@link-assistant/hive-mind 2.0.19 → 2.0.21

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @link-assistant/hive-mind
 
+## 2.0.21
+
+### Patch Changes
+
+- da88ee5: Add session-aware Docker-isolation container cleanup to hive-cleanup.
+
+## 2.0.20
+
+### Patch Changes
+
+- 078f346: Reap successful Docker-isolated task containers at session completion, keep failed containers with cleanup instructions by default, and update Docker images to start-command 0.30.1.
+
 ## 2.0.19
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "2.0.19",
+  "version": "2.0.21",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",

package/src/cleanup.lib.mjs

@@ -17,6 +17,7 @@
  * @see https://github.com/link-assistant/hive-mind/issues/1848
  */
 
+import { classifyExitStatus, isExecutingSessionStatus, isFailureSessionStatus, isTerminalSessionStatus, normalizeExitCode } from './session-status.lib.mjs';
 import { isValidIssueBranchName, parseIssueBranchName } from './solve.branch.lib.mjs';
 
 /**
@@ -161,6 +162,8 @@ export function buildActiveMatchers(activeTasks) {
       sessionId: task.sessionId || null,
       sessionName: task.sessionName || null,
       status: task.status || null,
+      exitCode: task.exitCode ?? null,
+      isolation: task.isolation || null,
       workspace: task.workspace || null,
     });
   }
@@ -431,3 +434,227 @@ export function formatEntryContext(item) {
 
