@link-assistant/hive-mind 2.11.2 → 2.11.4

package/src/anthropic-cost-accumulator.lib.mjs

@@ -42,6 +42,8 @@
  * future model. See docs/case-studies/issue-1886/ for the full analysis.
  */
 
+import { isFormalAiModel } from './models/index.mjs'; // Issue #2119
+
 // Module-level singleton: the cumulative Anthropic cost for the active logical
 // session (including anything seeded by a true resume from a prior process).
 let cumulativeAnthropicCostUSD = 0;
@@ -120,6 +122,40 @@ export const getCumulativeAnthropicCost = () => cumulativeAnthropicCostUSD;
  */
 export const hasCumulativeAnthropicCost = () => cumulativeAnthropicCostUSD > 0;
 
+/**
+ * Interpret a Claude `result` event's `total_cost_usd`.
+ *
+ * Issue #1886: a non-success terminal event (e.g. a usage-limit hit) still
+ * reports this process's cost, so it is kept as an accumulation fallback rather
+ * than as the authoritative total.
+ *
+ * Issue #2119: `--model formal-ai` is served by the local Link.Assistant model
+ * server, so the session never billed Anthropic. Claude Code nevertheless
+ * reports a `total_cost_usd` derived from Anthropic list prices for the model
+ * name it sees ($0.252315 in the issue) - a false positive that must not reach
+ * the accumulator or the published cost comment.
+ *
+ * @param {Object} params
+ * @param {Object} params.data the parsed `result` stream event
+ * @param {string|null} params.model the model requested on the command line
+ * @param {Function} params.log logger
+ * @returns {Promise<{total?: number, fallback?: number}|null>} the captured cost, or null when none applies
+ */
+export const captureAnthropicResultCost = async ({ data, model, log }) => {
+  const cost = data?.total_cost_usd;
+  if (cost === undefined || cost === null) return null;
+  if (isFormalAiModel(model)) {
+    await log(`💰 Ignoring Anthropic cost $${cost.toFixed(6)} reported for a Formal AI session (Link.Assistant, free)`, { verbose: true });
+    return null;
+  }
+  if (data.subtype === 'success') {
+    await log(`💰 Anthropic official cost captured from success result: $${cost.toFixed(6)}`, { verbose: true });
+    return { total: cost };
+  }
+  await log(`💰 Anthropic cost from ${data.subtype || 'unknown'} result kept as fallback for accumulation: $${cost.toFixed(6)}`, { verbose: true });
+  return { fallback: cost };
+};
+
 /**
  * Reset the accumulator. Intended for tests; production code starts scopes via
  * `beginAnthropicCostScope`.

