@yemi33/minions 0.1.57 → 0.1.59

package/dashboard.js

@@ -124,11 +124,11 @@ if (fs.existsSync(dashDir)) {
     _reloadTimer = setTimeout(rebuildDashboardHtml, 300); // debounce 300ms
   };
   // Watch top-level files (styles.css, layout.html)
-  try { fs.watch(dashDir, scheduleReload); } catch {}
+  try { fs.watch(dashDir, scheduleReload); } catch { /* optional */ }
   // Watch subdirectories (pages/, js/)
   for (const sub of ['pages', 'js']) {
     const subDir = path.join(dashDir, sub);
-    if (fs.existsSync(subDir)) try { fs.watch(subDir, scheduleReload); } catch {}
+    if (fs.existsSync(subDir)) try { fs.watch(subDir, scheduleReload); } catch { /* optional */ }
   }
 }
 
@@ -145,7 +145,7 @@ function getVerifyGuides() {
       const planFile = planSlug + '.json';
       guides.push({ file: f, planFile });
     }
-  } catch {}
+  } catch (e) { console.error('getVerifyGuides:', e.message); }
   return guides;
 }
 
@@ -273,7 +273,7 @@ try {
     const age = Date.now() - new Date(saved.lastActiveAt || 0).getTime();
     if (age < CC_SESSION_EXPIRY_MS) ccSession = saved;
   }
-} catch {}
+} catch { /* optional */ }
 
 // Static system prompt — baked into session on creation, never changes
 const CC_STATIC_SYSTEM_PROMPT = `You are the Command Center AI for a software engineering minions called "Minions."
@@ -459,7 +459,7 @@ try {
       }
     }
   }
-} catch {}
+} catch { /* optional */ }
 
 function persistDocSessions() {
   const obj = {};
@@ -635,6 +635,17 @@ function readBody(req) {
   });
 }
 
+const _rateLimits = new Map();
+function checkRateLimit(key, maxPerMinute) {
+  const now = Date.now();
+  const entries = _rateLimits.get(key) || [];
+  const recent = entries.filter(t => now - t < 60000);
+  if (recent.length >= maxPerMinute) return true;
+  recent.push(now);
+  _rateLimits.set(key, recent);
+  return false;
+}
+
 function jsonReply(res, code, data, req) {
   res.setHeader('Content-Type', 'application/json');
   res.setHeader('Access-Control-Allow-Origin', '*');
@@ -676,12 +687,12 @@ function cleanDispatchEntries(matchFn) {
             try {
               const pid = parseInt(fs.readFileSync(pidFile, 'utf8').trim());
               if (pid) process.kill(pid, 'SIGTERM');
-            } catch {}
-            try { fs.unlinkSync(pidFile); } catch {}
+            } catch { /* process may be dead */ }
+            try { fs.unlinkSync(pidFile); } catch { /* cleanup */ }
             // Clean up temp prompt files
-            try { fs.unlinkSync(path.join(engineDir, 'tmp', `prompt-${d.id}.md`)); } catch {}
-            try { fs.unlinkSync(path.join(engineDir, 'tmp', `sysprompt-${d.id}.md`)); } catch {}
-            try { fs.unlinkSync(path.join(engineDir, 'tmp', `sysprompt-${d.id}.md.tmp`)); } catch {}
+            try { fs.unlinkSync(path.join(engineDir, 'tmp', `prompt-${d.id}.md`)); } catch { /* cleanup */ }
+            try { fs.unlinkSync(path.join(engineDir, 'tmp', `sysprompt-${d.id}.md`)); } catch { /* cleanup */ }
+            try { fs.unlinkSync(path.join(engineDir, 'tmp', `sysprompt-${d.id}.md.tmp`)); } catch { /* cleanup */ }
           }
         }
         dispatch[queue] = dispatch[queue].filter(d => !matchFn(d));
@@ -718,7 +729,7 @@ function killEnginePid(pid) {
     } else {
       process.kill(pid, 'SIGKILL');
     }
-  } catch {}
+  } catch { /* process may be dead */ }
 }
 
 function restartEngine() {
@@ -835,7 +846,7 @@ const server = http.createServer(async (req, res) => {
           dispatch.completed = dispatch.completed.filter(d => !d.meta?.parentKey || d.meta.parentKey !== dispatchKey);
           return dispatch;
         }, { defaultValue: { pending: [], active: [], completed: [] } });
-      } catch {}
+      } catch (e) { console.error('dispatch cleanup:', e.message); }
 
