@link-assistant/hive-mind 2.10.4 → 2.11.0

package/src/locales/zh.lino

@@ -556,9 +556,9 @@ zh
       locked
         options "🔒 锁定选项：`{{options}}`"
       task
-        enabled "*/task* - 根据仓库链接和 issue 文本创建 GitHub issue"
-        usage "用法：`/task <github-repository-url>` 后接 issue 文本，或回复 `/task`"
-        example "示例：`/task https://github.com/owner/repo`，然后在后续行写 issue 文本"
+        enabled "*/task* - 根据文本或 CI/CD 上下文创建 GitHub issue"
+        usage "用法：`/task <github-repository-url>` 后接 issue 文本，或 `/task --ci-cd <github-repository-url>`"
+        example "示例：`/task --ci-cd https://github.com/owner/repo` 只创建 CI/CD 修复 issue"
         disabled "*/task* / */split* - ❌ 已禁用"
       split
         enabled "*/split* - 将 GitHub issue 拆分为更小的 issue"
@@ -649,6 +649,9 @@ zh
         executing "⏳ 正在执行..."
         finished "工作会话已成功完成"
         failed "工作会话失败（退出代码：{{exitCode}}）"
+        merged_but_failed "拉取请求已合并，但工作会话退出，代码为：{{exitCode}}"
+        merged_success "请求的拉取请求已成功合并。"
+        runner_also_failed "运行器也失败了；其退出代码已保留以供调查。"
         killed "工作会话已终止：{{reason}}{{exitSuffix}}"
         stopped "工作会话已由用户停止{{requestedBy}}{{exitSuffix}}"
     duration

