@yemi33/minions 0.1.98 → 0.1.99

package/CHANGELOG.md

@@ -1,10 +1,16 @@
 # Changelog
 
-## 0.1.98 (2026-04-01)
+## 0.1.99 (2026-04-01)
 
 ### Engine
 - engine/ado.js
 - engine/github.js
+- engine/lifecycle.js
+- engine/preflight.js
+- engine/shared.js
+
+### Other
+- test/unit.test.js
 
 ## 0.1.97 (2026-04-01)
 

package/engine/lifecycle.js

@@ -393,7 +393,12 @@ function chainPlanToPrd(dispatchItem, meta, config) {
   log('info', `Plan chaining: queuing plan-to-prd for next tick (chained from ${dispatchItem.id})`);
   const wiPath = path.join(MINIONS_DIR, 'work-items.json');
   let items = [];
-  try { items = JSON.parse(fs.readFileSync(wiPath, 'utf8')); } catch {}
+  try {
+    items = JSON.parse(fs.readFileSync(wiPath, 'utf8'));
+  } catch (err) {
+    log('warn', `Plan chaining: failed to parse ${wiPath}, falling back to empty list: ${err.message}`);
+    try { fs.copyFileSync(wiPath, wiPath + '.bak'); } catch (_) { /* backup best-effort */ }
+  }
   items.push({
     id: 'W-' + shared.uid(),
     title: `Convert plan to PRD: ${meta?.item?.title || planFile.name}`,
@@ -580,7 +585,7 @@ function syncPrsFromOutput(output, agentId, meta, config) {
       dirtyTargets.set(targetName, { prs: safeJson(prPath) || [], prPath });
     }
     const entry = dirtyTargets.get(targetName);
-    if (entry.prs.some(p => p.id === fullId || String(p.id).includes(prId))) continue;
+    if (entry.prs.some(p => p.id === fullId || String(p.id) === String(prId))) continue;
 
     let title = meta?.item?.title || '';
     const titleMatch = output.match(new RegExp(`${prId}[^\\n]*?[—–-]\\s*([^\\n]+)`, 'i'));
@@ -651,7 +656,7 @@ function updatePrAfterReview(agentId, pr, project) {
   }
 
   shared.safeWrite(project ? shared.projectPrPath(project) : path.join(path.resolve(MINIONS_DIR, '..'), '.minions', 'pull-requests.json'), prs);
-  log('info', `Updated ${pr.id} → minions review: ${minionsVerdict} by ${reviewerName}`);
+  log('info', `Updated ${pr.id} → minions review: ${target.reviewStatus} by ${reviewerName}`);
   createReviewFeedbackForAuthor(agentId, { ...pr, ...target }, config);
 }
 

package/engine/preflight.js

@@ -25,10 +25,11 @@ function findClaudeBinary() {
   // Fallback: parse the shell wrapper
   try {
     const which = execSync('bash -c "which claude"', { encoding: 'utf8', windowsHide: true, timeout: 5000 }).trim();
-    const wrapper = execSync(`bash -c "cat '${which}'"`, { encoding: 'utf8', windowsHide: true, timeout: 5000 });
+    const whichNative = which.replace(/^\/c\//, 'C:/').replace(/\//g, path.sep);
+    const wrapper = fs.readFileSync(whichNative, 'utf8');
     const m = wrapper.match(/node_modules\/@anthropic-ai\/claude-code\/cli\.js/);
     if (m) {
-      const basedir = path.dirname(which.replace(/^\/c\//, 'C:/').replace(/\//g, path.sep));
+      const basedir = path.dirname(whichNative);
       const resolved = path.join(basedir, 'node_modules', '@anthropic-ai', 'claude-code', 'cli.js');
       if (fs.existsSync(resolved)) return resolved;
     }

package/engine/shared.js

@@ -43,11 +43,13 @@ function safeJson(p) {
   try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch { return null; }
 }
 
