@yemi33/minions 0.1.419 → 0.1.421

package/CHANGELOG.md

@@ -1,12 +1,15 @@
 # Changelog
 
-## 0.1.419 (2026-04-06)
+## 0.1.421 (2026-04-06)
 
 ### Features
+- Dashboard robustness — raw string fixes, plan steering clarity, safeWrite race fix
+- Low-priority cleanup: dedupe regex, consolidate streaming parse, add path validation alignment
 - Fix 6 medium bugs: dispatch pruning, null guards, skill regex, meeting advancement, CLI PID check, pipeline retry
 - Convert remaining lifecycle.js safeWrite calls to mutateJsonFileLocked
 
 ### Fixes
+-  CC retry now drains queued messages after success
 -  address review feedback — pipeline.js socket leak and magic numbers
 
 ## 0.1.417 (2026-04-06)

package/dashboard/js/command-center.js

@@ -344,8 +344,14 @@ function ccRetryLast() {
   const el = document.getElementById('cc-messages');
   if (el?.lastElementChild) el.lastElementChild.remove();
   _ccMessages = _ccMessages.slice(0, -1); // remove error from history
-  // Resend
-  _ccDoSend(text.trim());
+  // Resend, then drain queue
+  _ccDoSend(text.trim()).then(async () => {
+    while (_ccQueue.length > 0) {
+      const next = _ccQueue.shift();
+      _renderQueueIndicator();
+      await _ccDoSend(next);
+    }
+  });
 }
 
 async function _ccFetch(url, body) {

package/dashboard.js

@@ -792,8 +792,13 @@ async function ccDocCall({ message, document, title, filePath, selection, canEdi
 function readBody(req) {
   return new Promise((resolve, reject) => {
     let body = '';
-    req.on('data', chunk => { body += chunk; if (body.length > 1e6) reject(new Error('Too large')); });
-    req.on('end', () => { try { resolve(JSON.parse(body)); } catch(e) { reject(e); } });
+    const timeout = setTimeout(() => {
+      req.destroy();
+      reject(new Error('Request body timeout after 30s'));
+    }, 30000);
+    req.on('data', chunk => { body += chunk; if (body.length > 1e6) { clearTimeout(timeout); reject(new Error('Too large')); } });
+    req.on('end', () => { clearTimeout(timeout); try { resolve(JSON.parse(body)); } catch(e) { reject(e); } });
+    req.on('error', (e) => { clearTimeout(timeout); reject(e); });
   });
 }
 
@@ -1321,17 +1326,19 @@ const server = http.createServer(async (req, res) => {
       let item;
       mutateJsonFileLocked(planPath, (plan) => {
         const target = (plan.missing_features || []).find(f => f.id === body.itemId);
-        if (target) {
-          if (body.name !== undefined) target.name = body.name;
-          if (body.description !== undefined) target.description = body.description;
-          if (body.priority !== undefined) target.priority = body.priority;
-          if (body.estimated_complexity !== undefined) target.estimated_complexity = body.estimated_complexity;
-          if (body.status !== undefined) target.status = body.status;
-          item = target;
-        }
+        if (!target) return plan; // TOCTOU: item deleted between pre-check and lock acquisition
+        if (body.name !== undefined) target.name = body.name;
+        if (body.description !== undefined) target.description = body.description;
+        if (body.priority !== undefined) target.priority = body.priority;
+        if (body.estimated_complexity !== undefined) target.estimated_complexity = body.estimated_complexity;
+        if (body.status !== undefined) target.status = body.status;
+        item = target;
         return plan;
       }, { defaultValue: preCheck });
 
+      // If item was deleted between pre-check and lock, return 404
+      if (!item) return jsonReply(res, 404, { error: 'item not found in plan (deleted concurrently)' });
+
       // Feature 3: Sync edits to materialized work item if still pending
       let workItemSynced = false;
       const wiSyncPaths = [path.join(MINIONS_DIR, 'work-items.json')];
@@ -1929,8 +1936,8 @@ If nothing to do: { "duplicates": [], "reclassify": [], "remove": [] }`;
           mutateJsonFileLocked(wiPath, (items) => {
             if (!Array.isArray(items)) return items;
             for (const w of items) {
-              if (w.sourcePlan === body.file && w.status === 'paused' && w._pausedBy === 'prd-pause') {
-                w.status = 'pending';
+              if (w.sourcePlan === body.file && w.status === WI_STATUS.PAUSED && w._pausedBy === 'prd-pause') {
+                w.status = WI_STATUS.PENDING;
                 delete w._pausedBy;
                 w._resumedAt = new Date().toISOString();
                 resumedItemIds.push(w.id);
@@ -1991,7 +1998,7 @@ If nothing to do: { "duplicates": [], "reclassify": [], "remove": [] }`;
               // Keep completed items as-is, reset everything else to pending.
               if (w.completedAt || DONE_STATUSES.has(w.status)) continue;
 
