 1] : inline.slice('--timeout='.length);
   const n = Number(raw);
   if (!Number.isInteger(n) || n <= 0) {
@@ -1748,13 +1765,10 @@ ${fs.existsSync(path.join(PKG_ROOT, '.git')) ? `
   const restartStartMs = Date.now();
   // Give the engine's graceful handler time to drain non-reattachable pooled
   // leases. Detached cold agents are not part of that drain and remain alive
-  // for normal PID-file reattachment by the replacement engine.
-  const shutdownTimeout = (() => {
-    try {
-      const cfg = JSON.parse(fs.readFileSync(path.join(MINIONS_HOME, 'config.json'), 'utf8'));
-      return Number(cfg?.engine?.shutdownTimeout) || shared.ENGINE_DEFAULTS.shutdownTimeout;
-    } catch { return shared.ENGINE_DEFAULTS.shutdownTimeout; }
-  })();
+  // for normal PID-file reattachment by the replacement engine. The same budget
+  // backs `stop --all` (see _resolveStopAllTimeoutMs) so both teardown paths
+  // honour the runtime's own drain window.
+  const shutdownTimeout = _resolveConfiguredShutdownTimeoutMs();
   // Ordered teardown — stop-intent first so the supervisor stands down and
   // cannot race-respawn what we are about to stop, then supervisor, dashboard,
   // graceful engine drain, verified reap, and the late-respawn sweep that
@@ -1764,7 +1778,7 @@ ${fs.existsSync(path.join(PKG_ROOT, '.git')) ? `
   // stack, and the port gate below is its real readiness condition.
   const teardown = stopWholeRuntimeStack({
     source: 'minions restart',
-    timeoutMs: shutdownTimeout + 5000,
+    timeoutMs: shutdownTimeout + STOP_STACK_DRAIN_GRACE_MS,
     waitForRelease: false,
   });
   // A holder that is provably NOT one of our daemons (a stale PID file, a

