@yemi33/minions 0.1.322 → 0.1.324

package/CHANGELOG.md

@@ -1,6 +1,10 @@
 # Changelog
 
-## 0.1.322 (2026-04-03)
+## 0.1.324 (2026-04-03)
+
+### Fixes
+-  7 bugs from engine audit — runtime crashes, race conditions, stale state
+-  scan skips NugetCache, OneDrive, .vs, packages + validates .git/HEAD
 
 ### Other
 - refactor: final magic string replacements in engine, lifecycle, cleanup

package/dashboard.js

@@ -878,18 +878,22 @@ const server = http.createServer(async (req, res) => {
       }
       if (!wiPath) return jsonReply(res, 404, { error: 'source not found' });
 
-      const items = JSON.parse(safeRead(wiPath) || '[]');
-      const item = items.find(i => i.id === id);
-      if (!item) return jsonReply(res, 404, { error: 'item not found' });
-
-      item.status = 'pending';
-      item._retryCount = 0; // Reset retry counter on manual retry
-      delete item.dispatched_at;
-      delete item.dispatched_to;
-      delete item.failReason;
-      delete item.failedAt;
-      delete item.fanOutAgents;
-      safeWrite(wiPath, items);
+      let found = false;
+      mutateJsonFileLocked(wiPath, (items) => {
+        if (!Array.isArray(items)) items = [];
+        const item = items.find(i => i.id === id);
+        if (!item) return items;
+        found = true;
+        item.status = 'pending';
+        item._retryCount = 0; // Reset retry counter on manual retry
+        delete item.dispatched_at;
+        delete item.dispatched_to;
+        delete item.failReason;
+        delete item.failedAt;
+        delete item.fanOutAgents;
+        return items;
+      });
+      if (!found) return jsonReply(res, 404, { error: 'item not found' });
 
       // Clear completed dispatch entries so the engine doesn't dedup this item
       const dispatchPath = path.join(MINIONS_DIR, 'engine', 'dispatch.json');
@@ -2897,7 +2901,9 @@ What would you like to discuss or change? When you're happy, say "approve" and I
 
       // Find git repos recursively (same logic as minions.js findGitRepos)
       const skipDirs = new Set(['node_modules', '.git', '.hg', 'AppData', '$Recycle.Bin', 'Windows',
-        'Program Files', 'Program Files (x86)', '.cache', '.npm', '.yarn', '.nuget', 'worktrees', '.minions', '.squad']);
+        'Program Files', 'Program Files (x86)', '.cache', '.npm', '.yarn', '.nuget', 'NugetCache',
+        'worktrees', '.minions', '.squad', '.vs', '.vscode', 'obj', 'bin', 'packages',
+        'OneDrive', 'OneDrive - Microsoft', '.copilot', 'marketplace-cache']);
       const repos = [];
       function walk(dir, depth) {
         if (depth > maxDepth) return;
@@ -2905,7 +2911,11 @@ What would you like to discuss or change? When you're happy, say "approve" and I
         try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
         for (const e of entries) {
           if (!e.isDirectory()) continue;
-          if (e.name === '.git') { repos.push(dir); return; }
+          if (e.name === '.git') {
+            // Validate it's a real repo — must have HEAD file
+            try { if (fs.existsSync(path.join(dir, '.git', 'HEAD'))) repos.push(dir); } catch {}
+            return;
+          }
           if (e.name.startsWith('.') || skipDirs.has(e.name)) continue;
           walk(path.join(dir, e.name), depth + 1);
         }

package/engine/dispatch.js

@@ -108,9 +108,11 @@ function completeDispatch(id, result = DISPATCH_RESULT.SUCCESS, reason = '', res
           ? path.join(MINIONS_DIR, 'work-items.json')
           : item.meta.project?.name ? projectWorkItemsPath({ name: item.meta.project.name, localPath: item.meta.project.localPath }) : null;
         if (wiPath) {
-          const items = safeJson(wiPath) || [];
-          const wi = items.find(i => i.id === item.meta.item.id);
-          if (wi) retries = wi._retryCount || 0;
+          const items = safeJson(wiPath);
+          if (items && Array.isArray(items)) {
+            const wi = items.find(i => i.id === item.meta.item.id);
+            if (wi) retries = wi._retryCount || 0;
+          }
         }
       } catch (e) { log('warn', 'read retry count: ' + e.message); }
       const maxRetries = ENGINE_DEFAULTS.maxRetries;

