@link-assistant/hive-mind 2.0.9 → 2.0.11

package/CHANGELOG.md

@@ -1,5 +1,99 @@
 # @link-assistant/hive-mind
 
+## 2.0.11
+
+### Patch Changes
+
+- a29902a: fix(codex): don't fail a completed turn on echoed fixture content; expand transient network auto-retry (#1955)
+
+  A `--tool codex` run failed with `❌ Codex emitted error event: Network lookup
+skipped in fixture` even though the codex session **succeeded** (`turn.completed=1`,
+  `turn.failed=0`, working tree clean, full pricing produced). The phrase was not a
+  real error: while building an unrelated NDJSON adapter, the codex agent printed a
+  **test fixture** to its terminal. In verbose mode (`RUST_LOG=debug`) the codex CLI
+  renders OTEL telemetry (`codex_otel.log_only`, `event.name="codex.tool_result"`)
+  to stderr, including a raw `Output:` dump of each command's stdout. Our line-by-line
+  parser — which consumes stderr as well as stdout — `JSON.parse`d the fixture line
+  `{"type":"error","message":"Network lookup skipped in fixture"}` and bucketed it as
+  a genuine codex stream error.
+  - `getCodexErrorEventSummary()` (`src/codex.lib.mjs`) now treats any stray
+    **non-`turn`** error event as non-fatal whenever the turn completed successfully
+    (a `turn.completed` with no `turn.failed`). `turn.failed` remains the authoritative
+    failure signal and is never suppressed; suppressed strays are still recorded in
+    `ignoredEvents` (and logged per-event in verbose mode) for observability. This is
+    transport-agnostic — it fixes the false positive regardless of how the echo
+    arrived.
+  - `classifyRetryableError()` (`src/tool-retry.lib.mjs`, shared by
+    claude/codex/gemini/qwen/opencode) now classifies the full set of genuinely
+    transient network faults as retryable (`isCapacity:false`): DNS failures
+    (`ENOTFOUND`, `EAI_AGAIN`, "temporary failure in name resolution"), connection
+    faults (`ETIMEDOUT`, `ECONNREFUSED`, `EHOSTUNREACH`, `ENETUNREACH`, `EPIPE`,
+    "no route to host", "network is unreachable"), and gateway errors (502/504 and
+    Cloudflare `52x`); the 503 branch was broadened to "service unavailable". Aligns
+    with AWS retry guidance, RFC 9110 §15.6, and the getaddrinfo(3) man-page. The
+    fixture phrase itself is explicitly guarded to stay non-retryable.
+
+  Adds `tests/test-issue-1955-codex-fixture-false-positive.mjs` (23 tests) and a deep
+  case study in `docs/case-studies/issue-1955/`.
+
+## 2.0.10
+
+### Patch Changes
+
+- e29c83e: Surface the docker-isolation session id + isolation backend immediately when the
+  Telegram bot launches a task, instead of only after the (potentially hour-long)
+  image pull / container startup finishes (#1946). `formatStartingWorkSessionMessage`
+  now renders the `Session:` and `🔒 Isolation:` lines on the `🔄 Starting...`
+  message, and `buildExecuteAndUpdateMessage` tracks the session up front (before
+  awaiting the launch) so the run is addressable by `/watch`, `/log` and `/status`
+  during the whole startup window. A new `untrackSession` helper removes the
+  optimistically-tracked session if the launch fails, so a phantom session is never
+  monitored or resumed. Fix applies to every caller of the shared execution path
+  (`/solve`, `/hive`, `/task`).
+
+  The image-preparation log gap and host-image re-download were reported upstream,
+  fixed there, and are now pinned in this repo's images: `Dockerfile` /
+  `Dockerfile.dind` bump `start-command` `0.29.1` → `0.29.2` (link-foundation/start#138
+  — the `docker pull`/dind-boot phase is now recorded in the `$` session log), and
+  `Dockerfile.dind` bumps its base from `konard/box-dind:2.3.2` → `2.3.5`
+  (link-foundation/box#106 — the dind entrypoint now verifies host-image passthrough
+  actually seeded the nested daemon instead of silently re-downloading ~30 GB). A
+  deep case study is in `docs/case-studies/issue-1946/`.
+
+- 4fcdb9a: fix(auto-merge): treat timeout-cancelled CI as a failure and never finish a session with no log when `--attach-logs` is enabled (#1952)
+
+  A job that hits its `timeout-minutes` limit surfaces as a **check-run** with
+  conclusion `cancelled`, but the **parent workflow run** concludes `failure`.
+  `getDetailedCIStatus` only inspects check-runs, so the auto-merge loop saw the
+  lone `cancelled` check, posted a **"Cancelled CI/CD Requires Review"** comment and
+  stopped — even though the workflow run had failed and other jobs in it had failed
+  too. The cancelled branch of `getMergeBlockers` now cross-references the workflow
+  runs for the commit SHA via a new pure helper
+  `classifyCancelledCIByWorkflowRuns` (`src/cancelled-ci-rerun.lib.mjs`):
+  - a run still queued/in-progress → `ci_pending` (wait until **all** checks reach a
+    terminal state before auto-restarting);
+  - any completed `failure`/`timed_out`/`startup_failure` run → `ci_failure` (the AI
+    is restarted to fix it, instead of stopping for human review);
+  - otherwise → the original re-triggerable `ci_cancelled` flow (genuine manual
+    cancellation). The "requires review" stop path is skipped whenever a `ci_failure`
+    blocker coexists, and `startup_failure` is now counted as a failing run in the
+    branch-health check too.
+
+  Separately, the same session finished with **no log attached** despite
+  `--attach-logs` being enabled, because every attach path in `solve.mjs` is
+  conditional and the stop-for-review exits can return before any iteration uploads.
+  `attachLogToGitHub` now records a process-global `logAttachedToGitHub` flag on
+  every successful upload, and a final safety net (`attachFinalLogIfMissing` in the
+  new `src/attach-logs-guarantee.lib.mjs`) attaches the cumulative session log at the
+  end of `solve.mjs` whenever `--attach-logs` is on, a PR exists, and nothing has
+  attached a log yet. A session can no longer finish with no log when `--attach-logs`
+  is enabled.
+
+  Adds `tests/test-cancelled-timeout-fail-1952.mjs` (13 tests) and
+  `tests/test-attach-logs-safety-net-1952.mjs` (9 tests), plus a deep case study in
+  `docs/case-studies/issue-1952/` reconstructed from the real-world trigger
+  (xlabtg/teleton-agent PR #670).
+
 ## 2.0.9
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "2.0.9",
+  "version": "2.0.11",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",