   return details.length > 0 ? ` (${details.join('; ')})` : '';
 }
+
+export const DEFAULT_DOCKER_ISOLATION_CLEANUP_MODE = 'succeeded';
+export const DOCKER_ISOLATION_CLEANUP_MODES = new Set(['succeeded', 'all', 'none']);
+
+const DOCKER_ISOLATION_SESSION_NAME_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+function normalizeText(value) {
+  return String(value || '')
+    .trim()
+    .toLowerCase();
+}
+
+/**
+ * Normalize the docker-isolation cleanup policy.
+ *
+ * Modes:
+ *   - succeeded: default; remove successful exited containers, keep failures
+ *   - all: remove all terminal/exited task containers
+ *   - none: report only
+ *
+ * @param {string|null|undefined} value
+ * @returns {'succeeded'|'all'|'none'}
+ */
+export function normalizeDockerIsolationCleanupMode(value) {
+  const mode = normalizeText(value);
+  if (!mode || ['default', 'true', '1', 'yes', 'on', 'succeeded', 'success', 'successful', 'failed-kept', 'keep-failed', 'on-failure'].includes(mode)) {
+    return DEFAULT_DOCKER_ISOLATION_CLEANUP_MODE;
+  }
+  if (['false', '0', 'no', 'off', 'none', 'disabled'].includes(mode)) return 'none';
+  if (['all', 'everything', 'finished', 'terminal'].includes(mode)) return 'all';
+  throw new Error(`Invalid docker isolation cleanup mode: ${value}. Expected one of: succeeded, all, none`);
+}
+
+/**
+ * True when a Docker container name looks like a start-command session UUID.
+ *
+ * @param {string} name
+ * @returns {boolean}
+ */
+export function isDockerIsolationSessionName(name) {
+  return DOCKER_ISOLATION_SESSION_NAME_RE.test(String(name || '').trim());
+}
+
+/**
+ * Parse Docker's status text, e.g. "Exited (137) 10 minutes ago".
+ *
+ * @param {string} status
+ * @returns {number|null}
+ */
+export function parseDockerContainerExitCode(status) {
+  const match = String(status || '').match(/\bExited\s+\((-?\d+)\)/i);
+  return match ? normalizeExitCode(match[1]) : null;
+}
+
+function createSessionLookup(sessionTasks) {
+  const lookup = new Map();
+  const merge = (key, task) => {
+    if (!key) return;
+    const existing = lookup.get(key) || {};
+    lookup.set(key, {
+      ...existing,
+      ...task,
+      status: task.status || existing.status || null,
+      exitCode: task.exitCode ?? existing.exitCode ?? null,
+      isolation: task.isolation || existing.isolation || null,
+      sessionId: task.sessionId || existing.sessionId || null,
+      sessionName: task.sessionName || existing.sessionName || null,
+      workspace: task.workspace || existing.workspace || null,
+    });
+  };
+
+  for (const task of sessionTasks || []) {
+    if (!task) continue;
+    merge(task.sessionId, task);
+    merge(task.sessionName, task);
+  }
+  return lookup;
+}
+
+function normalizeDockerContainer(container) {
+  const name = String(container?.name || container?.Names || container?.Name || '')
+    .replace(/^\//, '')
+    .trim();
+  const state = normalizeText(container?.state || container?.State);
+  const statusText = String(container?.status ?? container?.Status ?? '').trim();
+  const exitCode = normalizeExitCode(container?.exitCode ?? container?.ExitCode ?? parseDockerContainerExitCode(statusText));
+  const running = container?.running === true || state === 'running' || /^Up\b/i.test(statusText);
+  return {
+    ...container,
+    id: container?.id || container?.ID || null,
+    image: container?.image || container?.Image || null,
+    name,
+    state,
+    status: statusText,
+    exitCode,
+    running,
+  };
+}
+
+function inferDockerContainerOutcome(container, session) {
+  const sessionStatus = normalizeText(session?.status);
+  const exitCode = normalizeExitCode(container.exitCode ?? session?.exitCode);
+  const running = container.running || isExecutingSessionStatus(sessionStatus);
+  const containerTerminal = ['exited', 'dead', 'removing'].includes(container.state) || /^Exited\b/i.test(container.status) || exitCode !== null;
+  const sessionTerminal = isTerminalSessionStatus(sessionStatus);
+  const terminal = !running && (sessionTerminal || containerTerminal);
+  const exitStatus = classifyExitStatus(exitCode);
+  const failed = terminal && (isFailureSessionStatus(sessionStatus) || isFailureSessionStatus(exitStatus) || (exitCode !== null && exitCode !== 0));
+  const successful = terminal && !failed && exitCode === 0;
+  const unknown = terminal && !successful && !failed;
+
+  return {
+    running,
+    terminal,
+    exitCode,
+    successful,
+    failed,
+    unknown,
+  };
+}
+
+function dockerCleanupRecord(container, session, outcome, reason) {
+  return {
+    ...container,
+    ...outcome,
+    session: session || null,
+    reason,
+    command: `docker rm -f ${container.name}`,
+  };
+}
+
+/**
+ * Plan selective cleanup for Docker-isolation task containers.
+ *
+ * The input containers are expected to be Docker ps records already filtered to
+ * session UUID names, but the planner filters defensively too. Running
+ * containers are never removed, regardless of mode.
+ *
+ * @param {Object} options
+ * @param {Array} options.containers
+ * @param {Array} [options.sessionTasks]
+ * @param {string} [options.mode]
+ * @returns {{keep: Array, remove: Array, mode: string}}
+ */
+export function planDockerIsolationCleanup(options = {}) {
+  const mode = normalizeDockerIsolationCleanupMode(options.mode);
+  const sessions = createSessionLookup(options.sessionTasks || []);
+  const keep = [];
+  const remove = [];
+
+  for (const rawContainer of options.containers || []) {
+    const container = normalizeDockerContainer(rawContainer);
+    if (!isDockerIsolationSessionName(container.name)) continue;
+
+    const session = sessions.get(container.name) || null;
+    const outcome = inferDockerContainerOutcome(container, session);
+    let reason;
+    let action = 'keep';
+
+    if (mode === 'none') {
+      reason = 'disabled';
+    } else if (outcome.running) {
+      reason = 'active-container';
+    } else if (!outcome.terminal) {
+      reason = 'unknown-container-state';
+    } else if (mode === 'all') {
+      reason = 'finished-container';
+      action = 'remove';
+    } else if (outcome.successful) {
+      reason = 'successful-container';
+      action = 'remove';
+    } else if (outcome.failed) {
+      reason = 'failed-container-kept';
+    } else {
+      reason = 'unknown-outcome-kept';
+    }
+
+    const record = dockerCleanupRecord(container, session, outcome, reason);
+    if (action === 'remove') remove.push(record);
+    else keep.push(record);
+  }
+
+  return { keep, remove, mode };
+}
+
+/**
+ * Human-readable docker-isolation cleanup reason.
+ *
+ * @param {string} reason
+ * @returns {string}
+ */
+export function describeDockerIsolationReason(reason) {
+  const map = {
+    disabled: 'docker-isolation cleanup disabled',
+    'active-container': 'running docker-isolation task',
+    'unknown-container-state': 'container state is not terminal',
+    'successful-container': 'successful docker-isolation task container',
+    'finished-container': 'finished docker-isolation task container',
+    'failed-container-kept': 'failed docker-isolation task kept for debugging',
+    'unknown-outcome-kept': 'docker-isolation task outcome unknown',
+    'all-mode': 'non-running docker-isolation container',
+  };
+  return map[reason] || reason;
+}
+
+/**
+ * Format a docker-isolation container record for CLI logs.
+ *
+ * @param {Object} item
+ * @returns {string}
+ */
+export function formatDockerIsolationContainerSummary(item) {
+  if (!item) return '';
+  const parts = [`session ${item.name}`];
+  if (item.image) parts.push(`image ${item.image}`);
+  if (item.state) parts.push(`state ${item.state}`);
+  if (item.status) parts.push(`status ${item.status}`);
+  if (item.exitCode !== null && item.exitCode !== undefined) parts.push(`exit ${item.exitCode}`);
+  if (item.session) parts.push(formatTaskSummary(item.session));
+  if (item.command && ['disabled', 'failed-container-kept', 'unknown-outcome-kept'].includes(item.reason)) {
+    parts.push(`remove when done: ${item.command}`);
+  }
+  return parts.join(', ');
+}

