@link-assistant/hive-mind 2.0.8 → 2.0.10

package/CHANGELOG.md

@@ -1,5 +1,69 @@
 # @link-assistant/hive-mind
 
+## 2.0.10
+
+### Patch Changes
+
+- e29c83e: Surface the docker-isolation session id + isolation backend immediately when the
+  Telegram bot launches a task, instead of only after the (potentially hour-long)
+  image pull / container startup finishes (#1946). `formatStartingWorkSessionMessage`
+  now renders the `Session:` and `🔒 Isolation:` lines on the `🔄 Starting...`
+  message, and `buildExecuteAndUpdateMessage` tracks the session up front (before
+  awaiting the launch) so the run is addressable by `/watch`, `/log` and `/status`
+  during the whole startup window. A new `untrackSession` helper removes the
+  optimistically-tracked session if the launch fails, so a phantom session is never
+  monitored or resumed. Fix applies to every caller of the shared execution path
+  (`/solve`, `/hive`, `/task`).
+
+  The image-preparation log gap and host-image re-download were reported upstream,
+  fixed there, and are now pinned in this repo's images: `Dockerfile` /
+  `Dockerfile.dind` bump `start-command` `0.29.1` → `0.29.2` (link-foundation/start#138
+  — the `docker pull`/dind-boot phase is now recorded in the `$` session log), and
+  `Dockerfile.dind` bumps its base from `konard/box-dind:2.3.2` → `2.3.5`
+  (link-foundation/box#106 — the dind entrypoint now verifies host-image passthrough
+  actually seeded the nested daemon instead of silently re-downloading ~30 GB). A
+  deep case study is in `docs/case-studies/issue-1946/`.
+
+- 4fcdb9a: fix(auto-merge): treat timeout-cancelled CI as a failure and never finish a session with no log when `--attach-logs` is enabled (#1952)
+
+  A job that hits its `timeout-minutes` limit surfaces as a **check-run** with
+  conclusion `cancelled`, but the **parent workflow run** concludes `failure`.
+  `getDetailedCIStatus` only inspects check-runs, so the auto-merge loop saw the
+  lone `cancelled` check, posted a **"Cancelled CI/CD Requires Review"** comment and
+  stopped — even though the workflow run had failed and other jobs in it had failed
+  too. The cancelled branch of `getMergeBlockers` now cross-references the workflow
+  runs for the commit SHA via a new pure helper
+  `classifyCancelledCIByWorkflowRuns` (`src/cancelled-ci-rerun.lib.mjs`):
+  - a run still queued/in-progress → `ci_pending` (wait until **all** checks reach a
+    terminal state before auto-restarting);
+  - any completed `failure`/`timed_out`/`startup_failure` run → `ci_failure` (the AI
+    is restarted to fix it, instead of stopping for human review);
+  - otherwise → the original re-triggerable `ci_cancelled` flow (genuine manual
+    cancellation). The "requires review" stop path is skipped whenever a `ci_failure`
+    blocker coexists, and `startup_failure` is now counted as a failing run in the
+    branch-health check too.
+
+  Separately, the same session finished with **no log attached** despite
+  `--attach-logs` being enabled, because every attach path in `solve.mjs` is
+  conditional and the stop-for-review exits can return before any iteration uploads.
+  `attachLogToGitHub` now records a process-global `logAttachedToGitHub` flag on
+  every successful upload, and a final safety net (`attachFinalLogIfMissing` in the
+  new `src/attach-logs-guarantee.lib.mjs`) attaches the cumulative session log at the
+  end of `solve.mjs` whenever `--attach-logs` is on, a PR exists, and nothing has
+  attached a log yet. A session can no longer finish with no log when `--attach-logs`
+  is enabled.
+
+  Adds `tests/test-cancelled-timeout-fail-1952.mjs` (13 tests) and
+  `tests/test-attach-logs-safety-net-1952.mjs` (9 tests), plus a deep case study in
+  `docs/case-studies/issue-1952/` reconstructed from the real-world trigger
+  (xlabtg/teleton-agent PR #670).
+
+## 2.0.9
+
+### Patch Changes
+
+- c8b241a: Fix Claude public cost estimates for 1-hour prompt-cache writes by pricing `cache_creation.ephemeral_1h_input_tokens` at the documented 2x input rate instead of the 5-minute cache-write rate.
+
 ## 2.0.8
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "2.0.8",
+  "version": "2.0.10",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",