package/src/auto-restart-budget.lib.mjs

@@ -0,0 +1,107 @@
+#!/usr/bin/env node
+
+/**
+ * Issue #2119: one auto-restart budget for the whole run.
+ *
+ * The problem
+ * -----------
+ * Hive Mind had two independent auto-restart subsystems, each with its own
+ * counter reading the same `--auto-restart-max-iterations` flag:
+ *
+ *   - `solve.watch.lib.mjs` restarts on uncommitted changes / feedback and
+ *     labels its sessions `🔄 Auto-restart 1/5`;
+ *   - `solve.auto-merge.lib.mjs` restarts until the PR is mergeable and labels
+ *     its sessions `🔄 Auto-restart triggered (iteration 1)`.
+ *
+ * `solve.mjs` runs them one after another, so a limit of 5 allowed up to 10 AI
+ * sessions, and the two label formats made the published comments look like two
+ * unrelated features. In issue #2119 a `--model formal-ai` run that produced
+ * only a `.formal-ai/` scratch directory kept restarting on those "uncommitted
+ * changes" without ever reaching a visible failure.
+ *
+ * The fix
+ * -------
+ * A single process-wide budget shared by both subsystems:
+ *
+ *   - every AI session started by ANY auto-restart path consumes one iteration;
+ *   - every label renders as `N/M` (or `N` when the limit is disabled with 0),
+ *     so the limit is always visible;
+ *   - once the budget is exhausted the run must actually fail, and the caller
+ *     must run fail recovery (auto-commit of whatever is uncommitted) so the
+ *     result stays visible instead of being silently discarded.
+ *
+ * The counter is a module-level singleton for the same reason
+ * `anthropic-cost-accumulator.lib.mjs` is: the two subsystems are separate
+ * modules invoked sequentially from `solve.mjs` and never see each other's
+ * state, and one `solve` process handles exactly one logical run.
+ */
+
+import { DEFAULT_AUTO_ITERATION_LIMIT, formatAutoIterationLimit, hasReachedAutoIterationLimit, normalizeAutoIterationLimit } from './auto-iteration-limits.lib.mjs';
+
+// Iterations consumed so far by every auto-restart subsystem in this run.
+let iterationsUsed = 0;
+// The active limit; 0 means "no limit" (`--auto-restart-max-iterations 0`).
+let maxIterations = DEFAULT_AUTO_ITERATION_LIMIT;
+
+/**
+ * Start the shared budget for one `solve` run.
+ *
+ * Safe to call from every entry point: it is idempotent for the same limit, so
+ * the watch loop and the auto-merge loop can both claim the budget without the
+ * second one resetting the first one's progress.
+ *
+ * @param {Object} [options]
+ * @param {number|string|null} [options.maxIterations] raw `--auto-restart-max-iterations` value
+ * @param {boolean} [options.reset=false] force the counter back to zero (new logical run / tests)
+ * @returns {number} the normalized limit in effect
+ */
+export const beginAutoRestartBudget = ({ maxIterations: rawMax, reset = false } = {}) => {
+  const normalized = normalizeAutoIterationLimit(rawMax);
+  if (reset || normalized !== maxIterations) {
+    if (reset) iterationsUsed = 0;
+    maxIterations = normalized;
+  }
+  return maxIterations;
+};
+
+/** @returns {number} the normalized limit in effect (0 = unlimited) */
+export const getAutoRestartLimit = () => maxIterations;
+
+/** @returns {number} how many AI sessions auto-restart has already consumed */
+export const getAutoRestartIterationsUsed = () => iterationsUsed;
+
+/** @returns {number|null} iterations still available, or null when unlimited */
+export const getRemainingAutoRestartIterations = () => (maxIterations === 0 ? null : Math.max(0, maxIterations - iterationsUsed));
+
+/**
+ * @returns {boolean} true when no further auto-restart session may be started.
+ * Always false when the limit is disabled (0).
+ */
+export const hasExhaustedAutoRestartBudget = () => hasReachedAutoIterationLimit(iterationsUsed, maxIterations);
+
+/**
+ * Claim one iteration for an AI session that is about to start.
+ * Call this only when a tool execution really follows, so the published `N/M`
+ * label matches the number of sessions that actually ran.
+ * @returns {number} the 1-based iteration number just claimed
+ */
+export const consumeAutoRestartIteration = () => {
+  iterationsUsed += 1;
+  return iterationsUsed;
+};
+
+/**
+ * Render the shared `N/M` progress label used by every auto-restart message.
+ * @param {number} [iteration] the iteration to render; defaults to the current count
+ * @returns {string} e.g. `3/5`, or `3` when the limit is disabled
+ */
+export const formatAutoRestartLabel = (iteration = iterationsUsed) => (maxIterations === 0 ? `${iteration}` : `${iteration}/${maxIterations}`);
+
+/** @returns {string} the configured limit for display (`5` or `unlimited`) */
+export const formatAutoRestartLimit = () => formatAutoIterationLimit(maxIterations);
+
+/** Reset the budget. Intended for tests; production code calls `beginAutoRestartBudget`. */
+export const resetAutoRestartBudget = () => {
+  iterationsUsed = 0;
+  maxIterations = DEFAULT_AUTO_ITERATION_LIMIT;
+};