package/src/cleanup.mjs

@@ -23,6 +23,7 @@
  *   --no-keep-dirty               allow deleting clones with unpushed changes
  *   --processes                   map claude/codex/etc. PIDs to task sessions
  *   --kill-orphaned-agents        signal orphaned terminal-session agents
+ *   --docker-isolation[=<mode>]   cleanup task containers by session UUID
  *   --apt --journal --docker --npm   Ubuntu/system cleanup (opt-in)
  *   --system                      shorthand for --apt --journal --npm
  *   --sudo                        prefix package-manager commands with sudo
@@ -35,8 +36,8 @@ import path from 'node:path';
 import { promises as fsp } from 'node:fs';
 
 import { isConfirmationYes, readConfirmationLine } from './confirmation.lib.mjs';
-import { classifyEntries, summarize, formatBytes, describeReason, buildActiveMatchers, DEFAULT_PROTECTED_NAMES, formatEntryContext, formatTaskSummary } from './cleanup.lib.mjs';
-import { getTempRoot, listTempEntries, getPathSize, readFolderGitInfo, listProcessHeldPaths, getActiveTasks, listSessionTasks, removePath, runSystemCleanup, collectProcessDebugReport, signalOrphanedAgentTrees } from './cleanup.os.lib.mjs';
+import { classifyEntries, summarize, formatBytes, describeReason, buildActiveMatchers, DEFAULT_PROTECTED_NAMES, formatEntryContext, formatTaskSummary, DEFAULT_DOCKER_ISOLATION_CLEANUP_MODE, describeDockerIsolationReason, formatDockerIsolationContainerSummary, normalizeDockerIsolationCleanupMode, planDockerIsolationCleanup } from './cleanup.lib.mjs';
+import { getTempRoot, listTempEntries, getPathSize, readFolderGitInfo, listProcessHeldPaths, getActiveTasks, listSessionTasks, removePath, runSystemCleanup, collectProcessDebugReport, signalOrphanedAgentTrees, listDockerIsolationContainers, removeDockerContainer } from './cleanup.os.lib.mjs';
 import { formatProcessDebugReport } from './process-debug.lib.mjs';
 
 const args = process.argv.slice(2);
@@ -71,6 +72,17 @@ function parsePidList(values) {
     .filter(value => Number.isInteger(value) && value > 0);
 }
 