package/src/attach-logs-guarantee.lib.mjs

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+
+/**
+ * Issue #1952: Guarantee that a working session never finishes with NO log attached when
+ * `--attach-logs` is enabled.
+ *
+ * Every log-attachment path in solve.mjs is conditional and can be skipped on some logic paths:
+ *   - verifyResults() only attaches when the PR is detected as session-owned;
+ *   - the temporary-watch block only runs when there were uncommitted changes;
+ *   - the auto-merge/watch loops attach per AI iteration, but their stop-for-human-review exits
+ *     (billing_limit, ci_cancelled_requires_review, external_review_limit, limit reached) can
+ *     return before any iteration ran — attaching nothing.
+ * Without a final safety net such a session ends with no logs at all, exactly as reported.
+ *
+ * `attachLogToGitHub` records `global.logAttachedToGitHub` on every successful upload anywhere in
+ * the process, so this helper only attaches when nothing else did.
+ *
+ * @see https://github.com/link-assistant/hive-mind/issues/1952
+ */
+
+/**
+ * Attach the final session log if `--attach-logs` is enabled and nothing has attached a log yet.
+ *
+ * @param {Object} params
+ * @param {boolean} params.shouldAttachLogs - Whether `--attach-logs` is enabled.
+ * @param {string|number|null} params.prNumber - Target PR number (no PR ⇒ nothing to attach to).
+ * @param {string} params.owner
+ * @param {string} params.repo
+ * @param {Function} params.$ - command-stream tagged executor.
+ * @param {Function} params.log
+ * @param {Function} params.sanitizeLogContent
+ * @param {Function} params.getLogFile - Returns the path to the cumulative session log.
+ * @param {Function} params.attachLogToGitHub
+ * @param {Object} params.argv
+ * @param {string|null} [params.sessionId]
+ * @param {string|null} [params.tempDir]
+ * @param {number|null} [params.anthropicTotalCostUSD]
+ * @param {Object|null} [params.resultModelUsage]
+ * @param {Object} [params.globalState] - Defaults to the process `global`; injectable for tests.
+ * @returns {Promise<boolean>} `true` if a log has been attached (by this helper or earlier).
+ */
+export const attachFinalLogIfMissing = async ({ shouldAttachLogs, prNumber, owner, repo, $, log, sanitizeLogContent, getLogFile, attachLogToGitHub, argv, sessionId = null, tempDir = null, anthropicTotalCostUSD = null, resultModelUsage = null, globalState = global }) => {
+  // Only fire as a last resort: --attach-logs enabled, a PR to attach to, and nothing attached yet.
+  if (!shouldAttachLogs || !prNumber || globalState.logAttachedToGitHub) {
+    return globalState.logAttachedToGitHub === true;
+  }
+
+  await log('');
+  await log('📎 No session log was attached yet — attaching final log (--attach-logs safety net)...');
+  try {
+    const logUploadSuccess = await attachLogToGitHub({
+      logFile: getLogFile(),
+      targetType: 'pr',
+      targetNumber: prNumber,
+      owner,
+      repo,
+      $,
+      log,
+      sanitizeLogContent,
+      verbose: argv?.verbose,
+      sessionId,
+      tempDir,
+      anthropicTotalCostUSD,
+      argv,
+      requestedModel: argv?.originalModel || argv?.model,
+      tool: argv?.tool || 'claude',
+      resultModelUsage,
+    });
+    if (logUploadSuccess) {
+      await log('✅ Final working session log attached');
+    } else {
+      await log('⚠️  Final log attachment did not succeed (see messages above)', { level: 'warning' });
+    }
+  } catch (uploadError) {
+    await log(`⚠️  Error attaching final log: ${uploadError.message}`, { level: 'warning' });
+  }
+
+  return globalState.logAttachedToGitHub === true;
+};

package/src/cancelled-ci-rerun.lib.mjs

@@ -15,10 +15,81 @@ import { CANCELLED_CI_REVIEW_MARKER } from './tool-comments.lib.mjs';
 
 const CANCELLED_OR_STALE_CONCLUSIONS = new Set(['cancelled', 'stale']);
 
-export { CANCELLED_CI_REVIEW_MARKER };
+/**
+ * Issue #1952: Workflow-run conclusions that represent a genuine CI failure rather than a
+ * re-triggerable cancellation.
+ *
+ * GitHub surfaces a job that hit its `timeout-minutes` limit as a check-run with
+ * `conclusion: 'cancelled'`, but the parent workflow_run concludes `'failure'` (a step that
+ * exceeds `timeout-minutes` likewise produces `'failure'`; an infrastructure/setup error
+ * produces `'startup_failure'`; the legacy max-execution timeout produces `'timed_out'`).
+ *
+ * `getDetailedCIStatus` only inspects check-runs, so it cannot tell a timeout failure
+ * (check-run cancelled + workflow_run failed) apart from a deliberate manual/concurrency
+ * cancellation (check-run cancelled + workflow_run cancelled). Cross-referencing the
+ * workflow-run conclusion lets the caller treat a timeout/failure as a CI failure (which the
+ * AI should fix / auto-restart) instead of a re-triggerable cancellation that stops for human
+ * review.
+ *
+ * @see https://github.com/link-assistant/hive-mind/issues/1952
+ */
+const FAILURE_LIKE_WORKFLOW_RUN_CONCLUSIONS = new Set(['failure', 'timed_out', 'startup_failure']);
+
+export { CANCELLED_CI_REVIEW_MARKER, FAILURE_LIKE_WORKFLOW_RUN_CONCLUSIONS };
 
 export const getRetriggerableWorkflowRuns = (runs = []) => runs.filter(run => CANCELLED_OR_STALE_CONCLUSIONS.has(run?.conclusion));
 