package/src/auto-restart-exhaustion.lib.mjs

@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+
+/**
+ * Issue #2119: what happens when the shared auto-restart budget runs out.
+ *
+ * The issue requires that after the configured number of iterations the run
+ * "must actually stop (fail + auto-commit on fail recovery). So the result will
+ * be actually visible."
+ *
+ * Before this, the two auto-restart subsystems ended differently and neither
+ * preserved the work:
+ *
+ *   - `solve.watch.lib.mjs` logged "MAX ITERATIONS REACHED" and simply `break`ed
+ *     out of the loop, leaving the uncommitted changes that caused every restart
+ *     on the disposable temporary clone, where they were deleted with it;
+ *   - `solve.auto-merge.lib.mjs` posted a comment and returned
+ *     `auto_restart_limit_reached`, also without committing anything.
+ *
+ * This module is the one exhaustion path for both: log the failure, auto-commit
+ * (and push) whatever is uncommitted through the same critical-error recovery
+ * helper used elsewhere, and post a single comment that states the limit, the
+ * remaining blocker and what was preserved.
+ */
+
+import { commitUncommittedChangesOnCriticalError } from './critical-error-commit.lib.mjs';
+import { formatAutoRestartLabel, formatAutoRestartLimit, getAutoRestartIterationsUsed } from './auto-restart-budget.lib.mjs';
+import { AUTO_RESTART_MARKER, postTrackedComment } from './tool-comments.lib.mjs';
+import { reportError } from './sentry.lib.mjs';
+
+/**
+ * The single reason string returned by every auto-restart subsystem when the
+ * shared budget is exhausted, so `solve` can treat both the same way.
+ */
+export const AUTO_RESTART_LIMIT_REACHED_REASON = 'auto_restart_limit_reached';
+
+// Module-level singleton, like the shared budget itself: `solve.mjs` runs both
+// auto-restart loops sequentially and neither returns through a common result
+// object, so this is what lets `finalizeSolveProcess` exit non-zero. Without it
+// the run reported success even though the blocker was never resolved.
+let limitFailure = null;
+
+/** @returns {boolean} true once any auto-restart loop exhausted the shared budget */
+export const hasAutoRestartLimitFailure = () => Boolean(limitFailure);
+
+/** @returns {{reason: string, iterationsUsed: number, committed: boolean, pushed: boolean}|null} */
+export const getAutoRestartLimitFailure = () => limitFailure;
+
+/** Clear the recorded failure. Intended for tests. */
+export const resetAutoRestartLimitFailure = () => {
+  limitFailure = null;
+};
+
+/**
+ * Fail the run because the shared auto-restart budget is exhausted, preserving
+ * any uncommitted work first.
+ *
+ * Never throws: a failure to commit or comment must not mask the limit itself.
+ *
+ * @param {Object} params
+ * @param {string} params.owner GitHub owner
+ * @param {string} params.repo GitHub repository
+ * @param {number|null} params.prNumber PR to comment on (comment skipped when absent)
+ * @param {string} params.tempDir working tree holding the uncommitted work
+ * @param {string|null} params.branchName branch to push the preserved work to
+ * @param {Function} params.$ command-stream tagged-template executor
+ * @param {Function} params.log async logger
+ * @param {Function} params.formatAligned aligned log formatter
+ * @param {string} params.blocker the remaining reason that kept triggering restarts
+ * @param {string} [params.subsystem] which loop hit the limit, for the log line
+ * @returns {Promise<{reason: string, iterationsUsed: number, committed: boolean, pushed: boolean}>}
+ */
+export const failOnAutoRestartBudgetExhausted = async ({ owner, repo, prNumber, tempDir, branchName, $, log, formatAligned, blocker = 'uncommitted changes', subsystem = 'auto-restart' }) => {
+  const iterationsUsed = getAutoRestartIterationsUsed();
+  const label = formatAutoRestartLabel(iterationsUsed);
+
+  await log('');
+  await log(formatAligned('❌', 'AUTO-RESTART LIMIT REACHED', `Stopping ${subsystem} after ${label} iterations`), { level: 'error' });
+  await log(formatAligned('', 'Configured limit:', formatAutoRestartLimit(), 2), { level: 'error' });
+  await log(formatAligned('', 'Remaining blocker:', blocker, 2), { level: 'error' });
+  await log('');
+
+  // Fail recovery: the work that kept triggering restarts lives in a temporary
+  // clone that is about to be discarded. Commit and push it so the result is
+  // visible in the PR instead of vanishing with the clone.
+  const preserved = await commitUncommittedChangesOnCriticalError({
+    tempDir,
+    branchName,
+    $,
+    log,
+    reason: `auto-restart limit ${label} reached`,
+    push: true,
+  });
+
+  if (prNumber) {
+    const preservedText = preserved.committed ? `The uncommitted changes were auto-committed${preserved.pushed ? ' and pushed' : ' locally (push failed - see the log)'} so the partial result stays visible in this pull request.` : 'There were no uncommitted changes left to preserve.';
+    const body = `## ❌ ${AUTO_RESTART_MARKER} ${label} - limit reached
+
+Hive Mind stopped after ${label} automatic restart iterations without resolving the blocker.
+
+**Configured limit:** ${formatAutoRestartLimit()}
+**Remaining blocker:** ${blocker}
+
+${preservedText}
+
+No further AI sessions will be started automatically for this run. Review the remaining blocker manually, or rerun with a higher \`--auto-restart-max-iterations\` value.
+
+---
+*This run is reported as failed because the auto-restart limit was reached.*`;
+    try {
+      await postTrackedComment({ $, owner, repo, targetNumber: prNumber, body });
+      await log(formatAligned('', '💬 Posted auto-restart limit notification to PR', '', 2));
+    } catch (commentError) {
+      reportError(commentError, { context: 'post_auto_restart_limit_comment', owner, repo, prNumber, operation: 'comment_on_pr' });
+      await log(formatAligned('', '⚠️  Could not post auto-restart limit comment to PR', '', 2));
+    }
+  }
+
+  limitFailure = { reason: AUTO_RESTART_LIMIT_REACHED_REASON, iterationsUsed, committed: preserved.committed, pushed: preserved.pushed };
+  return limitFailure;
+};
+
+export default { AUTO_RESTART_LIMIT_REACHED_REASON, failOnAutoRestartBudgetExhausted, hasAutoRestartLimitFailure, getAutoRestartLimitFailure, resetAutoRestartLimitFailure };