-              if (w.status === 'dispatched') {
+              if (w.status === WI_STATUS.DISPATCHED) {
                 // Kill the agent working on this item, if any.
                 const activeEntry = (dispatch.active || []).find(d => d.meta?.item?.id === w.id || d.meta?.dispatchKey?.includes(w.id));
                 if (activeEntry) {
@@ -2017,8 +2024,8 @@ If nothing to do: { "duplicates": [], "reclassify": [], "remove": [] }`;
                 }
               }
 
-              if (w.status !== 'paused') reset++;
-              w.status = 'paused';
+              if (w.status !== WI_STATUS.PAUSED) reset++;
+              w.status = WI_STATUS.PAUSED;
               w._pausedBy = 'prd-pause';
               delete w._resumedAt;
               delete w.dispatched_at;
@@ -2329,9 +2336,8 @@ If nothing to do: { "duplicates": [], "reclassify": [], "remove": [] }`;
     try {
       const body = await readBody(req);
       if (!body.file) return jsonReply(res, 400, { error: 'file required' });
-      if (body.file.includes('..') || body.file.includes('\0') || body.file.includes('/') || body.file.includes('\\')) {
-        return jsonReply(res, 400, { error: 'invalid filename' });
-      }
+      try { shared.sanitizePath(body.file, body.file.endsWith('.json') ? PRD_DIR : PLANS_DIR); }
+      catch { return jsonReply(res, 400, { error: 'invalid filename' }); }
       const isJson = body.file.endsWith('.json');
       const targetDir = isJson ? PRD_DIR : PLANS_DIR;
       const archivePath = path.join(targetDir, 'archive', body.file);
@@ -2675,18 +2681,18 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           try {
             const prdDir = path.join(MINIONS_DIR, 'prd');
             if (fs.existsSync(prdDir)) {
-              for (const f of fs.readdirSync(prdDir)) {
-                if (!f.endsWith('.json')) continue;
-                const prd = safeJson(path.join(prdDir, f));
+              for (const prdFile of fs.readdirSync(prdDir)) {
+                if (!prdFile.endsWith('.json')) continue;
+                const prd = safeJson(path.join(prdDir, prdFile));
                 if (!prd || prd.source_plan !== planFile) continue;
                 if (prd.status === 'paused' || prd.status === 'rejected') continue;
                 // Found an active PRD linked to this plan — pause it
                 prd.status = 'paused';
                 prd.pausedAt = new Date().toISOString();
                 prd.pausedBy = 'plan-steering';
-                safeWrite(path.join(prdDir, f), prd);
-                pausedPrd = f;
-                // Pause work items (reuse pause logic inline)
+                safeWrite(path.join(prdDir, prdFile), prd);
+                pausedPrd = prdFile;
+                // Pause work items linked to this PRD (sourcePlan = PRD filename)
                 const wiPaths = [path.join(MINIONS_DIR, 'work-items.json')];
                 for (const proj of PROJECTS) wiPaths.push(shared.projectWorkItemsPath(proj));
                 const dispatchPath = path.join(MINIONS_DIR, 'engine', 'dispatch.json');
@@ -2695,45 +2701,45 @@ What would you like to discuss or change? When you're happy, say "approve" and I
                 const resetItemIds = new Set();
                 for (const wiPath of wiPaths) {
                   try {
-                    const items = safeJson(wiPath);
-                    if (!items) continue;
-                    let changed = false;
-                    for (const w of items) {
-                      if (w.sourcePlan !== f) continue;
-                      if (w.completedAt || DONE_STATUSES.has(w.status)) continue;
-                      if (w.status === 'dispatched') {
-                        const activeEntry = (dispatch.active || []).find(d => d.meta?.item?.id === w.id || d.meta?.dispatchKey?.includes(w.id));
-                        if (activeEntry) {
-                          const statusPath = path.join(MINIONS_DIR, 'agents', activeEntry.agent, 'status.json');
-                          try {
-                            const agentStatus = JSON.parse(safeRead(statusPath) || '{}');
-                            if (agentStatus.pid) {
-                              try {
-                                const safePid = shared.validatePid(agentStatus.pid);
-                                if (process.platform === 'win32') {
-                                  require('child_process').execFileSync('taskkill', ['/PID', String(safePid), '/F', '/T'], { stdio: 'pipe', timeout: 5000, windowsHide: true });
-                                } else {
-                                  process.kill(safePid, 'SIGTERM');
-                                }
-                              } catch { /* process may be dead or invalid PID */ }
-                            }
-                            agentStatus.status = 'idle';
-                            delete agentStatus.currentTask;
-                            delete agentStatus.dispatched;
-                            safeWrite(statusPath, agentStatus);
-                          } catch { /* agent reset */ }
-                          killedAgents.add(activeEntry.agent);
+                    mutateJsonFileLocked(wiPath, (items) => {
+                      if (!Array.isArray(items)) return items;
+                      for (const w of items) {
+                        if (w.sourcePlan !== prdFile) continue;
+                        if (w.completedAt || DONE_STATUSES.has(w.status)) continue;
+                        if (w.status === WI_STATUS.DISPATCHED) {
+                          const activeEntry = (dispatch.active || []).find(d => d.meta?.item?.id === w.id || d.meta?.dispatchKey?.includes(w.id));
+                          if (activeEntry) {
+                            const statusPath = path.join(MINIONS_DIR, 'agents', activeEntry.agent, 'status.json');
+                            try {
+                              const agentStatus = JSON.parse(safeRead(statusPath) || '{}');
+                              if (agentStatus.pid) {
+                                try {
+                                  const safePid = shared.validatePid(agentStatus.pid);
+                                  if (process.platform === 'win32') {
+                                    require('child_process').execFileSync('taskkill', ['/PID', String(safePid), '/F', '/T'], { stdio: 'pipe', timeout: 5000, windowsHide: true });
+                                  } else {
+                                    process.kill(safePid, 'SIGTERM');
+                                  }
+                                } catch { /* process may be dead or invalid PID */ }
+                              }
+                              agentStatus.status = 'idle';
+                              delete agentStatus.currentTask;
+                              delete agentStatus.dispatched;
+                              safeWrite(statusPath, agentStatus);
+                            } catch { /* agent reset */ }
+                            killedAgents.add(activeEntry.agent);
+                          }
                         }
+                        w.status = WI_STATUS.PAUSED;
+                        w._pausedBy = 'plan-steering';
+                        delete w.dispatched_at;
+                        delete w.dispatched_to;
+                        delete w.failReason;
+                        delete w.failedAt;
+                        if (w.id) resetItemIds.add(w.id);
                       }
-                      w.status = 'pending';
-                      delete w.dispatched_at;
-                      delete w.dispatched_to;
-                      delete w.failReason;
-                      delete w.failedAt;
-                      changed = true;
-                      if (w.id) resetItemIds.add(w.id);
-                    }
-                    if (changed) safeWrite(wiPath, items);
+                      return items;
+                    }, { defaultValue: [] });
                   } catch { /* reset work items */ }
                 }
                 if (resetItemIds.size > 0 || killedAgents.size > 0) {