       // Clear cooldown so item isn't blocked by exponential backoff
       try {
@@ -845,7 +856,7 @@ const server = http.createServer(async (req, res) => {
           delete cooldowns[dispatchKey];
           safeWrite(cooldownPath, cooldowns);
         }
-      } catch {}
+      } catch (e) { console.error('cooldown cleanup:', e.message); }
 
       return jsonReply(res, 200, { ok: true, id });
     } catch (e) { return jsonReply(res, 400, { error: e.message }); }
@@ -894,7 +905,7 @@ const server = http.createServer(async (req, res) => {
           if (key.includes(id)) { delete cooldowns[key]; cleaned = true; }
         }
         if (cleaned) safeWrite(cooldownPath, cooldowns);
-      } catch {}
+      } catch (e) { console.error('cooldown cleanup:', e.message); }
 
       invalidateStatusCache();
       return jsonReply(res, 200, { ok: true, id, dispatchRemoved });
@@ -1153,7 +1164,7 @@ const server = http.createServer(async (req, res) => {
             safeWrite(wiPath, items);
             workItemSynced = true;
           }
-        } catch {}
+        } catch (e) { console.error('work item sync:', e.message); }
       }
 
       return jsonReply(res, 200, { ok: true, item, workItemSynced });
@@ -1185,7 +1196,7 @@ const server = http.createServer(async (req, res) => {
             safeWrite(wiPath, filtered);
             cancelled = true;
           }
-        } catch {}
+        } catch (e) { console.error('work item cleanup:', e.message); }
       }
       // Also check central work-items
       const centralPath = path.join(MINIONS_DIR, 'work-items.json');
@@ -1194,7 +1205,7 @@ const server = http.createServer(async (req, res) => {
         const before = items.length;
         const filtered = items.filter(w => !(w.sourcePlan === body.source && w.id === body.itemId));
         if (filtered.length < before) { safeWrite(centralPath, filtered); cancelled = true; }
-      } catch {}
+      } catch (e) { console.error('central work item cleanup:', e.message); }
 
       // Clean dispatch entries for this item
       cleanDispatchEntries(d =>
@@ -1224,16 +1235,16 @@ const server = http.createServer(async (req, res) => {
           const status = JSON.parse(safeRead(statusPath) || '{}');
           if (status.pid) {
             if (process.platform === 'win32') {
-              try { require('child_process').execSync('taskkill /PID ' + status.pid + ' /F /T', { stdio: 'pipe', timeout: 5000 }); } catch {}
+              try { require('child_process').execSync('taskkill /PID ' + status.pid + ' /F /T', { stdio: 'pipe', timeout: 5000 }); } catch { /* process may be dead */ }
             } else {
-              try { process.kill(status.pid, 'SIGTERM'); } catch {}
+              try { process.kill(status.pid, 'SIGTERM'); } catch { /* process may be dead */ }
             }
           }
           status.status = 'idle';
           delete status.currentTask;
           delete status.dispatched;
           safeWrite(statusPath, status);
-        } catch {}
+        } catch (e) { console.error('agent cancel:', e.message); }
 
         cancelled.push({ agent: d.agent, task: d.task });
       }
@@ -1270,7 +1281,6 @@ const server = http.createServer(async (req, res) => {
       'Content-Type': 'text/event-stream',
       'Cache-Control': 'no-cache',
       'Connection': 'keep-alive',
-      'Access-Control-Allow-Origin': '*',
     });
 