package/src/session-monitor.docker-terminal.lib.mjs

@@ -0,0 +1,118 @@
+/**
+ * Issue #2117: guard against a *fabricated* terminal exit code for detached
+ * docker sessions.
+ *
+ * start-command derives the exit code of a detached docker session from an
+ * unanchored `Exit Code: N` scan over the whole execution log
+ * (`status-formatter.js#readExitCodeFromLog`), so any text the wrapped command
+ * prints — for example an AI agent echoing the tail of an older execution log —
+ * can be mistaken for the terminal footer. That is exactly how a `/solve` run
+ * that merged its pull request and exited 0 was announced as "Work session
+ * failed (exit code: 1)": the fabricated code entered the log 21 minutes before
+ * the command finished, and `$ --status` stamped the record with it the moment
+ * the container stopped — about two seconds before the real footer
+ * (`Exit Code: 0`) was appended by start-command's detached-docker watcher.
+ *
+ * The watcher always appends that footer right after the container exits, so a
+ * short deferral is enough for the authoritative value to appear. If it never
+ * does (e.g. the watcher itself was killed), the reported status is accepted
+ * once the grace period expires, preserving the previous behaviour: a real
+ * failure is still reported, just a minute later.
+ *
+ * @see https://github.com/link-assistant/hive-mind/issues/2117
+ * @see https://github.com/link-foundation/start/issues/150
+ */
+
+/** How long an uncorroborated docker terminal failure stays provisional. */
+export const DOCKER_TERMINAL_FOOTER_GRACE_MS = 60 * 1000;
+
+/** Session-snapshot field holding the first sighting of such a status. */
+export const DOCKER_TERMINAL_UNVERIFIED_FIRST_SEEN_FIELD = 'dockerTerminalUnverifiedFirstSeenAt';
+
+/**
+ * Whether the reported end of the session is recent enough for the fabrication
+ * race to still be open.
+ *
+ * start-command only invents a terminal result for a record it still has stored
+ * as `executing`, and it stamps that invention with `endTime = new Date()`
+ * (`status-formatter.js#enrichDetachedStatus`) — so a fabricated failure always
+ * looks like it ended just now, no matter how long ago the container really
+ * stopped. A record that reports an end time older than the grace period, on the
+ * other hand, has had all the time it needed for the footer to be written;
+ * deferring it would only postpone a real failure notification.
+ *
+ * @param {string|Date|null|undefined} endTime - End time from the status record.
+ * @param {number} nowMs - Current epoch milliseconds.
+ * @returns {boolean} True when the race cannot be ruled out.
+ */
+function terminalClaimIsRecent(endTime, nowMs) {
+  if (!endTime) return true; // No timestamp at all: the race cannot be ruled out.
+  const endMs = endTime instanceof Date ? endTime.getTime() : new Date(endTime).getTime();
+  if (!Number.isFinite(endMs)) return true;
+  return nowMs - endMs < DOCKER_TERMINAL_FOOTER_GRACE_MS;
+}
+
+/**
+ * Drop the deferral marker once the session's outcome is resolved (footer
+ * written, session running again, or the status accepted).
+ *
+ * @param {object|null|undefined} sessionInfo - Tracked session snapshot (mutated).
+ * @param {function} persistSnapshot - Callback persisting the updated snapshot.
+ */
+export function clearUnverifiedDockerTerminalMarker(sessionInfo, persistSnapshot) {
+  if (!sessionInfo?.[DOCKER_TERMINAL_UNVERIFIED_FIRST_SEEN_FIELD]) return;
+  delete sessionInfo[DOCKER_TERMINAL_UNVERIFIED_FIRST_SEEN_FIELD];
+  persistSnapshot();
+}
+
+/**
+ * Decide whether a docker terminal *failure* status that the log footer does not
+ * corroborate should be deferred (treated as still running) for now. The first
+ * sighting is persisted so the deferral survives a bot restart and cannot be
+ * reset forever by repeated polling.
+ *
+ * @param {string} sessionName - Session identifier, for verbose output only.
+ * @param {object|null|undefined} sessionInfo - Tracked session snapshot (mutated).
+ * @param {object} options
+ * @param {number|null} options.exitCode - Exit code `$ --status` reported.
+ * @param {string|Date|null} [options.endTime] - End time the status record reports.
+ * @param {boolean} options.verbose - Whether to explain the decision.
+ * @param {function} options.persistSnapshot - Callback persisting the snapshot.
+ * @returns {boolean} True while the status is still provisional.
+ */
+export function shouldDeferUnverifiedDockerTerminal(sessionName, sessionInfo, { exitCode, endTime = null, verbose, persistSnapshot }) {
+  const nowMs = Date.now();
+
+  if (!terminalClaimIsRecent(endTime, nowMs)) {
+    if (verbose) {
+      console.log(`[VERBOSE] Session ${sessionName} reports a terminal failure (exit ${exitCode}) that ended at ${endTime}, longer than ${DOCKER_TERMINAL_FOOTER_GRACE_MS}ms ago; the log footer had time to appear, so the reported exit code is accepted (issue #2117)`);
+    }
+    return false;
+  }
+
+  const raw = sessionInfo?.[DOCKER_TERMINAL_UNVERIFIED_FIRST_SEEN_FIELD];
+  const firstSeenMs = raw ? new Date(raw).getTime() : null;
+
+  if (firstSeenMs === null || !Number.isFinite(firstSeenMs)) {
+    if (sessionInfo) {
+      sessionInfo[DOCKER_TERMINAL_UNVERIFIED_FIRST_SEEN_FIELD] = new Date(nowMs).toISOString();
+      persistSnapshot();
+    }
+    if (verbose) {
+      console.log(`[VERBOSE] Session ${sessionName} reports a terminal failure (exit ${exitCode}) that no log footer corroborates; deferring for up to ${DOCKER_TERMINAL_FOOTER_GRACE_MS}ms until start-command writes the real footer (issue #2117)`);
+    }
+    return true;
+  }
+
+  if (nowMs - firstSeenMs < DOCKER_TERMINAL_FOOTER_GRACE_MS) {
+    if (verbose) {
+      console.log(`[VERBOSE] Session ${sessionName} still reports an unverified terminal failure (exit ${exitCode}); waiting for the log footer (issue #2117)`);
+    }
+    return true;
+  }
+
+  if (verbose) {
+    console.log(`[VERBOSE] Session ${sessionName} kept reporting a terminal failure (exit ${exitCode}) for ${DOCKER_TERMINAL_FOOTER_GRACE_MS}ms without a log footer; accepting the reported exit code (issue #2117)`);
+  }
+  return false;
+}

package/src/session-monitor.lib.mjs

@@ -26,8 +26,15 @@ import { formatSessionCompletionMessage, getSessionCompletionExitCode, classifyS
 import { notifySubscribers, getSubscriberCount } from './telegram-subscribers.lib.mjs';
 import { classifyExitStatus, normalizeExitCode } from './session-status.lib.mjs';
 import { readLastSessionIdFromLog, buildResumeCommand, formatResumeSection } from './session-resume.lib.mjs';
+import { resolveFailedSessionPullRequestState } from './github-pr-state.lib.mjs';
+// Issue #2117: a docker terminal failure that no anchored log footer corroborates
+// may be an exit code start-command fabricated from the command's own output.
+import { clearUnverifiedDockerTerminalMarker as clearUnverifiedDockerTerminalMarkerImpl, shouldDeferUnverifiedDockerTerminal as shouldDeferUnverifiedDockerTerminalImpl } from './session-monitor.docker-terminal.lib.mjs';
+import { isDockerIsolation, sessionStartMs, resolveOomKilledState, resolveStaleExecutingState as resolveStaleExecutingStateImpl } from './session-monitor.stale-executing.lib.mjs';
 
 export { formatSessionCompletionMessage, getSessionCompletionExitCode } from './work-session-formatting.lib.mjs';
+export { DOCKER_TERMINAL_FOOTER_GRACE_MS } from './session-monitor.docker-terminal.lib.mjs';
+export { STALE_EXECUTING_MIN_AGE_MS, DOCKER_BACKEND_GONE_GRACE_MS } from './session-monitor.stale-executing.lib.mjs';
 
 const exec = promisify(execCallback);
 