+/**
+ * Issue #1952: Workflow runs that have not yet reached a terminal state.
+ *
+ * The issue requires waiting "until all checks are success, fail or cancelled, to auto
+ * restart". Even when every check-run already looks cancelled, a workflow run may still be
+ * `queued`/`in_progress` (e.g. a retrying matrix leg), so the auto-merge loop must keep
+ * waiting rather than prematurely classifying the result.
+ *
+ * @param {Array<{status?: string}>} runs - Workflow runs for the commit SHA.
+ * @returns {Array} Runs whose `status` is not `'completed'`.
+ */
+export const getIncompleteWorkflowRuns = (runs = []) => runs.filter(run => run?.status && run.status !== 'completed');
+
+/**
+ * Issue #1952: Completed workflow runs whose conclusion represents a genuine failure
+ * (failure / timed_out / startup_failure), including the timeout-cancellation case.
+ *
+ * @param {Array<{status?: string, conclusion?: string}>} runs - Workflow runs for the commit SHA.
+ * @returns {Array} Completed runs with a failure-like conclusion.
+ */
+export const getFailedWorkflowRuns = (runs = []) => runs.filter(run => run?.status === 'completed' && FAILURE_LIKE_WORKFLOW_RUN_CONCLUSIONS.has(run?.conclusion));
+
+/**
+ * Issue #1952: Decide how a "cancelled" CI status (per check-runs) should be reclassified
+ * after cross-referencing the workflow runs for the same commit SHA.
+ *
+ * - `pending`  → at least one workflow run is still queued/in progress; keep waiting so we only
+ *                act once every check has reached a terminal state.
+ * - `failure`  → at least one completed workflow run failed/timed out/failed to start; the
+ *                cancellation reflects a real failure (e.g. a job hit `timeout-minutes`) and must
+ *                be treated as a CI failure, not a re-triggerable cancellation.
+ * - `cancelled`→ no failures and nothing pending; this is a genuine re-triggerable cancellation
+ *                (manual cancel, concurrency cancel, stale) that the existing rerun flow handles.
+ *
+ * @param {{runs?: Array}} params
+ * @returns {{classification: 'pending'|'failure'|'cancelled', incompleteRuns: Array, failedRuns: Array}}
+ */
+export const classifyCancelledCIByWorkflowRuns = ({ runs = [] } = {}) => {
+  const incompleteRuns = getIncompleteWorkflowRuns(runs);
+  if (incompleteRuns.length > 0) {
+    return { classification: 'pending', incompleteRuns, failedRuns: [] };
+  }
+
+  const failedRuns = getFailedWorkflowRuns(runs);
+  if (failedRuns.length > 0) {
+    return { classification: 'failure', incompleteRuns, failedRuns };
+  }
+
+  return { classification: 'cancelled', incompleteRuns, failedRuns };
+};
+
 export const shouldStopForCancelledCIReview = ({ retriggerableRuns = [], rerunTriggered = false, rerunFailures = [] }) => {
   if (rerunTriggered) {
     return false;

package/src/claude.budget-stats.lib.mjs

@@ -111,17 +111,27 @@ export const displayModelUsage = async (usage, log) => {
     await log('');
     await log('      Cost Calculation (USD):');
     const breakdown = usage.costBreakdown;
-    const types = [
-      { key: 'input', label: 'Input' },
-      { key: 'cacheWrite', label: 'Cache write' },
-      { key: 'cacheRead', label: 'Cache read' },
-      { key: 'output', label: 'Output' },
-    ];
-    for (const { key, label } of types) {
-      if (breakdown[key].tokens > 0) {
-        await log(`        ${label}: ${formatNumber(breakdown[key].tokens)} tokens × $${breakdown[key].costPerMillion}/M = $${new Decimal(breakdown[key].cost).toFixed(6)}`);
+    if (breakdown.input.tokens > 0) {
+      await log(`        Input: ${formatNumber(breakdown.input.tokens)} tokens × $${breakdown.input.costPerMillion}/M = $${new Decimal(breakdown.input.cost).toFixed(6)}`);
+    }
+    if (breakdown.cacheWrite?.tokens > 0) {
+      if (breakdown.cacheWrite.hasExplicitTtlSplit) {
+        if (breakdown.cacheWrite5m.tokens > 0) {
+          await log(`        Cache write (5m): ${formatNumber(breakdown.cacheWrite5m.tokens)} tokens × $${breakdown.cacheWrite5m.costPerMillion}/M = $${new Decimal(breakdown.cacheWrite5m.cost).toFixed(6)}`);
+        }
+        if (breakdown.cacheWrite1h.tokens > 0) {
+          await log(`        Cache write (1h): ${formatNumber(breakdown.cacheWrite1h.tokens)} tokens × $${breakdown.cacheWrite1h.costPerMillion}/M = $${new Decimal(breakdown.cacheWrite1h.cost).toFixed(6)}`);
+        }
+      } else {
+        await log(`        Cache write: ${formatNumber(breakdown.cacheWrite.tokens)} tokens × $${breakdown.cacheWrite.costPerMillion}/M = $${new Decimal(breakdown.cacheWrite.cost).toFixed(6)}`);
       }
     }
+    if (breakdown.cacheRead.tokens > 0) {
+      await log(`        Cache read: ${formatNumber(breakdown.cacheRead.tokens)} tokens × $${breakdown.cacheRead.costPerMillion}/M = $${new Decimal(breakdown.cacheRead.cost).toFixed(6)}`);
+    }
+    if (breakdown.output.tokens > 0) {
+      await log(`        Output: ${formatNumber(breakdown.output.tokens)} tokens × $${breakdown.output.costPerMillion}/M = $${new Decimal(breakdown.output.cost).toFixed(6)}`);
+    }
     // Issue #1710: itemise server-tool charges so the residual that puzzled
     // readers in PR #1707 ($0.04 web_search) is visible in the breakdown.
     if (breakdown.webSearch && breakdown.webSearch.requests > 0) {

package/src/claude.cost.lib.mjs

@@ -8,12 +8,22 @@
 import Decimal from 'decimal.js-light';
 import { SERVER_TOOL_PRICING_USD } from './anthropic-server-tool-pricing.lib.mjs';
 