package/src/claude.lib.mjs

@@ -17,11 +17,12 @@ import { sanitizeObjectStrings } from './unicode-sanitization.lib.mjs';
 import Decimal from 'decimal.js-light';
 import { createEmptySubSessionUsage, accumulateModelUsage, mergeResultModelUsage, createSubAgentCallEntry, accumulateSubAgentUsage, getRawRequestInputTokens, displaySessionTokenUsage } from './claude.budget-stats.lib.mjs';
 import { buildClaudeResumeCommand, buildClaudeAutonomousResumeCommand } from './claude.command-builder.lib.mjs';
-import { beginAnthropicCostScope, seedCumulativeAnthropicCost, addAnthropicRunCost } from './anthropic-cost-accumulator.lib.mjs'; // Issues #1886, #2056
+import { beginAnthropicCostScope, seedCumulativeAnthropicCost, addAnthropicRunCost, captureAnthropicResultCost } from './anthropic-cost-accumulator.lib.mjs'; // Issues #1886, #2056, #2119
 import { buildSolveResumeCommand } from './solve.resume-command.lib.mjs'; // Issue #942
 import { SESSION_FORCE_KILLED_MARKER, postTrackedComment } from './tool-comments.lib.mjs'; // Issue #1625
 import { handleClaudeRuntimeSwitch } from './claude.runtime-switch.lib.mjs'; // see issue #1141
 import { CLAUDE_MODELS as availableModels, mapClaudeSubAgentModelToEnvValue } from './models/index.mjs'; // Issue #1221, #1978
+import { applyFormalAiPricingOverride } from './formal-ai-pricing.lib.mjs'; // Issue #2119
 import { logPreparedToolCommand, resolveFormalAiToolInvocation } from './formal-ai.lib.mjs';
 import { buildMcpConfigWithoutPlaywright, ensureClaudePlaywrightMcpServer } from './playwright-mcp.lib.mjs';
 import { resolveClaudeSessionToolFlags } from './useless-tools.lib.mjs';
@@ -500,6 +501,7 @@ export const calculateSessionTokens = async (sessionId, tempDir, resultModelUsag
 };
 // Extracted to claude.stderr.lib.mjs (Issue #477, #1337)
 import { isStderrError } from './claude.stderr.lib.mjs';
+import { ensureAiToolScratchIgnored, filterAiToolScratchFromStatus } from './ai-tool-scratch.lib.mjs';
 export { isStderrError };
 export const executeClaudeCommand = async params => {
   const {
@@ -876,14 +878,9 @@ export const executeClaudeCommand = async params => {
                   }
                 }
                 if (data.subtype === 'success') resultSuccessReceived = true;
-                if (data.subtype === 'success' && data.total_cost_usd !== undefined && data.total_cost_usd !== null) {
-                  anthropicTotalCostUSD = data.total_cost_usd;
-                  await log(`💰 Anthropic official cost captured from success result: $${anthropicTotalCostUSD.toFixed(6)}`, { verbose: true });
-                } else if (data.total_cost_usd !== undefined && data.total_cost_usd !== null) {
-                  // Issue #1886: non-success terminal (e.g. usage-limit hit) still reports this process's cost — keep as accumulation fallback.
-                  anthropicCostFromAnyResult = data.total_cost_usd;
-                  await log(`💰 Anthropic cost from ${data.subtype || 'unknown'} result kept as fallback for accumulation: $${data.total_cost_usd.toFixed(6)}`, { verbose: true });
-                }
+                const capturedCost = await captureAnthropicResultCost({ data, model: argv.model, log });