+let _tmpCounter = 0;
+
 function safeWrite(p, data) {
   const dir = path.dirname(p);
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
   const content = typeof data === 'string' ? data : JSON.stringify(data, null, 2);
-  const tmp = p + '.tmp.' + process.pid;
+  const tmp = p + '.tmp.' + process.pid + '.' + (++_tmpCounter);
   try {
     fs.writeFileSync(tmp, content);
     // Atomic rename — retry on Windows EPERM (file locking)
@@ -58,7 +60,7 @@ function safeWrite(p, data) {
       } catch (e) {
         if (e.code === 'EPERM' && attempt < 4) {
           const delay = 50 * (attempt + 1); // 50, 100, 150, 200ms
-          try { const ab = new SharedArrayBuffer(4); Atomics.wait(new Int32Array(ab), 0, 0, delay); } catch { /* fallback busy-wait */ const start = Date.now(); while (Date.now() - start < delay) {} }
+          sleepMs(delay);
           continue;
         }
         // Final attempt failed — throw to let caller retry
@@ -85,11 +87,13 @@ function sleepMs(ms) {
     const ab = new SharedArrayBuffer(4);
     Atomics.wait(new Int32Array(ab), 0, 0, ms);
   } catch {
-    const start = Date.now();
-    while (Date.now() - start < ms) {}
+    // Fallback: synchronous sleep via child process — avoids busy-wait blocking the event loop
+    _spawnSync(process.execPath, ['-e', `setTimeout(()=>{},${Math.max(0, Math.floor(ms))})`], { windowsHide: true });
   }
 }
 
+const LOCK_STALE_MS = 60000; // 60 seconds — force-remove locks older than this
+
 function withFileLock(lockPath, fn, {
   timeoutMs = 5000,
   retryDelayMs = 25
@@ -104,6 +108,14 @@ function withFileLock(lockPath, fn, {
       break;
     } catch (err) {
       if (err.code !== 'EEXIST') throw err;
+      // Check for stale lock — if lock file is older than LOCK_STALE_MS, force-remove it
+      try {
+        const stat = fs.statSync(lockPath);
+        if (Date.now() - stat.mtimeMs > LOCK_STALE_MS) {
+          try { fs.unlinkSync(lockPath); } catch { /* race: another process removed it */ }
+          continue; // retry immediately after removing stale lock
+        }
+      } catch { /* lock file disappeared between EEXIST and stat — retry will succeed */ }
       sleepMs(retryDelayMs);
     }
   }
@@ -372,6 +384,23 @@ function getAdoOrgBase(project) {
     : `https://dev.azure.com/${project.adoOrg}`;
 }
 
+// ── Path Sanitization ───────────────────────────────────────────────────────
+
+/**
+ * Resolve a user-supplied path relative to a base directory and verify the
+ * result stays within the base. Throws if the resolved path escapes baseDir.
+ * Use to prevent path-traversal attacks on any user-facing file endpoint.
+ */
+function sanitizePath(baseDir, userInput) {
+  const resolvedBase = path.resolve(baseDir);
+  const resolvedFull = path.resolve(resolvedBase, userInput);
+  // Append path.sep so "/foo" doesn't match "/foobar"
+  if (!resolvedFull.startsWith(resolvedBase + path.sep) && resolvedFull !== resolvedBase) {
+    throw new Error(`Path traversal blocked: ${userInput} resolves outside ${baseDir}`);
+  }
+  return resolvedFull;
+}
+
 // ── Branch Sanitization ──────────────────────────────────────────────────────
 
 function sanitizeBranch(name) {
@@ -452,7 +481,10 @@ module.exports = {
   addPrLink,
   nextWorkItemId,
   getAdoOrgBase,
+  sanitizePath,
   sanitizeBranch,
   parseSkillFrontmatter,
+  sleepMs,
+  LOCK_STALE_MS,
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.98",
+  "version": "0.1.99",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"