@link-assistant/hive-mind 2.0.20 → 2.0.22

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @link-assistant/hive-mind
 
+## 2.0.22
+
+### Patch Changes
+
+- 4d65c05: Make disk admission safer by default: the disk usage queue gate now waits at 80%, the absolute free-space default is 10240 MB, and isolation defaults to Docker.
+
+## 2.0.21
+
+### Patch Changes
+
+- da88ee5: Add session-aware Docker-isolation container cleanup to hive-cleanup.
+
 ## 2.0.20
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "2.0.20",
+  "version": "2.0.22",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",

package/src/cleanup.lib.mjs

@@ -17,6 +17,7 @@
  * @see https://github.com/link-assistant/hive-mind/issues/1848
  */
 
+import { classifyExitStatus, isExecutingSessionStatus, isFailureSessionStatus, isTerminalSessionStatus, normalizeExitCode } from './session-status.lib.mjs';
 import { isValidIssueBranchName, parseIssueBranchName } from './solve.branch.lib.mjs';
 
 /**
@@ -161,6 +162,8 @@ export function buildActiveMatchers(activeTasks) {
       sessionId: task.sessionId || null,
       sessionName: task.sessionName || null,
       status: task.status || null,
+      exitCode: task.exitCode ?? null,
+      isolation: task.isolation || null,
       workspace: task.workspace || null,
     });
   }
@@ -431,3 +434,227 @@ export function formatEntryContext(item) {
 