package/dashboard/js/agent-identity.js

@@ -0,0 +1,121 @@
+// dashboard/js/agent-identity.js — shared agent display-identity formatter.
+//
+// Single client-side seam every user-facing renderer uses to render an agent's
+// friendly display name plus, for dynamically-created temp agents, a visible
+// "Temp" badge. The canonical agent id (`temp-<uid>`) is NEVER shown as the
+// primary name in normal UI, but stays discoverable via title/tooltip.
+//
+// The server already stamps a deterministic friendly `agentName` / `name` on
+// temp dispatch, work-item, and roster payloads (engine/core/shared.js
+// #tempAgentCallSign). The `callSign()` fallback below mirrors that algorithm
+// verbatim so a legacy record missing the friendly name still renders a stable
+// call sign rather than a raw `temp-msd…` hash. Keep this vocabulary + hash in
+// sync with engine/core/shared.js (asserted by
+// test/unit/temp-agent-identity.test.js).
+(function () {
+  'use strict';
+
+  // Mirror of engine/core/shared.js TEMP_AGENT_CALL_SIGN_ADJECTIVES / _NAMES.
+  var ADJECTIVES = [
+    'Cosmic', 'Starry', 'Nebular', 'Twinkly', 'Lunar', 'Solar', 'Astral', 'Galactic',
+    'Stellar', 'Orbital', 'Meteoric', 'Cloudy', 'Sunny', 'Radiant', 'Sparkly', 'Dreamy',
+    'Breezy', 'Drifting', 'Glowing', 'Floaty', 'Skybound', 'Wandering', 'Whirling', 'Shimmery',
+  ];
+  var NAMES = [
+    'Comet', 'Nova', 'Luna', 'Sol', 'Astro', 'Orion', 'Nebula', 'Pluto',
+    'Halley', 'Vega', 'Rigel', 'Sirius', 'Polaris', 'Stardust', 'Cosmo', 'Nimbus',
+    'Zephyr', 'Aurora', 'Meteor', 'Galaxy', 'Twinkle', 'Cirrus', 'Cygnus', 'Juno',
+  ];
+
+  function isTemp(idOrObj) {
+    var id = _idOf(idOrObj);
+    return typeof id === 'string' && /^temp-/i.test(id.trim());
+  }
+
+  // FNV-1a 32-bit — mirror of engine/core/shared.js#_fnv1a32.
+  function _fnv1a32(str) {
+    var h = 0x811c9dc5;
+    for (var i = 0; i < str.length; i++) {
+      h ^= str.charCodeAt(i);
+      h = (h + ((h << 1) + (h << 4) + (h << 7) + (h << 8) + (h << 24))) >>> 0;
+    }
+    return h >>> 0;
+  }
+
+  // Deterministic friendly call sign from a canonical temp id, e.g. "Cosmic Comet".
+  // Returns null for non-temp / malformed ids.
+  function callSign(idOrObj) {
+    var id = _idOf(idOrObj);
+    if (!isTemp(id)) return null;
+    var key = id.trim().toLowerCase();
+    // Single hash of the canonical id, then slice independent index streams from
+    // its low and high bits (mirror of engine/core/shared.js#tempAgentCallSign).
+    // Hashing the bare id once keeps its full entropy in BOTH indices; a trailing
+    // ":adj"/":name" discriminator would let the identical suffix dominate the
+    // FNV-1a low bits and collapse the joint distribution for the long-shared-
+    // prefix ids that concurrent temp allocation produces.
+    var h = _fnv1a32(key);
+    var adj = ADJECTIVES[h % ADJECTIVES.length];
+    var name = NAMES[Math.floor(h / ADJECTIVES.length) % NAMES.length];
+    return adj + ' ' + name;
+  }
+
+  function _idOf(idOrObj) {
+    if (idOrObj && typeof idOrObj === 'object') {
+      return idOrObj.id || idOrObj.agent || idOrObj.dispatched_to || '';
+    }
+    return idOrObj;
+  }
+
+  // Friendly display name string (UNESCAPED — callers escape). Prefers a
+  // server-supplied friendly name, then the deterministic call sign, then the
+  // canonical id. Never leads with `temp-…` when a call sign is derivable.
+  function displayName(idOrObj) {
+    var provided = null;
+    var id = _idOf(idOrObj);
+    if (idOrObj && typeof idOrObj === 'object') {
+      provided = idOrObj.name || idOrObj.agentName || idOrObj.displayName || null;
+    }
+    if (isTemp(id)) {
+      // A stored friendly name wins (stable across the record's life); otherwise
+      // derive deterministically. Guard against a legacy raw `temp-…` slipping
+      // through as `provided`.
+      if (provided && !/^temp-/i.test(String(provided).trim())) return provided;
+      return callSign(id) || id || '';
+    }
+    return provided || id || '';
+  }
+
+  var _esc = (typeof escapeHtml === 'function')
+    ? escapeHtml
+    : function (s) {
+        return String(s == null ? '' : s)
+          .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+          .replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+      };
+
+  // Static, XSS-safe "Temp" badge markup. `title` carries the canonical id for
+  // debugging; the visible + aria-labelled "Temp" text keeps the temporary
+  // status unmistakable to sighted and assistive-tech users alike.
+  function badgeHtml(idOrObj) {
+    var id = _idOf(idOrObj);
+    var title = id ? ' title="Temporary agent — ' + _esc(id) + '"' : ' title="Temporary agent"';
+    return '<span class="agent-temp-badge" role="img" aria-label="Temporary agent"' + title + '>Temp</span>';
+  }
+
+  // Escaped friendly name + trailing Temp badge (for temp agents). Safe to
+  // inject as innerHTML. This is the single formatter renderers should use.
+  function nameWithBadgeHtml(idOrObj) {
+    var name = _esc(displayName(idOrObj));
+    if (isTemp(idOrObj)) return name + ' ' + badgeHtml(idOrObj);
+    return name;
+  }
+
+  window.MinionsAgentIdentity = {
+    isTemp: isTemp,
+    callSign: callSign,
+    displayName: displayName,
+    badgeHtml: badgeHtml,
+    nameWithBadgeHtml: nameWithBadgeHtml,
+  };
+})();

