@link-assistant/hive-mind 2.1.8 → 2.1.11

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @link-assistant/hive-mind
 
+## 2.1.11
+
+### Patch Changes
+
+- 208e123: Fix false-positive npm releases (issue #2028). `setup-npm.mjs` now pins npm to the 11.x line and validates the result instead of installing `npm@latest` (which pulled in npm 12.0.0, whose sigstore regression crashes provenance publishes — npm/cli#9722). `publish-to-npm.mjs` no longer trusts the publish command's exit status alone: it observes the real exit code, scans output for failure patterns, and verifies the version is actually live on npm before reporting success, so a failed publish can no longer be reported as a successful release. Added `sanitize-npm-userconfig.mjs` to remove the deprecated `always-auth` npm warning from release logs.
+
+## 2.1.10
+
+### Patch Changes
+
+- 9964e69: Retry Claude stream-json sessions with `--resume` when the stream ends without a terminal result event after tool output.
+- afbc353: Avoid fetching `use-m` at isolation-runner import time when tests only use pure helper exports.
+
+## 2.1.9
+
+### Patch Changes
+
+- 5559c5e: Check all replacement repository branch tips before deleting a non-fork fork replacement, and report concrete branch-only commits when deletion is unsafe.
+
 ## 2.1.8
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "2.1.8",
+  "version": "2.1.11",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",

package/src/claude.lib.mjs

@@ -1163,6 +1163,11 @@ export const executeClaudeCommand = async params => {
           queuedFeedback,
         };
       }
+      if (shouldFailClaudeStreamWithoutResult({ commandFailed, streamingInput, resultEventReceived })) {
+        commandFailed = true;
+        lastMessage = buildMissingClaudeResultMessage({ lastToolResultError, lastMessage });
+        await log(`\n\n❌ Command failed: ${lastMessage}`, { level: 'error' });
+      }
       const retryableLastError = classifyRetryableError(lastMessage);
       // Issue #1834: Corrupted extended-thinking blocks → try to resume the session first, then fall
       // back to a fresh restart (PR #1835 feedback). When both caps are reached, tryThinkingBlockRecovery
@@ -1291,11 +1296,6 @@ export const executeClaudeCommand = async params => {
           .join('\n');
         await log(`\n\n❌ Command failed: No messages processed and errors detected in stderr\nStderr errors:\n${errorsPreview}`, { level: 'error' });
       }
-      if (shouldFailClaudeStreamWithoutResult({ commandFailed, streamingInput, resultEventReceived })) {
-        commandFailed = true;
-        lastMessage = buildMissingClaudeResultMessage({ lastToolResultError, lastMessage });
-        await log(`\n\n❌ Command failed: ${lastMessage}`, { level: 'error' });
-      }
       if (commandFailed) {
         // Take resource snapshot after failure
         const resourcesAfter = await getResourceSnapshot();

package/src/isolation-runner.lib.mjs

@@ -20,11 +20,26 @@ import os from 'node:os';
 import path from 'node:path';
 import { isExecutingSessionStatus, isTerminalSessionStatus } from './session-status.lib.mjs';
 
-if (typeof use === 'undefined') {
-  await ensureUseM();
-}
+let commandStreamDollarPromise = null;
+
+async function getCommandStreamDollar() {
+  if (!commandStreamDollarPromise) {
+    commandStreamDollarPromise = (async () => {
+      if (typeof globalThis.use === 'undefined') {
+        await ensureUseM();
+      }
+      const { $ } = await globalThis.use('command-stream');
+      return $;
+    })();
+  }
 
-const { $ } = await use('command-stream');
+  try {
+    return await commandStreamDollarPromise;
+  } catch (error) {
+    commandStreamDollarPromise = null;
+    throw error;
+  }
+}
 