   return details.length > 0 ? ` (${details.join('; ')})` : '';
 }
+
+export const DEFAULT_DOCKER_ISOLATION_CLEANUP_MODE = 'succeeded';
+export const DOCKER_ISOLATION_CLEANUP_MODES = new Set(['succeeded', 'all', 'none']);
+
+const DOCKER_ISOLATION_SESSION_NAME_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+function normalizeText(value) {
+  return String(value || '')
+    .trim()
+    .toLowerCase();
+}
+
+/**
+ * Normalize the docker-isolation cleanup policy.
+ *
+ * Modes:
+ *   - succeeded: default; remove successful exited containers, keep failures
+ *   - all: remove all terminal/exited task containers
+ *   - none: report only
+ *
+ * @param {string|null|undefined} value
+ * @returns {'succeeded'|'all'|'none'}
+ */
+export function normalizeDockerIsolationCleanupMode(value) {
+  const mode = normalizeText(value);
+  if (!mode || ['default', 'true', '1', 'yes', 'on', 'succeeded', 'success', 'successful', 'failed-kept', 'keep-failed', 'on-failure'].includes(mode)) {
+    return DEFAULT_DOCKER_ISOLATION_CLEANUP_MODE;
+  }
+  if (['false', '0', 'no', 'off', 'none', 'disabled'].includes(mode)) return 'none';
+  if (['all', 'everything', 'finished', 'terminal'].includes(mode)) return 'all';
+  throw new Error(`Invalid docker isolation cleanup mode: ${value}. Expected one of: succeeded, all, none`);
+}
+
+/**
+ * True when a Docker container name looks like a start-command session UUID.
+ *
+ * @param {string} name
+ * @returns {boolean}
+ */
+export function isDockerIsolationSessionName(name) {
+  return DOCKER_ISOLATION_SESSION_NAME_RE.test(String(name || '').trim());
+}
+
+/**
+ * Parse Docker's status text, e.g. "Exited (137) 10 minutes ago".
+ *
+ * @param {string} status
+ * @returns {number|null}
+ */
+export function parseDockerContainerExitCode(status) {
+  const match = String(status || '').match(/\bExited\s+\((-?\d+)\)/i);
+  return match ? normalizeExitCode(match[1]) : null;
+}
+
+function createSessionLookup(sessionTasks) {
+  const lookup = new Map();
+  const merge = (key, task) => {
+    if (!key) return;
+    const existing = lookup.get(key) || {};
+    lookup.set(key, {
+      ...existing,
+      ...task,
+      status: task.status || existing.status || null,
+      exitCode: task.exitCode ?? existing.exitCode ?? null,
+      isolation: task.isolation || existing.isolation || null,
+      sessionId: task.sessionId || existing.sessionId || null,
+      sessionName: task.sessionName || existing.sessionName || null,
+      workspace: task.workspace || existing.workspace || null,
+    });
+  };
+
+  for (const task of sessionTasks || []) {
+    if (!task) continue;
+    merge(task.sessionId, task);
+    merge(task.sessionName, task);
+  }
+  return lookup;
+}
+
+function normalizeDockerContainer(container) {
+  const name = String(container?.name || container?.Names || container?.Name || '')
+    .replace(/^\//, '')
+    .trim();
+  const state = normalizeText(container?.state || container?.State);
+  const statusText = String(container?.status ?? container?.Status ?? '').trim();
+  const exitCode = normalizeExitCode(container?.exitCode ?? container?.ExitCode ?? parseDockerContainerExitCode(statusText));
+  const running = container?.running === true || state === 'running' || /^Up\b/i.test(statusText);
+  return {
+    ...container,
+    id: container?.id || container?.ID || null,
+    image: container?.image || container?.Image || null,
+    name,
+    state,
+    status: statusText,
+    exitCode,
+    running,
+  };
+}
+
+function inferDockerContainerOutcome(container, session) {
+  const sessionStatus = normalizeText(session?.status);
+  const exitCode = normalizeExitCode(container.exitCode ?? session?.exitCode);
+  const running = container.running || isExecutingSessionStatus(sessionStatus);
+  const containerTerminal = ['exited', 'dead', 'removing'].includes(container.state) || /^Exited\b/i.test(container.status) || exitCode !== null;
+  const sessionTerminal = isTerminalSessionStatus(sessionStatus);
+  const terminal = !running && (sessionTerminal || containerTerminal);
+  const exitStatus = classifyExitStatus(exitCode);
+  const failed = terminal && (isFailureSessionStatus(sessionStatus) || isFailureSessionStatus(exitStatus) || (exitCode !== null && exitCode !== 0));
+  const successful = terminal && !failed && exitCode === 0;
+  const unknown = terminal && !successful && !failed;
+
+  return {
+    running,
+    terminal,
+    exitCode,
+    successful,
+    failed,
+    unknown,
+  };
+}
+
+function dockerCleanupRecord(container, session, outcome, reason) {
+  return {
+    ...container,
+    ...outcome,
+    session: session || null,
+    reason,
+    command: `docker rm -f ${container.name}`,
+  };
+}
+
+/**
+ * Plan selective cleanup for Docker-isolation task containers.
+ *
+ * The input containers are expected to be Docker ps records already filtered to
+ * session UUID names, but the planner filters defensively too. Running
+ * containers are never removed, regardless of mode.
+ *
+ * @param {Object} options
+ * @param {Array} options.containers
+ * @param {Array} [options.sessionTasks]
+ * @param {string} [options.mode]
+ * @returns {{keep: Array, remove: Array, mode: string}}
+ */
+export function planDockerIsolationCleanup(options = {}) {
+  const mode = normalizeDockerIsolationCleanupMode(options.mode);
+  const sessions = createSessionLookup(options.sessionTasks || []);
+  const keep = [];
+  const remove = [];
+
+  for (const rawContainer of options.containers || []) {
+    const container = normalizeDockerContainer(rawContainer);
+    if (!isDockerIsolationSessionName(container.name)) continue;
+
+    const session = sessions.get(container.name) || null;
+    const outcome = inferDockerContainerOutcome(container, session);
+    let reason;
+    let action = 'keep';
+
+    if (mode === 'none') {
+      reason = 'disabled';
+    } else if (outcome.running) {
+      reason = 'active-container';
+    } else if (!outcome.terminal) {
+      reason = 'unknown-container-state';
+    } else if (mode === 'all') {
+      reason = 'finished-container';
+      action = 'remove';
+    } else if (outcome.successful) {
+      reason = 'successful-container';
+      action = 'remove';
+    } else if (outcome.failed) {
+      reason = 'failed-container-kept';
+    } else {
+      reason = 'unknown-outcome-kept';
+    }
+
+    const record = dockerCleanupRecord(container, session, outcome, reason);
+    if (action === 'remove') remove.push(record);
+    else keep.push(record);
+  }
+
+  return { keep, remove, mode };
+}
+
+/**
+ * Human-readable docker-isolation cleanup reason.
+ *
+ * @param {string} reason
+ * @returns {string}
+ */
+export function describeDockerIsolationReason(reason) {
+  const map = {
+    disabled: 'docker-isolation cleanup disabled',
+    'active-container': 'running docker-isolation task',
+    'unknown-container-state': 'container state is not terminal',
+    'successful-container': 'successful docker-isolation task container',
+    'finished-container': 'finished docker-isolation task container',
+    'failed-container-kept': 'failed docker-isolation task kept for debugging',
+    'unknown-outcome-kept': 'docker-isolation task outcome unknown',
+    'all-mode': 'non-running docker-isolation container',
+  };
+  return map[reason] || reason;
+}
+
+/**
+ * Format a docker-isolation container record for CLI logs.
+ *
+ * @param {Object} item
+ * @returns {string}
+ */
+export function formatDockerIsolationContainerSummary(item) {
+  if (!item) return '';
+  const parts = [`session ${item.name}`];
+  if (item.image) parts.push(`image ${item.image}`);
+  if (item.state) parts.push(`state ${item.state}`);
+  if (item.status) parts.push(`status ${item.status}`);
+  if (item.exitCode !== null && item.exitCode !== undefined) parts.push(`exit ${item.exitCode}`);
+  if (item.session) parts.push(formatTaskSummary(item.session));
+  if (item.command && ['disabled', 'failed-container-kept', 'unknown-outcome-kept'].includes(item.reason)) {
+    parts.push(`remove when done: ${item.command}`);
+  }
+  return parts.join(', ');
+}

package/src/cleanup.mjs

@@ -23,6 +23,7 @@
  *   --no-keep-dirty               allow deleting clones with unpushed changes
  *   --processes                   map claude/codex/etc. PIDs to task sessions
  *   --kill-orphaned-agents        signal orphaned terminal-session agents
+ *   --docker-isolation[=<mode>]   cleanup task containers by session UUID
  *   --apt --journal --docker --npm   Ubuntu/system cleanup (opt-in)
  *   --system                      shorthand for --apt --journal --npm
  *   --sudo                        prefix package-manager commands with sudo
@@ -35,8 +36,8 @@ import path from 'node:path';
 import { promises as fsp } from 'node:fs';
 