+function parseDockerIsolationMode() {
+  if (hasFlag('--no-docker-isolation')) return 'none';
+  const configured = getFlagValue('--docker-isolation') ?? process.env.HIVE_MIND_CLEANUP_DOCKER_ISOLATION ?? process.env.HIVE_CLEANUP_DOCKER_ISOLATION ?? DEFAULT_DOCKER_ISOLATION_CLEANUP_MODE;
+  try {
+    return normalizeDockerIsolationCleanupMode(configured);
+  } catch (error) {
+    console.error(`Error: ${error.message}`);
+    process.exit(1);
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Early --version / --help handling (no heavy imports).
 // ---------------------------------------------------------------------------
@@ -117,11 +129,17 @@ Process diagnostics:
 System / Ubuntu cleanup (opt-in):
   --apt                       apt-get clean / autoclean / autoremove
   --journal                   journalctl --vacuum-time=2weeks
-  --docker                    docker system prune -f
+  --docker                    docker system prune -f (host-wide Docker cleanup)
   --npm                       npm cache clean --force
   --system                    Shorthand for --apt --journal --npm
   --sudo                      Prefix package-manager commands with sudo
 
+Docker isolation cleanup:
+  --docker-isolation[=<mode>] Clean task containers named by session UUID
+                              [default: ${DEFAULT_DOCKER_ISOLATION_CLEANUP_MODE}]
+                              modes: succeeded, all, none
+  --no-docker-isolation       Disable Docker-isolation task container cleanup
+
   --verbose, -v               Verbose logging
   --version                   Show version number
   --help, -h                  Show this help
@@ -150,6 +168,7 @@ const options = {
   apt: hasFlag('--apt', '--system'),
   journal: hasFlag('--journal', '--system'),
   docker: hasFlag('--docker'),
+  dockerIsolationMode: parseDockerIsolationMode(),
   npm: hasFlag('--npm', '--system'),
   sudo: hasFlag('--sudo'),
 };
@@ -311,16 +330,47 @@ async function main() {
     await log(`   ${formatBytes(item.size).padStart(7)}  ${item.path}  — ${describeReason(item.reason)}${formatEntryContext(item)}`);
   }
 
-  await log(`\n📊 Summary: keep ${totals.keepCount} (${formatBytes(totals.keepBytes)}), remove ${totals.removeCount} (${formatBytes(totals.removeBytes)})`);
+  let dockerIsolationPlan = { keep: [], remove: [], mode: options.dockerIsolationMode };
+  if (options.dockerIsolationMode === 'none') {
+    await log('\n🐳 Docker isolation containers: disabled (--docker-isolation=none)');
+  } else {
+    const dockerIsolationContainers = listDockerIsolationContainers();
+    dockerIsolationPlan = planDockerIsolationCleanup({
+      containers: dockerIsolationContainers,
+      sessionTasks,
+      mode: options.dockerIsolationMode,
+    });
+
+    await log(`\n🐳 Docker isolation containers (${dockerIsolationPlan.mode}):`);
+    if (dockerIsolationPlan.keep.length === 0 && dockerIsolationPlan.remove.length === 0) {
+      await log('   (none detected)');
+    } else {
+      await log('   KEPT:');
+      if (dockerIsolationPlan.keep.length === 0) await log('      (none)');
+      for (const item of dockerIsolationPlan.keep) {
+        await log(`      ${formatDockerIsolationContainerSummary(item)} — ${describeDockerIsolationReason(item.reason)}`);
+      }
+
+      await log(`   ${options.dryRun ? 'WOULD REMOVE' : 'TO REMOVE'}:`);
+      if (dockerIsolationPlan.remove.length === 0) await log('      (none)');
+      for (const item of dockerIsolationPlan.remove) {
+        await log(`      ${formatDockerIsolationContainerSummary(item)} — ${describeDockerIsolationReason(item.reason)}`);
+      }
+    }
+  }
+
+  await log(`\n📊 Summary: keep ${totals.keepCount} (${formatBytes(totals.keepBytes)}), remove ${totals.removeCount} (${formatBytes(totals.removeBytes)}), docker keep ${dockerIsolationPlan.keep.length}, docker remove ${dockerIsolationPlan.remove.length}`);
 