+                if (capturedCost?.total !== undefined) anthropicTotalCostUSD = capturedCost.total;
+                if (capturedCost?.fallback !== undefined) anthropicCostFromAnyResult = capturedCost.fallback;
                 // Issue #1263: Extract result summary (AI's summary of work done) for --attach-solution-summary
                 if (data.subtype === 'success' && data.result && typeof data.result === 'string') {
                   resultSummary = data.result;
@@ -1070,10 +1067,9 @@ export const executeClaudeCommand = async params => {
               if (data.result && typeof data.result === 'string') resultSummary = data.result;
               if (data.modelUsage) resultModelUsage = data.modelUsage;
             }
-            if (data.total_cost_usd != null) {
-              if (data.subtype === 'success') anthropicTotalCostUSD = data.total_cost_usd;
-              else anthropicCostFromAnyResult = data.total_cost_usd;
-            }
+            const capturedCost = await captureAnthropicResultCost({ data, model: argv.model, log });
+            if (capturedCost?.total !== undefined) anthropicTotalCostUSD = capturedCost.total;
+            if (capturedCost?.fallback !== undefined) anthropicCostFromAnyResult = capturedCost.fallback;
           }
           // Issue #1472: Forward remaining buffer event to interactive handler (was previously missed)
           if (interactiveHandler) {
@@ -1422,14 +1418,22 @@ export const executeClaudeCommand = async params => {
     }
   }; // End of executeWithRetry function
   // Start the execution with retry logic
-  return await executeWithRetry();
+  const claudeResult = (await executeWithRetry()) || {};
+  // Issue #2119: `--model formal-ai` runs against the local Link.Assistant model
+  // server. Claude reports no pricing record of its own, so without this the
+  // session was published with Anthropic's cost and no provider at all.
+  const formalAiPricing = applyFormalAiPricingOverride({ model: argv.model, pricingInfo: claudeResult.pricingInfo ?? null, publicPricingEstimate: claudeResult.publicPricingEstimate ?? null, anthropicTotalCostUSD: claudeResult.anthropicTotalCostUSD ?? null, tokenUsage: claudeResult.streamTokenUsage ?? null });
+  return { ...claudeResult, ...formalAiPricing };
 };
 export const checkForUncommittedChanges = async (tempDir, owner, repo, branchName, $, log, autoCommit = false, autoRestartEnabled = true) => {
   await log('\n🔍 Checking for uncommitted changes...');
+  // Issue #2119: AI tools leave scratch state (.formal-ai/, .playwright-mcp/) in
+  // the workspace. Ignoring it here keeps it out of both this check and 'git add -A'.
+  await ensureAiToolScratchIgnored(tempDir, log);
   try {
     const gitStatusResult = await $({ cwd: tempDir })`git status --porcelain 2>&1`;
     if (gitStatusResult.code === 0) {
-      const statusOutput = gitStatusResult.stdout.toString().trim();
+      const statusOutput = filterAiToolScratchFromStatus(gitStatusResult.stdout.toString().trim());
       if (statusOutput) {
         await log('📝 Found uncommitted changes');
         await log('Changes:');