 import { isConfirmationYes, readConfirmationLine } from './confirmation.lib.mjs';
-import { classifyEntries, summarize, formatBytes, describeReason, buildActiveMatchers, DEFAULT_PROTECTED_NAMES, formatEntryContext, formatTaskSummary } from './cleanup.lib.mjs';
-import { getTempRoot, listTempEntries, getPathSize, readFolderGitInfo, listProcessHeldPaths, getActiveTasks, listSessionTasks, removePath, runSystemCleanup, collectProcessDebugReport, signalOrphanedAgentTrees } from './cleanup.os.lib.mjs';
+import { classifyEntries, summarize, formatBytes, describeReason, buildActiveMatchers, DEFAULT_PROTECTED_NAMES, formatEntryContext, formatTaskSummary, DEFAULT_DOCKER_ISOLATION_CLEANUP_MODE, describeDockerIsolationReason, formatDockerIsolationContainerSummary, normalizeDockerIsolationCleanupMode, planDockerIsolationCleanup } from './cleanup.lib.mjs';
+import { getTempRoot, listTempEntries, getPathSize, readFolderGitInfo, listProcessHeldPaths, getActiveTasks, listSessionTasks, removePath, runSystemCleanup, collectProcessDebugReport, signalOrphanedAgentTrees, listDockerIsolationContainers, removeDockerContainer } from './cleanup.os.lib.mjs';
 import { formatProcessDebugReport } from './process-debug.lib.mjs';
 
 const args = process.argv.slice(2);
@@ -71,6 +72,17 @@ function parsePidList(values) {
     .filter(value => Number.isInteger(value) && value > 0);
 }
 
+function parseDockerIsolationMode() {
+  if (hasFlag('--no-docker-isolation')) return 'none';
+  const configured = getFlagValue('--docker-isolation') ?? process.env.HIVE_MIND_CLEANUP_DOCKER_ISOLATION ?? process.env.HIVE_CLEANUP_DOCKER_ISOLATION ?? DEFAULT_DOCKER_ISOLATION_CLEANUP_MODE;
+  try {
+    return normalizeDockerIsolationCleanupMode(configured);
+  } catch (error) {
+    console.error(`Error: ${error.message}`);
+    process.exit(1);
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Early --version / --help handling (no heavy imports).
 // ---------------------------------------------------------------------------
@@ -117,11 +129,17 @@ Process diagnostics:
 System / Ubuntu cleanup (opt-in):
   --apt                       apt-get clean / autoclean / autoremove
   --journal                   journalctl --vacuum-time=2weeks
-  --docker                    docker system prune -f
+  --docker                    docker system prune -f (host-wide Docker cleanup)
   --npm                       npm cache clean --force
   --system                    Shorthand for --apt --journal --npm
   --sudo                      Prefix package-manager commands with sudo
 
+Docker isolation cleanup:
+  --docker-isolation[=<mode>] Clean task containers named by session UUID
+                              [default: ${DEFAULT_DOCKER_ISOLATION_CLEANUP_MODE}]
+                              modes: succeeded, all, none
+  --no-docker-isolation       Disable Docker-isolation task container cleanup
+
   --verbose, -v               Verbose logging
   --version                   Show version number
   --help, -h                  Show this help
@@ -150,6 +168,7 @@ const options = {
   apt: hasFlag('--apt', '--system'),
   journal: hasFlag('--journal', '--system'),
   docker: hasFlag('--docker'),
+  dockerIsolationMode: parseDockerIsolationMode(),
   npm: hasFlag('--npm', '--system'),
   sudo: hasFlag('--sudo'),
 };
@@ -311,16 +330,47 @@ async function main() {
     await log(`   ${formatBytes(item.size).padStart(7)}  ${item.path}  — ${describeReason(item.reason)}${formatEntryContext(item)}`);
   }
 
-  await log(`\n📊 Summary: keep ${totals.keepCount} (${formatBytes(totals.keepBytes)}), remove ${totals.removeCount} (${formatBytes(totals.removeBytes)})`);
+  let dockerIsolationPlan = { keep: [], remove: [], mode: options.dockerIsolationMode };
+  if (options.dockerIsolationMode === 'none') {
+    await log('\n🐳 Docker isolation containers: disabled (--docker-isolation=none)');
+  } else {
+    const dockerIsolationContainers = listDockerIsolationContainers();
+    dockerIsolationPlan = planDockerIsolationCleanup({
+      containers: dockerIsolationContainers,
+      sessionTasks,
+      mode: options.dockerIsolationMode,
+    });
+
+    await log(`\n🐳 Docker isolation containers (${dockerIsolationPlan.mode}):`);
+    if (dockerIsolationPlan.keep.length === 0 && dockerIsolationPlan.remove.length === 0) {
+      await log('   (none detected)');
+    } else {
+      await log('   KEPT:');
+      if (dockerIsolationPlan.keep.length === 0) await log('      (none)');
+      for (const item of dockerIsolationPlan.keep) {
+        await log(`      ${formatDockerIsolationContainerSummary(item)} — ${describeDockerIsolationReason(item.reason)}`);
+      }
+
+      await log(`   ${options.dryRun ? 'WOULD REMOVE' : 'TO REMOVE'}:`);
+      if (dockerIsolationPlan.remove.length === 0) await log('      (none)');
+      for (const item of dockerIsolationPlan.remove) {
+        await log(`      ${formatDockerIsolationContainerSummary(item)} — ${describeDockerIsolationReason(item.reason)}`);
+      }
+    }
+  }
+
+  await log(`\n📊 Summary: keep ${totals.keepCount} (${formatBytes(totals.keepBytes)}), remove ${totals.removeCount} (${formatBytes(totals.removeBytes)}), docker keep ${dockerIsolationPlan.keep.length}, docker remove ${dockerIsolationPlan.remove.length}`);
 