package/src/attach-logs-guarantee.lib.mjs

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+
+/**
+ * Issue #1952: Guarantee that a working session never finishes with NO log attached when
+ * `--attach-logs` is enabled.
+ *
+ * Every log-attachment path in solve.mjs is conditional and can be skipped on some logic paths:
+ *   - verifyResults() only attaches when the PR is detected as session-owned;
+ *   - the temporary-watch block only runs when there were uncommitted changes;
+ *   - the auto-merge/watch loops attach per AI iteration, but their stop-for-human-review exits
+ *     (billing_limit, ci_cancelled_requires_review, external_review_limit, limit reached) can
+ *     return before any iteration ran — attaching nothing.
+ * Without a final safety net such a session ends with no logs at all, exactly as reported.
+ *
+ * `attachLogToGitHub` records `global.logAttachedToGitHub` on every successful upload anywhere in
+ * the process, so this helper only attaches when nothing else did.
+ *
+ * @see https://github.com/link-assistant/hive-mind/issues/1952
+ */
+
+/**
+ * Attach the final session log if `--attach-logs` is enabled and nothing has attached a log yet.
+ *
+ * @param {Object} params
+ * @param {boolean} params.shouldAttachLogs - Whether `--attach-logs` is enabled.
+ * @param {string|number|null} params.prNumber - Target PR number (no PR ⇒ nothing to attach to).
+ * @param {string} params.owner
+ * @param {string} params.repo
+ * @param {Function} params.$ - command-stream tagged executor.
+ * @param {Function} params.log
+ * @param {Function} params.sanitizeLogContent
+ * @param {Function} params.getLogFile - Returns the path to the cumulative session log.
+ * @param {Function} params.attachLogToGitHub
+ * @param {Object} params.argv
+ * @param {string|null} [params.sessionId]
+ * @param {string|null} [params.tempDir]
+ * @param {number|null} [params.anthropicTotalCostUSD]
+ * @param {Object|null} [params.resultModelUsage]
+ * @param {Object} [params.globalState] - Defaults to the process `global`; injectable for tests.
+ * @returns {Promise<boolean>} `true` if a log has been attached (by this helper or earlier).
+ */
+export const attachFinalLogIfMissing = async ({ shouldAttachLogs, prNumber, owner, repo, $, log, sanitizeLogContent, getLogFile, attachLogToGitHub, argv, sessionId = null, tempDir = null, anthropicTotalCostUSD = null, resultModelUsage = null, globalState = global }) => {
+  // Only fire as a last resort: --attach-logs enabled, a PR to attach to, and nothing attached yet.
+  if (!shouldAttachLogs || !prNumber || globalState.logAttachedToGitHub) {
+    return globalState.logAttachedToGitHub === true;
+  }
+
+  await log('');
+  await log('📎 No session log was attached yet — attaching final log (--attach-logs safety net)...');
+  try {
+    const logUploadSuccess = await attachLogToGitHub({
+      logFile: getLogFile(),
+      targetType: 'pr',
+      targetNumber: prNumber,
+      owner,
+      repo,
+      $,
+      log,
+      sanitizeLogContent,
+      verbose: argv?.verbose,
+      sessionId,
+      tempDir,
+      anthropicTotalCostUSD,
+      argv,
+      requestedModel: argv?.originalModel || argv?.model,
+      tool: argv?.tool || 'claude',
+      resultModelUsage,
+    });
+    if (logUploadSuccess) {
+      await log('✅ Final working session log attached');
+    } else {
+      await log('⚠️  Final log attachment did not succeed (see messages above)', { level: 'warning' });
+    }
+  } catch (uploadError) {
+    await log(`⚠️  Error attaching final log: ${uploadError.message}`, { level: 'warning' });
+  }
+
+  return globalState.logAttachedToGitHub === true;
+};

package/src/cancelled-ci-rerun.lib.mjs

@@ -15,10 +15,81 @@ import { CANCELLED_CI_REVIEW_MARKER } from './tool-comments.lib.mjs';
 
 const CANCELLED_OR_STALE_CONCLUSIONS = new Set(['cancelled', 'stale']);
 