 // Re-export the shared status predicates so existing callers that reach them via
 // the isolation-runner module (e.g. session-monitor's `runner.isExecutingSessionStatus`)
@@ -516,6 +531,7 @@ export function readSessionExitFromLog(logPath, options = {}) {
  */
 async function findStartCommandBinary() {
   try {
+    const $ = await getCommandStreamDollar();
     const result = await $({ mirror: false })`which $`;
     const path = result.stdout?.toString().trim() || '';
     return path || null;
@@ -677,6 +693,7 @@ export async function querySessionStatus(sessionId, verbose = false) {
   }
 
   try {
+    const $ = await getCommandStreamDollar();
     const result = await $({ mirror: false })`${binPath} --status ${sessionId} --output-format json`;
 
     const stdout = result.stdout?.toString().trim() || '';
@@ -755,6 +772,7 @@ export async function listIsolationSessions(verbose = false) {
     return [];
   }
   try {
+    const $ = await getCommandStreamDollar();
     const result = await $({ mirror: false })`${binPath} --list --output-format json`;
     const stdout = result.stdout?.toString().trim() || '';
     const sessions = parseSessionListOutput(stdout);
@@ -791,6 +809,7 @@ export async function stopIsolatedSession(sessionId, verbose = false) {
   }
 
   try {
+    const $ = await getCommandStreamDollar();
     const result = await $({ mirror: false })`${binPath} --stop ${sessionId}`;
     const stdout = result.stdout?.toString() || '';
     const stderr = result.stderr?.toString() || '';
@@ -827,6 +846,7 @@ export async function stopIsolatedSession(sessionId, verbose = false) {
  */
 export async function checkScreenSessionRunning(sessionName, verbose = false) {
   try {
+    const $ = await getCommandStreamDollar();
     const result = await $({ mirror: false })`screen -ls`;
     const output = result.stdout?.toString() || '';
     const exists = output.includes(sessionName);
@@ -857,6 +877,7 @@ export async function checkScreenSessionRunning(sessionName, verbose = false) {
  */
 export async function checkDockerContainerRunning(containerName, verbose = false) {
   try {
+    const $ = await getCommandStreamDollar();
     const result = await $({ mirror: false })`docker inspect -f ${'{{.State.Running}}'} ${containerName}`;
     const running = (result.stdout?.toString() || '').trim() === 'true';
     if (verbose) {
@@ -890,6 +911,7 @@ export function parseDockerContainerWritableLayerSizeOutput(output) {
 export async function getDockerContainerWritableLayerSize(containerName, verbose = false) {
   if (!containerName) return null;
   try {
+    const $ = await getCommandStreamDollar();
     const result = await $({ mirror: false })`docker inspect --size -f ${'{{.SizeRw}}'} ${containerName}`;
     const bytes = parseDockerContainerWritableLayerSizeOutput(result.stdout?.toString() || '');
     if (verbose) {
@@ -922,6 +944,7 @@ export async function releaseDockerContainerStartGate(containerName, verbose = f
 
   for (let attempt = 1; attempt <= 5; attempt++) {
     try {
+      const $ = await getCommandStreamDollar();
       await $({ mirror: false })`docker exec ${containerName} sh -c ${releaseCommand}`;
       if (verbose) {
         console.log(`[VERBOSE] isolation-runner: released docker start gate for '${containerName}'`);
@@ -960,6 +983,7 @@ export async function removeDockerContainer(containerName, verbose = false) {
   }
 