@@ -521,134 +528,16 @@ function isNonIsolationSessionActive(sessionName, sessionInfo, verbose = false)
   return true;
 }
 
-/**
- * Issue #1927: minimum age before a session that `$ --status` still reports as
- * `executing` is allowed to be declared dead purely on a backend-liveness probe
- * (the screen/tmux/docker session is gone). This avoids a race where a session
- * that has just been launched — but whose backend has not registered yet — is
- * falsely reported as killed. The authoritative log-footer check is NOT gated by
- * this, because a written "Exit Code:" footer is proof the command terminated.
- */
-export const STALE_EXECUTING_MIN_AGE_MS = 90 * 1000;
-export const DOCKER_BACKEND_GONE_GRACE_MS = 2 * 60 * 1000;
-const DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD = 'dockerBackendGoneFirstSeenAt';
-
-function sessionStartMs(sessionInfo) {
-  const start = sessionInfo?.startTime;
-  if (!start) return null;
-  const date = start instanceof Date ? start : new Date(start);
-  const ms = date.getTime();
-  return Number.isFinite(ms) ? ms : null;
-}
-
-function isDockerIsolation(sessionInfo, statusResult) {
-  return sessionInfo?.isolationBackend === 'docker' || statusResult?.isolation === 'docker';
+function clearUnverifiedDockerTerminalMarker(sessionName, sessionInfo) {
+  clearUnverifiedDockerTerminalMarkerImpl(sessionInfo, () => persistSessionSnapshot(sessionName, sessionInfo));
 }
 
-function getDockerBackendGoneFirstSeenMs(sessionInfo) {
-  const raw = sessionInfo?.[DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD];
-  if (!raw) return null;
-  const ms = new Date(raw).getTime();
-  return Number.isFinite(ms) ? ms : null;
+function shouldDeferUnverifiedDockerTerminal(sessionName, sessionInfo, { exitCode, endTime, verbose }) {
+  return shouldDeferUnverifiedDockerTerminalImpl(sessionName, sessionInfo, { exitCode, endTime, verbose, persistSnapshot: () => persistSessionSnapshot(sessionName, sessionInfo) });
 }
 