     // Send initial content
@@ -1281,7 +1291,7 @@ const server = http.createServer(async (req, res) => {
         res.write(`data: ${JSON.stringify(content)}\n\n`);
         offset = Buffer.byteLength(content, 'utf8');
       }
-    } catch {}
+    } catch { /* optional */ }
 
     // Watch for changes using fs.watchFile (cross-platform, works on Windows)
     const watcher = () => {
@@ -1296,7 +1306,7 @@ const server = http.createServer(async (req, res) => {
           const chunk = buf.toString('utf8');
           if (chunk) res.write(`data: ${JSON.stringify(chunk)}\n\n`);
         }
-      } catch {}
+      } catch { /* optional */ }
     };
 
     fs.watchFile(liveLogPath, { interval: 500 }, watcher);
@@ -1387,7 +1397,7 @@ const server = http.createServer(async (req, res) => {
     const cat = match[1];
     const file = decodeURIComponent(match[2]);
     // Prevent path traversal
-    if (file.includes('..') || file.includes('/') || file.includes('\\')) {
+    if (file.includes('..') || file.includes('\0') || file.includes('/') || file.includes('\\')) {
       return jsonReply(res, 400, { error: 'invalid file name' });
     }
     const content = safeRead(path.join(MINIONS_DIR, 'knowledge', cat, file));
@@ -1487,7 +1497,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
           const meta = `<!-- swept: ${new Date().toISOString()} | reason: ${reason} -->\n`;
           safeWrite(destPath, meta + content);
           safeUnlink(filePath);
-        } catch {}
+        } catch (e) { console.error('kb archive:', e.message); }
       }
 
       // Process removals (stale/empty) — archive, not delete
@@ -1524,7 +1534,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
           safeWrite(path.join(destDir, entry.file), updated);
           safeUnlink(srcPath);
           reclassified++;
-        } catch {}
+        } catch (e) { console.error('kb reclassify:', e.message); }
       }
 
       // Prune swept files older than 30 days
@@ -1535,9 +1545,9 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
           const fp = path.join(kbArchiveDir, f);
           try {
             if (Date.now() - fs.statSync(fp).mtimeMs > SWEPT_RETENTION_MS) { safeUnlink(fp); pruned++; }
-          } catch {}
+          } catch { /* cleanup */ }
         }
-      } catch {}
+      } catch { /* optional */ }
 
       const summary = `${merged} duplicates merged, ${removed} stale removed, ${reclassified} reclassified${pruned ? ', ' + pruned + ' old swept files pruned' : ''}`;
       safeWrite(path.join(ENGINE_DIR, 'kb-swept.json'), JSON.stringify({ timestamp: new Date().toISOString(), summary }));
@@ -1565,7 +1575,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
         const filePath = path.join(dir, f);
         const content = safeRead(filePath) || '';
         let updatedAt = '';
-        try { updatedAt = new Date(fs.statSync(filePath).mtimeMs).toISOString(); } catch {}
+        try { updatedAt = new Date(fs.statSync(filePath).mtimeMs).toISOString(); } catch { /* optional */ }
         const isJson = f.endsWith('.json');
         if (isJson) {
           try {
@@ -1587,7 +1597,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
               revisionFeedback: plan.revision_feedback || null,
               sourcePlan: plan.source_plan || null,
             });
-          } catch {}
+          } catch { /* JSON parse fallback */ }
         } else {
           const titleMatch = content.match(/^#\s+(?:Plan:\s*)?(.+)/m);
           const projectMatch = content.match(/\*\*Project:\*\*\s*(.+)/m);
@@ -1618,7 +1628,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
 
   async function handlePlansArchiveRead(req, res, match) {
     const file = decodeURIComponent(match[1]);
-    if (file.includes('..')) return jsonReply(res, 400, { error: 'invalid' });
+    if (file.includes('..') || file.includes('\0')) return jsonReply(res, 400, { error: 'invalid' });
     // Check prd/archive/ first for .json, then plans/archive/ for .md
     const archiveDir = file.endsWith('.json') ? path.join(PRD_DIR, 'archive') : path.join(PLANS_DIR, 'archive');
     let content = safeRead(path.join(archiveDir, file));
@@ -1634,7 +1644,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
 