   // 7. Execute deletion (unless dry-run).
+  const hasTempRemovals = classified.remove.length > 0;
+  const hasDockerRemovals = dockerIsolationPlan.remove.length > 0;
   if (options.dryRun) {
     await log('\n✅ Dry run complete. Re-run without --dry-run to delete.');
-  } else if (classified.remove.length === 0) {
+  } else if (!hasTempRemovals && !hasDockerRemovals) {
     await log('\n✅ Nothing to delete.');
   } else {
     if (!options.force) {
-      console.log(`\n⚠️  This will permanently delete ${classified.remove.length} entries (${formatBytes(totals.removeBytes)}).`);
+      console.log(`\n⚠️  This will permanently delete ${classified.remove.length} entries (${formatBytes(totals.removeBytes)}) and remove ${dockerIsolationPlan.remove.length} Docker isolation containers.`);
       console.log('Type "yes" to confirm, or Ctrl+C to cancel:');
       let answer = '';
       try {
@@ -335,20 +385,39 @@ async function main() {
       }
     }
 
-    await log('\n🗑️  Deleting...');
-    let deleted = 0;
-    let failed = 0;
-    for (const item of classified.remove) {
-      const ok = removePath(item.path);
-      if (ok) {
-        deleted++;
-        await vlog(`   removed ${item.path}`);
-      } else {
-        failed++;
-        await log(`   ⚠️  failed to remove ${item.path}`, { level: 'warn' });
+    if (hasTempRemovals) {
+      await log('\n🗑️  Deleting...');
+      let deleted = 0;
+      let failed = 0;
+      for (const item of classified.remove) {
+        const ok = removePath(item.path);
+        if (ok) {
+          deleted++;
+          await vlog(`   removed ${item.path}`);
+        } else {
+          failed++;
+          await log(`   ⚠️  failed to remove ${item.path}`, { level: 'warn' });
+        }
+      }
+      await log(`\n✅ Deleted ${deleted} entries${failed ? `, ${failed} failed` : ''}.`);
+    }
+
+    if (hasDockerRemovals) {
+      await log('\n🐳 Removing Docker isolation containers...');
+      let removed = 0;
+      let failed = 0;
+      for (const item of dockerIsolationPlan.remove) {
+        const ok = removeDockerContainer(item.name);
+        if (ok) {
+          removed++;
+          await log(`   ✓ ${item.command}`);
+        } else {
+          failed++;
+          await log(`   ⚠️  failed: ${item.command}`, { level: 'warn' });
+        }
       }
+      await log(`\n✅ Removed ${removed} Docker isolation containers${failed ? `, ${failed} failed` : ''}.`);
     }
-    await log(`\n✅ Deleted ${deleted} entries${failed ? `, ${failed} failed` : ''}.`);
   }
 
   // 8. System / Ubuntu cleanup (opt-in).

package/src/cleanup.os.lib.mjs

@@ -19,7 +19,7 @@ import path from 'node:path';
 import os from 'node:os';
 import { execFileSync } from 'node:child_process';
 
-import { extractTaskRefsFromCommand, parseRemoteUrl } from './cleanup.lib.mjs';
+import { extractTaskRefsFromCommand, isDockerIsolationSessionName, parseDockerContainerExitCode, parseRemoteUrl } from './cleanup.lib.mjs';
 import { correlateProcesses, parseStartCommandLogMetadata, redactProcessText } from './process-debug.lib.mjs';
 
 /** Run a command, returning trimmed stdout or null on any failure. */
@@ -303,6 +303,73 @@ export function listScreenSessions() {
   return sessions;
 }
 