-function clearDockerBackendGoneMarker(sessionName, sessionInfo) {
-  if (!sessionInfo?.[DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD]) return;
-  delete sessionInfo[DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD];
-  persistSessionSnapshot(sessionName, sessionInfo);
-}
-
-/**
- * Cross-check whether a session that `$ --status` still reports as `executing`
- * has actually terminated. Issue #1927: start-command's status can get stuck on
- * `executing` after the process was killed (a lingering shell keeps the screen
- * session alive, flipping executed→executing), so a SIGKILLed /solve was never
- * reported. Two independent signals are consulted, strongest first:
- *
- *   1. The execution log FOOTER. When start-command wrote "Exit Code: N" the
- *      command terminated, full stop — regardless of what `--status` claims.
- *      This is authoritative and catches the dominant lingering-shell case.
- *   2. Backend LIVENESS. If no footer was written (e.g. the wrapper itself was
- *      hard-killed) but the backing screen/tmux/docker session is gone, the
- *      process cannot still be executing. Gated by STALE_EXECUTING_MIN_AGE_MS to
- *      avoid a just-launched-not-yet-registered race.
- *
- * @returns {Promise<{exitCode: number|null, status: string, reason: string}|null>}
- *   Terminal details when the session is actually dead, else null (still running).
- */
-async function resolveStaleExecutingState(sessionName, sessionInfo, statusResult, { verbose, runner, exitFromLog, backendAlive }) {
-  // 1. Authoritative: the log footer.
-  const logPath = statusResult?.logPath || sessionInfo?.logPath || null;
-  if (logPath) {
-    const readFooter = exitFromLog || runner.readSessionExitFromLog;
-    const footer = readFooter ? readFooter(logPath, { verbose }) : null;
-    if (footer?.finished) {
-      const status = classifyExitStatus(footer.exitCode) || (footer.exitCode === 0 ? 'executed' : 'failed');
-      return { exitCode: footer.exitCode, status, reason: `log-footer(exit ${footer.exitCode})` };
-    }
-  }
-
-  // 2. Liveness probe, only once the session is old enough to have registered.
-  const startMs = sessionStartMs(sessionInfo);
-  const ageMs = startMs != null ? Date.now() - startMs : Infinity;
-  if (ageMs >= STALE_EXECUTING_MIN_AGE_MS && sessionInfo?.isolationBackend) {
-    const probe = backendAlive || runner.checkBackendSessionAlive;
-    const alive = probe ? await probe(sessionInfo.sessionId || sessionName, sessionInfo.isolationBackend, verbose) : null;
-    // Only `false` (definitively gone) counts as killed; `null` (unknown backend)
-    // is treated as "no signal" so we don't kill on an indeterminate probe.
-    if (alive === false) {
-      if (isDockerIsolation(sessionInfo, statusResult)) {
-        const nowMs = Date.now();
-        const firstSeenMs = getDockerBackendGoneFirstSeenMs(sessionInfo);
-        if (firstSeenMs === null) {
-          sessionInfo[DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD] = new Date(nowMs).toISOString();
-          persistSessionSnapshot(sessionName, sessionInfo);
-          if (verbose) {
-            console.log(`[VERBOSE] Session ${sessionName} docker backend is gone but no terminal status/footer is available yet; deferring killed classification for ${DOCKER_BACKEND_GONE_GRACE_MS}ms`);
-          }
-          return null;
-        }
-        if (nowMs - firstSeenMs < DOCKER_BACKEND_GONE_GRACE_MS) {
-          if (verbose) {
-            console.log(`[VERBOSE] Session ${sessionName} docker backend is still gone; waiting for terminal status/footer before reporting killed`);
-          }
-          return null;
-        }
-      }
-      return { exitCode: null, status: 'killed', reason: 'backend-gone' };
-    }
-    if (alive === true) {
-      clearDockerBackendGoneMarker(sessionName, sessionInfo);
-    }
-  }
-
-  return null;
-}
-
-function resolveOomKilledState(sessionName, sessionInfo, statusResult, { verbose, runner, exitFromLog }) {
-  const logPath = statusResult?.logPath || sessionInfo?.logPath || null;
-  let footer = null;
-  if (logPath) {
-    const readFooter = exitFromLog || runner.readSessionExitFromLog;
-    footer = readFooter ? readFooter(logPath, { verbose }) : null;
-  }
-
-  const statusExitCode = normalizeExitCode(statusResult?.exitCode);
-  const footerExitCode = footer?.finished ? normalizeExitCode(footer.exitCode) : null;
-  let exitCode = 137;
-  if (statusExitCode !== null && statusExitCode > 0) {
-    exitCode = statusExitCode;
-  } else if (footerExitCode !== null && footerExitCode > 0) {
-    exitCode = footerExitCode;
-  }
-  const endTime = statusResult?.endTime || footer?.endTime || statusResult?.currentTime || null;
-  const corrected = { ...statusResult, status: 'oom-killed', exitCode, endTime };
-
-  if (verbose) {
-    console.log(`[VERBOSE] Session ${sessionName} status includes oomKilled=true; treating it as terminal oom-killed (exit ${exitCode})`);
-  }
-
-  return { running: false, exitCode, status: 'oom-killed', statusResult: corrected, stale: true };
+function resolveStaleExecutingState(sessionName, sessionInfo, statusResult, options) {
+  return resolveStaleExecutingStateImpl(sessionName, sessionInfo, statusResult, { ...options, persistSnapshot: () => persistSessionSnapshot(sessionName, sessionInfo) });
 }
 
