@yemi33/minions 0.1.410 → 0.1.412

package/CHANGELOG.md

@@ -1,10 +1,18 @@
 # Changelog
 
-## 0.1.410 (2026-04-06)
+## 0.1.412 (2026-04-06)
+
+### Fixes
+-  resolve npm path from Node binary dir — not PATH
+
+## 0.1.411 (2026-04-06)
 
 ### Fixes
 -  steering messages retry instead of being silently dropped
 
+### Other
+- refactor: simplify steering — remove redundant session read, fix TOCTOU
+
 ## 0.1.409 (2026-04-06)
 
 ### Fixes

package/dashboard.js

@@ -179,12 +179,13 @@ async function checkNpmVersion() {
   const now = Date.now();
   if (_npmVersionCache && (now - _npmVersionCacheTs) < NPM_CHECK_INTERVAL) return _npmVersionCache;
   try {
-    // Use npm view — respects user's .npmrc proxy/registry config (unlike raw https.get)
+    // Use npm view — respects user's .npmrc proxy/registry config
+    // Resolve npm path from Node binary location — detached processes may not have PATH
     const { execFile } = require('child_process');
-    // On Windows, detached processes may not have npm on PATH — use npm.cmd explicitly
-    const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+    const nodeDir = require('path').dirname(process.execPath);
+    const npmPath = require('path').join(nodeDir, process.platform === 'win32' ? 'npm.cmd' : 'npm');
     const version = await new Promise((resolve, reject) => {
-      execFile(npmCmd, ['view', PKG_NAME, 'version'], { timeout: 15000, windowsHide: true, env: process.env }, (err, stdout) => {
+      execFile(npmPath, ['view', PKG_NAME, 'version'], { timeout: 15000, windowsHide: true }, (err, stdout) => {
         if (err) reject(err); else resolve((stdout || '').trim());
       });
     });

package/engine/timeout.js

@@ -58,18 +58,16 @@ function checkSteering(config) {
   const activeProcesses = engine().activeProcesses;
   for (const [id, info] of activeProcesses) {
     const steerPath = path.join(AGENTS_DIR, info.agentId, 'steer.md');
-    if (!fs.existsSync(steerPath)) continue;
+    let steerMtime;
+    try { steerMtime = fs.statSync(steerPath).mtimeMs; } catch { continue; } // ENOENT = no steering message
 
     const sessionId = info.sessionId;
     if (!sessionId) {
       // No sessionId yet — check stale (>5 min means it'll never arrive)
-      try {
-        const age = Date.now() - fs.statSync(steerPath).mtimeMs;
-        if (age > 300000) {
-          log('warn', `Steering: no sessionId for ${info.agentId} after 5m — deleting stale message`);
-          try { fs.unlinkSync(steerPath); } catch {}
-        }
-      } catch {}
+      if (Date.now() - steerMtime > 300000) {
+        log('warn', `Steering: no sessionId for ${info.agentId} after 5m — deleting stale message`);
+        try { fs.unlinkSync(steerPath); } catch {}
+      }
       // Leave steer.md in place — retry next tick when sessionId may be available
       continue;
     }

package/engine.js

@@ -462,12 +462,14 @@ function spawnAgent(dispatchItem, config) {
   }
 
   // Session resume: reuse last session if same branch and recent enough (< 2 hours)
+  let cachedSessionId = null;
   // Only resume when the context is relevant — same branch means the agent is
   // continuing work on the same PR/feature (e.g., author fixing their own build failure)
   if (!agentId.startsWith('temp-')) {
     try {
       const sessionFile = safeJson(path.join(AGENTS_DIR, agentId, 'session.json'));
       if (sessionFile?.sessionId && sessionFile.savedAt) {
+        cachedSessionId = sessionFile.sessionId;
         const sessionAge = Date.now() - new Date(sessionFile.savedAt).getTime();
         const sameBranch = branchName && sessionFile.branch && sessionFile.branch === branchName;
         if (sessionAge < 2 * 60 * 60 * 1000 && sameBranch) {
@@ -655,10 +657,12 @@ function spawnAgent(dispatchItem, config) {
     }
 
     // Parse output and run all post-completion hooks
-    const { resultSummary } = runPostCompletionHooks(dispatchItem, agentId, code, stdout, config);
+    const { resultSummary, autoRecovered } = runPostCompletionHooks(dispatchItem, agentId, code, stdout, config);
 
     // Move from active to completed in dispatch (single source of truth for agent status)
-    completeDispatch(id, code === 0 ? DISPATCH_RESULT.SUCCESS : DISPATCH_RESULT.ERROR, '', resultSummary);
+    // autoRecovered: agent failed (e.g. heartbeat timeout) but created PRs — treat as success
+    const effectiveResult = (code === 0 || autoRecovered) ? DISPATCH_RESULT.SUCCESS : DISPATCH_RESULT.ERROR;
+    completeDispatch(id, effectiveResult, '', resultSummary);
 
     // Cleanup temp files (including PID file now that dispatch is complete)
     try { fs.unlinkSync(sysPromptPath); } catch { /* cleanup */ }
@@ -696,13 +700,7 @@ function spawnAgent(dispatchItem, config) {
   }, 3000);
 
   // Track process — even if PID isn't available yet (async on Windows)
-  // Pre-load sessionId from session.json so steering works immediately on resume
-  let initialSessionId = null;
-  try {
-    const sj = safeJson(path.join(AGENTS_DIR, agentId, 'session.json'));
-    if (sj?.sessionId && sj.dispatchId === id) initialSessionId = sj.sessionId;
-  } catch {}
-  activeProcesses.set(id, { proc, agentId, startedAt, sessionId: initialSessionId });
+  activeProcesses.set(id, { proc, agentId, startedAt, sessionId: cachedSessionId });
 
   // Log PID and persist to registry
   if (proc.pid) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.410",
+  "version": "0.1.412",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"