@yemi33/minions 0.1.56 → 0.1.58

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.1.58 (2026-03-30)
+
+### Engine
+- engine.js
+
+### Dashboard
+- dashboard.js
+
+### Other
+- test/unit.test.js
+
+## 0.1.57 (2026-03-30)
+
+### Engine
+- engine.js
+
 ## 0.1.56 (2026-03-30)
 
 ### Other

package/dashboard.js

@@ -635,6 +635,17 @@ function readBody(req) {
   });
 }
 
+const _rateLimits = new Map();
+function checkRateLimit(key, maxPerMinute) {
+  const now = Date.now();
+  const entries = _rateLimits.get(key) || [];
+  const recent = entries.filter(t => now - t < 60000);
+  if (recent.length >= maxPerMinute) return true;
+  recent.push(now);
+  _rateLimits.set(key, recent);
+  return false;
+}
+
 function jsonReply(res, code, data, req) {
   res.setHeader('Content-Type', 'application/json');
   res.setHeader('Access-Control-Allow-Origin', '*');
@@ -1270,7 +1281,6 @@ const server = http.createServer(async (req, res) => {
       'Content-Type': 'text/event-stream',
       'Cache-Control': 'no-cache',
       'Connection': 'keep-alive',
-      'Access-Control-Allow-Origin': '*',
     });
 
     // Send initial content
@@ -1387,7 +1397,7 @@ const server = http.createServer(async (req, res) => {
     const cat = match[1];
     const file = decodeURIComponent(match[2]);
     // Prevent path traversal
-    if (file.includes('..') || file.includes('/') || file.includes('\\')) {
+    if (file.includes('..') || file.includes('\0') || file.includes('/') || file.includes('\\')) {
       return jsonReply(res, 400, { error: 'invalid file name' });
     }
     const content = safeRead(path.join(MINIONS_DIR, 'knowledge', cat, file));
@@ -1618,7 +1628,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
 
   async function handlePlansArchiveRead(req, res, match) {
     const file = decodeURIComponent(match[1]);
-    if (file.includes('..')) return jsonReply(res, 400, { error: 'invalid' });
+    if (file.includes('..') || file.includes('\0')) return jsonReply(res, 400, { error: 'invalid' });
     // Check prd/archive/ first for .json, then plans/archive/ for .md
     const archiveDir = file.endsWith('.json') ? path.join(PRD_DIR, 'archive') : path.join(PLANS_DIR, 'archive');
     let content = safeRead(path.join(archiveDir, file));
@@ -1634,7 +1644,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
 
   async function handlePlansRead(req, res, match) {
     const file = decodeURIComponent(match[1]);
-    if (file.includes('..') || file.includes('/') || file.includes('\\')) return jsonReply(res, 400, { error: 'invalid' });
+    if (file.includes('..') || file.includes('\0') || file.includes('/') || file.includes('\\')) return jsonReply(res, 400, { error: 'invalid' });
     let content = safeRead(resolvePlanPath(file));
     // Fallback: check all directories (prd/, plans/, guides/, archives)
     if (!content) content = safeRead(path.join(PRD_DIR, file));
@@ -1801,7 +1811,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
     try {
       const body = await readBody(req);
       if (!body.file) return jsonReply(res, 400, { error: 'file is required' });
-      if (body.file.includes('..')) return jsonReply(res, 400, { error: 'invalid file path' });
+      if (body.file.includes('..') || body.file.includes('\0')) return jsonReply(res, 400, { error: 'invalid file path' });
 
       const prdPath = path.join(PRD_DIR, body.file);
       const plan = safeJson(prdPath);
@@ -1865,6 +1875,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
   }
 
   async function handlePlansExecute(req, res) {
+    if (checkRateLimit('plans-execute', 5)) return jsonReply(res, 429, { error: 'Rate limited — max 5 requests/minute' });
     try {
       const body = await readBody(req);
       if (!body.file) return jsonReply(res, 400, { error: 'file required' });
@@ -1975,7 +1986,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
     try {
       const body = await readBody(req);
       if (!body.file) return jsonReply(res, 400, { error: 'file required' });
-      if (body.file.includes('..') || body.file.includes('/') || body.file.includes('\\')) {
+      if (body.file.includes('..') || body.file.includes('\0') || body.file.includes('/') || body.file.includes('\\')) {
         return jsonReply(res, 400, { error: 'invalid filename' });
       }
       const planPath = resolvePlanPath(body.file);
@@ -2345,6 +2356,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       const body = await readBody(req);
       const { name } = body;
       if (!name) return jsonReply(res, 400, { error: 'name required' });
+      if (name.includes('..') || name.includes('\0')) return jsonReply(res, 400, { error: 'Invalid file name' });
 