 async function getIsolationSessionState(sessionName, sessionInfo, options = {}) {
@@ -678,25 +567,30 @@ async function getIsolationSessionState(sessionName, sessionInfo, options = {})
           const corrected = { ...statusResult, status: correctedStatus, exitCode: stale.exitCode, endTime: statusResult.endTime || stale.endTime || null };
           return { running: false, exitCode: stale.exitCode, status: correctedStatus, statusResult: corrected, stale: true };
         }
+        // Back to a plain `executing` report: any earlier unverified terminal
+        // failure was provisional and is now moot (issue #2117).
+        clearUnverifiedDockerTerminalMarker(sessionName, sessionInfo);
         return { running: true, exitCode: null, status: statusResult.status, statusResult };
       }
       if (runner.isTerminalSessionStatus(statusResult.status)) {
-        let exitCode = statusResult.exitCode !== undefined ? statusResult.exitCode : null;
-        // Issue #1927: when start-command reports a terminal status but a missing
-        // or sentinel (-1) exit code — which its lingering-shell reverse-flip can
-        // produce — recover the real code from the log footer so a SIGKILL is not
-        // mislabelled as a generic failure.
-        if ((exitCode === null || exitCode === -1) && (statusResult.logPath || sessionInfo?.logPath)) {
-          const readFooter = exitFromLog || runner.readSessionExitFromLog;
-          const footer = readFooter ? readFooter(statusResult.logPath || sessionInfo.logPath, { verbose }) : null;
-          if (footer?.finished) {
-            exitCode = footer.exitCode;
-            const correctedStatus = classifyExitStatus(footer.exitCode) || statusResult.status;
-            if (verbose) {
-              console.log(`[VERBOSE] Session ${sessionName} reported terminal '${statusResult.status}' with exit ${statusResult.exitCode}; recovered real exit ${exitCode} (${correctedStatus}) from log footer`);
-            }
-            return { running: false, exitCode, status: correctedStatus, statusResult: { ...statusResult, status: correctedStatus, exitCode } };
+        const exitCode = statusResult.exitCode !== undefined ? statusResult.exitCode : null;
+        const logPath = statusResult.logPath || sessionInfo?.logPath || null;
+        // The log FOOTER is the authoritative terminal result. It is anchored on
+        // the `=====` separator (see parseSessionExitFooter), so — unlike the
+        // exit code `$ --status` derives from an unanchored full-log scan — it
+        // cannot be forged by output the wrapped command printed (issue #2117).
+        // Prefer it whenever it exists: that both recovers a real code from a
+        // missing/sentinel status (issue #1927) and overrides a fabricated one.
+        const readFooter = exitFromLog || runner.readSessionExitFromLog;
+        const footer = logPath && readFooter ? readFooter(logPath, { verbose }) : null;
+        if (footer?.finished) {
+          const footerExitCode = footer.exitCode;
+          const correctedStatus = classifyExitStatus(footerExitCode) || statusResult.status;
+          if (verbose && normalizeExitCode(footerExitCode) !== normalizeExitCode(exitCode)) {
+            console.log(`[VERBOSE] Session ${sessionName} reported terminal '${statusResult.status}' with exit ${exitCode}; the log footer says exit ${footerExitCode} (${correctedStatus}) and wins (issues #1927/#2117)`);
           }
+          clearUnverifiedDockerTerminalMarker(sessionName, sessionInfo);
+          return { running: false, exitCode: footerExitCode, status: correctedStatus, statusResult: { ...statusResult, status: correctedStatus, exitCode: footerExitCode } };
         }
         // Issue #1939: a native docker session can report a terminal status
         // ("executed") with the unknown exit-code sentinel (-1) while the
@@ -704,8 +598,21 @@ async function getIsolationSessionState(sessionName, sessionInfo, options = {})
         // a real terminal exit, such a status is provisional — fall through to
         // isSessionRunning() below, which cross-checks the live container via
         // `docker inspect` before we notify the user the work finished.
-        const ambiguousDockerTerminal = sessionInfo.isolationBackend === 'docker' && typeof runner.isUnknownDockerExitCode === 'function' && runner.isUnknownDockerExitCode(exitCode);
+        const dockerSession = isDockerIsolation(sessionInfo, statusResult);
+        const ambiguousDockerTerminal = dockerSession && typeof runner.isUnknownDockerExitCode === 'function' && runner.isUnknownDockerExitCode(exitCode);
+        // Issue #2117: a docker terminal FAILURE with no corroborating footer is
+        // provisional too — start-command can fabricate that exit code from the
+        // command's own output. Give the real footer a moment to appear instead
+        // of announcing a failure the run never had. Only a *freshly* reported
+        // end time can still be in that race, so an older terminal record is
+        // still reported without delay.
+        const normalizedExitCode = normalizeExitCode(exitCode);
+        const unverifiedDockerFailure = dockerSession && !ambiguousDockerTerminal && normalizedExitCode !== null && normalizedExitCode !== 0;
+        if (unverifiedDockerFailure && shouldDeferUnverifiedDockerTerminal(sessionName, sessionInfo, { exitCode, endTime: statusResult.endTime || null, verbose })) {
+          return { running: true, exitCode: null, status: statusResult.status, statusResult, deferred: true };
+        }
         if (!ambiguousDockerTerminal) {
+          clearUnverifiedDockerTerminalMarker(sessionName, sessionInfo);
           return { running: false, exitCode, status: statusResult.status, statusResult };
         }
       }
@@ -844,11 +751,8 @@ export async function monitorSessions(bot, verbose = false, options = {}) {
           verbose,
         });
 
