@yemi33/minions 0.1.615 → 0.1.617

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.1.617 (2026-04-08)
+
+### Fixes
+-  audit fixes for _killProcessInWorktree
+
+### Other
+- simplify: remove redundant alias, avoid Set spread in hot loop
+
 ## 0.1.615 (2026-04-08)
 
 ### Features

package/engine/cleanup.js

@@ -43,10 +43,8 @@ function worktreeDirMatchesBranch(dirLower, branch) {
  * Kill orphaned processes whose dispatch ID appears in the worktree dir name.
  * Only kills processes NOT in the active dispatch queue — never kills live agents.
  */
-function _killProcessInWorktree(dir, activeProcesses) {
+function _killProcessInWorktree(dir, activeProcesses, activeIds) {
   const dirLower = dir.toLowerCase();
-  const dispatch = getDispatch();
-  const activeIds = new Set((dispatch.active || []).map(d => d.id));
 
   // Check tracked in-memory processes — only kill if dispatch is no longer active
   for (const [id, info] of activeProcesses.entries()) {
@@ -65,7 +63,8 @@ function _killProcessInWorktree(dir, activeProcesses) {
       const pidFileName = f.replace(/^pid-/, '').replace(/\.pid$/, '');
       if (!dirLower.includes(pidFileName.slice(-8))) continue;
       // Verify this PID file's dispatch is not active
-      const isActive = [...activeIds].some(id => pidFileName.includes(id.slice(-8)));
+      let isActive = false;
+      for (const id of activeIds) { if (pidFileName.includes(id.slice(-8))) { isActive = true; break; } }
       if (isActive) continue; // still active — do not kill
       const pid = parseInt(fs.readFileSync(path.join(tmpDir, f), 'utf8').trim(), 10);
       if (pid > 0) {
@@ -76,6 +75,11 @@ function _killProcessInWorktree(dir, activeProcesses) {
             if (!taskInfo.toLowerCase().includes('node')) continue; // not a node process — skip
             exec(`taskkill /F /PID ${pid}`, { stdio: 'pipe', timeout: 5000, windowsHide: true });
           } else {
+            // Verify it's a node process before killing (prevent recycled PID kill)
+            try {
+              const psOut = exec(`ps -p ${pid} -o comm=`, { encoding: 'utf8', timeout: 3000 }).trim();
+              if (!psOut.includes('node') && !psOut.includes('claude')) continue;
+            } catch { continue; } // process dead or ps failed
             process.kill(pid, 'SIGKILL');
           }
           log('info', `Killed orphaned PID ${pid} (${f}) before worktree removal`);
@@ -200,6 +204,7 @@ function runCleanup(config, verbose = false) {
 
       const wtEntries = []; // { dir, wtPath, mtime, shouldClean, isProtected }
       const dispatch = getDispatch();
+      const activeDispatchIds = new Set((dispatch.active || []).map(d => d.id));
 
       for (const { dir, wtPath } of allDirs) {
 
@@ -312,7 +317,7 @@ function runCleanup(config, verbose = false) {
           if (_attemptedWorktreePaths.has(entry.wtPath)) continue;
           _attemptedWorktreePaths.add(entry.wtPath);
           // Kill any process still running in this worktree before removal
-          _killProcessInWorktree(entry.dir, activeProcesses);
+          _killProcessInWorktree(entry.dir, activeProcesses, activeDispatchIds);
           if (shared.removeWorktree(entry.wtPath, root, worktreeRoot)) {
             cleaned.worktrees++;
             if (verbose) console.log(`  Removed worktree: ${entry.wtPath}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.615",
+  "version": "0.1.617",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"