package/engine/ado.js

@@ -381,7 +381,7 @@ async function reconcilePrs(config) {
       const title = adoPr.title || '';
       // Extract item ID from branch name or PR title (e.g., feat(P-2cafdc2a): ...)
       const branchMatch = branch.match(/(P-[a-z0-9]{6,})/i) || branch.match(/(W-[a-z0-9]{6,})/i) || branch.match(/(PL-[a-z0-9]{6,})/i);
-      const titleMatch = title.match(/\((P-[a-z0-9]{6,})\)/) || title.match(/\((W-[a-z0-9]{6,})\)/) || title.match(/\((W-[a-z0-9]{6,})\)/) || title.match(/\((PL-[a-z0-9]{6,})\)/);
+      const titleMatch = title.match(/\((P-[a-z0-9]{6,})\)/) || title.match(/\((W-[a-z0-9]{6,})\)/) || title.match(/\((PL-[a-z0-9]{6,})\)/);
       const linkedItemId = branchMatch?.[1] || titleMatch?.[1] || null;
       const linkedItem = linkedItemId ? allItems.find(i => i.id === linkedItemId) : null;
       const confirmedItemId = linkedItem ? linkedItemId : null;

package/engine/llm.js

@@ -160,25 +160,12 @@ function callLLMStreaming(promptText, sysPromptText, { timeout = 120000, label =
               if (block.type === 'text' && block.text && block.text !== lastTextSent) {
                 lastTextSent = block.text;
                 onChunk(block.text);
-              }
-            }
-          }
-        } catch { /* incomplete JSON or non-JSON line */ }
-      }
-      // Also emit tool_use events so the frontend can show "Using tool: Read..."
-      for (const line of lines) {
-        const trimmed = line.trim();
-        if (!trimmed || !trimmed.startsWith('{')) continue;
-        try {
-          const obj = JSON.parse(trimmed);
-          if (obj.type === 'assistant' && obj.message?.content) {
-            for (const block of obj.message.content) {
-              if (block.type === 'tool_use' && block.name && onToolUse) {
+              } else if (block.type === 'tool_use' && block.name && onToolUse) {
                 onToolUse(block.name, block.input);
               }
             }
           }
-        } catch {}
+        } catch { /* incomplete JSON or non-JSON line */ }
       }
     });
     proc.stderr.on('data', d => { stderr += d.toString(); });

package/engine/preflight.js

@@ -27,7 +27,13 @@ function findClaudeBinary() {
     path.join(path.dirname(process.execPath), '..', 'lib', 'node_modules', '@anthropic-ai', 'claude-code', 'cli.js'),
     // fnm / volta — sibling to the node binary
     path.join(path.dirname(process.execPath), 'node_modules', '@anthropic-ai', 'claude-code', 'cli.js'),
-  ].filter(Boolean);
+  ].filter(p => {
+    if (!p) {
+      if (process.env.MINIONS_DEBUG) console.log('[preflight] Dropped empty CLI search path entry');
+      return false;
+    }
+    return true;
+  });
   for (const p of searchPaths) {
     try { if (fs.existsSync(p)) return p; } catch {}
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.419",
+  "version": "0.1.421",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"