-export { CANCELLED_CI_REVIEW_MARKER };
+/**
+ * Issue #1952: Workflow-run conclusions that represent a genuine CI failure rather than a
+ * re-triggerable cancellation.
+ *
+ * GitHub surfaces a job that hit its `timeout-minutes` limit as a check-run with
+ * `conclusion: 'cancelled'`, but the parent workflow_run concludes `'failure'` (a step that
+ * exceeds `timeout-minutes` likewise produces `'failure'`; an infrastructure/setup error
+ * produces `'startup_failure'`; the legacy max-execution timeout produces `'timed_out'`).
+ *
+ * `getDetailedCIStatus` only inspects check-runs, so it cannot tell a timeout failure
+ * (check-run cancelled + workflow_run failed) apart from a deliberate manual/concurrency
+ * cancellation (check-run cancelled + workflow_run cancelled). Cross-referencing the
+ * workflow-run conclusion lets the caller treat a timeout/failure as a CI failure (which the
+ * AI should fix / auto-restart) instead of a re-triggerable cancellation that stops for human
+ * review.
+ *
+ * @see https://github.com/link-assistant/hive-mind/issues/1952
+ */
+const FAILURE_LIKE_WORKFLOW_RUN_CONCLUSIONS = new Set(['failure', 'timed_out', 'startup_failure']);
+
+export { CANCELLED_CI_REVIEW_MARKER, FAILURE_LIKE_WORKFLOW_RUN_CONCLUSIONS };
 
 export const getRetriggerableWorkflowRuns = (runs = []) => runs.filter(run => CANCELLED_OR_STALE_CONCLUSIONS.has(run?.conclusion));
 
+/**
+ * Issue #1952: Workflow runs that have not yet reached a terminal state.
+ *
+ * The issue requires waiting "until all checks are success, fail or cancelled, to auto
+ * restart". Even when every check-run already looks cancelled, a workflow run may still be
+ * `queued`/`in_progress` (e.g. a retrying matrix leg), so the auto-merge loop must keep
+ * waiting rather than prematurely classifying the result.
+ *
+ * @param {Array<{status?: string}>} runs - Workflow runs for the commit SHA.
+ * @returns {Array} Runs whose `status` is not `'completed'`.
+ */
+export const getIncompleteWorkflowRuns = (runs = []) => runs.filter(run => run?.status && run.status !== 'completed');
+
+/**
+ * Issue #1952: Completed workflow runs whose conclusion represents a genuine failure
+ * (failure / timed_out / startup_failure), including the timeout-cancellation case.
+ *
+ * @param {Array<{status?: string, conclusion?: string}>} runs - Workflow runs for the commit SHA.
+ * @returns {Array} Completed runs with a failure-like conclusion.
+ */
+export const getFailedWorkflowRuns = (runs = []) => runs.filter(run => run?.status === 'completed' && FAILURE_LIKE_WORKFLOW_RUN_CONCLUSIONS.has(run?.conclusion));
+
+/**
+ * Issue #1952: Decide how a "cancelled" CI status (per check-runs) should be reclassified
+ * after cross-referencing the workflow runs for the same commit SHA.
+ *
+ * - `pending`  → at least one workflow run is still queued/in progress; keep waiting so we only
+ *                act once every check has reached a terminal state.
+ * - `failure`  → at least one completed workflow run failed/timed out/failed to start; the
+ *                cancellation reflects a real failure (e.g. a job hit `timeout-minutes`) and must
+ *                be treated as a CI failure, not a re-triggerable cancellation.
+ * - `cancelled`→ no failures and nothing pending; this is a genuine re-triggerable cancellation
+ *                (manual cancel, concurrency cancel, stale) that the existing rerun flow handles.
+ *
+ * @param {{runs?: Array}} params
+ * @returns {{classification: 'pending'|'failure'|'cancelled', incompleteRuns: Array, failedRuns: Array}}
+ */
+export const classifyCancelledCIByWorkflowRuns = ({ runs = [] } = {}) => {
+  const incompleteRuns = getIncompleteWorkflowRuns(runs);
+  if (incompleteRuns.length > 0) {
+    return { classification: 'pending', incompleteRuns, failedRuns: [] };
+  }
+
+  const failedRuns = getFailedWorkflowRuns(runs);
+  if (failedRuns.length > 0) {
+    return { classification: 'failure', incompleteRuns, failedRuns };
+  }
+
+  return { classification: 'cancelled', incompleteRuns, failedRuns };
+};
+
 export const shouldStopForCancelledCIReview = ({ retriggerableRuns = [], rerunTriggered = false, rerunFailures = [] }) => {
   if (rerunTriggered) {
     return false;