+const getCacheWrite5mPrice = cost => cost.cache_write_5m ?? cost.cache_write ?? 0;
+
+const getCacheWrite1hPrice = (cost, cacheWrite5mPrice) => {
+  if (cost.cache_write_1h !== undefined && cost.cache_write_1h !== null) return cost.cache_write_1h;
+  if (cost.input) return new Decimal(cost.input).mul(2).toNumber();
+  if (cacheWrite5mPrice) return new Decimal(cacheWrite5mPrice).mul(1.6).toNumber();
+  return 0;
+};
+
 /**
  * Calculate USD cost for a model's usage with optional detailed breakdown.
  *
  * Cost components (Issue #1600 uses Decimal for precision):
  *   - input        × cost.input        / 1M
- *   - cacheWrite   × cost.cache_write  / 1M
+ *   - cacheWrite5m × cost.cache_write  / 1M
+ *   - cacheWrite1h × (cost.cache_write_1h || cost.input × 2) / 1M
  *   - cacheRead    × cost.cache_read   / 1M
  *   - output       × cost.output       / 1M
  *   - webSearch    × $0.01 / request   (Issue #1710 — see SERVER_TOOL_PRICING_USD)
@@ -32,6 +42,8 @@ export const calculateModelCost = (usage, modelInfo, includeBreakdown = false) =
   const breakdown = {
     input: { tokens: 0, costPerMillion: 0, cost: 0 },
     cacheWrite: { tokens: 0, costPerMillion: 0, cost: 0 },
+    cacheWrite5m: { tokens: 0, costPerMillion: 0, cost: 0 },
+    cacheWrite1h: { tokens: 0, costPerMillion: 0, cost: 0 },
     cacheRead: { tokens: 0, costPerMillion: 0, cost: 0 },
     output: { tokens: 0, costPerMillion: 0, cost: 0 },
     // Issue #1710: server-side tool usage (web_search) is billed per-request,
@@ -47,11 +59,35 @@ export const calculateModelCost = (usage, modelInfo, includeBreakdown = false) =
       cost: new Decimal(usage.inputTokens).div(million).mul(new Decimal(cost.input)).toNumber(),
     };
   }
-  if (usage.cacheCreationTokens && cost.cache_write) {
+  const explicitCacheWrite5mTokens = usage.cacheCreation5mTokens || 0;
+  const explicitCacheWrite1hTokens = usage.cacheCreation1hTokens || 0;
+  const explicitCacheWriteTokens = explicitCacheWrite5mTokens + explicitCacheWrite1hTokens;
+  const cacheWriteTokens = Math.max(usage.cacheCreationTokens || 0, explicitCacheWriteTokens);
+  const hasCacheWriteTtlSplit = explicitCacheWriteTokens > 0;
+  const unsplitCacheWriteTokens = hasCacheWriteTtlSplit ? Math.max(0, cacheWriteTokens - explicitCacheWriteTokens) : cacheWriteTokens;
+  const cacheWrite5mTokens = hasCacheWriteTtlSplit ? explicitCacheWrite5mTokens + unsplitCacheWriteTokens : cacheWriteTokens;
+  const cacheWrite1hTokens = hasCacheWriteTtlSplit ? explicitCacheWrite1hTokens : 0;
+  const cacheWrite5mPrice = getCacheWrite5mPrice(cost);
+  const cacheWrite1hPrice = getCacheWrite1hPrice(cost, cacheWrite5mPrice);
+  if (cacheWriteTokens && (cacheWrite5mPrice || cacheWrite1hPrice)) {
+    const cacheWrite5mCost = new Decimal(cacheWrite5mTokens).div(million).mul(new Decimal(cacheWrite5mPrice)).toNumber();
+    const cacheWrite1hCost = new Decimal(cacheWrite1hTokens).div(million).mul(new Decimal(cacheWrite1hPrice)).toNumber();
+    const cacheWriteCost = new Decimal(cacheWrite5mCost).plus(new Decimal(cacheWrite1hCost)).toNumber();
     breakdown.cacheWrite = {
-      tokens: usage.cacheCreationTokens,
-      costPerMillion: cost.cache_write,
-      cost: new Decimal(usage.cacheCreationTokens).div(million).mul(new Decimal(cost.cache_write)).toNumber(),
+      tokens: cacheWriteTokens,
+      costPerMillion: hasCacheWriteTtlSplit ? new Decimal(cacheWriteCost).div(new Decimal(cacheWriteTokens)).mul(million).toNumber() : cacheWrite5mPrice,
+      cost: cacheWriteCost,
+      hasExplicitTtlSplit: hasCacheWriteTtlSplit,
+    };
+    breakdown.cacheWrite5m = {
+      tokens: cacheWrite5mTokens,
+      costPerMillion: cacheWrite5mPrice,
+      cost: cacheWrite5mCost,
+    };
+    breakdown.cacheWrite1h = {
+      tokens: cacheWrite1hTokens,
+      costPerMillion: cacheWrite1hPrice,
+      cost: cacheWrite1hCost,
     };
   }
   if (usage.cacheReadTokens && cost.cache_read) {

package/src/github-merge-ci.lib.mjs

@@ -222,7 +222,12 @@ export async function checkBranchCIHealth(owner, repo, branch = 'main', options,
     }
 