   async function handlePlansRead(req, res, match) {
     const file = decodeURIComponent(match[1]);
-    if (file.includes('..') || file.includes('/') || file.includes('\\')) return jsonReply(res, 400, { error: 'invalid' });
+    if (file.includes('..') || file.includes('\0') || file.includes('/') || file.includes('\\')) return jsonReply(res, 400, { error: 'invalid' });
     let content = safeRead(resolvePlanPath(file));
     // Fallback: check all directories (prd/, plans/, guides/, archives)
     if (!content) content = safeRead(path.join(PRD_DIR, file));
@@ -1645,7 +1655,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
     if (!content) return jsonReply(res, 404, { error: 'not found' });
     // Find the actual file path for Last-Modified header + expose resolved relative path
     const planCandidates = [resolvePlanPath(file), path.join(PRD_DIR, file), path.join(PRD_DIR, 'guides', file), path.join(PLANS_DIR, file), path.join(PRD_DIR, 'archive', file), path.join(PLANS_DIR, 'archive', file)];
-    for (const p of planCandidates) { try { const st = fs.statSync(p); if (st) { res.setHeader('Last-Modified', st.mtime.toISOString()); res.setHeader('X-Resolved-Path', path.relative(MINIONS_DIR, p).replace(/\\/g, '/')); break; } } catch {} }
+    for (const p of planCandidates) { try { const st = fs.statSync(p); if (st) { res.setHeader('Last-Modified', st.mtime.toISOString()); res.setHeader('X-Resolved-Path', path.relative(MINIONS_DIR, p).replace(/\\/g, '/')); break; } } catch { /* optional */ } }
     const contentType = file.endsWith('.json') ? 'application/json' : 'text/plain';
     res.setHeader('Content-Type', contentType + '; charset=utf-8');
     res.setHeader('Cache-Control', 'no-cache');
@@ -1689,7 +1699,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
             }
           }
           if (changed) safeWrite(wiPath, items);
-        } catch {}
+        } catch (e) { console.error('resume work items:', e.message); }
       }
 
       // Clear dispatch completed entries for resumed items so they aren't dedup-blocked
@@ -1749,16 +1759,16 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
                   const agentStatus = JSON.parse(safeRead(statusPath) || '{}');
                   if (agentStatus.pid) {
                     if (process.platform === 'win32') {
-                      try { require('child_process').execSync('taskkill /PID ' + agentStatus.pid + ' /F /T', { stdio: 'pipe', timeout: 5000 }); } catch {}
+                      try { require('child_process').execSync('taskkill /PID ' + agentStatus.pid + ' /F /T', { stdio: 'pipe', timeout: 5000 }); } catch { /* process may be dead */ }
                     } else {
-                      try { process.kill(agentStatus.pid, 'SIGTERM'); } catch {}
+                      try { process.kill(agentStatus.pid, 'SIGTERM'); } catch { /* process may be dead */ }
                     }
                   }
                   agentStatus.status = 'idle';
                   delete agentStatus.currentTask;
                   delete agentStatus.dispatched;
                   safeWrite(statusPath, agentStatus);
-                } catch {}
+                } catch (e) { console.error('agent reset:', e.message); }
                 killedAgents.add(activeEntry.agent);
               }
             }
@@ -1775,7 +1785,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
             if (w.id) resetItemIds.add(w.id);
           }
           if (changed) safeWrite(wiPath, items);
-        } catch {}
+        } catch (e) { console.error('reset work items:', e.message); }
       }
 
       // Remove dispatch active entries for reset items or killed agents.
@@ -1801,7 +1811,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
     try {
       const body = await readBody(req);
       if (!body.file) return jsonReply(res, 400, { error: 'file is required' });
-      if (body.file.includes('..')) return jsonReply(res, 400, { error: 'invalid file path' });
+      if (body.file.includes('..') || body.file.includes('\0')) return jsonReply(res, 400, { error: 'invalid file path' });
 
       const prdPath = path.join(PRD_DIR, body.file);
       const plan = safeJson(prdPath);
@@ -1832,7 +1842,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
       }
 