package/src/codex.lib.mjs

@@ -358,6 +358,30 @@ const isNonFatalCodexItemErrorMessage = message => /^in-process app-server event
 export const getCodexErrorEventSummary = codexJsonState => {
   const events = [];
   const ignoredEvents = [];
+
+  // Issue #1955: When the codex turn genuinely completed (a `turn.completed`
+  // event was observed) and codex never emitted a `turn.failed`, the session
+  // SUCCEEDED. Any stray top-level `error` (stream) or nested item `error` event
+  // in that case is non-fatal and must not fail the run. Two things produce such
+  // strays:
+  //   1. A transient error codex itself retried/recovered from before completing
+  //      the turn (e.g. a momentary stream blip).
+  //   2. Echoed content that merely *looks* like a codex protocol event. The
+  //      codex CLI prints OTEL telemetry (`codex_otel.log_only`,
+  //      event.name="codex.tool_result") containing a raw `Output:` dump of each
+  //      command's stdout. When a command prints a line shaped like a protocol
+  //      event — e.g. a printed NDJSON fixture line
+  //      `{"type":"error","message":"Network lookup skipped in fixture"}` — our
+  //      line-by-line parser misreads it as a genuine codex stream error and
+  //      fails an otherwise-successful run. This was the exact false positive in
+  //      issue #1955 (codex finished, working tree clean, CI passed, yet the run
+  //      was reported failed).
+  // `turn.failed` is the authoritative failure signal, so it is NEVER suppressed
+  // here; only non-`turn` error events are gated on turn completion.
+  const turnCompleted = (codexJsonState?.eventCounts?.['turn.completed'] || 0) > 0;
+  const turnFailed = (codexJsonState?.turnFailures?.length || 0) > 0;
+  const sessionSucceeded = turnCompleted && !turnFailed;
+
   const addEvents = (type, items = []) => {
     for (const item of items) {
       const message = unwrapCodexErrorMessage(item?.message);
@@ -369,6 +393,13 @@ export const getCodexErrorEventSummary = codexJsonState => {
         });
         continue;
       }
+      if (type !== 'turn' && sessionSucceeded) {
+        ignoredEvents.push({
+          ...event,
+          reason: 'Codex turn completed successfully with no turn.failed; stray non-turn error event is non-fatal (Issue #1955)',
+        });
+        continue;
+      }
       events.push(event);
     }
   };
@@ -1146,7 +1177,13 @@ export const executeCodexCommand = async params => {
       const codexErrorSummary = getCodexErrorEventSummary(codexJsonState);
       if (codexErrorSummary.ignoredEvents.length > 0) {
         const ignoredMessages = [...new Set(codexErrorSummary.ignoredEvents.map(event => event.message))].join('; ');
-        await log(`⚠️ Ignoring non-fatal Codex item error event(s): ${ignoredMessages}`, { level: 'warning', verbose: true });
+        await log(`⚠️ Ignoring non-fatal Codex error event(s): ${ignoredMessages}`, { level: 'warning', verbose: true });
+        // Issue #1955: trace why each stray error event was treated as non-fatal so a
+        // future regression (e.g. a real error wrongly suppressed) is diagnosable from
+        // the verbose log without re-deriving the turn.completed/turn.failed state.
+        for (const ignored of codexErrorSummary.ignoredEvents) {
+          await log(`   ↳ [${ignored.type}] "${ignored.message}" — ${ignored.reason}`, { verbose: true });
+        }
       }
       if (codexErrorSummary.hasError) {
         const limitSource = codexErrorSummary.message || lastMessage;

package/src/github-merge-ci.lib.mjs

@@ -222,7 +222,12 @@ export async function checkBranchCIHealth(owner, repo, branch = 'main', options,
     }
 
     // All runs for the latest commit are completed — check for failures
-    const failedRuns = runs.filter(r => r.conclusion === 'failure' || r.conclusion === 'timed_out');
+    // Issue #1952: Treat `startup_failure` as a failure too (a workflow that failed to start is a
+    // genuine failure, not a transient state). `cancelled` is intentionally NOT treated as a
+    // failure here: this branch-health check resolves the HEAD SHA up front (issue #1425), and a
+    // cancelled run on the resolved HEAD is normally a superseded/manual cancellation rather than a
+    // timeout — a timeout surfaces as `failure`/`timed_out` at the workflow-run level and is caught.
+    const failedRuns = runs.filter(r => r.conclusion === 'failure' || r.conclusion === 'timed_out' || r.conclusion === 'startup_failure');
 
     if (failedRuns.length > 0) {
       if (verbose) {

package/src/github.lib.mjs

@@ -790,6 +790,9 @@ ${sessionNote}
             await log(`  ${status.emoji} ${status.label} uploaded to ${targetName} as ${isPublicRepo ? 'public' : 'private'} ${uploadTypeLabel}${chunkInfo}${posted.commentId ? ` (comment id=${posted.commentId})` : ''}`);
             await log(`  🔗 Log URL: ${logUrl}`);
             await log(`  📊 Log size: ${Math.round(logStats.size / 1024)}KB`);
+            // Issue #1952: Record that a session log was attached anywhere in this process so the
+            // top-level --attach-logs safety net can guarantee no session finishes with no logs.
+            global.logAttachedToGitHub = true;
             return true;
           } else {
             await log(`  ❌ Failed to post comment with log link: ${posted.stderr || 'unknown error'}`);
@@ -813,7 +816,12 @@ ${sessionNote}
       }
     } else {
       // Comment fits within limit
-      return await attachRegularComment(options, logComment);
+      const regularOk = await attachRegularComment(options, logComment);
+      // Issue #1952: see note above — mark a successful attach for the --attach-logs safety net.
+      if (regularOk) {
+        global.logAttachedToGitHub = true;
+      }
+      return regularOk;
     }
   } catch (uploadError) {
     // Issue #1212: ENOSPC-specific actionable guidance

package/src/session-monitor.lib.mjs

@@ -194,6 +194,32 @@ export function getTrackedSessionInfo(sessionName) {
   return activeSessions.get(sessionName) || null;
 }
 