   try {
+    const $ = await getCommandStreamDollar();
     const result = await $({ mirror: false })`docker rm -f ${containerName}`;
     const stdout = result.stdout?.toString() || '';
     const stderr = result.stderr?.toString() || '';
@@ -992,6 +1016,7 @@ export async function removeDockerContainer(containerName, verbose = false) {
  */
 export async function checkTmuxSessionRunning(sessionName, verbose = false) {
   try {
+    const $ = await getCommandStreamDollar();
     await $({ mirror: false })`tmux has-session -t ${sessionName}`;
     if (verbose) console.log(`[VERBOSE] isolation-runner: tmux has-session '${sessionName}': running`);
     return true;
@@ -1035,6 +1060,7 @@ export async function checkBackendSessionAlive(sessionId, backend, verbose = fal
  */
 export async function checkDockerImagePresent(image, verbose = false) {
   try {
+    const $ = await getCommandStreamDollar();
     await $({ mirror: false })`docker image inspect ${image}`;
     if (verbose) console.log(`[VERBOSE] isolation-runner: docker image inspect '${image}': present`);
     return true;
@@ -1062,6 +1088,7 @@ export async function checkDockerImagePresent(image, verbose = false) {
  */
 export async function checkDockerStorageDriver(verbose = false) {
   try {
+    const $ = await getCommandStreamDollar();
     const result = await $({ mirror: false })`docker info --format ${'{{.Driver}}'}`;
     const driver = (result.stdout?.toString() || '').trim().toLowerCase() || null;
     if (verbose) console.log(`[VERBOSE] isolation-runner: docker storage driver: ${driver || '(unknown)'}`);
@@ -1091,6 +1118,7 @@ export async function checkDockerDiskSpace(verbose = false) {
   try {
     let dataRoot = '/var/lib/docker';
     try {
+      const $ = await getCommandStreamDollar();
       const info = await $({ mirror: false })`docker info --format ${'{{.DockerRootDir}}'}`;
       const root = (info.stdout?.toString() || '').trim();
       if (root) dataRoot = root;
@@ -1099,6 +1127,7 @@ export async function checkDockerDiskSpace(verbose = false) {
       // fails on it (e.g. the path does not exist) we return null below.
     }
 
+    const $ = await getCommandStreamDollar();
     const df = await $({ mirror: false })`df -Pk ${dataRoot}`;
     // `df -P` guarantees one logical line per filesystem (no wrapping). The last
     // line is the data row: Filesystem 1024-blocks Used Available Capacity Mount

package/src/solve.pre-pr-failure-notifier.lib.mjs

@@ -1,5 +1,5 @@
 import { getTrackedToolCommentIds, postTrackedComment, SOLUTION_DRAFT_FAILED_MARKER } from './tool-comments.lib.mjs';
-import { extractForkReplacementBlockedDetails, isForkReplacementBlockedReason } from './solve.repository-recovery-message.lib.mjs';
+import { extractForkReplacementBlockedDetails, isForkReplacementBlockedReason, GITHUB_FORK_SUPPORT_URL } from './solve.repository-recovery-message.lib.mjs';
 import { FORK_DIVERGENCE_RESOLUTION_OPTION, buildForkDivergenceFailureActionSection } from './solve.branch-divergence.lib.mjs';
 
 export { FORK_DIVERGENCE_RESOLUTION_OPTION };
@@ -41,6 +41,7 @@ export function buildPrePullRequestFailureActionSection(reason = '') {
 - It could not prove whether the existing repository has unique commits, so it did not delete it automatically.
 
 ### What you can do
+- Recover the fork without deleting: if \`${repository}\` was a fork of \`${upstream}\` that GitHub detached (for example after a private/public visibility change), ask GitHub Support at ${GITHUB_FORK_SUPPORT_URL} ("Attach, detach or reroute forks") to re-attach it. Detachment from a visibility change is documented as permanent, so this is not guaranteed, and while detached the repository cannot open a cross-repository pull request to \`${upstream}\`.
 - Repository owner path: back up any needed work, then delete, rename, archive, or repair \`${repository}\` in GitHub and rerun the solver.
 - External-owner path: ask the repository owner or a Hive Mind administrator to clean it up and rerun the solver.
 - Use \`--allow-force-non-fork-repository-deletion\` only after confirming that deleting \`${repository}\` is acceptable and any unique commits can be lost.`;

package/src/solve.repository-recovery-message.lib.mjs

@@ -26,27 +26,47 @@ export function buildForkReplacementSafetyCheckDescription({ aheadBy = null, com
   return 'Hive Mind could not prove the repository has no unique commits.';
 }
 