-        // Issue #1688/#1905: When the original /solve URL was an issue, look up
-        //   the created PR so the completion message can include both an
-        //   `Issue:` and a `Pull request:` line. The linked-issue API can lag
-        //   behind the solver's own verification log, so we also inspect the
-        //   completed session log before giving up.
+        // Issue #1688/#1905: Resolve the created PR from GitHub or, when its
+        // linked-issue API lags, from the completed solve log.
         let pullRequestUrl = null;
         try {
           pullRequestUrl = await resolvePullRequestUrlForSession(sessionInfo, {
@@ -863,10 +767,25 @@ export async function monitorSessions(bot, verbose = false, options = {}) {
           }
         }
 
-        // Issue #594: when --show-limits was used at command time, capture an
-        //   end-of-task limits snapshot and append a delta block to the
-        //   completion message. The cached helpers respect a 20-min TTL so
-        //   parallel sessions don't stampede the upstream API.
+        let pullRequestState = null;
+        const completionOutcome = classifySessionOutcome({ exitCode: finalExitCode, status: resolvedStatus });
+        try {
+          pullRequestState = await resolveFailedSessionPullRequestState({
+            pullRequestUrl,
+            outcome: completionOutcome,
+            lookupPullRequestState: options.lookupPullRequestState,
+            verbose,
+            sessionName,
+            exitCode: finalExitCode,
+            status: resolvedStatus,
+            logPath: statusResult?.logPath || sessionInfo?.logPath,
+          });
+        } catch (stateError) {
+          if (verbose) console.log(`[VERBOSE] Pull request state resolution failed for ${sessionName}: ${stateError?.message || stateError}`);
+        }
+
+        // Issue #594: append an end-of-task limits snapshot/delta. Cached
+        // helpers prevent parallel sessions from stampeding the upstream API.
         const limitsExtraSections = [];
         if (sessionInfo?.showLimits) {
           try {
@@ -895,15 +814,8 @@ export async function monitorSessions(bot, verbose = false, options = {}) {
           }
         }
 
-        // Issue #1927 (review follow-up): when a /solve session was KILLED
-        //   (OOM/SIGKILL — the silent failure this issue is about), surface a
-        //   ready-to-run `--resume <lastSessionId>` command so the surviving
-        //   parent (the operator, or an automation watching the bot) can pick the
-        //   work back up. We deliberately do NOT auto-relaunch here: a job that
-        //   reliably OOMs would storm. The rule "use the LAST of multiple
-        //   sessions" is honored by reading the last `Session ID:` marker from
-        //   the captured log. Purely additive — failures never block the
-        //   completion notification, preserving backward compatibility.
+        // Issue #1927: for a killed /solve, offer a command using the last tool
+        // session ID in the log. Do not auto-relaunch work that may reliably OOM.
         const resumeExtraSections = [];
         try {
           const outcome = classifySessionOutcome({ exitCode: finalExitCode, status: resolvedStatus });
@@ -961,6 +873,7 @@ export async function monitorSessions(bot, verbose = false, options = {}) {
           exitCode: finalExitCode,
           infoBlock: sessionInfo?.infoBlock || '',
           pullRequestUrl,
+          pullRequestState,
           extraSections: [...limitsExtraSections, ...resumeExtraSections, ...diskExtraSections, ...dockerTaskContainerExtraSections],
         });
 