       const inboxPath = path.join(MINIONS_DIR, 'notes', 'inbox', name);
       const content = safeRead(inboxPath);
@@ -2384,6 +2396,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       const body = await readBody(req);
       const { name, category } = body;
       if (!name) return jsonReply(res, 400, { error: 'name required' });
+      if (name.includes('..') || name.includes('\0')) return jsonReply(res, 400, { error: 'Invalid file name' });
       if (!category || !shared.KB_CATEGORIES.includes(category)) {
         return jsonReply(res, 400, { error: 'category required: ' + shared.KB_CATEGORIES.join(', ') });
       }
@@ -2420,7 +2433,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     try {
       const body = await readBody(req);
       const { name } = body;
-      if (!name || name.includes('..') || name.includes('/') || name.includes('\\')) {
+      if (!name || name.includes('..') || name.includes('\0') || name.includes('/') || name.includes('\\')) {
         return jsonReply(res, 400, { error: 'invalid name' });
       }
       const filePath = path.join(MINIONS_DIR, 'notes', 'inbox', name);
@@ -2446,7 +2459,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     try {
       const body = await readBody(req);
       const { name } = body;
-      if (!name || name.includes('..') || name.includes('/') || name.includes('\\')) {
+      if (!name || name.includes('..') || name.includes('\0') || name.includes('/') || name.includes('\\')) {
         return jsonReply(res, 400, { error: 'invalid name' });
       }
       const filePath = path.join(MINIONS_DIR, 'notes', 'inbox', name);
@@ -2460,7 +2473,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     const params = new URL(req.url, 'http://localhost').searchParams;
     const file = params.get('file');
     const dir = params.get('dir');
-    if (!file || file.includes('..')) { res.statusCode = 400; res.end('Invalid file'); return; }
+    if (!file || file.includes('..') || file.includes('\0')) { res.statusCode = 400; res.end('Invalid file'); return; }
 
     let content = '';
     if (dir) {
@@ -2616,6 +2629,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
   }
 
   async function handleCommandCenter(req, res) {
+    if (checkRateLimit('command-center', 10)) return jsonReply(res, 429, { error: 'Rate limited — max 10 requests/minute' });
     try {
       const body = await readBody(req);
       if (!body.message) return jsonReply(res, 400, { error: 'message required' });
@@ -3103,19 +3117,34 @@ What would you like to discuss or change? When you're happy, say "approve" and I
   // ── Route Dispatcher ────────────────────────────────────────────────────────
 
   const pathname = req.url.split('?')[0];
+  const _reqStart = Date.now();
   for (const route of ROUTES) {
     if (route.method !== req.method) continue;
     if (typeof route.path === 'string') {
       // For /api/skill, match with query string prefix since it has no fixed path variant
       if (route.path === '/api/skill') {
         if (!req.url.startsWith('/api/skill?') && req.url !== '/api/skill') continue;
-        return await route.handler(req, res, {});
+        const _result = await route.handler(req, res, {});
+        if (pathname.startsWith('/api/') && !pathname.includes('/status') && !pathname.includes('/hot-reload') && !pathname.includes('/status-stream')) {
+          console.log(`  ${req.method} ${pathname} ${Date.now() - _reqStart}ms`);
+        }
+        return _result;
       }
       if (pathname !== route.path) continue;
-      return await route.handler(req, res, {});
+      const _result = await route.handler(req, res, {});
+      if (pathname.startsWith('/api/') && !pathname.includes('/status') && !pathname.includes('/hot-reload') && !pathname.includes('/status-stream')) {
+        console.log(`  ${req.method} ${pathname} ${Date.now() - _reqStart}ms`);
+      }
+      return _result;
     }
     const m = pathname.match(route.path);
-    if (m) return await route.handler(req, res, m);
+    if (m) {
+      const _result = await route.handler(req, res, m);
+      if (pathname.startsWith('/api/') && !pathname.includes('/status') && !pathname.includes('/hot-reload') && !pathname.includes('/status-stream')) {
+        console.log(`  ${req.method} ${pathname} ${Date.now() - _reqStart}ms`);
+      }
+      return _result;
+    }
   }
 
   // Serve dashboard HTML with gzip + caching

package/engine.js

@@ -102,7 +102,7 @@ function log(level, msg, meta = {}) {
   let logData = safeJson(LOG_PATH) || [];
   if (!Array.isArray(logData)) logData = logData.entries || [];
   logData.push(entry);
-  if (logData.length > 500) logData.splice(0, logData.length - 500);
+  if (logData.length > 2000) logData.splice(0, logData.length - 2000);
   safeWrite(LOG_PATH, logData);
 }
 