-export function buildForkReplacementBlockedReason({ existingRepository, expectedUpstream, relationshipDescription, safetyCheckDescription } = {}) {
+// GitHub Support's self-service fork request workflow. See
+// https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/detaching-a-fork
+export const GITHUB_FORK_SUPPORT_URL = 'https://support.github.com/request/fork';
+
+/**
+ * Explain how to recover the GitHub fork relationship without deleting the
+ * existing repository. GitHub detaches a fork from its upstream network when the
+ * repository's visibility is toggled (for example private -> public), and that
+ * detachment is documented as permanent with no API/self-service reattachment.
+ * The only non-deletion path is a GitHub Support request. See issue #2019.
+ */
+export function buildDetachedForkRecoveryGuidance({ existingRepository, expectedUpstream } = {}) {
+  const repository = fallback(existingRepository, 'the existing repository');
+  const upstream = fallback(expectedUpstream, 'the expected upstream repository');
+
+  return `Recover the fork link WITHOUT deleting ${repository}: if ${repository} was once a GitHub fork of ${upstream} that got detached (for example after its visibility was switched to private and then back to public), the only path that keeps the repository is a GitHub Support request. Open ${GITHUB_FORK_SUPPORT_URL}, choose the "Attach, detach or reroute forks" flow, and ask to re-attach ${repository} to ${upstream}. GitHub documents visibility-change detachment as permanent, so reattachment is not guaranteed. While detached, ${repository} cannot open a cross-repository pull request to ${upstream}, so the solver needs either a reattached fork or a fresh fork to continue.`;
+}
+
+export function buildForkReplacementBlockedReason({ existingRepository, expectedUpstream, relationshipDescription, safetyCheckDescription, likelyDetachedFork = false } = {}) {
   const repository = fallback(existingRepository, 'the existing repository');
   const upstream = fallback(expectedUpstream, 'the expected upstream repository');
   const relationship = fallback(relationshipDescription, `${repository} is not a confirmed GitHub fork of ${upstream}.`);
   const safetyCheck = fallback(safetyCheckDescription, buildForkReplacementSafetyCheckDescription());
+  const detachedForkNote = likelyDetachedFork ? `\n- Likely cause: ${repository} shares history with ${upstream} but GitHub reports it as a non-fork, which matches a fork that was detached from its network (commonly after a private/public visibility change).` : '';
 
   return `${FORK_REPLACEMENT_BLOCKED_REASON_PREFIX}
 
 What happened:
 - Expected fork or replacement repository: ${repository}
 - Expected upstream: ${upstream}
-- Actual state: ${relationship}
+- Actual state: ${relationship}${detachedForkNote}
 - Safety check: ${safetyCheck}
 
 Why it stopped:
 Hive Mind did not delete ${repository} because the repository may contain commits that would be lost.
 
 Options:
-1. Back up any needed work in ${repository}, then delete, rename, archive, or repair that repository in GitHub and rerun the solver.
-2. If you do not control ${repository}, ask the repository owner or a Hive Mind administrator to clean it up and rerun the solver.
-3. Rerun with --allow-force-non-fork-repository-deletion only after confirming that deleting ${repository} is acceptable.`;
+1. ${buildDetachedForkRecoveryGuidance({ existingRepository: repository, expectedUpstream: upstream })}
+2. Back up any needed work in ${repository}, then delete, rename, archive, or repair that repository in GitHub and rerun the solver.
+3. If you do not control ${repository}, ask the repository owner or a Hive Mind administrator to clean it up and rerun the solver.
+4. Rerun with --allow-force-non-fork-repository-deletion only after confirming that deleting ${repository} is acceptable.`;
 }
 