package/src/session-monitor.stale-executing.lib.mjs

@@ -0,0 +1,151 @@
+/**
+ * Terminal-state reconciliation helpers for tracked isolation sessions.
+ *
+ * These live next to session-monitor.lib.mjs (which is at its `max-lines`
+ * budget) and cover two independent defects:
+ *
+ *   - issue #1927: `$ --status` can stay stuck on `executing` after the process
+ *     was killed, so the monitor has to cross-check the log footer and the
+ *     backing screen/tmux/docker session.
+ *   - issue #2015: a docker session reported with `oomKilled=true` is terminal
+ *     and must be surfaced as such instead of being polled forever.
+ *
+ * @see https://github.com/link-assistant/hive-mind/issues/1927
+ * @see https://github.com/link-assistant/hive-mind/issues/2015
+ */
+
+import { classifyExitStatus, normalizeExitCode } from './session-status.lib.mjs';
+
+/**
+ * Issue #1927: minimum age before a session that `$ --status` still reports as
+ * `executing` is allowed to be declared dead purely on a backend-liveness probe
+ * (the screen/tmux/docker session is gone). This avoids a race where a session
+ * that has just been launched — but whose backend has not registered yet — is
+ * falsely reported as killed. The authoritative log-footer check is NOT gated by
+ * this, because a written "Exit Code:" footer is proof the command terminated.
+ */
+export const STALE_EXECUTING_MIN_AGE_MS = 90 * 1000;
+export const DOCKER_BACKEND_GONE_GRACE_MS = 2 * 60 * 1000;
+const DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD = 'dockerBackendGoneFirstSeenAt';
+
+export function sessionStartMs(sessionInfo) {
+  const start = sessionInfo?.startTime;
+  if (!start) return null;
+  const date = start instanceof Date ? start : new Date(start);
+  const ms = date.getTime();
+  return Number.isFinite(ms) ? ms : null;
+}
+
+export function isDockerIsolation(sessionInfo, statusResult) {
+  return sessionInfo?.isolationBackend === 'docker' || statusResult?.isolation === 'docker';
+}
+
+function getDockerBackendGoneFirstSeenMs(sessionInfo) {
+  const raw = sessionInfo?.[DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD];
+  if (!raw) return null;
+  const ms = new Date(raw).getTime();
+  return Number.isFinite(ms) ? ms : null;
+}
+
+function clearDockerBackendGoneMarker(sessionInfo, persistSnapshot) {
+  if (!sessionInfo?.[DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD]) return;
+  delete sessionInfo[DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD];
+  persistSnapshot();
+}
+
+/**
+ * Cross-check whether a session that `$ --status` still reports as `executing`
+ * has actually terminated. Issue #1927: start-command's status can get stuck on
+ * `executing` after the process was killed (a lingering shell keeps the screen
+ * session alive, flipping executed→executing), so a SIGKILLed /solve was never
+ * reported. Two independent signals are consulted, strongest first:
+ *
+ *   1. The execution log FOOTER. When start-command wrote "Exit Code: N" the
+ *      command terminated, full stop — regardless of what `--status` claims.
+ *      This is authoritative and catches the dominant lingering-shell case.
+ *   2. Backend LIVENESS. If no footer was written (e.g. the wrapper itself was
+ *      hard-killed) but the backing screen/tmux/docker session is gone, the
+ *      process cannot still be executing. Gated by STALE_EXECUTING_MIN_AGE_MS to
+ *      avoid a just-launched-not-yet-registered race.
+ *
+ * @returns {Promise<{exitCode: number|null, status: string, reason: string}|null>}
+ *   Terminal details when the session is actually dead, else null (still running).
+ */
+export async function resolveStaleExecutingState(sessionName, sessionInfo, statusResult, { verbose, runner, exitFromLog, backendAlive, persistSnapshot }) {
+  // 1. Authoritative: the log footer.
+  const logPath = statusResult?.logPath || sessionInfo?.logPath || null;
+  if (logPath) {
+    const readFooter = exitFromLog || runner.readSessionExitFromLog;
+    const footer = readFooter ? readFooter(logPath, { verbose }) : null;
+    if (footer?.finished) {
+      const status = classifyExitStatus(footer.exitCode) || (footer.exitCode === 0 ? 'executed' : 'failed');
+      return { exitCode: footer.exitCode, status, reason: `log-footer(exit ${footer.exitCode})` };
+    }
+  }
+
+  // 2. Liveness probe, only once the session is old enough to have registered.
+  const startMs = sessionStartMs(sessionInfo);
+  const ageMs = startMs != null ? Date.now() - startMs : Infinity;
+  if (ageMs >= STALE_EXECUTING_MIN_AGE_MS && sessionInfo?.isolationBackend) {
+    const probe = backendAlive || runner.checkBackendSessionAlive;
+    const alive = probe ? await probe(sessionInfo.sessionId || sessionName, sessionInfo.isolationBackend, verbose) : null;
+    // Only `false` (definitively gone) counts as killed; `null` (unknown backend)
+    // is treated as "no signal" so we don't kill on an indeterminate probe.
+    if (alive === false) {
+      if (isDockerIsolation(sessionInfo, statusResult)) {
+        const nowMs = Date.now();
+        const firstSeenMs = getDockerBackendGoneFirstSeenMs(sessionInfo);
+        if (firstSeenMs === null) {
+          sessionInfo[DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD] = new Date(nowMs).toISOString();
+          persistSnapshot();
+          if (verbose) {
+            console.log(`[VERBOSE] Session ${sessionName} docker backend is gone but no terminal status/footer is available yet; deferring killed classification for ${DOCKER_BACKEND_GONE_GRACE_MS}ms`);
+          }
+          return null;
+        }
+        if (nowMs - firstSeenMs < DOCKER_BACKEND_GONE_GRACE_MS) {
+          if (verbose) {
+            console.log(`[VERBOSE] Session ${sessionName} docker backend is still gone; waiting for terminal status/footer before reporting killed`);
+          }
+          return null;
+        }
+      }
+      return { exitCode: null, status: 'killed', reason: 'backend-gone' };
+    }
+    if (alive === true) {
+      clearDockerBackendGoneMarker(sessionInfo, persistSnapshot);
+    }
+  }
+
+  return null;
+}
+
+/**
+ * Issue #2015: `oomKilled` is terminal — the container was killed by the kernel,
+ * so no further polling can change the outcome.
+ */
+export function resolveOomKilledState(sessionName, sessionInfo, statusResult, { verbose, runner, exitFromLog }) {
+  const logPath = statusResult?.logPath || sessionInfo?.logPath || null;
+  let footer = null;
+  if (logPath) {
+    const readFooter = exitFromLog || runner.readSessionExitFromLog;
+    footer = readFooter ? readFooter(logPath, { verbose }) : null;
+  }
+
+  const statusExitCode = normalizeExitCode(statusResult?.exitCode);
+  const footerExitCode = footer?.finished ? normalizeExitCode(footer.exitCode) : null;
+  let exitCode = 137;
+  if (statusExitCode !== null && statusExitCode > 0) {
+    exitCode = statusExitCode;
+  } else if (footerExitCode !== null && footerExitCode > 0) {
+    exitCode = footerExitCode;
+  }
+  const endTime = statusResult?.endTime || footer?.endTime || statusResult?.currentTime || null;
+  const corrected = { ...statusResult, status: 'oom-killed', exitCode, endTime };
+
+  if (verbose) {
+    console.log(`[VERBOSE] Session ${sessionName} status includes oomKilled=true; treating it as terminal oom-killed (exit ${exitCode})`);
+  }
+
+  return { running: false, exitCode, status: 'oom-killed', statusResult: corrected, stale: true };
+}

