@yemi33/minions 0.1.563 → 0.1.564

package/CHANGELOG.md

@@ -1,8 +1,9 @@
 # Changelog
 
-## 0.1.563 (2026-04-08)
+## 0.1.564 (2026-04-08)
 
 ### Fixes
+-  worktree audit followups — delete ordering, path traversal guard
 -  worktree lifecycle — fail on dep merge, fallback rm, cleanup on plan delete
 -  auto-reset CC session on resume failure, add error logging
 

package/dashboard.js

@@ -2392,11 +2392,17 @@ If nothing to do: { "duplicates": [], "reclassify": [], "remove": [] }`;
       shared.sanitizePath(body.file, body.file.endsWith('.json') ? PRD_DIR : PLANS_DIR);
       const planPath = resolvePlanPath(body.file);
       if (!fs.existsSync(planPath)) return jsonReply(res, 404, { error: 'plan not found' });
-      // Read PRD content before deleting to get source_plan for cleanup
+      // Read plan content before deleting — needed for worktree cleanup and source_plan
+      let planObj = null;
       let prdSourcePlan = null;
       if (body.file.endsWith('.json')) {
-        try { prdSourcePlan = safeJsonObj(planPath).source_plan || null; } catch {}
+        try { planObj = safeJsonObj(planPath); prdSourcePlan = planObj?.source_plan || null; } catch {}
       }
+      // Clean up worktrees before deleting work items (needs branch info from work items)
+      try {
+        const { cleanupPlanWorktrees } = require('./engine/lifecycle');
+        cleanupPlanWorktrees(body.file, planObj || {}, PROJECTS, getConfig());
+      } catch (e) { console.error('plan worktree cleanup:', e.message); }
       safeUnlink(planPath);
 
       // Clean up materialized work items from all projects + central
@@ -2439,13 +2445,6 @@ If nothing to do: { "duplicates": [], "reclassify": [], "remove": [] }`;
         } catch (e) { console.error('plan-to-prd cleanup:', e.message); }
       }
 
-      // Clean up worktrees associated with this plan
-      try {
-        const plan = body.file.endsWith('.json') ? (safeJsonObj(path.join(PRD_DIR, 'archive', body.file)) || safeJsonObj(path.join(PRD_DIR, body.file)) || {}) : {};
-        const { cleanupPlanWorktrees } = require('./engine/lifecycle');
-        cleanupPlanWorktrees(body.file, plan, PROJECTS, getConfig());
-      } catch (e) { console.error('plan worktree cleanup:', e.message); }
-
       invalidateStatusCache();
       return jsonReply(res, 200, { ok: true, cleanedWorkItems: cleaned, cleanedDispatches: dispatchCleaned });
     } catch (e) { return jsonReply(res, 400, { error: e.message }); }

package/engine/shared.js

@@ -808,7 +808,7 @@ function mutatePullRequests(filePath, mutator) {
  */
 function removeWorktree(wtPath, gitRoot, worktreeRoot) {
   const resolved = path.resolve(wtPath);
-  const resolvedRoot = path.resolve(worktreeRoot);
+  const resolvedRoot = path.resolve(worktreeRoot) + path.sep;
   if (!resolved.startsWith(resolvedRoot)) {
     log('warn', `removeWorktree: refusing to remove ${wtPath} — not under ${worktreeRoot}`);
     return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.563",
+  "version": "0.1.564",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"