 export function isForkReplacementBlockedReason(reason = '') {

package/src/solve.repository-safety.lib.mjs

@@ -0,0 +1,163 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { summarizeGitHubCompareFailure } from './solve.repository-recovery-message.lib.mjs';
+
+const resultText = result => `${result?.stderr?.toString?.() || ''}${result?.stdout?.toString?.() || ''}`.trim();
+const resultStdout = result => result?.stdout?.toString?.().trim() || '';
+const shortSha = sha => String(sha || '').slice(0, 12);
+
+const branchLabel = branch => {
+  const subject = branch.subject ? ` ${branch.subject}` : '';
+  return `${branch.ref} (${branch.uniqueCommitCount} commit(s), ${shortSha(branch.sha)}${subject})`;
+};
+
+export function buildReplacementBranchSafetyDescription({ uniqueBranches = [], branchCount = 0, failureOutput = '' } = {}) {
+  if (failureOutput) {
+    return `Local Git branch reachability check failed (${summarizeGitHubCompareFailure(failureOutput)}), so Hive Mind could not prove all replacement repository branches are preserved upstream.`;
+  }
+
+  if (uniqueBranches.length > 0) {
+    const examples = uniqueBranches.slice(0, 3).map(branchLabel).join('; ');
+    const remaining = uniqueBranches.length > 3 ? `; and ${uniqueBranches.length - 3} more` : '';
+    return `Local Git branch reachability found ${uniqueBranches.length} replacement branch tip(s) with commits not reachable from upstream branches or PR refs: ${examples}${remaining}.`;
+  }
+
+  return `Local Git branch reachability found all ${branchCount} replacement branch tip(s) reachable from upstream branches or PR refs.`;
+}
+
+async function runStep(commandPromise, failurePrefix) {
+  const result = await commandPromise;
+  if (result.code !== 0) {
+    return {
+      ok: false,
+      output: `${failurePrefix}: ${resultText(result) || `exit ${result.code}`}`,
+    };
+  }
+  return { ok: true, result };
+}
+
+const parseReplacementRefs = output =>
+  String(output || '')
+    .split('\n')
+    .map(line => line.trim())
+    .filter(Boolean)
+    .map(line => {
+      const [ref, sha] = line.split(/\s+/, 2);
+      return { ref, sha };
+    })
+    .filter(item => item.ref && item.sha);
+
+/**
+ * Verify that deleting a non-fork replacement repository will not remove branch
+ * tips that are absent from the upstream repository. This is intentionally used
+ * only in the rare fork-replacement recovery path.
+ */
+export async function checkReplacementRepositoryBranchSafety({ $, owner, repo, existingRepository, tempRoot = os.tmpdir() }) {
+  const tempDir = await fs.mkdtemp(path.join(tempRoot, 'hive-mind-fork-replacement-'));
+
+  try {
+    const init = await runStep($({ cwd: tempDir })`git init -q 2>&1`, 'git init failed');
+    if (!init.ok) {
+      return {
+        safeToDelete: false,
+        branchCount: 0,
+        uniqueBranches: [],
+        safetyCheckDescription: buildReplacementBranchSafetyDescription({ failureOutput: init.output }),
+      };
+    }
+
+    const upstreamUrl = `https://github.com/${owner}/${repo}.git`;
+    const replacementUrl = `https://github.com/${existingRepository}.git`;
+
+    const upstreamFetch = await runStep($({ cwd: tempDir })`git fetch --filter=blob:none ${upstreamUrl} '+refs/heads/*:refs/remotes/upstream/*' '+refs/pull/*/head:refs/remotes/upstream-pr/*' 2>&1`, 'upstream fetch failed');
+    if (!upstreamFetch.ok) {
+      return {
+        safeToDelete: false,
+        branchCount: 0,
+        uniqueBranches: [],