package/dashboard/js/modal.js

@@ -14,6 +14,10 @@ function closeModal() {
   }
   const modalEl = document.querySelector('#modal .modal');
   if (modalEl) modalEl.classList.remove('modal-wide');
+  // The modal subtree is about to be hidden — dismiss any transient popup
+  // anchored inside it while contains() can still identify its anchor. Scoped,
+  // so a popover anchored elsewhere on the page is untouched.
+  if (typeof _dismissModalTransientPopups === 'function') _dismissModalTransientPopups();
   document.getElementById('modal').classList.remove('open');
   if (typeof popModalFrame === 'function') popModalFrame();
   else if (typeof clearModalBackStack === 'function') clearModalBackStack();

package/dashboard/js/refresh.js

@@ -202,7 +202,11 @@ const RENDER_VERSIONS = {
   // Bumped 22→23: 'paused' joins the lifecycle order between failed and the
   // terminal tail (it was unranked, so it sorted behind every done row in both
   // directions) — row ORDER changes again for byte-identical input.
-  workItems: 23,
+  // Bumped 23→24 (W-mscjvm33007r79ef): per-item actions (except Delete) moved
+  // into an overflow (⋯) menu and an opt-in bulk-selection mode adds an optional
+  // leading checkbox column + row-selected styling — row MARKUP changes for
+  // byte-identical input.
+  workItems: 24,
   skills: 1,
   commands: 1,
   mcpServers: 1,
@@ -519,6 +523,21 @@ function _refreshSidebarCounterSummaries() {
   // entry read it — drop the dead endpoint + fetch. (Review finding #9.)
 }
 
+function _setToolsRefreshStatus(state) {
+  var el = document.getElementById('tools-refresh-status');
+  if (!el) return;
+  var text = '';
+  if (state === 'loading') {
+    text = 'Discovering skills, commands & MCP servers…';
+  } else if (state === 'error-stale') {
+    text = 'Showing last known inventory — refresh failed. Retrying…';
+  } else if (state === 'error-cold') {
+    text = 'Could not load skills inventory. Retrying…';
+  }
+  el.textContent = text;
+  el.style.display = text ? 'block' : 'none';
+}
+
 function _renderToolsInventory(tools) {
   if (!tools || !Array.isArray(tools.skills)
       || !Array.isArray(tools.commands)
@@ -988,20 +1007,36 @@ function _processStatusUpdate(data, opts) {
   // Skills/commands/MCP discovery runs in a child process behind /api/tools.
   // It is only consumed by the Tools page, so every other page skips the
   // request and /api/status stays a small, non-blocking health envelope.
+  //
+  // Perceived latency: /api/tools serves a cached inventory immediately and
+  // refreshes in the background (stale-while-revalidate on the server), so the
+  // page renders from last-known data instead of blocking on the multi-second
+  // child scan. The status line below represents the only user-visible states:
+  // the true cold-start wait (no data yet) and a refresh failure while stale
+  // data is shown.
   _safeRender('toolsInventory', function() {
     if (typeof currentPage !== 'undefined' && currentPage !== 'tools') return;
     const seq = (window._refreshSeq = (window._refreshSeq || 0) + 1);
     window._lastRequestedSeq = window._lastRequestedSeq || {};
     window._lastRequestedSeq.toolsInventory = seq;
+    if (!window._lastToolsInventory) _setToolsRefreshStatus('loading');
     _condFetchJson('/api/tools')
       .then(function(resp) {
-        if (seq < (window._lastRequestedSeq.toolsInventory || 0) || resp.notModified) return;
+        if (seq < (window._lastRequestedSeq.toolsInventory || 0)) return;
+        if (resp.notModified) { _setToolsRefreshStatus('idle'); return; }
         const tools = resp.data;
         if (_renderToolsInventory(tools)) window._lastToolsInventory = tools;
+        _setToolsRefreshStatus('idle');
       })
       .catch(function() {
+        if (seq < (window._lastRequestedSeq.toolsInventory || 0)) return;
         const tools = window._lastToolsInventory;
-        if (tools) _renderToolsInventory(tools);
+        if (tools) {
+          _renderToolsInventory(tools);
+          _setToolsRefreshStatus('error-stale');
+        } else {
+          _setToolsRefreshStatus('error-cold');
+        }
       });
   });
   // Harness propagation diagnostic comes from /api/harness/diagnostics.

