@yemi33/minions 0.1.614 → 0.1.616

package/CHANGELOG.md

@@ -1,11 +1,17 @@
 # Changelog
 
-## 0.1.614 (2026-04-08)
+## 0.1.616 (2026-04-08)
+
+### Fixes
+-  audit fixes for _killProcessInWorktree
+
+## 0.1.615 (2026-04-08)
 
 ### Features
 -  clickable pinned notes and skills with full content + doc-chat
 
 ### Fixes
+-  only kill orphaned processes before worktree removal, not active ones
 -  kill process holding worktree lock before removal attempt
 -  dedup worktree removal attempts, add Windows rd fallback
 -  accurate LLM call timing and agent metrics on engine page

package/engine/cleanup.js

@@ -40,39 +40,52 @@ function worktreeDirMatchesBranch(dirLower, branch) {
 }
 
 /**
- * Kill any tracked or PID-filed process whose dispatch ID appears in the worktree dir name.
- * Must run BEFORE removeWorktree so file handles are released on Windows.
+ * Kill orphaned processes whose dispatch ID appears in the worktree dir name.
+ * Only kills processes NOT in the active dispatch queue — never kills live agents.
  */
-function _killProcessInWorktree(dir, activeProcesses) {
+function _killProcessInWorktree(dir, activeProcesses, activeDispatchIds) {
   const dirLower = dir.toLowerCase();
-  // Check tracked active processes
+  const activeIds = activeDispatchIds;
+
+  // Check tracked in-memory processes — only kill if dispatch is no longer active
   for (const [id, info] of activeProcesses.entries()) {
-    if (dirLower.includes(id.toLowerCase().slice(-8))) {
-      try { shared.killImmediate(info.proc); } catch {}
-      activeProcesses.delete(id);
-    }
+    if (!dirLower.includes(id.toLowerCase().slice(-8))) continue;
+    if (activeIds.has(id)) continue; // still active — do not kill
+    try { shared.killImmediate(info.proc); } catch {}
+    activeProcesses.delete(id);
+    log('info', `Killed orphaned process for dispatch ${id} before worktree removal`);
   }
-  // Check PID files in engine/tmp/ — format: pid-{label}-{id}.pid
+
+  // Check PID files in engine/tmp/ — only kill if no active dispatch matches
   try {
     const tmpDir = path.join(ENGINE_DIR, 'tmp');
     for (const f of fs.readdirSync(tmpDir)) {
       if (!f.startsWith('pid-') || !f.endsWith('.pid')) continue;
-      // Extract dispatch ID suffix from filename
-      const parts = f.replace(/^pid-/, '').replace(/\.pid$/, '').split('-');
-      const suffix = parts.slice(-1)[0];
-      if (suffix && dirLower.includes(suffix)) {
-        const pid = parseInt(fs.readFileSync(path.join(tmpDir, f), 'utf8').trim(), 10);
-        if (pid > 0) {
-          try {
-            if (process.platform === 'win32') {
-              exec(`taskkill /F /PID ${pid}`, { stdio: 'pipe', timeout: 5000, windowsHide: true });
-            } else {
-              process.kill(pid, 'SIGKILL');
-            }
-          } catch {} // process may already be dead
-        }
-        try { fs.unlinkSync(path.join(tmpDir, f)); } catch {}
+      const pidFileName = f.replace(/^pid-/, '').replace(/\.pid$/, '');
+      if (!dirLower.includes(pidFileName.slice(-8))) continue;
+      // Verify this PID file's dispatch is not active
+      const isActive = [...activeIds].some(id => pidFileName.includes(id.slice(-8)));
+      if (isActive) continue; // still active — do not kill
+      const pid = parseInt(fs.readFileSync(path.join(tmpDir, f), 'utf8').trim(), 10);
+      if (pid > 0) {
+        // Verify the process is actually a node/claude process before killing
+        try {
+          if (process.platform === 'win32') {
+            const taskInfo = exec(`tasklist /FI "PID eq ${pid}" /NH`, { encoding: 'utf8', timeout: 3000, windowsHide: true });
+            if (!taskInfo.toLowerCase().includes('node')) continue; // not a node process — skip
+            exec(`taskkill /F /PID ${pid}`, { stdio: 'pipe', timeout: 5000, windowsHide: true });
+          } else {
+            // Verify it's a node process before killing (prevent recycled PID kill)
+            try {
+              const psOut = exec(`ps -p ${pid} -o comm=`, { encoding: 'utf8', timeout: 3000 }).trim();
+              if (!psOut.includes('node') && !psOut.includes('claude')) continue;
+            } catch { continue; } // process dead or ps failed
+            process.kill(pid, 'SIGKILL');
+          }
+          log('info', `Killed orphaned PID ${pid} (${f}) before worktree removal`);
+        } catch {} // process may already be dead
       }
+      try { fs.unlinkSync(path.join(tmpDir, f)); } catch {}
     }
   } catch {} // tmp dir may not exist
 }
@@ -191,6 +204,7 @@ function runCleanup(config, verbose = false) {
 
       const wtEntries = []; // { dir, wtPath, mtime, shouldClean, isProtected }
       const dispatch = getDispatch();
+      const activeDispatchIds = new Set((dispatch.active || []).map(d => d.id));
 
       for (const { dir, wtPath } of allDirs) {
 
@@ -303,7 +317,7 @@ function runCleanup(config, verbose = false) {
           if (_attemptedWorktreePaths.has(entry.wtPath)) continue;
           _attemptedWorktreePaths.add(entry.wtPath);
           // Kill any process still running in this worktree before removal
-          _killProcessInWorktree(entry.dir, activeProcesses);
+          _killProcessInWorktree(entry.dir, activeProcesses, activeDispatchIds);
           if (shared.removeWorktree(entry.wtPath, root, worktreeRoot)) {
             cleaned.worktrees++;
             if (verbose) console.log(`  Removed worktree: ${entry.wtPath}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.614",
+  "version": "0.1.616",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"