+        safetyCheckDescription: buildReplacementBranchSafetyDescription({ failureOutput: upstreamFetch.output }),
+      };
+    }
+
+    const replacementFetch = await runStep($({ cwd: tempDir })`git fetch --filter=blob:none ${replacementUrl} '+refs/heads/*:refs/remotes/replacement/*' 2>&1`, 'replacement fetch failed');
+    if (!replacementFetch.ok) {
+      return {
+        safeToDelete: false,
+        branchCount: 0,
+        uniqueBranches: [],
+        safetyCheckDescription: buildReplacementBranchSafetyDescription({ failureOutput: replacementFetch.output }),
+      };
+    }
+
+    const refsResult = await runStep($({ cwd: tempDir })`git for-each-ref --format='%(refname:short) %(objectname)' refs/remotes/replacement 2>&1`, 'replacement ref listing failed');
+    if (!refsResult.ok) {
+      return {
+        safeToDelete: false,
+        branchCount: 0,
+        uniqueBranches: [],
+        safetyCheckDescription: buildReplacementBranchSafetyDescription({ failureOutput: refsResult.output }),
+      };
+    }
+
+    const replacementRefs = parseReplacementRefs(resultStdout(refsResult.result));
+    const uniqueBranches = [];
+
+    for (const { ref, sha } of replacementRefs) {
+      const countResult = await runStep($({ cwd: tempDir })`git rev-list --count ${ref} --not --remotes=upstream --remotes=upstream-pr 2>&1`, `unique commit count failed for ${ref}`);
+      if (!countResult.ok) {
+        return {
+          safeToDelete: false,
+          branchCount: replacementRefs.length,
+          uniqueBranches,
+          safetyCheckDescription: buildReplacementBranchSafetyDescription({ failureOutput: countResult.output }),
+        };
+      }
+
+      const uniqueCommitCount = Number.parseInt(resultStdout(countResult.result), 10);
+      if (!Number.isFinite(uniqueCommitCount)) {
+        return {
+          safeToDelete: false,
+          branchCount: replacementRefs.length,
+          uniqueBranches,
+          safetyCheckDescription: buildReplacementBranchSafetyDescription({ failureOutput: `invalid unique commit count for ${ref}: ${resultStdout(countResult.result)}` }),
+        };
+      }
+
+      if (uniqueCommitCount > 0) {
+        const subjectResult = await $({ cwd: tempDir })`git log -1 --format=%s ${ref} 2>&1`;
+        uniqueBranches.push({
+          ref: ref.replace(/^replacement\//, ''),
+          sha,
+          uniqueCommitCount,
+          subject: subjectResult.code === 0 ? resultStdout(subjectResult) : '',
+        });
+      }
+    }
+
+    const reachableBranchCount = replacementRefs.length - uniqueBranches.length;
+
+    return {
+      safeToDelete: uniqueBranches.length === 0,
+      branchCount: replacementRefs.length,
+      reachableBranchCount,
+      // At least one branch tip is fully reachable from upstream refs, so the
+      // replacement shares history with upstream. Combined with GitHub reporting
+      // it as a non-fork, that matches a fork detached from its network (see
+      // issue #2019), typically after a private/public visibility change.
+      likelyDetachedFork: replacementRefs.length > 0 && reachableBranchCount > 0,
+      uniqueBranches,
+      safetyCheckDescription: buildReplacementBranchSafetyDescription({ uniqueBranches, branchCount: replacementRefs.length }),
+    };
+  } catch (error) {
+    return {
+      safeToDelete: false,
+      branchCount: 0,
+      uniqueBranches: [],
+      safetyCheckDescription: buildReplacementBranchSafetyDescription({ failureOutput: error.message }),
+    };
+  } finally {
+    await fs.rm(tempDir, { recursive: true, force: true });
+  }
+}