package/dashboard/js/render-agents.js

@@ -80,7 +80,7 @@ function renderAgents(agents) {
   grid.innerHTML = agents.map(a => `
     <div class="agent-card ${statusColor(a.status)}" data-agent-id="${escapeHtml(a.id)}" onclick="if(shouldIgnoreSelectionClick(event))return;openAgentDetail(this.dataset.agentId)">
       <div class="agent-card-header">
-        <span class="agent-name"><span class="agent-emoji">${escapeHtml(a.emoji)}</span>${escapeHtml(a.name)}${_runtimeTagHtml(a.runtime)}${_modelChipHtml(a.displayModel || a.model)}</span>
+        <span class="agent-name"><span class="agent-emoji">${escapeHtml(a.emoji)}</span>${MinionsAgentIdentity.nameWithBadgeHtml(a)}${_runtimeTagHtml(a.runtime)}${_modelChipHtml(a.displayModel || a.model)}</span>
         <span class="status-badge ${escapeHtml(a.status)}">${escapeHtml(a.status)}</span>
       </div>
       <div class="agent-role">${escapeHtml(a.role)}</div>
@@ -158,9 +158,21 @@ async function openAgentDetail(id) {
   modelSpan.textContent = modelLabel;
   const children = [
     emojiSpan,
-    document.createTextNode(' ' + (agent.name || '') + ' \u2014 ' + (agent.role || '')),
+    document.createTextNode(' ' + (MinionsAgentIdentity.displayName(agent) || agent.name || '') + ' \u2014 ' + (agent.role || '')),
     runtimeSpan,
   ];
+  // Temp agents get a visible + aria-labelled "Temp" badge; the canonical id
+  // stays in the title for debugging. Built via DOM so no user data is ever
+  // interpreted as HTML (SEC-03 detail-header contract).
+  if (MinionsAgentIdentity.isTemp(agent)) {
+    const tempBadge = document.createElement('span');
+    tempBadge.className = 'agent-temp-badge';
+    tempBadge.setAttribute('role', 'img');
+    tempBadge.setAttribute('aria-label', 'Temporary agent');
+    tempBadge.title = 'Temporary agent — ' + (agent.id || '');
+    tempBadge.textContent = 'Temp';
+    children.push(tempBadge);
+  }
   children.push(modelSpan);
   nameEl.replaceChildren(...children);
 

package/dashboard/js/render-dispatch.js

@@ -303,7 +303,7 @@ function renderDispatch(dispatch, opts) {
   const dispatchItemHtml = (d, trailing) =>
     '<div class="dispatch-item">' +
       '<span class="dispatch-type ' + (d.type || '') + '">' + escHtml(d.type || '') + '</span>' +
-      '<span class="dispatch-agent">' + escHtml(d.agentName || d.agent || '') + '</span>' +
+      '<span class="dispatch-agent">' + MinionsAgentIdentity.nameWithBadgeHtml({ id: d.agent, name: d.agentName }) + '</span>' +
       '<span class="dispatch-task" title="' + escHtml(d.task || '') + '">' + escHtml(d.task || '') + '</span>' +
       renderStuckChip(d) +
       trailing +
@@ -359,7 +359,7 @@ function renderDispatch(dispatch, opts) {
           : '';
         return '<tr>' +
           '<td><span class="dispatch-type ' + (d.type || '') + '">' + escHtml(d.type || '') + '</span></td>' +
-          '<td>' + escHtml(d.agentName || d.agent || '') + '</td>' +
+          '<td>' + MinionsAgentIdentity.nameWithBadgeHtml({ id: d.agent, name: d.agentName }) + '</td>' +
           '<td style="width:100%;max-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap">' + escHtml((d.task || '').slice(0, 60)) + '</td>' +
           '<td style="color:' + (d.result === 'success' ? 'var(--green)' : 'var(--red)') + '">' + escHtml(d.result || '') + errorBtn + '</td>' +
           '<td class="pr-date">' + shortTime(d.completed_at) + '</td>' +