       // Delete old PRD — agent will write replacement at same path
-      try { fs.unlinkSync(prdPath); } catch {}
+      try { fs.unlinkSync(prdPath); } catch { /* cleanup */ }
 
       // Queue plan-to-prd regeneration with instructions to preserve completed items
       const wiPath = path.join(MINIONS_DIR, 'work-items.json');
@@ -1865,6 +1875,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
   }
 
   async function handlePlansExecute(req, res) {
+    if (checkRateLimit('plans-execute', 5)) return jsonReply(res, 429, { error: 'Rate limited — max 5 requests/minute' });
     try {
       const body = await readBody(req);
       if (!body.file) return jsonReply(res, 400, { error: 'file required' });
@@ -1952,7 +1963,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
           if (filtered.length < items.length) {
             safeWrite(wiInfo.path, filtered);
           }
-        } catch {}
+        } catch (e) { console.error('work item sync:', e.message); }
       }
 
       // Count plan items that have no work item yet (will auto-materialize)
@@ -1975,7 +1986,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
     try {
       const body = await readBody(req);
       if (!body.file) return jsonReply(res, 400, { error: 'file required' });
-      if (body.file.includes('..') || body.file.includes('/') || body.file.includes('\\')) {
+      if (body.file.includes('..') || body.file.includes('\0') || body.file.includes('/') || body.file.includes('\\')) {
         return jsonReply(res, 400, { error: 'invalid filename' });
       }
       const planPath = resolvePlanPath(body.file);
@@ -2001,7 +2012,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
             cleaned += items.length - filtered.length;
             safeWrite(wiPath, filtered);
           }
-        } catch {}
+        } catch (e) { console.error('plan cleanup:', e.message); }
       }
 
       // Clean up dispatch entries for this plan's items
@@ -2025,7 +2036,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
             }
           }
           if (changed) safeWrite(centralPath, centralItems);
-        } catch {}
+        } catch (e) { console.error('plan-to-prd cleanup:', e.message); }
       }
 
       invalidateStatusCache();
@@ -2166,7 +2177,7 @@ If nothing to do, return: { "duplicates": [], "reclassify": [], "remove": [] }`;
             }
           }
           if (filtered.length < items.length) safeWrite(wiInfo.path, filtered);
-        } catch {}
+        } catch (e) { console.error('work item deletion:', e.message); }
       }
       for (const itemId of deletedItemIds) {
         cleanDispatchEntries(d =>
@@ -2345,6 +2356,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       const body = await readBody(req);
       const { name } = body;
       if (!name) return jsonReply(res, 400, { error: 'name required' });
+      if (name.includes('..') || name.includes('\0')) return jsonReply(res, 400, { error: 'Invalid file name' });
 
       const inboxPath = path.join(MINIONS_DIR, 'notes', 'inbox', name);
       const content = safeRead(inboxPath);
@@ -2373,7 +2385,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       // Move to archive
       const archiveDir = path.join(MINIONS_DIR, 'notes', 'archive');
       if (!fs.existsSync(archiveDir)) fs.mkdirSync(archiveDir, { recursive: true });
-      try { const _c = safeRead(inboxPath); safeWrite(path.join(archiveDir, `persisted-${name}`), _c); safeUnlink(inboxPath); } catch {}
+      try { const _c = safeRead(inboxPath); safeWrite(path.join(archiveDir, `persisted-${name}`), _c); safeUnlink(inboxPath); } catch (e) { console.error('inbox archive:', e.message); }
 