+/**
+ * Stop tracking a session that was registered optimistically but never actually
+ * started (e.g. the start-command launch failed). Removes it from the in-memory
+ * map and the durable store without emitting a `session_completed` audit event —
+ * the session never ran, so it has no exit code to record (issue #1946).
+ *
+ * @param {string} sessionName - Name/UUID of the session to drop
+ * @param {boolean} verbose - Whether to log verbose output
+ */
+export function untrackSession(sessionName, verbose = false) {
+  if (!sessionName) return;
+  const sessionInfo = activeSessions.get(sessionName) || null;
+  const existed = activeSessions.delete(sessionName);
+  if (verbose && existed) {
+    console.log(`[VERBOSE] Session ${sessionName} untracked (launch failed before it started)`);
+  }
+  if (sessionStore && isPersistableSession(sessionInfo)) {
+    try {
+      sessionStore.remove(sessionName, { status: 'launch-failed', exitCode: null });
+    } catch (error) {
+      console.error(`[session-monitor] Could not remove untracked session ${sessionName}: ${error.message}`);
+    }
+  }
+  logEvent('session_untracked', { sessionName });
+}
+
 /**
  * Get the number of active sessions being tracked
  * @param {boolean} verbose - Whether to log verbose output

package/src/solve.auto-merge-helpers.lib.mjs

@@ -37,6 +37,12 @@ const { reportError } = sentryLib;
 const githubMergeLib = await import('./github-merge.lib.mjs');
 const { checkPRMergeable, checkForBillingLimitError, getDetailedCIStatus, getWorkflowRunsForSha, getWorkflowRunJobsCount, getActiveRepoWorkflows, getCommitDate, checkWorkflowsHavePRTriggers, checkPreviousPRCommitsHadCI, getActivePRWorkflowRuns } = githubMergeLib;
 
+// Issue #1952: Cross-reference cancelled check-runs against workflow-run conclusions so a
+// job that hit `timeout-minutes` (check-run cancelled + workflow_run failed) is treated as a
+// CI failure rather than a re-triggerable cancellation that stops for human review.
+const cancelledCiRerunLib = await import('./cancelled-ci-rerun.lib.mjs');
+const { classifyCancelledCIByWorkflowRuns } = cancelledCiRerunLib;
+
 /**
  * Issue #1712: Plain-English meaning of GitHub Actions / check-run statuses, so the
  * verbose log explains itself instead of forcing the user to look up GitHub docs.
@@ -816,19 +822,60 @@ export const getMergeBlockers = async (owner, repo, prNumber, verbose = false, c
         billingMessage: billingCheck.message,
       });
     } else {
-      // These need to be re-triggered, NOT treated as AI-fixable failures
+      // Issue #1952: A check-run with conclusion 'cancelled' does NOT always mean a
+      // re-triggerable cancellation. When a job hits its `timeout-minutes` limit GitHub
+      // cancels the job (check-run conclusion 'cancelled') but the parent workflow_run
+      // concludes 'failure'/'timed_out'/'startup_failure'. getDetailedCIStatus only sees the
+      // check-runs, so it reports status='cancelled' and we used to post a "Cancelled CI/CD
+      // Requires Review" comment and stop. Cross-reference the workflow runs for this SHA to
+      // tell the two cases apart:
+      //   - any run still queued/in_progress  → wait (ci_pending) until every check is terminal
+      //   - any completed run failed/timed out → treat as a CI failure (auto-restart the AI)
+      //   - otherwise                          → genuine re-triggerable cancellation (ci_cancelled)
       const cancelledOrStaleChecks = [...ciStatus.cancelledChecks, ...(ciStatus.staleChecks || [])];
       const cancelledDetails = cancelledOrStaleChecks.map(c => {
         const concPart = c.conclusion ? ` [${c.conclusion}]` : '';
         const urlPart = c.html_url ? ` — ${c.html_url}` : '';
         return `${c.name}${concPart}${urlPart}`;
       });
-      blockers.push({
-        type: 'ci_cancelled',
-        message: 'CI/CD checks were cancelled or became stale',
-        details: cancelledDetails,
-        sha: ciStatus.sha,
-      });
+
+      const cancelledWorkflowRuns = await getWorkflowRunsForSha(owner, repo, ciStatus.sha, verbose);
+      const { classification, incompleteRuns, failedRuns } = classifyCancelledCIByWorkflowRuns({ runs: cancelledWorkflowRuns });
+
+      if (classification === 'pending') {
+        // Some checks already show cancelled, but a workflow run is still running — the issue
+        // requires waiting until ALL checks reach a terminal state before auto-restarting.
+        if (verbose) {
+          await log(`[VERBOSE] /merge: PR #${prNumber} has cancelled check-run(s) but ${incompleteRuns.length} workflow run(s) still in progress — waiting for all to reach a terminal state before classifying`);
+        }
+        blockers.push({
+          type: 'ci_pending',
+          message: `Some CI/CD checks are cancelled, but ${incompleteRuns.length} workflow run(s) have not reached a terminal state yet — waiting before deciding`,
+          details: incompleteRuns.map(formatRunLine),
+        });
+      } else if (classification === 'failure') {
+        // The cancellation reflects a real failure (e.g. a job hit `timeout-minutes`). Per
+        // issue #1952 this must be treated as a CI failure so the AI is restarted to fix it,
+        // instead of posting a "requires human review" comment for a re-trigger that would
+        // never make progress.
+        if (verbose) {
+          await log(`[VERBOSE] /merge: PR #${prNumber} cancelled check-run(s) belong to ${failedRuns.length} failed workflow run(s) (conclusions: ${[...new Set(failedRuns.map(r => r.conclusion))].join(', ')}) — treating cancellation as a CI failure`);
+        }
+        await log(formatAligned('❌', 'CI cancelled by failure/timeout:', `${failedRuns.map(r => `${r.name} (${r.conclusion})`).join(', ')}`, 2));
+        blockers.push({
+          type: 'ci_failure',
+          message: 'CI/CD checks were cancelled by a workflow failure or timeout (treated as a failure)',
+          details: [...cancelledDetails, ...failedRuns.map(r => `${r.path || r.name} (${r.conclusion}) — see ${r.html_url}`)],
+        });
+      } else {
+        // Genuine re-triggerable cancellation (manual cancel, concurrency cancel, stale).
+        blockers.push({
+          type: 'ci_cancelled',
+          message: 'CI/CD checks were cancelled or became stale',
+          details: cancelledDetails,
+          sha: ciStatus.sha,
+        });
+      }
     }
   } else if (ciStatus.status === 'failure') {
     // Some checks genuinely failed - check if it's billing limits first