@@ -356,16 +356,23 @@ function renderPlaybook(type, vars) {
     return null;
   }
 
-  // Inject pinned context (always visible to agents)
+  // Inject pinned context (always visible to agents) — capped at 4KB
   let pinnedContent = '';
   try { pinnedContent = fs.readFileSync(path.join(MINIONS_DIR, 'pinned.md'), 'utf8'); } catch {}
   if (pinnedContent) {
+    if (pinnedContent.length > 4096) pinnedContent = pinnedContent.slice(0, 4096) + '\n\n_...pinned.md truncated (read full file if needed)_';
     content += '\n\n---\n\n## Pinned Context (CRITICAL — READ FIRST)\n\n' + pinnedContent;
   }
 
-  // Inject team notes context
-  const notes = getNotes();
+  // Inject team notes (single injection point — not in buildAgentContext) — capped at 8KB
+  let notes = getNotes();
   if (notes) {
+    if (notes.length > 8192) {
+      const sections = notes.split(/(?=^### )/m);
+      const recent = sections.slice(-10).join('');
+      notes = recent.length > 8192 ? recent.slice(0, 8192) + '\n\n_...notes truncated_' : recent;
+      notes += '\n\n_' + Math.max(0, sections.length - 10) + ' older entries in `notes.md` — Read if needed._';
+    }
     content += '\n\n---\n\n## Team Notes (MUST READ)\n\n' + notes;
   }
 
@@ -621,18 +628,8 @@ function buildAgentContext(agentId, config, project) {
     context += `## Pending Work Queue (${(dispatch.pending || []).length} items)\n\n${pendingItems.join('\n')}${(dispatch.pending || []).length > 10 ? '\n- ... and ' + ((dispatch.pending || []).length - 10) + ' more' : ''}\n\n`;
   }
 
-  // Team notes — last 5 sections only (recent learnings, not the full history)
-  const notes = getNotes();
-  if (notes) {
-    const sections = notes.split(/(?=^### )/m);
-    const header = sections[0] && !sections[0].startsWith('### ') ? sections.shift() : '';
-    if (sections.length > 5) {
-      const recent = sections.slice(-5).join('');
-      context += `## Team Notes (last 5 of ${sections.length})\n\n${recent}\n\n_${sections.length - 5} older entries in \`notes.md\` — Read if needed._\n\n`;
-    } else {
-      context += `## Team Notes\n\n${notes}\n\n`;
-    }
-  }
+  // Team notes injected via renderPlaybook (single injection point, with truncation)
+  // Not duplicated here to avoid double-injection and token waste
 
   return context;
 }
@@ -2815,7 +2812,7 @@ function discoverFromWorkItems(config, project) {
     try { vars.notes_content = fs.readFileSync(path.join(MINIONS_DIR, 'notes.md'), 'utf8'); } catch {}
 
     // Inject references and acceptance criteria
-    const refs = (item.references || []).map(r =>
+    const refs = (item.references || []).filter(r => r && r.url).map(r =>
       '- [' + (r.title || r.url) + '](' + r.url + ')' + (r.type ? ' (' + r.type + ')' : '')
     ).join('\n');
     vars.references = refs ? '## References\n\n' + refs : '';
@@ -3110,7 +3107,7 @@ function discoverCentralWorkItems(config) {
         };
 
         // Inject references and acceptance criteria
-        const fanRefs = (item.references || []).map(r =>
+        const fanRefs = (item.references || []).filter(r => r && r.url).map(r =>
           '- [' + (r.title || r.url) + '](' + r.url + ')' + (r.type ? ' (' + r.type + ')' : '')
         ).join('\n');
         vars.references = fanRefs ? '## References\n\n' + fanRefs : '';
@@ -3185,7 +3182,7 @@ function discoverCentralWorkItems(config) {
       try { vars.notes_content = fs.readFileSync(path.join(MINIONS_DIR, 'notes.md'), 'utf8'); } catch {}
 
       // Inject references and acceptance criteria
-      const normRefs = (item.references || []).map(r =>
+      const normRefs = (item.references || []).filter(r => r && r.url).map(r =>
         '- [' + (r.title || r.url) + '](' + r.url + ')' + (r.type ? ' (' + r.type + ')' : '')
       ).join('\n');
       vars.references = normRefs ? '## References\n\n' + normRefs : '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.56",
+  "version": "0.1.58",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"