@yemi33/minions 0.1.419 → 0.1.420

package/CHANGELOG.md

@@ -1,8 +1,9 @@
 # Changelog
 
-## 0.1.419 (2026-04-06)
+## 0.1.420 (2026-04-06)
 
 ### Features
+- Low-priority cleanup: dedupe regex, consolidate streaming parse, add path validation alignment
 - Fix 6 medium bugs: dispatch pruning, null guards, skill regex, meeting advancement, CLI PID check, pipeline retry
 - Convert remaining lifecycle.js safeWrite calls to mutateJsonFileLocked
 

package/dashboard.js

@@ -2329,9 +2329,8 @@ If nothing to do: { "duplicates": [], "reclassify": [], "remove": [] }`;
     try {
       const body = await readBody(req);
       if (!body.file) return jsonReply(res, 400, { error: 'file required' });
-      if (body.file.includes('..') || body.file.includes('\0') || body.file.includes('/') || body.file.includes('\\')) {
-        return jsonReply(res, 400, { error: 'invalid filename' });
-      }
+      try { shared.sanitizePath(body.file, body.file.endsWith('.json') ? PRD_DIR : PLANS_DIR); }
+      catch { return jsonReply(res, 400, { error: 'invalid filename' }); }
       const isJson = body.file.endsWith('.json');
       const targetDir = isJson ? PRD_DIR : PLANS_DIR;
       const archivePath = path.join(targetDir, 'archive', body.file);

package/engine/ado.js

@@ -381,7 +381,7 @@ async function reconcilePrs(config) {
       const title = adoPr.title || '';
       // Extract item ID from branch name or PR title (e.g., feat(P-2cafdc2a): ...)
       const branchMatch = branch.match(/(P-[a-z0-9]{6,})/i) || branch.match(/(W-[a-z0-9]{6,})/i) || branch.match(/(PL-[a-z0-9]{6,})/i);
-      const titleMatch = title.match(/\((P-[a-z0-9]{6,})\)/) || title.match(/\((W-[a-z0-9]{6,})\)/) || title.match(/\((W-[a-z0-9]{6,})\)/) || title.match(/\((PL-[a-z0-9]{6,})\)/);
+      const titleMatch = title.match(/\((P-[a-z0-9]{6,})\)/) || title.match(/\((W-[a-z0-9]{6,})\)/) || title.match(/\((PL-[a-z0-9]{6,})\)/);
       const linkedItemId = branchMatch?.[1] || titleMatch?.[1] || null;
       const linkedItem = linkedItemId ? allItems.find(i => i.id === linkedItemId) : null;
       const confirmedItemId = linkedItem ? linkedItemId : null;

package/engine/llm.js

@@ -160,25 +160,12 @@ function callLLMStreaming(promptText, sysPromptText, { timeout = 120000, label =
               if (block.type === 'text' && block.text && block.text !== lastTextSent) {
                 lastTextSent = block.text;
                 onChunk(block.text);
-              }
-            }
-          }
-        } catch { /* incomplete JSON or non-JSON line */ }
-      }
-      // Also emit tool_use events so the frontend can show "Using tool: Read..."
-      for (const line of lines) {
-        const trimmed = line.trim();
-        if (!trimmed || !trimmed.startsWith('{')) continue;
-        try {
-          const obj = JSON.parse(trimmed);
-          if (obj.type === 'assistant' && obj.message?.content) {
-            for (const block of obj.message.content) {
-              if (block.type === 'tool_use' && block.name && onToolUse) {
+              } else if (block.type === 'tool_use' && block.name && onToolUse) {
                 onToolUse(block.name, block.input);
               }
             }
           }
-        } catch {}
+        } catch { /* incomplete JSON or non-JSON line */ }
       }
     });
     proc.stderr.on('data', d => { stderr += d.toString(); });

package/engine/preflight.js

@@ -27,7 +27,13 @@ function findClaudeBinary() {
     path.join(path.dirname(process.execPath), '..', 'lib', 'node_modules', '@anthropic-ai', 'claude-code', 'cli.js'),
     // fnm / volta — sibling to the node binary
     path.join(path.dirname(process.execPath), 'node_modules', '@anthropic-ai', 'claude-code', 'cli.js'),
-  ].filter(Boolean);
+  ].filter(p => {
+    if (!p) {
+      if (process.env.MINIONS_DEBUG) console.log('[preflight] Dropped empty CLI search path entry');
+      return false;
+    }
+    return true;
+  });
   for (const p of searchPaths) {
     try { if (fs.existsSync(p)) return p; } catch {}
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.419",
+  "version": "0.1.420",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"