package/src/solve.auto-merge.lib.mjs

@@ -489,7 +489,13 @@ Once the billing issue is resolved, you can re-run the CI checks or push a new c
       // Cancelled checks (e.g., manually cancelled, cancelled by another workflow) should be
       // re-triggered automatically. We should NOT restart the AI for these.
       const cancelledBlocker = blockers.find(b => b.type === 'ci_cancelled');
-      if (cancelledBlocker && !billingBlocker) {
+      // Issue #1952: When a genuine CI failure coexists with cancelled checks, the result is a
+      // failure ("if we still have other fails in the CI/CD checks - it is fail"). Defer to the
+      // ci_failure path (which restarts the AI) instead of attempting a re-trigger and then
+      // stopping for human review — the latter posted a misleading "Cancelled CI/CD Requires
+      // Review" comment even though real failures needed fixing.
+      const ciFailureBlocker = blockers.find(b => b.type === 'ci_failure');
+      if (cancelledBlocker && !billingBlocker && !ciFailureBlocker) {
         await log('');
         await log(formatAligned('🔄', 'CANCELLED CI/CD CHECKS DETECTED', ''));
         await log(formatAligned('', 'Cancelled checks:', (cancelledBlocker.details || []).join(', '), 2));
@@ -570,7 +576,9 @@ Once the billing issue is resolved, you can re-run the CI checks or push a new c
       // Reason 2: CI failures (only if NOT a billing limit issue and NOT just cancelled)
       // Only restart AI when we have genuine code failures (real feedback to act on)
       const externalReviewLimitBlocker = blockers.find(b => b.type === 'external_review_limit');
-      const ciBlocker = blockers.find(b => b.type === 'ci_failure');
+      // Issue #1952: Reuse the ci_failure blocker resolved above so cancelled+failure mixes
+      // take the restart path rather than the cancelled-review path.
+      const ciBlocker = ciFailureBlocker;
       const hasMergeConflictBlocker = blockers.some(b => b.type === 'not_mergeable' && b.message?.includes('conflicts'));
       if (externalReviewLimitBlocker && !ciBlocker && !billingBlocker && !cancelledBlocker && !hasNewComments && !hasUncommittedChanges && !hasMergeConflictBlocker) {
         await log('');

package/src/solve.mjs

@@ -58,6 +58,7 @@ const { setupRepositoryAndClone, verifyDefaultBranchAndStatus } = await import('
 const { recordAfterCloneSize, recordAfterAgentSize } = await import('./solve.disk-diagnostics.lib.mjs');
 const { createOrCheckoutBranch } = await import('./solve.branch.lib.mjs');
 const { startWorkSession, endWorkSession, SESSION_TYPES } = await import('./solve.session.lib.mjs');
+const { attachFinalLogIfMissing } = await import('./attach-logs-guarantee.lib.mjs'); // Issue #1952
 // Issue #1625: centralized markers + tracked comment posting for solve.mjs's
 // own usage-limit notifications (so they're excluded from the
 // "did the AI post anything?" check in --auto-attach-solution-summary).
@@ -1430,13 +1431,11 @@ try {
         }
       }
     }
-
-    // If auto-merge succeeded, update logs attached status
-    if (autoMergeResult && autoMergeResult.success) {
-      logsAttached = true;
-    }
   }
 
+  // Issue #1952: Final --attach-logs safety net + logsAttached reconciliation. See attach-logs-guarantee.lib.mjs.
+  logsAttached = (await attachFinalLogIfMissing({ shouldAttachLogs, prNumber, owner, repo, $, log, sanitizeLogContent, getLogFile, attachLogToGitHub, argv, sessionId, tempDir, anthropicTotalCostUSD, resultModelUsage })) || logsAttached;
+
   // Issue #1516: Cleanup after all signals (was before verifyResults, caused premature commits)
   await cleanupClaudeFile(tempDir, branchName, claudeCommitHash, argv);
 

