@yemi33/minions 0.1.563 → 0.1.565

package/CHANGELOG.md

@@ -1,11 +1,15 @@
 # Changelog
 
-## 0.1.563 (2026-04-08)
+## 0.1.565 (2026-04-08)
 
 ### Fixes
+-  worktree audit followups — delete ordering, path traversal guard
 -  worktree lifecycle — fail on dep merge, fallback rm, cleanup on plan delete
 -  auto-reset CC session on resume failure, add error logging
 
+### Other
+- perf: cache claude binary path across spawns in spawn-agent.js
+
 ## 0.1.561 (2026-04-08)
 
 ### Fixes

package/dashboard.js

@@ -2392,11 +2392,17 @@ If nothing to do: { "duplicates": [], "reclassify": [], "remove": [] }`;
       shared.sanitizePath(body.file, body.file.endsWith('.json') ? PRD_DIR : PLANS_DIR);
       const planPath = resolvePlanPath(body.file);
       if (!fs.existsSync(planPath)) return jsonReply(res, 404, { error: 'plan not found' });
-      // Read PRD content before deleting to get source_plan for cleanup
+      // Read plan content before deleting — needed for worktree cleanup and source_plan
+      let planObj = null;
       let prdSourcePlan = null;
       if (body.file.endsWith('.json')) {
-        try { prdSourcePlan = safeJsonObj(planPath).source_plan || null; } catch {}
+        try { planObj = safeJsonObj(planPath); prdSourcePlan = planObj?.source_plan || null; } catch {}
       }
+      // Clean up worktrees before deleting work items (needs branch info from work items)
+      try {
+        const { cleanupPlanWorktrees } = require('./engine/lifecycle');
+        cleanupPlanWorktrees(body.file, planObj || {}, PROJECTS, getConfig());
+      } catch (e) { console.error('plan worktree cleanup:', e.message); }
       safeUnlink(planPath);
 
       // Clean up materialized work items from all projects + central
@@ -2439,13 +2445,6 @@ If nothing to do: { "duplicates": [], "reclassify": [], "remove": [] }`;
         } catch (e) { console.error('plan-to-prd cleanup:', e.message); }
       }
 
-      // Clean up worktrees associated with this plan
-      try {
-        const plan = body.file.endsWith('.json') ? (safeJsonObj(path.join(PRD_DIR, 'archive', body.file)) || safeJsonObj(path.join(PRD_DIR, body.file)) || {}) : {};
-        const { cleanupPlanWorktrees } = require('./engine/lifecycle');
-        cleanupPlanWorktrees(body.file, plan, PROJECTS, getConfig());
-      } catch (e) { console.error('plan worktree cleanup:', e.message); }
-
       invalidateStatusCache();
       return jsonReply(res, 200, { ok: true, cleanedWorkItems: cleaned, cleanedDispatches: dispatchCleaned });
     } catch (e) { return jsonReply(res, 400, { error: e.message }); }

package/engine/shared.js

@@ -808,7 +808,7 @@ function mutatePullRequests(filePath, mutator) {
  */
 function removeWorktree(wtPath, gitRoot, worktreeRoot) {
   const resolved = path.resolve(wtPath);
-  const resolvedRoot = path.resolve(worktreeRoot);
+  const resolvedRoot = path.resolve(worktreeRoot) + path.sep;
   if (!resolved.startsWith(resolvedRoot)) {
     log('warn', `removeWorktree: refusing to remove ${wtPath} — not under ${worktreeRoot}`);
     return false;

package/engine/spawn-agent.js

@@ -25,9 +25,21 @@ const env = cleanChildEnv();
 // Resolve claude binary — supports both npm install (cli.js) and native installer (binary on PATH)
 let claudeBin;
 let claudeIsNative = false; // true = native binary, false = node cli.js
+const capsCachePath = path.join(__dirname, 'claude-caps.json');
+let _sysPromptFileSupported = null;
 