+function splitDockerNames(value) {
+  return String(value || '')
+    .split(',')
+    .map(name => name.trim().replace(/^\/+/, ''))
+    .filter(Boolean);
+}
+
+/**
+ * Parse `docker ps -a --format '{{json .}}'` output into docker-isolation task
+ * containers. start-command names native Docker isolation containers after the
+ * session UUID, so unrelated host containers are ignored.
+ *
+ * @param {string} output
+ * @returns {Array<{id: string|null, name: string, image: string|null, state: string, status: string, exitCode: number|null, running: boolean}>}
+ */
+export function parseDockerPsJsonLines(output) {
+  const containers = [];
+  const seen = new Set();
+
+  for (const line of String(output || '').split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+
+    let data;
+    try {
+      data = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+
+    const state = String(data.State || data.state || '')
+      .trim()
+      .toLowerCase();
+    const status = String(data.Status || data.status || '').trim();
+    const exitCode = parseDockerContainerExitCode(status);
+    const running = state === 'running' || /^Up\b/i.test(status);
+
+    for (const name of splitDockerNames(data.Names || data.Name || data.names || data.name)) {
+      if (!isDockerIsolationSessionName(name)) continue;
+      if (seen.has(name)) continue;
+      seen.add(name);
+      containers.push({
+        id: data.ID || data.Id || data.id || null,
+        name,
+        image: data.Image || data.image || null,
+        state,
+        status,
+        exitCode,
+        running,
+      });
+    }
+  }
+
+  return containers;
+}
+
+/**
+ * Enumerate Docker-isolation task containers from the local Docker daemon.
+ * Returns an empty list when docker is unavailable.
+ *
+ * @returns {Array}
+ */
+export function listDockerIsolationContainers() {
+  const out = tryExec('docker', ['ps', '-a', '--format', '{{json .}}']);
+  return out ? parseDockerPsJsonLines(out) : [];
+}
+
 function listStartCommandLogFiles(logRoot, maxFiles) {
   const files = [];
   const stack = [logRoot];
@@ -677,7 +744,7 @@ export function resolvePrHeadBranch(ref) {
  * @param {Object} [options]
  * @param {boolean} [options.verbose=false]
  * @param {boolean} [options.resolveBranches=false] - resolve PR head branches via gh
- * @returns {Promise<Array<{owner, repo, type, number, branch: string|null, sessionId: string|null, sessionName: string|null, status: string|null, workspace: string|null, terminal: boolean, startTime: string|null}>>}
+ * @returns {Promise<Array<{owner, repo, type, number, branch: string|null, sessionId: string|null, sessionName: string|null, status: string|null, exitCode: number|null, isolation: string|null, workspace: string|null, terminal: boolean, startTime: string|null}>>}
  */
 export async function listSessionTasks(options = {}) {
   const { verbose = false, resolveBranches = false } = options;
@@ -711,6 +778,8 @@ export async function listSessionTasks(options = {}) {
         sessionId: session.uuid || null,
         sessionName: session.sessionName || null,
         status: session.status || null,
+        exitCode: session.exitCode ?? null,
+        isolation: session.isolation || null,
         workspace: session.workingDirectory || null,
         terminal,
         startTime: session.startTime || null,
@@ -784,6 +853,18 @@ export function removePath(targetPath) {
   }
 }
 
+/**
+ * Remove a Docker-isolation task container by session UUID. Returns false for
+ * invalid names, missing docker, missing containers, or docker errors.
+ *
+ * @param {string} containerName
+ * @returns {boolean}
+ */
+export function removeDockerContainer(containerName) {
+  if (!isDockerIsolationSessionName(containerName)) return false;
+  return tryExec('docker', ['rm', '-f', containerName], { timeout: 180000, stdio: ['ignore', 'pipe', 'pipe'] }) !== null;
+}
+
 /**
  * System / Ubuntu cleanup actions. Each is opt-in. In dry-run mode the commands
  * are only described, never executed.

package/src/config.lib.mjs

@@ -111,7 +111,7 @@ export const githubLimits = {
 
 // Memory and disk configurations
 export const systemLimits = {
-  minDiskSpaceMb: parseIntWithDefault('HIVE_MIND_MIN_DISK_SPACE_MB', 2048),
+  minDiskSpaceMb: parseIntWithDefault('HIVE_MIND_MIN_DISK_SPACE_MB', 10240),
   defaultPageSizeKb: parseIntWithDefault('HIVE_MIND_DEFAULT_PAGE_SIZE_KB', 16),
 };
 

package/src/hive.mjs

@@ -1444,7 +1444,7 @@ if (isRunningDirectly) {
     } else {
       const systemCheck = await checkSystem(
         {
-          minDiskSpaceMB: argv.minDiskSpace || 2048,
+          minDiskSpaceMB: argv.minDiskSpace || 10240,
           minMemoryMB: 256,
           exitOnFailure: true,
         },

package/src/isolation-runner.lib.mjs

@@ -488,7 +488,7 @@ export function readSessionExitFromLog(logPath, options = {}) {
  */
 async function findStartCommandBinary() {
   try {
-    const result = await $`which $`;
+    const result = await $({ mirror: false })`which $`;
     const path = result.stdout?.toString().trim() || '';
     return path || null;
   } catch {

package/src/memory-check.mjs

@@ -26,7 +26,7 @@ const lib = await import('./lib.mjs');
 const { log: libLog, setLogFile } = lib;
 
 // Function to check available disk space
-export const checkDiskSpace = async (minSpaceMB = 2048, options = {}) => {
+export const checkDiskSpace = async (minSpaceMB = 10240, options = {}) => {
   const log = options.log || libLog;
 
   try {
@@ -289,7 +289,7 @@ export const getResourceSnapshot = async () => {
 
 // Combined system check function
 export const checkSystem = async (requirements = {}, options = {}) => {
-  const { minMemoryMB = 256, minDiskSpaceMB = 2048, exitOnFailure = false } = requirements;
+  const { minMemoryMB = 256, minDiskSpaceMB = 10240, exitOnFailure = false } = requirements;
 