package/src/telegram-bot.mjs

@@ -328,7 +328,7 @@ const { isOldMessage: _isOldMessage, isGroupChat: _isGroupChat, isChatAuthorized
 const { installTelegramFormattingFallback, isTelegramFormattingError, isTelegramMessageTooLongError, safeEditMessageText, safeReply, TELEGRAM_TEXT_LIMIT } = await import('./telegram-safe-reply.lib.mjs');
 const { registerTerminalWatchCommand, startAutoTerminalWatchForSession } = await import('./telegram-terminal-watch-command.lib.mjs');
 const { launchBotWithRetry } = await import('./telegram-bot-launcher.lib.mjs');
-const { trackSession, startSessionMonitoring, hasActiveSessionForUrlAsync, findStoppableSessionByUrl, setSessionStore, setSessionLogger, resumeTrackedSessions, getActiveSessionCount } = await import('./session-monitor.lib.mjs');
+const { trackSession, untrackSession, startSessionMonitoring, hasActiveSessionForUrlAsync, findStoppableSessionByUrl, setSessionStore, setSessionLogger, resumeTrackedSessions, getActiveSessionCount } = await import('./session-monitor.lib.mjs');
 const { createBotLogger } = await import('./bot-logger.lib.mjs');
 const { createSessionStore } = await import('./session-store.lib.mjs');
 const { createHeartbeat, resumeSessionsOnLaunch, createShutdownHandler } = await import('./bot-lifecycle.lib.mjs');
@@ -524,7 +524,7 @@ async function validateGitHubUrl(args, options = {}) {
   return { valid: true, parsed, normalizedUrl: url };
 }
 
-const executeAndUpdateMessage = buildExecuteAndUpdateMessage({ resolveIsolation, ISOLATION_BACKEND, isolationRunner, VERBOSE, executeStartScreen, trackSession, AUTO_WATCH_MESSAGE, startAutoTerminalWatchForSession, bot, formatExecutingWorkSessionMessage });
+const executeAndUpdateMessage = buildExecuteAndUpdateMessage({ resolveIsolation, ISOLATION_BACKEND, isolationRunner, VERBOSE, executeStartScreen, trackSession, untrackSession, AUTO_WATCH_MESSAGE, startAutoTerminalWatchForSession, bot, formatExecutingWorkSessionMessage, formatStartingWorkSessionMessage });
 
 bot.command('help', async ctx => {
   VERBOSE && console.log('[VERBOSE] /help command received');

package/src/telegram-command-execution.lib.mjs

@@ -98,7 +98,7 @@ function executeWithCommand(startScreenCmd, command, args, verbose = false) {
  * @returns {Function} executeAndUpdateMessage(ctx, startingMessage, commandName, args, infoBlock, perCommandIsolation, tool, urlContext, sessionExtras)
  */
 export function buildExecuteAndUpdateMessage(deps) {
-  const { resolveIsolation, ISOLATION_BACKEND, isolationRunner, VERBOSE, executeStartScreen, trackSession, AUTO_WATCH_MESSAGE, startAutoTerminalWatchForSession, bot, formatExecutingWorkSessionMessage } = deps;
+  const { resolveIsolation, ISOLATION_BACKEND, isolationRunner, VERBOSE, executeStartScreen, trackSession, untrackSession, AUTO_WATCH_MESSAGE, startAutoTerminalWatchForSession, bot, formatExecutingWorkSessionMessage, formatStartingWorkSessionMessage } = deps;
   return async function executeAndUpdateMessage(ctx, startingMessage, commandName, args, infoBlock, perCommandIsolation = null, tool = 'claude', urlContext = null, { showLimits = false, limitsAtStart = null, locale = null } = {}) {
     const { chat, message_id: msgId } = startingMessage;
     const safeEdit = async text => {
@@ -115,12 +115,23 @@ export function buildExecuteAndUpdateMessage(deps) {
     const iso = await resolveIsolation(perCommandIsolation, ISOLATION_BACKEND, isolationRunner, VERBOSE);
     let result, session, sessionInfo;
     if (iso) {
+      // Issue #1946: the isolation session UUID is generated locally, *before*
+      // start-command launches the (potentially multi-GB, slow) container. Show
+      // the UUID + isolation backend and track the session immediately so it is
+      // addressable by /watch, /log and /status during the whole startup window
+      // instead of only after the blocking launch returns. start-command runs the
+      // container detached, so the await below does not block other bot commands.
       session = iso.runner.generateSessionId();
       VERBOSE && console.log(`[VERBOSE] Using isolation (${iso.backend}), session: ${session}`);
+      sessionInfo = { ...baseSessionInfo, isolationBackend: iso.backend, sessionId: session };
+      trackSession(session, sessionInfo, VERBOSE);
+      await safeEdit(formatStartingWorkSessionMessage({ sessionName: session, isolationBackend: iso.backend, infoBlock, locale }));
       result = await iso.runner.executeWithIsolation(commandName, args, { backend: iso.backend, sessionId: session, tool, verbose: VERBOSE });
-      if (result.success) {
-        sessionInfo = { ...baseSessionInfo, isolationBackend: iso.backend, sessionId: session };
-        trackSession(session, sessionInfo, VERBOSE);
+      if (!result.success) {
+        // The launch never produced a live container — drop the optimistic
+        // tracking so a phantom session is not monitored or resumed.
+        if (typeof untrackSession === 'function') untrackSession(session, VERBOSE);
+        sessionInfo = undefined;
       }
     } else {
       result = await executeStartScreen(commandName, args);

package/src/tool-retry.lib.mjs

@@ -89,6 +89,44 @@ export const classifyRetryableError = value => {
     return { message, isRetryable: true, isCapacity: false, label: 'Socket/connection closed unexpectedly' };
   }
 