-// Strategy 1: Check if `claude` is on PATH (native installer or npm global bin)
+// Fast path: use cached binary path if it still exists on disk
 try {
+  const caps = JSON.parse(fs.readFileSync(capsCachePath, 'utf8'));
+  if (caps.claudeBin && fs.existsSync(caps.claudeBin)) {
+    claudeBin = caps.claudeBin;
+    claudeIsNative = !!caps.claudeIsNative;
+    _sysPromptFileSupported = caps.sysPromptFile ?? null;
+  }
+} catch {}
+
+// Strategy 1: Check if `claude` is on PATH (native installer or npm global bin)
+if (!claudeBin) try {
   const isWin = process.platform === 'win32';
   const cmd = isWin ? 'where claude 2>NUL' : 'which claude 2>/dev/null';
   const which = exec(cmd, { encoding: 'utf8', env, timeout: 10000 }).trim().split('\n')[0].trim();
@@ -79,11 +91,11 @@ if (!claudeBin) {
   } catch { /* optional */ }
 }
 
-// Debug log
+// Debug log (async — not on critical path)
 const tmpDir = path.join(__dirname, 'tmp');
 if (!fs.existsSync(tmpDir)) fs.mkdirSync(tmpDir, { recursive: true });
 const debugPath = path.join(tmpDir, 'spawn-debug.log');
-fs.writeFileSync(debugPath, `spawn-agent.js at ${ts()}\nclaudeBin=${claudeBin || 'not found'}\nnative=${claudeIsNative}\nprompt=${promptFile}\nsysPrompt=${sysPromptFile}\nextraArgs=${extraArgs.join(' ')}\n`);
+fs.writeFile(debugPath, `spawn-agent.js at ${ts()}\nclaudeBin=${claudeBin || 'not found'}\nnative=${claudeIsNative}\nprompt=${promptFile}\nsysPrompt=${sysPromptFile}\nextraArgs=${extraArgs.join(' ')}\n`, () => {});
 
 // When resuming a session, skip system prompt (it's baked into the session)
 const isResume = extraArgs.includes('--resume');
@@ -104,14 +116,8 @@ if (!claudeBin) {
   process.exit(78); // 78 = configuration error (distinct from runtime failures)
 }
 
-// Check if --system-prompt-file is supported (cached to avoid spawning claude --help every call)
+// Check if --system-prompt-file is supported (cached alongside binary path above)
 let actualArgs = cliArgs;
-const capsCachePath = path.join(__dirname, 'claude-caps.json');
-let _sysPromptFileSupported = null;
-try {
-  const caps = JSON.parse(fs.readFileSync(capsCachePath, 'utf8'));
-  if (caps.claudeBin === claudeBin) _sysPromptFileSupported = caps.sysPromptFile;
-} catch {}
 if (_sysPromptFileSupported === null) {
   try {
     const { spawnSync } = require('child_process');
@@ -119,8 +125,9 @@ if (_sysPromptFileSupported === null) {
       ? spawnSync(claudeBin, ['--help'], { encoding: 'utf8', timeout: 10000, windowsHide: true })
       : spawnSync(process.execPath, [claudeBin, '--help'], { encoding: 'utf8', timeout: 10000, windowsHide: true });
     _sysPromptFileSupported = (testResult.stdout || '').includes('system-prompt-file');
-    try { fs.writeFileSync(capsCachePath, JSON.stringify({ claudeBin, sysPromptFile: _sysPromptFileSupported, checkedAt: ts() })); } catch { /* optional */ }
   } catch { _sysPromptFileSupported = true; /* assume supported */ }
+  // Save binary path + capability flag together
+  try { fs.writeFileSync(capsCachePath, JSON.stringify({ claudeBin, claudeIsNative, sysPromptFile: _sysPromptFileSupported, checkedAt: ts() })); } catch {}
 }
 if (!isResume) try {
   if (!_sysPromptFileSupported) {
@@ -147,7 +154,7 @@ const proc = claudeIsNative
   ? runFile(claudeBin, actualArgs, { stdio: ['pipe', 'pipe', 'pipe'], env })
   : runFile(process.execPath, [claudeBin, ...actualArgs], { stdio: ['pipe', 'pipe', 'pipe'], env });
 
-fs.appendFileSync(debugPath, `PID=${proc.pid || 'none'}\nargs=${actualArgs.join(' ').slice(0, 500)}\n`);
+fs.appendFile(debugPath, `PID=${proc.pid || 'none'}\nargs=${actualArgs.join(' ').slice(0, 500)}\n`, () => {});
 
 // Write PID file for parent engine to verify spawn
 const pidFile = promptFile.replace(/prompt-/, 'pid-').replace(/\.md$/, '.pid');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.563",
+  "version": "0.1.565",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"