package/src/solve.finalize.lib.mjs

@@ -1,20 +1,35 @@
 export async function finalizeSolveProcess({ tempDir, argv, limitReached, path, getLogFile, log, closeSentry, logActiveHandles, cleanupTempDirectory, safeExit }) {
-  await cleanupTempDirectory(tempDir, argv, limitReached);
+  const runFinalizationStep = async (label, step) => {
+    try {
+      await step();
+    } catch (error) {
+      const message = error?.message || String(error);
+      try {
+        await log(`⚠️  Finalization step failed (${label}): ${message}`, { level: 'warning' });
+      } catch {
+        console.warn(`⚠️  Finalization step failed (${label}): ${message}`);
+      }
+    }
+  };
 
-  // Show final log file reference so users always know where to find the complete log
-  if (getLogFile()) {
-    const finalLogPath = path.resolve(getLogFile());
-    await log(`\n📁 Complete log file: ${finalLogPath}`);
-  }
+  await runFinalizationStep('temporary directory cleanup', () => cleanupTempDirectory(tempDir, argv, limitReached));
+
+  await runFinalizationStep('final log reference', async () => {
+    // Show final log file reference so users always know where to find the complete log
+    if (getLogFile()) {
+      const finalLogPath = path.resolve(getLogFile());
+      await log(`\n📁 Complete log file: ${finalLogPath}`);
+    }
+  });
 
   // Issue #1346: Flush Sentry events before exit.
   // closeSentry() uses a hard Promise.race deadline so it cannot block indefinitely.
-  await closeSentry();
+  await runFinalizationStep('Sentry close', closeSentry);
 
   // Issue #1431: Log active handles before draining.
   // Always logged to file and console so future hangs are immediately visible in logs.
   // drainHandles() inside safeExit() will unref/close these before process.exit().
-  await logActiveHandles(msg => log(msg));
+  await runFinalizationStep('active handle diagnostics', () => logActiveHandles(msg => log(msg)));
 
   // Issue #1431: safeExit() unrefs handles so the event loop exits naturally, then calls process.exit(0)
   await safeExit(0, 'Process completed');

package/src/solve.mjs

@@ -160,7 +160,7 @@ const cleanupWrapper = async () => {
 };
 const interruptWrapper = createInterruptWrapper({ cleanupContext, checkForUncommittedChanges, shouldAttachLogs, attachLogToGitHub, getLogFile, sanitizeLogContent, $, log });
 initializeExitHandler(getAbsoluteLogPath, log, cleanupWrapper, interruptWrapper, ({ code, reason, failureActionSection }) => notifyIssueAboutPrePullRequestFailure({ code, reason, failureActionSection, argv, globalState: global, $, log, getLogFile, shouldAttachLogs, attachLogToGitHub, sanitizeLogContent, rawCommand }));
-installGlobalExitHandlers();
+installGlobalExitHandlers({ handleProcessErrors: false }); // #2117: solve's richer process-error handlers below must not race a duplicate pair.
 // Issue #1823: Configure the working-session guard. When the experimental
 // --do-not-shutdown-in-the-middle-of-working-session flag is set (hive passes it to every
 // worker), an interrupt received during an AI working session is deferred: solve lets the AI