+  // Issue #1955: Transient DNS resolution failures. When the local resolver, the
+  // upstream DNS, or the network briefly drops, Node's undici/fetch (and the Codex
+  // CLI's reqwest stack) surface the failure with one of these signatures:
+  //   getaddrinfo ENOTFOUND api.openai.com / getaddrinfo EAI_AGAIN api.github.com /
+  //   "Temporary failure in name resolution" / "dns error" / "failed to lookup
+  //   address information". These are 100% temporary — the host is not gone, name
+  //   resolution simply failed for a moment — so the same request is safe to retry
+  //   after a backoff. Switching models does not help (it is a network-layer fault),
+  //   so isCapacity is false.
+  // NOTE: deliberately scoped to real resolver error tokens so it never matches
+  // unrelated text that merely contains the word "lookup" (e.g. the echoed fixture
+  // line "Network lookup skipped in fixture" from issue #1955, which is not an error
+  // at all).
+  if (lower.includes('enotfound') || lower.includes('eai_again') || lower.includes('temporary failure in name resolution') || lower.includes('getaddrinfo') || lower.includes('dns error') || lower.includes('failed to lookup address information') || lower.includes('name or service not known')) {
+    return { message, isRetryable: true, isCapacity: false, label: 'DNS resolution failure' };
+  }
+
+  // Issue #1955: Transient connection-level network failures from the OS/socket
+  // layer — the peer is unreachable or refused the connection for a moment, or a
+  // connect/read timed out. These are temporary (load balancer rotating, a node
+  // briefly down, a VPN/proxy hiccup, a flaky link) and the identical request
+  // typically succeeds on retry. Covers Node libuv error codes and their textual
+  // equivalents. ETIMEDOUT/"timed out" here is the connection/socket timeout
+  // (distinct from the API-level "request timed out" handled above).
+  if (lower.includes('etimedout') || lower.includes('connection timed out') || lower.includes('econnrefused') || lower.includes('connection refused') || lower.includes('ehostunreach') || lower.includes('no route to host') || lower.includes('enetunreach') || lower.includes('network is unreachable') || lower.includes('epipe') || lower.includes('eai_fail')) {
+    return { message, isRetryable: true, isCapacity: false, label: 'Transient network connection failure' };
+  }
+
+  // Issue #1955: Transient HTTP gateway / proxy errors (502 Bad Gateway, 504 Gateway
+  // Timeout) and Cloudflare's edge family (520 Unknown Error, 521 Web Server Is Down,
+  // 522 Connection Timed Out, 523 Origin Is Unreachable, 524 A Timeout Occurred).
+  // These come from an intermediary (CDN/proxy/load balancer), not from a request the
+  // client got wrong, and clear on their own — OpenAI/Anthropic/GitHub all front their
+  // APIs with such proxies. Safe to retry the same request after a backoff.
+  if (lower.includes('502 bad gateway') || lower.includes('bad gateway') || lower.includes('504 gateway timeout') || lower.includes('gateway time-out') || lower.includes('gateway timeout') || lower.includes('api error: 502') || lower.includes('api error: 504') || /\b52[0-4]\b/.test(lower)) {
+    return { message, isRetryable: true, isCapacity: false, label: 'Gateway error (502/504/52x)' };
+  }
+
   // Issue #1834: Corrupted extended-thinking blocks. When extended thinking is combined with tool
   // use, Claude Code can persist a thinking block to the session transcript with the `thinking`
   // text emptied to "" while retaining the original `signature`. On resume/continue the block is
@@ -120,7 +158,10 @@ export const classifyRetryableError = value => {
     return { message, isRetryable: true, isCapacity: false, label: 'Server rate limited (429)' };
   }
 
-  if (lower.includes('api error: 503') || (lower.includes('503') && (lower.includes('upstream connect error') || lower.includes('remote connection failure')))) {
+  // Issue #1955: broadened to also catch the bare "503 Service Unavailable" that
+  // GitHub/OpenAI/Anthropic return when a backend is briefly saturated — a
+  // transient, self-clearing condition, safe to retry with the same request.
+  if (lower.includes('api error: 503') || lower.includes('503 service unavailable') || lower.includes('service unavailable') || (lower.includes('503') && (lower.includes('upstream connect error') || lower.includes('remote connection failure')))) {
     return { message, isRetryable: true, isCapacity: false, label: '503 network error' };
   }
 

package/src/work-session-formatting.lib.mjs

@@ -65,9 +65,19 @@ export function formatSessionDurationSeconds(seconds) {
   return parts.join(' ');
 }
 
-export function formatStartingWorkSessionMessage({ infoBlock = '', locale = null } = {}) {
+export function formatStartingWorkSessionMessage({ sessionName = null, isolationBackend = null, infoBlock = '', locale = null } = {}) {
+  const header = text(locale, 'telegram.work_session_starting', '🔄 Starting...');
   const details = infoBlock ? `\n\n${infoBlock}` : '';
-  return `${text(locale, 'telegram.work_session_starting', '🔄 Starting...')}${details}`;
+  // Issue #1946: for isolation backends the session UUID is known *before* the
+  // (potentially long, multi-GB) container/image preparation finishes, so
+  // surface it together with the isolation backend right away. This makes the
+  // session addressable by /watch, /log and /status while it is still starting,
+  // instead of leaving an info-less "Starting..." up for the whole image pull.
+  if (!sessionName) return `${header}${details}`;
+  const sessionLabel = text(locale, 'telegram.session_label', 'Session');
+  const isolationLabel = text(locale, 'telegram.isolation_label', 'Isolation');
+  const isolationInfo = isolationBackend ? `\n🔒 ${isolationLabel}: \`${isolationBackend}\`` : '';
+  return `${header}\n\n📊 ${sessionLabel}: \`${sessionName}\`${isolationInfo}${details}`;
 }
 
 export function formatExecutingWorkSessionMessage({ sessionName = 'unknown', isolationBackend = null, infoBlock = '', locale = null } = {}) {