package/engine/lifecycle.js

@@ -809,7 +809,7 @@ async function handlePostMerge(pr, project, config, newStatus) {
         if (item && item.status !== 'done') {
           log('info', `Post-merge: marking work item ${mergedItemId} as done (was ${item.status}) for ${pr.id}`);
           item.status = 'done';
-          item.completedAt = e.ts();
+          item.completedAt = ts();
           item._mergedVia = pr.id;
           shared.safeWrite(wiPath, items);
           break;
@@ -1221,7 +1221,7 @@ function runPostCompletionHooks(dispatchItem, agentId, code, stdout, config) {
           return d.includes(branchSlug) && fs.statSync(path.join(worktreeRoot, d)).isDirectory();
         });
         // Only remove if no other active dispatch uses this branch
-        const dispatch = e.getDispatch();
+        const dispatch = getDispatch();
         const otherActive = ((dispatch.active || []).concat(dispatch.pending || [])).some(d =>
           d.id !== dispatchItem.id && d.meta?.branch && shared.sanitizeBranch && shared.sanitizeBranch(d.meta.branch) === branchSlug
         );
@@ -1229,7 +1229,7 @@ function runPostCompletionHooks(dispatchItem, agentId, code, stdout, config) {
           for (const dir of dirs) {
             const wtPath = path.join(worktreeRoot, dir);
             try {
-              shared.exec(`git worktree remove "${wtPath}" --force`, { cwd: rootDir, stdio: 'pipe', timeout: 15000, windowsHide: true });
+              execSilent(`git worktree remove "${wtPath}" --force`, { cwd: rootDir, timeout: 15000 });
               log('info', `Post-completion: removed worktree ${dir}`);
             } catch (err) {
               log('warn', `Post-completion: failed to remove worktree ${dir}: ${err.message}`);
@@ -1269,10 +1269,10 @@ function runPostCompletionHooks(dispatchItem, agentId, code, stdout, config) {
             wi._retryCount = retries + 1;
             delete wi.dispatched_at;
             delete wi.dispatched_to;
-            e.log('info', `Auto-retry ${retries + 1}/${maxR} for ${meta.item.id} (no PR created)`);
+            log('info', `Auto-retry ${retries + 1}/${maxR} for ${meta.item.id} (no PR created)`);
           } else {
             wi.status = WI_STATUS.FAILED;
-            e.log('warn', `${meta.item.id} failed after ${maxR} retries — no PR created`);
+            log('warn', `${meta.item.id} failed after ${maxR} retries — no PR created`);
           }
           shared.safeWrite(wiPath, items);
         }

package/engine.js

@@ -591,6 +591,11 @@ function spawnAgent(dispatchItem, config) {
       // Re-attach to existing tracking
       activeProcesses.set(id, { proc: resumeProc, agentId, startedAt: procInfo.startedAt, sessionId: steerSessionId });
 
+      // Reset output buffers so post-completion parsing only sees the resumed session
+      stdout = '';
+      stderr = '';
+      lastOutputAt = Date.now();
+
       // Re-wire stdout/stderr handlers (same as original)
       resumeProc.stdout.on('data', (data) => {
         const chunk = data.toString();

package/minions.js

@@ -257,7 +257,9 @@ function findGitRepos(rootDir, maxDepth = 3) {
       // Skip common non-project dirs
       const base = path.basename(dir);
       if (['node_modules', '.git', '.hg', 'AppData', '$Recycle.Bin', 'Windows', 'Program Files',
-           'Program Files (x86)', '.cache', '.npm', '.yarn', '.nuget', 'worktrees', '.minions'].includes(base)) return;
+           'Program Files (x86)', '.cache', '.npm', '.yarn', '.nuget', 'NugetCache',
+           'worktrees', '.minions', '.squad', '.vs', '.vscode', 'obj', 'bin', 'packages',
+           'OneDrive', 'OneDrive - Microsoft', '.copilot', 'marketplace-cache'].includes(base)) return;
       // Skip minions home directory itself
       if (path.resolve(dir) === path.resolve(MINIONS_HOME)) return;
 
@@ -271,6 +273,8 @@ function findGitRepos(rootDir, maxDepth = 3) {
             if (content.trimStart().startsWith('gitdir:')) return; // worktree, skip
           } catch {}
         }
+        // Validate it's a real repo — must have HEAD file
+        if (stat.isDirectory() && !fs.existsSync(path.join(gitDir, 'HEAD'))) return;
         repos.push(dir);
         return; // Don't recurse into git repos (they may have nested submodules)
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.322",
+  "version": "0.1.324",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"