package/src/solve.repository.lib.mjs

@@ -30,6 +30,7 @@ const { log, formatAligned } = lib;
 // Import exit handler
 import { safeExit } from './exit-handler.lib.mjs';
 import { parseForkFullNameFromGhOutput } from './github-repository-names.lib.mjs';
+import { checkReplacementRepositoryBranchSafety } from './solve.repository-safety.lib.mjs';
 import { buildForkReplacementBlockedReason, buildForkReplacementSafetyCheckDescription } from './solve.repository-recovery-message.lib.mjs';
 
 // Import GitHub utilities for permission checks
@@ -525,34 +526,75 @@ export const setupRepository = async (argv, owner, repo, forkOwner = null, issue
         const relationshipDescription = !forkValidation.isFork ? `${existingForkName} is not a GitHub fork of ${owner}/${repo}.` : `${existingForkName} is a GitHub fork of ${forkValidation.parent || 'unknown parent'}, not ${owner}/${repo}.`;
         await log(`${formatAligned('', '', detail)}`);
         await log(`${formatAligned('', '', `Fork parent: ${forkValidation.parent || 'N/A (not a fork)'}, source: ${forkValidation.source || 'N/A'}, expected: ${owner}/${repo}`)}`);
-        // Safety check: compare commits before deleting to avoid data loss
-        await log(`${formatAligned('🔍', 'Safety check:', 'Comparing commits against upstream...')}`);
+        // Safety check: compare commits before deleting to avoid data loss.
+        // GitHub compare only answers for fork-network refs, so a local Git
+        // fallback checks every replacement branch tip before deletion.
+        await log(`${formatAligned('🔍', 'Safety check:', 'Comparing default branch against upstream...')}`);
         let safeToDelete = false;
         let safetyCheckDescription = buildForkReplacementSafetyCheckDescription();
+        let shouldRunBranchReachabilityCheck = false;
+        let likelyDetachedFork = false;
         try {
           const cmp = await $`gh api repos/${owner}/${repo}/compare/${owner}:HEAD...${existingForkName.split('/')[0]}:HEAD --paginate --jq '.ahead_by' 2>&1`;
           const aheadBy = parseInt(cmp.stdout.toString().trim(), 10);
           if (cmp.code === 0 && aheadBy === 0) {
-            await log(`${formatAligned('✅', 'Safe to delete:', 'No additional commits in non-fork repository')}`);
-            safeToDelete = true;
+            await log(`${formatAligned('✅', 'Default branch:', 'No additional commits in replacement repository')}`);
+            shouldRunBranchReachabilityCheck = true;
           } else if (cmp.code === 0) {
             safetyCheckDescription = buildForkReplacementSafetyCheckDescription({ aheadBy });
-            const aheadDescription = Number.isFinite(aheadBy) ? `${aheadBy} commit(s)` : 'an unknown number of commit(s)';
-            await log(`${formatAligned('⚠️', 'UNSAFE:', `Repository has ${aheadDescription} ahead of upstream that would be lost`)}`, { level: 'warning' });
+            if (Number.isFinite(aheadBy)) {
+              await log(`${formatAligned('⚠️', 'UNSAFE:', `Default branch has ${aheadBy} commit(s) ahead of upstream that would be lost`)}`, { level: 'warning' });
+            } else {
+              await log(`${formatAligned('⚠️', 'Compare unclear:', 'GitHub compare did not return a numeric ahead_by value')}`, { level: 'warning' });
+              shouldRunBranchReachabilityCheck = true;
+            }
           } else {
             const compareOutput = (cmp.stderr?.toString() || '') + (cmp.stdout?.toString() || '');
             safetyCheckDescription = buildForkReplacementSafetyCheckDescription({ compareFailureOutput: compareOutput });
             await log(`${formatAligned('⚠️', 'Compare failed:', compareOutput.split('\n')[0])}`, { level: 'warning' });
+            shouldRunBranchReachabilityCheck = true;
           }
         } catch (e) {
           safetyCheckDescription = buildForkReplacementSafetyCheckDescription({ compareFailureOutput: e.message });
           await log(`${formatAligned('⚠️', 'Compare error:', e.message)}`, { level: 'warning' });
+          shouldRunBranchReachabilityCheck = true;