   // Note: log is passed through options to checkDiskSpace and checkRAM
   const results = {
@@ -334,7 +334,7 @@ const createMemoryCheckYargsConfig = yargsInstance =>
       alias: 'd',
       type: 'number',
       description: 'Minimum required disk space in MB',
-      default: 2048,
+      default: 10240,
     })
     .option('exit-on-failure', {
       alias: 'e',

package/src/queue-config.lib.mjs

@@ -22,6 +22,7 @@ import { ensureUseM } from './use-m-bootstrap.lib.mjs';
  *
  * @see https://github.com/link-assistant/hive-mind/issues/1242
  * @see https://github.com/link-assistant/hive-mind/issues/1253
+ * @see https://github.com/link-assistant/hive-mind/issues/1981
  */
 
 // Use use-m to dynamically import modules
@@ -236,9 +237,8 @@ function getThresholdConfig(linoKey, envVarThreshold, envVarStrategy, defaultThr
  * - 'enqueue': Block and wait in queue
  * - 'dequeue-one-at-a-time': Allow one command, block subsequent
  *
- * BREAKING CHANGE: Disk threshold default strategy changed from 'dequeue-one-at-a-time' to 'reject'
- * because the queue is lost on server restart anyway, so there's no point in queueing.
- * To restore old behavior: HIVE_MIND_DISK_STRATEGY=dequeue-one-at-a-time
+ * Issue #1981: disk now defaults to the normal wait/enqueue path at 80% used.
+ * Operators can still choose immediate rejection with HIVE_MIND_DISK_STRATEGY=reject.
  */
 export const QUEUE_CONFIG = {
   // Threshold configurations with value and strategy
@@ -246,10 +246,8 @@ export const QUEUE_CONFIG = {
   thresholds: {
     ram: getThresholdConfig('ram', 'HIVE_MIND_RAM_THRESHOLD', 'HIVE_MIND_RAM_STRATEGY', 0.65, 'enqueue'),
     cpu: getThresholdConfig('cpu', 'HIVE_MIND_CPU_THRESHOLD', 'HIVE_MIND_CPU_STRATEGY', 0.65, 'enqueue'),
-    // BREAKING: disk default changed from 'dequeue-one-at-a-time' to 'reject'
-    // Queue is in RAM and lost on restart - no point enlarging it when disk is full
-    // See: https://github.com/link-assistant/hive-mind/issues/1253
-    disk: getThresholdConfig('disk', 'HIVE_MIND_DISK_THRESHOLD', 'HIVE_MIND_DISK_STRATEGY', 0.9, 'reject'),
+    // Issue #1981: wait instead of immediately rejecting when disk crosses 80%.
+    disk: getThresholdConfig('disk', 'HIVE_MIND_DISK_THRESHOLD', 'HIVE_MIND_DISK_STRATEGY', 0.8, 'enqueue'),
     claude5Hour: getThresholdConfig('claude5Hour', 'HIVE_MIND_CLAUDE_5_HOUR_SESSION_THRESHOLD', 'HIVE_MIND_CLAUDE_5_HOUR_SESSION_STRATEGY', 0.65, 'dequeue-one-at-a-time'),
     claudeWeekly: getThresholdConfig('claudeWeekly', 'HIVE_MIND_CLAUDE_WEEKLY_THRESHOLD', 'HIVE_MIND_CLAUDE_WEEKLY_STRATEGY', 0.97, 'dequeue-one-at-a-time'),
     codex5Hour: getThresholdConfig('codex5Hour', 'HIVE_MIND_CODEX_5_HOUR_SESSION_THRESHOLD', 'HIVE_MIND_CODEX_5_HOUR_SESSION_STRATEGY', 0.65, 'dequeue-one-at-a-time'),
@@ -265,7 +263,7 @@ export const QUEUE_CONFIG = {
   // These are derived from thresholds.{metric}.value
   RAM_THRESHOLD: getThresholdConfig('ram', 'HIVE_MIND_RAM_THRESHOLD', 'HIVE_MIND_RAM_STRATEGY', 0.65, 'enqueue').value,
   CPU_THRESHOLD: getThresholdConfig('cpu', 'HIVE_MIND_CPU_THRESHOLD', 'HIVE_MIND_CPU_STRATEGY', 0.65, 'enqueue').value,
-  DISK_THRESHOLD: getThresholdConfig('disk', 'HIVE_MIND_DISK_THRESHOLD', 'HIVE_MIND_DISK_STRATEGY', 0.9, 'reject').value,
+  DISK_THRESHOLD: getThresholdConfig('disk', 'HIVE_MIND_DISK_THRESHOLD', 'HIVE_MIND_DISK_STRATEGY', 0.8, 'enqueue').value,
   CLAUDE_5_HOUR_SESSION_THRESHOLD: getThresholdConfig('claude5Hour', 'HIVE_MIND_CLAUDE_5_HOUR_SESSION_THRESHOLD', 'HIVE_MIND_CLAUDE_5_HOUR_SESSION_STRATEGY', 0.65, 'dequeue-one-at-a-time').value,
   CLAUDE_WEEKLY_THRESHOLD: getThresholdConfig('claudeWeekly', 'HIVE_MIND_CLAUDE_WEEKLY_THRESHOLD', 'HIVE_MIND_CLAUDE_WEEKLY_STRATEGY', 0.97, 'dequeue-one-at-a-time').value,
   CODEX_5_HOUR_SESSION_THRESHOLD: getThresholdConfig('codex5Hour', 'HIVE_MIND_CODEX_5_HOUR_SESSION_THRESHOLD', 'HIVE_MIND_CODEX_5_HOUR_SESSION_STRATEGY', 0.65, 'dequeue-one-at-a-time').value,