   // 7. Execute deletion (unless dry-run).
+  const hasTempRemovals = classified.remove.length > 0;
+  const hasDockerRemovals = dockerIsolationPlan.remove.length > 0;
   if (options.dryRun) {
     await log('\n✅ Dry run complete. Re-run without --dry-run to delete.');
-  } else if (classified.remove.length === 0) {
+  } else if (!hasTempRemovals && !hasDockerRemovals) {
     await log('\n✅ Nothing to delete.');
   } else {
     if (!options.force) {
-      console.log(`\n⚠️  This will permanently delete ${classified.remove.length} entries (${formatBytes(totals.removeBytes)}).`);
+      console.log(`\n⚠️  This will permanently delete ${classified.remove.length} entries (${formatBytes(totals.removeBytes)}) and remove ${dockerIsolationPlan.remove.length} Docker isolation containers.`);
       console.log('Type "yes" to confirm, or Ctrl+C to cancel:');
       let answer = '';
       try {
@@ -335,20 +385,39 @@ async function main() {
       }
     }
 
-    await log('\n🗑️  Deleting...');
-    let deleted = 0;
-    let failed = 0;
-    for (const item of classified.remove) {
-      const ok = removePath(item.path);
-      if (ok) {
-        deleted++;
-        await vlog(`   removed ${item.path}`);
-      } else {
-        failed++;
-        await log(`   ⚠️  failed to remove ${item.path}`, { level: 'warn' });
+    if (hasTempRemovals) {
+      await log('\n🗑️  Deleting...');
+      let deleted = 0;
+      let failed = 0;
+      for (const item of classified.remove) {
+        const ok = removePath(item.path);
+        if (ok) {
+          deleted++;
+          await vlog(`   removed ${item.path}`);
+        } else {
+          failed++;
+          await log(`   ⚠️  failed to remove ${item.path}`, { level: 'warn' });
+        }
+      }
+      await log(`\n✅ Deleted ${deleted} entries${failed ? `, ${failed} failed` : ''}.`);
+    }
+
+    if (hasDockerRemovals) {
+      await log('\n🐳 Removing Docker isolation containers...');
+      let removed = 0;
+      let failed = 0;
+      for (const item of dockerIsolationPlan.remove) {
+        const ok = removeDockerContainer(item.name);
+        if (ok) {
+          removed++;
+          await log(`   ✓ ${item.command}`);
+        } else {
+          failed++;
+          await log(`   ⚠️  failed: ${item.command}`, { level: 'warn' });
+        }
       }
+      await log(`\n✅ Removed ${removed} Docker isolation containers${failed ? `, ${failed} failed` : ''}.`);
     }
-    await log(`\n✅ Deleted ${deleted} entries${failed ? `, ${failed} failed` : ''}.`);
   }
 
   // 8. System / Ubuntu cleanup (opt-in).

package/src/cleanup.os.lib.mjs

@@ -19,7 +19,7 @@ import path from 'node:path';
 import os from 'node:os';
 import { execFileSync } from 'node:child_process';
 
-import { extractTaskRefsFromCommand, parseRemoteUrl } from './cleanup.lib.mjs';
+import { extractTaskRefsFromCommand, isDockerIsolationSessionName, parseDockerContainerExitCode, parseRemoteUrl } from './cleanup.lib.mjs';
 import { correlateProcesses, parseStartCommandLogMetadata, redactProcessText } from './process-debug.lib.mjs';
 
 /** Run a command, returning trimmed stdout or null on any failure. */
@@ -303,6 +303,73 @@ export function listScreenSessions() {
   return sessions;
 }
 