       return jsonReply(res, 200, { ok: true, title });
     } catch (e) { return jsonReply(res, 400, { error: e.message }); }
@@ -2384,6 +2396,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       const body = await readBody(req);
       const { name, category } = body;
       if (!name) return jsonReply(res, 400, { error: 'name required' });
+      if (name.includes('..') || name.includes('\0')) return jsonReply(res, 400, { error: 'Invalid file name' });
       if (!category || !shared.KB_CATEGORIES.includes(category)) {
         return jsonReply(res, 400, { error: 'category required: ' + shared.KB_CATEGORIES.join(', ') });
       }
@@ -2410,7 +2423,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       // Move inbox item to archive
       const archiveDir = path.join(MINIONS_DIR, 'notes', 'archive');
       if (!fs.existsSync(archiveDir)) fs.mkdirSync(archiveDir, { recursive: true });
-      try { const _c = safeRead(inboxPath); safeWrite(path.join(archiveDir, `kb-${category}-${name}`), _c); safeUnlink(inboxPath); } catch {}
+      try { const _c = safeRead(inboxPath); safeWrite(path.join(archiveDir, `kb-${category}-${name}`), _c); safeUnlink(inboxPath); } catch (e) { console.error('inbox archive:', e.message); }
 
       return jsonReply(res, 200, { ok: true, category, file: name });
     } catch (e) { return jsonReply(res, 400, { error: e.message }); }
@@ -2420,7 +2433,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     try {
       const body = await readBody(req);
       const { name } = body;
-      if (!name || name.includes('..') || name.includes('/') || name.includes('\\')) {
+      if (!name || name.includes('..') || name.includes('\0') || name.includes('/') || name.includes('\\')) {
         return jsonReply(res, 400, { error: 'invalid name' });
       }
       const filePath = path.join(MINIONS_DIR, 'notes', 'inbox', name);
@@ -2446,7 +2459,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     try {
       const body = await readBody(req);
       const { name } = body;
-      if (!name || name.includes('..') || name.includes('/') || name.includes('\\')) {
+      if (!name || name.includes('..') || name.includes('\0') || name.includes('/') || name.includes('\\')) {
         return jsonReply(res, 400, { error: 'invalid name' });
       }
       const filePath = path.join(MINIONS_DIR, 'notes', 'inbox', name);
@@ -2460,7 +2473,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     const params = new URL(req.url, 'http://localhost').searchParams;
     const file = params.get('file');
     const dir = params.get('dir');
-    if (!file || file.includes('..')) { res.statusCode = 400; res.end('Invalid file'); return; }
+    if (!file || file.includes('..') || file.includes('\0')) { res.statusCode = 400; res.end('Invalid file'); return; }
 
     let content = '';
     if (dir) {
@@ -2513,7 +2526,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
         fs.writeFileSync(psPath, psScript);
         try {
           selectedPath = execSync(`powershell -STA -NoProfile -ExecutionPolicy Bypass -File "${psPath}"`, { encoding: 'utf8', timeout: 120000 }).trim();
-        } finally { try { fs.unlinkSync(psPath); } catch {} }
+        } finally { try { fs.unlinkSync(psPath); } catch { /* cleanup */ } }
       } else if (process.platform === 'darwin') {
         selectedPath = execSync(`osascript -e 'POSIX path of (choose folder with prompt "Select project folder")'`, { encoding: 'utf8', timeout: 120000 }).trim();
       } else {
@@ -2559,14 +2572,14 @@ What would you like to discuss or change? When you're happy, say "approve" and I
                     remoteUrl.match(/https:\/\/dev\.azure\.com\/([^/]+)\/([^/]+)\/_git\/([^/\s]+)/);
           if (m) { detected.org = m[1]; detected.project = m[2]; detected.repoName = m[3]; }
         }
-      } catch {}
+      } catch (e) { console.error('git remote detection:', e.message); }
       try {
         const pkgPath = path.join(target, 'package.json');
         if (fs.existsSync(pkgPath)) {
           const pkg = safeJson(pkgPath);
           if (pkg.name) detected.name = pkg.name.replace(/^@[^/]+\//, '');
         }
-      } catch {}
+      } catch { /* optional */ }
       let description = '';
       try {
         const claudeMd = path.join(target, 'CLAUDE.md');
@@ -2574,7 +2587,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           const lines = (safeRead(claudeMd) || '').split('\n').filter(l => l.trim() && !l.startsWith('#'));
           if (lines[0] && lines[0].length < 200) description = lines[0].trim();
         }
-      } catch {}
+      } catch { /* optional */ }
 