package/src/solve.config.lib.mjs

@@ -289,8 +289,8 @@ export const SOLVE_OPTION_DEFINITIONS = {
   },
   'min-disk-space': {
     type: 'number',
-    description: 'Minimum required disk space in MB (default: 2048)',
-    default: 2048,
+    description: 'Minimum required disk space in MB (default: 10240)',
+    default: 10240,
   },
   'log-dir': {
     type: 'string',

package/src/solve.mjs

@@ -248,7 +248,7 @@ if (argv.planModel) {
 const skipToolConnectionCheck = argv.dryRun || argv.skipToolConnectionCheck || argv.toolConnectionCheck === false;
 const { cascadePlaywrightMcpDisable, ensureSolvePlaywrightMcpReady } = await import('./playwright-mcp.lib.mjs');
 await cascadePlaywrightMcpDisable(argv, log);
-if (!(await performSystemChecks(argv.minDiskSpace || 2048, skipToolConnectionCheck, argv.model, argv))) {
+if (!(await performSystemChecks(argv.minDiskSpace || 10240, skipToolConnectionCheck, argv.model, argv))) {
   await safeExit(1, 'System checks failed');
 }
 // Playwright MCP preflight is local/free and stays independent from paid tool connection checks.

package/src/solve.validation.lib.mjs

@@ -54,7 +54,7 @@ const { parseResetTime: parseResetTimeToDate } = usageLimitLib;
 const { validateClaudeConnection } = claudeLib;
 
 // Wrapper function for disk space check using imported module
-const checkDiskSpace = async (minSpaceMB = 2048) => {
+const checkDiskSpace = async (minSpaceMB = 10240) => {
   const result = await memoryCheck.checkDiskSpace(minSpaceMB, { log });
   return result.success;
 };
@@ -216,7 +216,7 @@ export const validateContinueOnlyOnFeedback = async (argv, isPrUrl, isIssueUrl)
 // Perform all system checks (disk space, memory, tool connection, GitHub permissions)
 // Note: skipToolConnection only skips the connection check, not model validation
 // Model validation should be done separately before calling this function
-export const performSystemChecks = async (minDiskSpace = 2048, skipToolConnection = false, model = 'sonnet', argv = {}) => {
+export const performSystemChecks = async (minDiskSpace = 10240, skipToolConnection = false, model = 'sonnet', argv = {}) => {
   // Check disk space before proceeding
   const hasEnoughSpace = await checkDiskSpace(minDiskSpace);
   if (!hasEnoughSpace) {

package/src/task.config.lib.mjs

@@ -61,7 +61,7 @@ export const createYargsConfig = yargsInstance =>
       type: 'string',
       description: 'agent-commander isolation mode',
       choices: ['screen', 'none', 'docker'],
-      default: 'screen',
+      default: 'docker',
     })
     .option('screen-name', {
       type: 'string',

package/src/task.mjs

@@ -35,7 +35,7 @@ if (earlyArgs.length === 0 || earlyArgs.includes('--help') || earlyArgs.includes
   console.log('  --split-count      Number of issues to split into [default: 2]');
   console.log('  --tool             AI tool for agent-commander read-only mode (claude, codex, opencode, agent, qwen, gemini) [default: claude]');
   console.log('  --model, -m        Model to use');
-  console.log('  --isolation        agent-commander isolation mode [default: screen]');
+  console.log('  --isolation        agent-commander isolation mode [default: docker]');
   console.log('  --dry-run          Print split output without creating GitHub issues');
   console.log('  --verbose, -v      Enable verbose logging');
   console.log('  --output-format    Output format (text or json) [default: text]');

package/src/telegram-bot.mjs

@@ -102,7 +102,7 @@ const config = yargs(hideBin(process.argv))
   .option('autoStartScreenWatchMessage', { type: 'boolean', description: 'Experimental: auto-start separate /terminal_watch messages for public /solve sessions', alias: 'auto-start-screen-watch-message', default: getenv('TELEGRAM_AUTO_START_SCREEN_WATCH_MESSAGE', getenv('TELEGRAM_AUTO_WATCH_MESSAGE', 'false')) === 'true' })
   // Issue #594: bot-owner toggle for --show-limits virtual option in /solve and /hive.
   .option('showLimits', { type: 'boolean', description: 'Experimental: allow /solve and /hive callers to use --show-limits to embed Claude/Codex usage at start, end, and delta in the completion message', alias: 'show-limits', default: getenv('TELEGRAM_SHOW_LIMITS', 'true') !== 'false' })
-  .option('isolation', { type: 'string', description: "Isolation backend (screen/tmux/docker). Defaults to 'screen' so Telegram-bot work sessions survive bot restarts; pass --isolation '' (or set TELEGRAM_ISOLATION='') to disable.", default: getenv('TELEGRAM_ISOLATION', 'screen') })
+  .option('isolation', { type: 'string', description: "Isolation backend (screen/tmux/docker). Defaults to 'docker' so Telegram-bot work sessions run in Docker isolation; pass --isolation '' (or set TELEGRAM_ISOLATION='') to disable.", default: getenv('TELEGRAM_ISOLATION', 'docker') })
   .help('h')
   .alias('h', 'help')
   .parserConfiguration({