     // All runs for the latest commit are completed — check for failures
-    const failedRuns = runs.filter(r => r.conclusion === 'failure' || r.conclusion === 'timed_out');
+    // Issue #1952: Treat `startup_failure` as a failure too (a workflow that failed to start is a
+    // genuine failure, not a transient state). `cancelled` is intentionally NOT treated as a
+    // failure here: this branch-health check resolves the HEAD SHA up front (issue #1425), and a
+    // cancelled run on the resolved HEAD is normally a superseded/manual cancellation rather than a
+    // timeout — a timeout surfaces as `failure`/`timed_out` at the workflow-run level and is caught.
+    const failedRuns = runs.filter(r => r.conclusion === 'failure' || r.conclusion === 'timed_out' || r.conclusion === 'startup_failure');
 
     if (failedRuns.length > 0) {
       if (verbose) {

package/src/github.lib.mjs

@@ -790,6 +790,9 @@ ${sessionNote}
             await log(`  ${status.emoji} ${status.label} uploaded to ${targetName} as ${isPublicRepo ? 'public' : 'private'} ${uploadTypeLabel}${chunkInfo}${posted.commentId ? ` (comment id=${posted.commentId})` : ''}`);
             await log(`  🔗 Log URL: ${logUrl}`);
             await log(`  📊 Log size: ${Math.round(logStats.size / 1024)}KB`);
+            // Issue #1952: Record that a session log was attached anywhere in this process so the
+            // top-level --attach-logs safety net can guarantee no session finishes with no logs.
+            global.logAttachedToGitHub = true;
             return true;
           } else {
             await log(`  ❌ Failed to post comment with log link: ${posted.stderr || 'unknown error'}`);
@@ -813,7 +816,12 @@ ${sessionNote}
       }
     } else {
       // Comment fits within limit
-      return await attachRegularComment(options, logComment);
+      const regularOk = await attachRegularComment(options, logComment);
+      // Issue #1952: see note above — mark a successful attach for the --attach-logs safety net.
+      if (regularOk) {
+        global.logAttachedToGitHub = true;
+      }
+      return regularOk;
     }
   } catch (uploadError) {
     // Issue #1212: ENOSPC-specific actionable guidance

package/src/session-monitor.lib.mjs

@@ -194,6 +194,32 @@ export function getTrackedSessionInfo(sessionName) {
   return activeSessions.get(sessionName) || null;
 }
 
+/**
+ * Stop tracking a session that was registered optimistically but never actually
+ * started (e.g. the start-command launch failed). Removes it from the in-memory
+ * map and the durable store without emitting a `session_completed` audit event —
+ * the session never ran, so it has no exit code to record (issue #1946).
+ *
+ * @param {string} sessionName - Name/UUID of the session to drop
+ * @param {boolean} verbose - Whether to log verbose output
+ */
+export function untrackSession(sessionName, verbose = false) {
+  if (!sessionName) return;
+  const sessionInfo = activeSessions.get(sessionName) || null;
+  const existed = activeSessions.delete(sessionName);
+  if (verbose && existed) {
+    console.log(`[VERBOSE] Session ${sessionName} untracked (launch failed before it started)`);
+  }
+  if (sessionStore && isPersistableSession(sessionInfo)) {
+    try {
+      sessionStore.remove(sessionName, { status: 'launch-failed', exitCode: null });
+    } catch (error) {
+      console.error(`[session-monitor] Could not remove untracked session ${sessionName}: ${error.message}`);
+    }
+  }
+  logEvent('session_untracked', { sessionName });
+}
+
 /**
  * Get the number of active sessions being tracked
  * @param {boolean} verbose - Whether to log verbose output

package/src/solve.auto-merge-helpers.lib.mjs

@@ -37,6 +37,12 @@ const { reportError } = sentryLib;
 const githubMergeLib = await import('./github-merge.lib.mjs');
 const { checkPRMergeable, checkForBillingLimitError, getDetailedCIStatus, getWorkflowRunsForSha, getWorkflowRunJobsCount, getActiveRepoWorkflows, getCommitDate, checkWorkflowsHavePRTriggers, checkPreviousPRCommitsHadCI, getActivePRWorkflowRuns } = githubMergeLib;
 