       const name = body.name || detected.name;
       const prUrlBase = detected.repoHost === 'github'
@@ -2616,6 +2629,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
   }
 
   async function handleCommandCenter(req, res) {
+    if (checkRateLimit('command-center', 10)) return jsonReply(res, 429, { error: 'Rate limited — max 10 requests/minute' });
     try {
       const body = await readBody(req);
       if (!body.message) return jsonReply(res, 400, { error: 'message required' });
@@ -3028,7 +3042,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
 
       // Also append to live-output.log so it shows in the chat view
       const liveLogPath = path.join(agentDir, 'live-output.log');
-      try { fs.appendFileSync(liveLogPath, '\n[human-steering] ' + message + '\n'); } catch {}
+      try { fs.appendFileSync(liveLogPath, '\n[human-steering] ' + message + '\n'); } catch { /* optional */ }
 
       return jsonReply(res, 200, { ok: true, message: 'Steering message sent' });
     }},
@@ -3103,19 +3117,34 @@ What would you like to discuss or change? When you're happy, say "approve" and I
   // ── Route Dispatcher ────────────────────────────────────────────────────────
 
   const pathname = req.url.split('?')[0];
+  const _reqStart = Date.now();
   for (const route of ROUTES) {
     if (route.method !== req.method) continue;
     if (typeof route.path === 'string') {
       // For /api/skill, match with query string prefix since it has no fixed path variant
       if (route.path === '/api/skill') {
         if (!req.url.startsWith('/api/skill?') && req.url !== '/api/skill') continue;
-        return await route.handler(req, res, {});
+        const _result = await route.handler(req, res, {});
+        if (pathname.startsWith('/api/') && !pathname.includes('/status') && !pathname.includes('/hot-reload') && !pathname.includes('/status-stream')) {
+          console.log(`  ${req.method} ${pathname} ${Date.now() - _reqStart}ms`);
+        }
+        return _result;
       }
       if (pathname !== route.path) continue;
-      return await route.handler(req, res, {});
+      const _result = await route.handler(req, res, {});
+      if (pathname.startsWith('/api/') && !pathname.includes('/status') && !pathname.includes('/hot-reload') && !pathname.includes('/status-stream')) {
+        console.log(`  ${req.method} ${pathname} ${Date.now() - _reqStart}ms`);
+      }
+      return _result;
     }
     const m = pathname.match(route.path);
-    if (m) return await route.handler(req, res, m);
+    if (m) {
+      const _result = await route.handler(req, res, m);
+      if (pathname.startsWith('/api/') && !pathname.includes('/status') && !pathname.includes('/hot-reload') && !pathname.includes('/status-stream')) {
+        console.log(`  ${req.method} ${pathname} ${Date.now() - _reqStart}ms`);
+      }
+      return _result;
+    }
   }
 
   // Serve dashboard HTML with gzip + caching

package/engine/ado.js

@@ -91,7 +91,7 @@ async function forEachActivePr(config, token, callback) {
         const updated = await callback(project, pr, prNum, orgBase);
         if (updated) projectUpdated++;
       } catch (err) {
-        try { engine().log('warn', `Failed to poll status for ${pr.id}: ${err.message}`); } catch {}
+        try { engine().log('warn', `Failed to poll status for ${pr.id}: ${err.message}`); } catch { /* engine not available */ }
       }
     }
 
@@ -160,7 +160,7 @@ async function pollPrStatus(config) {
             if (newReviewStatus === 'approved') metrics[authorId].prsApproved = (metrics[authorId].prsApproved || 0) + 1;
             else metrics[authorId].prsRejected = (metrics[authorId].prsRejected || 0) + 1;
             shared.safeWrite(metricsPath, metrics);
-          } catch {}
+          } catch (err) { try { engine().log('warn', `Metrics update: ${err.message}`); } catch { /* engine not available */ } }
         }
       }
     }