package/src/telegram-solve-queue.lib.mjs

@@ -724,10 +724,11 @@ export class SolveQueue {
    * Default strategies:
    * - RAM: enqueue
    * - CPU: enqueue
-   * - DISK: reject (changed from dequeue-one-at-a-time - queue lost on restart)
+   * - DISK: enqueue (waits until disk drops below the threshold)
    *
    * See: https://github.com/link-assistant/hive-mind/issues/1155
    * See: https://github.com/link-assistant/hive-mind/issues/1253
+   * See: https://github.com/link-assistant/hive-mind/issues/1981
    *
    * @param {number} totalProcessing - Total processing count (queue + external claude processes)
    * @returns {Promise<{ok: boolean, reasons: string[], oneAtATime: boolean, rejected: boolean, rejectReason: string|null}>}

package/src/telegram-start-stop-command.lib.mjs

@@ -584,7 +584,7 @@ export function registerStartStopCommands(bot, options) {
       // immediately and was dispatched to a detached session) but the session
       // monitor still tracks a running isolated session for this URL, forward
       // CTRL+C to its start-command UUID. This is the common case for tasks
-      // that begin executing right away with `--isolation screen`.
+      // that begin executing right away with an isolation backend.
       const queueHasTask = lookup.action === 'cancel-queued' || lookup.action === 'stop-running';
       if (!queueHasTask && runningSession?.stoppable && runningSession.sessionId) {
         VERBOSE && console.log(`[VERBOSE] /stop: forwarding CTRL+C to tracked session ${runningSession.sessionId} for ${url} (queue action=${lookup.action})`);
@@ -597,7 +597,7 @@ export function registerStartStopCommands(bot, options) {
         // running-but-non-stoppable (non-isolation) session, say so; otherwise
         // fall back to the UUID hint.
         if (runningSession) {
-          await ctx.reply(`⚠️ Found a running task for ${url}, but it was not started with an isolation backend, so \`/stop\` cannot forward CTRL+C to it.\n\nNext time you can run the command with \`--isolation screen\` to make this task interruptible via \`/stop\`.`, {
+          await ctx.reply(`⚠️ Found a running task for ${url}, but it was not started with an isolation backend, so \`/stop\` cannot forward CTRL+C to it.\n\nNext time run it with the default isolation backend or pass \`--isolation docker\` to make this task interruptible via \`/stop\`.`, {
             parse_mode: 'Markdown',
             reply_to_message_id: message.message_id,
           });
@@ -615,13 +615,13 @@ export function registerStartStopCommands(bot, options) {
         // have forwarded CTRL+C above). If it tracked a non-isolation session,
         // explain why it can't be stopped; otherwise report not found.
         if (runningSession) {
-          await ctx.reply(`⚠️ Found a running task for ${url}, but it was not started with an isolation backend, so \`/stop\` cannot forward CTRL+C to it.\n\nNext time you can run the command with \`--isolation screen\` to make this task interruptible via \`/stop\`.`, {
+          await ctx.reply(`⚠️ Found a running task for ${url}, but it was not started with an isolation backend, so \`/stop\` cannot forward CTRL+C to it.\n\nNext time run it with the default isolation backend or pass \`--isolation docker\` to make this task interruptible via \`/stop\`.`, {
             parse_mode: 'Markdown',
             reply_to_message_id: message.message_id,
           });
           return;
         }
-        await ctx.reply(`ℹ️ No queued or running task found for ${url}.\n\nIf the task is running with \`--isolation screen\`, try \`/stop <UUID>\` (the UUID is shown in the bot's session-id message).`, {
+        await ctx.reply(`ℹ️ No queued or running task found for ${url}.\n\nIf the task is running with an isolation backend, try \`/stop <UUID>\` (the UUID is shown in the bot's session-id message).`, {
           parse_mode: 'Markdown',
           reply_to_message_id: message.message_id,
         });
@@ -655,7 +655,7 @@ export function registerStartStopCommands(bot, options) {
       // running-not-isolated: a started, non-isolated screen session. We
       // could shell out to `screen -X -S <name> stuff $'\003'`, but that's
       // brittle and out of scope for #1780. Tell the user how to recover.
-      await ctx.reply(`⚠️ Found a running task for ${url}, but it was not started with an isolation backend, so \`/stop\` cannot forward CTRL+C to it.\n\nNext time you can run the command with \`--isolation screen\` to make this task interruptible via \`/stop\`.`, {
+      await ctx.reply(`⚠️ Found a running task for ${url}, but it was not started with an isolation backend, so \`/stop\` cannot forward CTRL+C to it.\n\nNext time run it with the default isolation backend or pass \`--isolation docker\` to make this task interruptible via \`/stop\`.`, {
         parse_mode: 'Markdown',
         reply_to_message_id: message.message_id,
       });