+function splitDockerNames(value) {
+  return String(value || '')
+    .split(',')
+    .map(name => name.trim().replace(/^\/+/, ''))
+    .filter(Boolean);
+}
+
+/**
+ * Parse `docker ps -a --format '{{json .}}'` output into docker-isolation task
+ * containers. start-command names native Docker isolation containers after the
+ * session UUID, so unrelated host containers are ignored.
+ *
+ * @param {string} output
+ * @returns {Array<{id: string|null, name: string, image: string|null, state: string, status: string, exitCode: number|null, running: boolean}>}
+ */
+export function parseDockerPsJsonLines(output) {
+  const containers = [];
+  const seen = new Set();
+
+  for (const line of String(output || '').split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+
+    let data;
+    try {
+      data = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+
+    const state = String(data.State || data.state || '')
+      .trim()
+      .toLowerCase();
+    const status = String(data.Status || data.status || '').trim();
+    const exitCode = parseDockerContainerExitCode(status);
+    const running = state === 'running' || /^Up\b/i.test(status);
+
+    for (const name of splitDockerNames(data.Names || data.Name || data.names || data.name)) {
+      if (!isDockerIsolationSessionName(name)) continue;
+      if (seen.has(name)) continue;
+      seen.add(name);
+      containers.push({
+        id: data.ID || data.Id || data.id || null,
+        name,
+        image: data.Image || data.image || null,
+        state,
+        status,
+        exitCode,
+        running,
+      });
+    }
+  }
+
+  return containers;
+}
+
+/**
+ * Enumerate Docker-isolation task containers from the local Docker daemon.
+ * Returns an empty list when docker is unavailable.
+ *
+ * @returns {Array}
+ */
+export function listDockerIsolationContainers() {
+  const out = tryExec('docker', ['ps', '-a', '--format', '{{json .}}']);
+  return out ? parseDockerPsJsonLines(out) : [];
+}
+
 function listStartCommandLogFiles(logRoot, maxFiles) {
   const files = [];
   const stack = [logRoot];
@@ -677,7 +744,7 @@ export function resolvePrHeadBranch(ref) {
  * @param {Object} [options]
  * @param {boolean} [options.verbose=false]
  * @param {boolean} [options.resolveBranches=false] - resolve PR head branches via gh
- * @returns {Promise<Array<{owner, repo, type, number, branch: string|null, sessionId: string|null, sessionName: string|null, status: string|null, workspace: string|null, terminal: boolean, startTime: string|null}>>}
+ * @returns {Promise<Array<{owner, repo, type, number, branch: string|null, sessionId: string|null, sessionName: string|null, status: string|null, exitCode: number|null, isolation: string|null, workspace: string|null, terminal: boolean, startTime: string|null}>>}
  */
 export async function listSessionTasks(options = {}) {
   const { verbose = false, resolveBranches = false } = options;
@@ -711,6 +778,8 @@ export async function listSessionTasks(options = {}) {
         sessionId: session.uuid || null,
         sessionName: session.sessionName || null,
         status: session.status || null,
+        exitCode: session.exitCode ?? null,
+        isolation: session.isolation || null,
         workspace: session.workingDirectory || null,
         terminal,
         startTime: session.startTime || null,
@@ -784,6 +853,18 @@ export function removePath(targetPath) {
   }
 }
 
+/**
+ * Remove a Docker-isolation task container by session UUID. Returns false for
+ * invalid names, missing docker, missing containers, or docker errors.
+ *
+ * @param {string} containerName
+ * @returns {boolean}
+ */
+export function removeDockerContainer(containerName) {
+  if (!isDockerIsolationSessionName(containerName)) return false;
+  return tryExec('docker', ['rm', '-f', containerName], { timeout: 180000, stdio: ['ignore', 'pipe', 'pipe'] }) !== null;
+}
+
 /**
  * System / Ubuntu cleanup actions. Each is opt-in. In dry-run mode the commands
  * are only described, never executed.

package/src/isolation-runner.lib.mjs

@@ -488,7 +488,7 @@ export function readSessionExitFromLog(logPath, options = {}) {
  */
 async function findStartCommandBinary() {
   try {
-    const result = await $`which $`;
+    const result = await $({ mirror: false })`which $`;
     const path = result.stdout?.toString().trim() || '';
     return path || null;
   } catch {
@@ -831,6 +831,47 @@ export async function checkDockerContainerRunning(containerName, verbose = false
   }
 }
 