+        }
+
+        if (shouldRunBranchReachabilityCheck) {
+          await log(`${formatAligned('🔍', 'Safety check:', 'Checking all replacement branches against upstream refs...')}`);
+          const branchSafety = await checkReplacementRepositoryBranchSafety({
+            $,
+            owner,
+            repo,
+            existingRepository: existingForkName,
+          });
+          safetyCheckDescription = branchSafety.safetyCheckDescription;
+          likelyDetachedFork = Boolean(branchSafety.likelyDetachedFork);
+
+          if (likelyDetachedFork) {
+            await log(`${formatAligned('🔗', 'Detached fork:', `${existingForkName} shares history with ${owner}/${repo} but is not a GitHub fork — this matches a fork detached by a private/public visibility change`)}`);
+          }
+
+          if (branchSafety.safeToDelete) {
+            await log(`${formatAligned('✅', 'Safe to delete:', `All ${branchSafety.branchCount} replacement branch tip(s) are reachable from upstream`)}`);
+            safeToDelete = true;
+          } else if (branchSafety.uniqueBranches.length > 0) {
+            await log(`${formatAligned('⚠️', 'UNSAFE:', `${branchSafety.uniqueBranches.length} replacement branch tip(s) have commits not reachable from upstream`)}`, { level: 'warning' });
+            for (const branch of branchSafety.uniqueBranches.slice(0, 3)) {
+              await log(`${formatAligned('', '', `${branch.ref}: ${branch.uniqueCommitCount} commit(s), ${branch.sha.slice(0, 12)} ${branch.subject || ''}`)}`, { level: 'warning' });
+            }
+          } else {
+            await log(`${formatAligned('⚠️', 'Branch check failed:', safetyCheckDescription)}`, { level: 'warning' });
+          }
         }
         if (!safeToDelete) {
           if (argv.allowForceNonForkRepositoryDeletion) {
             // Force flag set — proceed with deletion despite the failed safety check.
             await log(`${formatAligned('⚠️', 'Force deletion ENABLED:', '--allow-force-non-fork-repository-deletion — proceeding despite potential data loss')}`, { level: 'warning' });
           } else {
+            if (likelyDetachedFork) {
+              await log(`  🔗 Recover without deletion: ask GitHub Support to re-attach ${existingForkName} to ${owner}/${repo} at https://support.github.com/request/fork ("Attach, detach or reroute forks")`);
+            }
             await log(`  💡 Manual fix required: back up work, then: gh repo delete ${existingForkName} --yes`);
             await log(`     Then run this command again to create a proper fork of ${owner}/${repo}`);
             await log(`  🔧 Or force deletion (DANGEROUS): solve ${argv.url || argv['issue-url'] || argv._[0] || '<issue-url>'} --allow-force-non-fork-repository-deletion`);
@@ -563,6 +605,7 @@ export const setupRepository = async (argv, owner, repo, forkOwner = null, issue
                 expectedUpstream: `${owner}/${repo}`,
                 relationshipDescription,
                 safetyCheckDescription,
+                likelyDetachedFork,
               })
             );
           }

package/src/tool-retry.lib.mjs

@@ -59,6 +59,13 @@ export const classifyRetryableError = value => {
     return { message, isRetryable: true, isCapacity: false, label: 'Stream disconnected before completion' };
   }
 
+  // Issue #2023: Claude Code can close a stream-json process after tool output
+  // (for example "Exit code 144") without emitting the terminal result event.
+  // The session is still resumable; failing immediately loses in-progress work.
+  if (lower.includes('claude stream ended without a terminal result event')) {
+    return { message, isRetryable: true, isCapacity: false, label: 'Claude stream ended without terminal result' };
+  }
+
   // Issue #1937: Stream idle timeout. When the Anthropic streaming response stalls
   // (no bytes for the SDK's idle window) after the model has already emitted part of
   // its answer, the Claude CLI aborts the turn and surfaces a synthetic assistant /