+// Issue #1952: Cross-reference cancelled check-runs against workflow-run conclusions so a
+// job that hit `timeout-minutes` (check-run cancelled + workflow_run failed) is treated as a
+// CI failure rather than a re-triggerable cancellation that stops for human review.
+const cancelledCiRerunLib = await import('./cancelled-ci-rerun.lib.mjs');
+const { classifyCancelledCIByWorkflowRuns } = cancelledCiRerunLib;
+
 /**
  * Issue #1712: Plain-English meaning of GitHub Actions / check-run statuses, so the
  * verbose log explains itself instead of forcing the user to look up GitHub docs.
@@ -816,19 +822,60 @@ export const getMergeBlockers = async (owner, repo, prNumber, verbose = false, c
         billingMessage: billingCheck.message,
       });
     } else {
-      // These need to be re-triggered, NOT treated as AI-fixable failures
+      // Issue #1952: A check-run with conclusion 'cancelled' does NOT always mean a
+      // re-triggerable cancellation. When a job hits its `timeout-minutes` limit GitHub
+      // cancels the job (check-run conclusion 'cancelled') but the parent workflow_run
+      // concludes 'failure'/'timed_out'/'startup_failure'. getDetailedCIStatus only sees the
+      // check-runs, so it reports status='cancelled' and we used to post a "Cancelled CI/CD
+      // Requires Review" comment and stop. Cross-reference the workflow runs for this SHA to
+      // tell the two cases apart:
+      //   - any run still queued/in_progress  → wait (ci_pending) until every check is terminal
+      //   - any completed run failed/timed out → treat as a CI failure (auto-restart the AI)
+      //   - otherwise                          → genuine re-triggerable cancellation (ci_cancelled)
       const cancelledOrStaleChecks = [...ciStatus.cancelledChecks, ...(ciStatus.staleChecks || [])];
       const cancelledDetails = cancelledOrStaleChecks.map(c => {
         const concPart = c.conclusion ? ` [${c.conclusion}]` : '';
         const urlPart = c.html_url ? ` — ${c.html_url}` : '';
         return `${c.name}${concPart}${urlPart}`;
       });
-      blockers.push({
-        type: 'ci_cancelled',
-        message: 'CI/CD checks were cancelled or became stale',
-        details: cancelledDetails,
-        sha: ciStatus.sha,
-      });
+
+      const cancelledWorkflowRuns = await getWorkflowRunsForSha(owner, repo, ciStatus.sha, verbose);
+      const { classification, incompleteRuns, failedRuns } = classifyCancelledCIByWorkflowRuns({ runs: cancelledWorkflowRuns });
+
+      if (classification === 'pending') {
+        // Some checks already show cancelled, but a workflow run is still running — the issue
+        // requires waiting until ALL checks reach a terminal state before auto-restarting.
+        if (verbose) {
+          await log(`[VERBOSE] /merge: PR #${prNumber} has cancelled check-run(s) but ${incompleteRuns.length} workflow run(s) still in progress — waiting for all to reach a terminal state before classifying`);
+        }
+        blockers.push({
+          type: 'ci_pending',
+          message: `Some CI/CD checks are cancelled, but ${incompleteRuns.length} workflow run(s) have not reached a terminal state yet — waiting before deciding`,
+          details: incompleteRuns.map(formatRunLine),
+        });
+      } else if (classification === 'failure') {
+        // The cancellation reflects a real failure (e.g. a job hit `timeout-minutes`). Per
+        // issue #1952 this must be treated as a CI failure so the AI is restarted to fix it,
+        // instead of posting a "requires human review" comment for a re-trigger that would
+        // never make progress.
+        if (verbose) {
+          await log(`[VERBOSE] /merge: PR #${prNumber} cancelled check-run(s) belong to ${failedRuns.length} failed workflow run(s) (conclusions: ${[...new Set(failedRuns.map(r => r.conclusion))].join(', ')}) — treating cancellation as a CI failure`);
+        }
+        await log(formatAligned('❌', 'CI cancelled by failure/timeout:', `${failedRuns.map(r => `${r.name} (${r.conclusion})`).join(', ')}`, 2));
+        blockers.push({
+          type: 'ci_failure',
+          message: 'CI/CD checks were cancelled by a workflow failure or timeout (treated as a failure)',
+          details: [...cancelledDetails, ...failedRuns.map(r => `${r.path || r.name} (${r.conclusion}) — see ${r.html_url}`)],
+        });
+      } else {
+        // Genuine re-triggerable cancellation (manual cancel, concurrency cancel, stale).
+        blockers.push({
+          type: 'ci_cancelled',
+          message: 'CI/CD checks were cancelled or became stale',
+          details: cancelledDetails,
+          sha: ciStatus.sha,
+        });
+      }
     }
   } else if (ciStatus.status === 'failure') {
     // Some checks genuinely failed - check if it's billing limits first