+/**
+ * Best-effort removal for a Docker container backing a native
+ * `$ --isolated docker` session.
+ *
+ * start-command names the container after the `--session` value. The monitor
+ * calls this only after the session is terminal and after the host-side log has
+ * been inspected, so removing the container reclaims its writable layer without
+ * losing the captured task log. Never throws: completion notification must not
+ * fail just because Docker already removed the container.
+ *
+ * @param {string} containerName - Container name (the session UUID)
+ * @param {boolean} [verbose] - Enable verbose logging
+ * @returns {Promise<{success: boolean, output: string, error: string|null}>}
+ */
+export async function removeDockerContainer(containerName, verbose = false) {
+  if (!containerName) {
+    return { success: false, output: '', error: 'missing container name' };
+  }
+
+  try {
+    const result = await $({ mirror: false })`docker rm -f ${containerName}`;
+    const stdout = result.stdout?.toString() || '';
+    const stderr = result.stderr?.toString() || '';
+    if (verbose) {
+      console.log(`[VERBOSE] isolation-runner: docker rm -f '${containerName}' succeeded`);
+    }
+    return { success: true, output: stdout || stderr, error: null };
+  } catch (error) {
+    const stderr = error?.stderr?.toString?.() || '';
+    const stdout = error?.stdout?.toString?.() || '';
+    if (verbose) {
+      console.log(`[VERBOSE] isolation-runner: docker rm -f '${containerName}' failed: ${stderr.trim() || error?.message || error}`);
+    }
+    return {
+      success: false,
+      output: stdout,
+      error: stderr.trim() || error?.message || String(error),
+    };
+  }
+}
+
 /**
  * Check whether a tmux session with the given name still exists.
  * `tmux has-session -t <name>` exits 0 when it exists and non-zero otherwise,

package/src/session-monitor.lib.mjs

@@ -110,6 +110,20 @@ export function getIsolationSessionStateForTests(sessionName, sessionInfo, optio
  * mechanism will no longer be needed.
  */
 export const NON_ISOLATION_SESSION_TIMEOUT_MS = 10 * 60 * 1000; // 10 minutes
+export const DEFAULT_DOCKER_TASK_CONTAINER_KEEP_POLICY = 'on-failure';
+export const DOCKER_TASK_CONTAINER_KEEP_POLICIES = ['always', 'on-failure', 'never'];
+
+export function resolveDockerTaskContainerKeepPolicy({ env = process.env, verbose = false } = {}) {
+  const raw = String(env?.HIVE_MIND_KEEP_TASK_CONTAINER || '')
+    .trim()
+    .toLowerCase();
+  if (!raw) return DEFAULT_DOCKER_TASK_CONTAINER_KEEP_POLICY;
+  if (DOCKER_TASK_CONTAINER_KEEP_POLICIES.includes(raw)) return raw;
+  if (verbose) {
+    console.log(`[VERBOSE] Invalid HIVE_MIND_KEEP_TASK_CONTAINER='${raw}', using '${DEFAULT_DOCKER_TASK_CONTAINER_KEEP_POLICY}'`);
+  }
+  return DEFAULT_DOCKER_TASK_CONTAINER_KEEP_POLICY;
+}
 
 /**
  * Check if a screen session exists
@@ -345,6 +359,70 @@ async function buildDiskDiagnosticsExtraSection(logPath, { verbose = false, read
   }
 }
 