package/src/solve.auto-merge.lib.mjs

@@ -489,7 +489,13 @@ Once the billing issue is resolved, you can re-run the CI checks or push a new c
       // Cancelled checks (e.g., manually cancelled, cancelled by another workflow) should be
       // re-triggered automatically. We should NOT restart the AI for these.
       const cancelledBlocker = blockers.find(b => b.type === 'ci_cancelled');
-      if (cancelledBlocker && !billingBlocker) {
+      // Issue #1952: When a genuine CI failure coexists with cancelled checks, the result is a
+      // failure ("if we still have other fails in the CI/CD checks - it is fail"). Defer to the
+      // ci_failure path (which restarts the AI) instead of attempting a re-trigger and then
+      // stopping for human review — the latter posted a misleading "Cancelled CI/CD Requires
+      // Review" comment even though real failures needed fixing.
+      const ciFailureBlocker = blockers.find(b => b.type === 'ci_failure');
+      if (cancelledBlocker && !billingBlocker && !ciFailureBlocker) {
         await log('');
         await log(formatAligned('🔄', 'CANCELLED CI/CD CHECKS DETECTED', ''));
         await log(formatAligned('', 'Cancelled checks:', (cancelledBlocker.details || []).join(', '), 2));
@@ -570,7 +576,9 @@ Once the billing issue is resolved, you can re-run the CI checks or push a new c
       // Reason 2: CI failures (only if NOT a billing limit issue and NOT just cancelled)
       // Only restart AI when we have genuine code failures (real feedback to act on)
       const externalReviewLimitBlocker = blockers.find(b => b.type === 'external_review_limit');
-      const ciBlocker = blockers.find(b => b.type === 'ci_failure');
+      // Issue #1952: Reuse the ci_failure blocker resolved above so cancelled+failure mixes
+      // take the restart path rather than the cancelled-review path.
+      const ciBlocker = ciFailureBlocker;
       const hasMergeConflictBlocker = blockers.some(b => b.type === 'not_mergeable' && b.message?.includes('conflicts'));
       if (externalReviewLimitBlocker && !ciBlocker && !billingBlocker && !cancelledBlocker && !hasNewComments && !hasUncommittedChanges && !hasMergeConflictBlocker) {
         await log('');

package/src/solve.mjs

@@ -58,6 +58,7 @@ const { setupRepositoryAndClone, verifyDefaultBranchAndStatus } = await import('
 const { recordAfterCloneSize, recordAfterAgentSize } = await import('./solve.disk-diagnostics.lib.mjs');
 const { createOrCheckoutBranch } = await import('./solve.branch.lib.mjs');
 const { startWorkSession, endWorkSession, SESSION_TYPES } = await import('./solve.session.lib.mjs');
+const { attachFinalLogIfMissing } = await import('./attach-logs-guarantee.lib.mjs'); // Issue #1952
 // Issue #1625: centralized markers + tracked comment posting for solve.mjs's
 // own usage-limit notifications (so they're excluded from the
 // "did the AI post anything?" check in --auto-attach-solution-summary).
@@ -1430,13 +1431,11 @@ try {
         }
       }
     }
-
-    // If auto-merge succeeded, update logs attached status
-    if (autoMergeResult && autoMergeResult.success) {
-      logsAttached = true;
-    }
   }
 
+  // Issue #1952: Final --attach-logs safety net + logsAttached reconciliation. See attach-logs-guarantee.lib.mjs.
+  logsAttached = (await attachFinalLogIfMissing({ shouldAttachLogs, prNumber, owner, repo, $, log, sanitizeLogContent, getLogFile, attachLogToGitHub, argv, sessionId, tempDir, anthropicTotalCostUSD, resultModelUsage })) || logsAttached;
+
   // Issue #1516: Cleanup after all signals (was before verifyResults, caused premature commits)
   await cleanupClaudeFile(tempDir, branchName, claudeCommitHash, argv);
 

package/src/telegram-bot.mjs

@@ -328,7 +328,7 @@ const { isOldMessage: _isOldMessage, isGroupChat: _isGroupChat, isChatAuthorized
 const { installTelegramFormattingFallback, isTelegramFormattingError, isTelegramMessageTooLongError, safeEditMessageText, safeReply, TELEGRAM_TEXT_LIMIT } = await import('./telegram-safe-reply.lib.mjs');
 const { registerTerminalWatchCommand, startAutoTerminalWatchForSession } = await import('./telegram-terminal-watch-command.lib.mjs');
 const { launchBotWithRetry } = await import('./telegram-bot-launcher.lib.mjs');
-const { trackSession, startSessionMonitoring, hasActiveSessionForUrlAsync, findStoppableSessionByUrl, setSessionStore, setSessionLogger, resumeTrackedSessions, getActiveSessionCount } = await import('./session-monitor.lib.mjs');
+const { trackSession, untrackSession, startSessionMonitoring, hasActiveSessionForUrlAsync, findStoppableSessionByUrl, setSessionStore, setSessionLogger, resumeTrackedSessions, getActiveSessionCount } = await import('./session-monitor.lib.mjs');
 const { createBotLogger } = await import('./bot-logger.lib.mjs');
 const { createSessionStore } = await import('./session-store.lib.mjs');
 const { createHeartbeat, resumeSessionsOnLaunch, createShutdownHandler } = await import('./bot-lifecycle.lib.mjs');
@@ -524,7 +524,7 @@ async function validateGitHubUrl(args, options = {}) {
   return { valid: true, parsed, normalizedUrl: url };
 }
 
-const executeAndUpdateMessage = buildExecuteAndUpdateMessage({ resolveIsolation, ISOLATION_BACKEND, isolationRunner, VERBOSE, executeStartScreen, trackSession, AUTO_WATCH_MESSAGE, startAutoTerminalWatchForSession, bot, formatExecutingWorkSessionMessage });
+const executeAndUpdateMessage = buildExecuteAndUpdateMessage({ resolveIsolation, ISOLATION_BACKEND, isolationRunner, VERBOSE, executeStartScreen, trackSession, untrackSession, AUTO_WATCH_MESSAGE, startAutoTerminalWatchForSession, bot, formatExecutingWorkSessionMessage, formatStartingWorkSessionMessage });
 
 bot.command('help', async ctx => {
   VERBOSE && console.log('[VERBOSE] /help command received');

package/src/telegram-command-execution.lib.mjs

@@ -98,7 +98,7 @@ function executeWithCommand(startScreenCmd, command, args, verbose = false) {
  * @returns {Function} executeAndUpdateMessage(ctx, startingMessage, commandName, args, infoBlock, perCommandIsolation, tool, urlContext, sessionExtras)
  */
 export function buildExecuteAndUpdateMessage(deps) {
-  const { resolveIsolation, ISOLATION_BACKEND, isolationRunner, VERBOSE, executeStartScreen, trackSession, AUTO_WATCH_MESSAGE, startAutoTerminalWatchForSession, bot, formatExecutingWorkSessionMessage } = deps;
+  const { resolveIsolation, ISOLATION_BACKEND, isolationRunner, VERBOSE, executeStartScreen, trackSession, untrackSession, AUTO_WATCH_MESSAGE, startAutoTerminalWatchForSession, bot, formatExecutingWorkSessionMessage, formatStartingWorkSessionMessage } = deps;
   return async function executeAndUpdateMessage(ctx, startingMessage, commandName, args, infoBlock, perCommandIsolation = null, tool = 'claude', urlContext = null, { showLimits = false, limitsAtStart = null, locale = null } = {}) {
     const { chat, message_id: msgId } = startingMessage;
     const safeEdit = async text => {
@@ -115,12 +115,23 @@ export function buildExecuteAndUpdateMessage(deps) {
     const iso = await resolveIsolation(perCommandIsolation, ISOLATION_BACKEND, isolationRunner, VERBOSE);
     let result, session, sessionInfo;
     if (iso) {
+      // Issue #1946: the isolation session UUID is generated locally, *before*
+      // start-command launches the (potentially multi-GB, slow) container. Show
+      // the UUID + isolation backend and track the session immediately so it is
+      // addressable by /watch, /log and /status during the whole startup window
+      // instead of only after the blocking launch returns. start-command runs the
+      // container detached, so the await below does not block other bot commands.
       session = iso.runner.generateSessionId();
       VERBOSE && console.log(`[VERBOSE] Using isolation (${iso.backend}), session: ${session}`);
+      sessionInfo = { ...baseSessionInfo, isolationBackend: iso.backend, sessionId: session };
+      trackSession(session, sessionInfo, VERBOSE);
+      await safeEdit(formatStartingWorkSessionMessage({ sessionName: session, isolationBackend: iso.backend, infoBlock, locale }));
       result = await iso.runner.executeWithIsolation(commandName, args, { backend: iso.backend, sessionId: session, tool, verbose: VERBOSE });
-      if (result.success) {
-        sessionInfo = { ...baseSessionInfo, isolationBackend: iso.backend, sessionId: session };
-        trackSession(session, sessionInfo, VERBOSE);
+      if (!result.success) {
+        // The launch never produced a live container — drop the optimistic
+        // tracking so a phantom session is not monitored or resumed.
+        if (typeof untrackSession === 'function') untrackSession(session, VERBOSE);
+        sessionInfo = undefined;
       }
     } else {
       result = await executeStartScreen(commandName, args);

package/src/work-session-formatting.lib.mjs

@@ -65,9 +65,19 @@ export function formatSessionDurationSeconds(seconds) {
   return parts.join(' ');
 }
 
-export function formatStartingWorkSessionMessage({ infoBlock = '', locale = null } = {}) {
+export function formatStartingWorkSessionMessage({ sessionName = null, isolationBackend = null, infoBlock = '', locale = null } = {}) {
+  const header = text(locale, 'telegram.work_session_starting', '🔄 Starting...');
   const details = infoBlock ? `\n\n${infoBlock}` : '';
-  return `${text(locale, 'telegram.work_session_starting', '🔄 Starting...')}${details}`;
+  // Issue #1946: for isolation backends the session UUID is known *before* the
+  // (potentially long, multi-GB) container/image preparation finishes, so
+  // surface it together with the isolation backend right away. This makes the
+  // session addressable by /watch, /log and /status while it is still starting,
+  // instead of leaving an info-less "Starting..." up for the whole image pull.
+  if (!sessionName) return `${header}${details}`;
+  const sessionLabel = text(locale, 'telegram.session_label', 'Session');
+  const isolationLabel = text(locale, 'telegram.isolation_label', 'Isolation');
+  const isolationInfo = isolationBackend ? `\n🔒 ${isolationLabel}: \`${isolationBackend}\`` : '';
+  return `${header}\n\n📊 ${sessionLabel}: \`${sessionName}\`${isolationInfo}${details}`;
 }
 
 export function formatExecutingWorkSessionMessage({ sessionName = 'unknown', isolationBackend = null, infoBlock = '', locale = null } = {}) {