+function isSuccessfulTaskCompletion({ exitCode = null, status = null } = {}) {
+  const outcome = classifySessionOutcome({ exitCode, status });
+  if (outcome.failed) return false;
+  if (exitCode === 0) return true;
+
+  const normalizedStatus = String(status || '')
+    .trim()
+    .toLowerCase();
+  return exitCode === null && (normalizedStatus === 'executed' || normalizedStatus === 'completed');
+}
+
+function formatDockerTaskContainerKeptSection({ containerName, keepPolicy }) {
+  return ['*Docker container kept*', `Container: \`${containerName}\``, `Policy: \`HIVE_MIND_KEEP_TASK_CONTAINER=${keepPolicy}\``, `Inspect: \`docker start -ai ${containerName}\``, `Shell: \`docker exec -it ${containerName} sh\``, `Remove when done: \`docker rm -f ${containerName}\``].join('\n');
+}
+
+export function buildDockerTaskContainerCompletionAction({ sessionName, sessionInfo, exitCode = null, status = null, env = process.env, verbose = false } = {}) {
+  if (sessionInfo?.isolationBackend !== 'docker') {
+    return { applies: false, containerName: null, keepPolicy: null, shouldRemove: false, extraSection: '' };
+  }
+
+  const containerName = sessionInfo.sessionId || sessionName || null;
+  if (!containerName) {
+    return { applies: false, containerName: null, keepPolicy: null, shouldRemove: false, extraSection: '' };
+  }
+
+  const keepPolicy = resolveDockerTaskContainerKeepPolicy({ env, verbose });
+  const successful = isSuccessfulTaskCompletion({ exitCode, status });
+  const shouldKeep = keepPolicy === 'always' || (keepPolicy === 'on-failure' && !successful);
+
+  return {
+    applies: true,
+    containerName,
+    keepPolicy,
+    successful,
+    shouldRemove: !shouldKeep,
+    extraSection: shouldKeep ? formatDockerTaskContainerKeptSection({ containerName, keepPolicy }) : '',
+  };
+}
+
+async function applyDockerTaskContainerCompletionAction(action, { verbose = false, removeDockerContainer = null } = {}) {
+  if (!action?.applies || !action.shouldRemove || !action.containerName) return;
+
+  try {
+    const removeFn =
+      removeDockerContainer ||
+      (async (containerName, removeVerbose) => {
+        const runner = await getIsolationRunner();
+        return runner.removeDockerContainer(containerName, removeVerbose);
+      });
+    const result = await removeFn(action.containerName, verbose);
+    if (verbose) {
+      if (result?.success) {
+        console.log(`[VERBOSE] Removed docker task container '${action.containerName}' after terminal session completion`);
+      } else {
+        console.log(`[VERBOSE] Could not remove docker task container '${action.containerName}': ${result?.error || 'unknown error'}`);
+      }
+    }
+  } catch (error) {
+    if (verbose) {
+      console.log(`[VERBOSE] Could not remove docker task container '${action.containerName}': ${error?.message || error}`);
+    }
+  }
+}
+
 function isNonIsolationSessionActive(sessionName, sessionInfo, verbose = false) {
   const startTime = sessionInfo.startTime instanceof Date ? sessionInfo.startTime : new Date(sessionInfo.startTime);
   const elapsed = Date.now() - startTime.getTime();
@@ -602,8 +680,17 @@ export async function monitorSessions(bot, verbose = false, options = {}) {
     if (!stillRunning) {
       console.log(`Session ${sessionName} has finished. Sending notification to chat ${sessionInfo.chatId}`);
 
+      let dockerTaskContainerAction = null;
       try {
         const finalExitCode = getSessionCompletionExitCode({ exitCode, statusResult });
+        dockerTaskContainerAction = buildDockerTaskContainerCompletionAction({
+          sessionName,
+          sessionInfo,
+          exitCode: finalExitCode,
+          status: resolvedStatus,
+          env: options.env || process.env,
+          verbose,
+        });
 
         // Issue #1688/#1905: When the original /solve URL was an issue, look up
         //   the created PR so the completion message can include both an
@@ -709,6 +796,7 @@ export async function monitorSessions(bot, verbose = false, options = {}) {
             console.log(`[VERBOSE] Could not build disk diagnostics section for ${sessionName}: ${diskError?.message || diskError}`);
           }
         }
+        const dockerTaskContainerExtraSections = dockerTaskContainerAction?.extraSection ? [dockerTaskContainerAction.extraSection] : [];
 
         const message = formatSessionCompletionMessage({
           sessionName,
@@ -718,7 +806,7 @@ export async function monitorSessions(bot, verbose = false, options = {}) {
           exitCode: finalExitCode,
           infoBlock: sessionInfo?.infoBlock || '',
           pullRequestUrl,
-          extraSections: [...limitsExtraSections, ...resumeExtraSections, ...diskExtraSections],
+          extraSections: [...limitsExtraSections, ...resumeExtraSections, ...diskExtraSections, ...dockerTaskContainerExtraSections],
         });
 
         // Update the original reply message if messageId is available, otherwise send new message
@@ -758,10 +846,18 @@ export async function monitorSessions(bot, verbose = false, options = {}) {
           }
         }
 
+        await applyDockerTaskContainerCompletionAction(dockerTaskContainerAction, {
+          verbose,
+          removeDockerContainer: options.removeDockerContainer,
+        });
         completeSession(sessionName, finalExitCode || 0, verbose, resolvedStatus);
       } catch (error) {
         console.error(`Failed to send completion notification for ${sessionName}:`, error);
         if (isMessageAlreadyUpdatedError(error)) {
+          await applyDockerTaskContainerCompletionAction(dockerTaskContainerAction, {
+            verbose,
+            removeDockerContainer: options.removeDockerContainer,
+          });
           completeSession(sessionName, exitCode || 0, verbose, resolvedStatus);
         } else {
           sessionInfo.lastNotificationError = error.message;