package/src/claude.runtime-switch.lib.mjs

@@ -53,7 +53,7 @@ export const handleClaudeRuntimeSwitch = async argv => {
         process.exit(1);
       }
       // Read current shebang
-      const firstLine = await $`head -1 "${claudePath}"`;
+      const firstLine = await $`head -1 ${claudePath}`;
       const currentShebang = firstLine.stdout.toString().trim();
       await log(`   Current shebang: ${currentShebang}`);
       if (currentShebang.includes('bun')) {
@@ -63,7 +63,7 @@ export const handleClaudeRuntimeSwitch = async argv => {
 
       // Create backup
       const backupPath = `${claudePath}.nodejs-backup`;
-      await $`cp "${claudePath}" "${backupPath}"`;
+      await $`cp ${claudePath} ${backupPath}`;
       await log(`   📦 Backup created: ${backupPath}`);
 
       // Read file content and replace shebang
@@ -126,7 +126,7 @@ export const handleClaudeRuntimeSwitch = async argv => {
         process.exit(1);
       }
       // Read current shebang
-      const firstLine = await $`head -1 "${claudePath}"`;
+      const firstLine = await $`head -1 ${claudePath}`;
       const currentShebang = firstLine.stdout.toString().trim();
       await log(`   Current shebang: ${currentShebang}`);
       if (currentShebang.includes('node') && !currentShebang.includes('bun')) {
@@ -138,7 +138,7 @@ export const handleClaudeRuntimeSwitch = async argv => {
       try {
         await fs.access(backupPath);
         // Restore from backup
-        await $`cp "${backupPath}" "${claudePath}"`;
+        await $`cp ${backupPath} ${claudePath}`;
         await log(`   ✅ Restored Claude from backup: ${backupPath}`);
       } catch (backupError) {
         reportError(backupError, {

package/src/codex.lib.mjs

@@ -25,13 +25,15 @@ import { detectUsageLimit, formatUsageLimitMessage } from './usage-limit.lib.mjs
 import { buildSolveResumeCommand } from './solve.resume-command.lib.mjs'; // Issue #942
 const __codexBuildSolveResumeCmd = (argv, sessionId, tempDir) => (sessionId && argv?.url ? buildSolveResumeCommand({ issueUrl: argv.url, sessionId, tool: 'codex', model: argv.model, fallbackModel: argv.fallbackModel, tempDir }) : null);
 import { sanitizeObjectStrings } from './unicode-sanitization.lib.mjs';
+import { createLineBuffer } from './json-stream.lib.mjs'; // Issue #2119
 import { mapModelToId, resolveCodexReasoningEffort } from './codex.options.lib.mjs';
 import { createInteractiveHandler } from './interactive-mode.lib.mjs';
 import { initProgressMonitoring } from './solve.progress-monitoring.lib.mjs';
 import { ensureCodexPlaywrightMcpServer, getCodexPlaywrightMcpDisableConfigArgs } from './playwright-mcp.lib.mjs';
 import { fetchModelInfo } from './model-info.lib.mjs';
-import { defaultModels } from './models/index.mjs';
+import { defaultModels, isFormalAiModel } from './models/index.mjs';
 import { logPreparedToolCommand, resolveFormalAiToolInvocation } from './formal-ai.lib.mjs';
+import { buildFormalAiPricingInfo } from './formal-ai-pricing.lib.mjs'; // Issue #2119
 import { classifyRetryableError, prepareRetryAfterError, waitWithCountdown } from './tool-retry.lib.mjs';
 import { parseSubSessionSize, buildCodexSubSessionSizeConfigArgs, buildCodexDisable1mContextConfigArgs } from './sub-session-size.lib.mjs'; // Issue #1706
 import { getCumulativeContextInputTokens } from './context-fill.lib.mjs';
@@ -39,6 +41,7 @@ import { deployHandoffSkill } from './handoff-skill.lib.mjs'; // Issue #1877
 import { applyCodexCapabilityEnv, runCodexCapabilityPreflight } from './codex-capability-preflight.lib.mjs'; // Issue #2074
 import { createPullRequestBaseBranchCommandIntervention } from './solve.pr-base-command-intervention.lib.mjs';
 import Decimal from 'decimal.js-light';
+import { ensureAiToolScratchIgnored, filterAiToolScratchFromStatus } from './ai-tool-scratch.lib.mjs';
 
 const CODEX_USAGE_FIELD_NAMES = ['input_tokens', 'cached_input_tokens', 'output_tokens', 'cache_write_tokens', 'cache_creation_input_tokens', 'reasoning_tokens', 'reasoning_output_tokens', 'input_tokens_details.cached_tokens', 'input_tokens_details.cache_read_tokens', 'input_tokens_details.cache_write_tokens', 'input_tokens_details.cache_creation_tokens', 'input_tokens_details.cache_creation_input_tokens', 'output_tokens_details.reasoning_tokens'];
 const CODEX_LONG_CONTEXT_PRICE_THRESHOLD = 272000;
@@ -581,6 +584,9 @@ export const calculateCodexPricingFromModelInfo = (modelId, tokenUsage, modelInf
 
 export const calculateCodexPricing = async (modelId, tokenUsage) => {
   if (!modelId) return null;
+  // Issue #2119: a Formal AI session is served by the local Link.Assistant
+  // model server, so OpenAI pricing must not be applied to it.
+  if (isFormalAiModel(modelId)) return buildFormalAiPricingInfo(modelId, tokenUsage);
   try {
     const modelInfo = await fetchModelInfo(modelId, { preferredProviderIds: ['openai'] });
     return calculateCodexPricingFromModelInfo(modelId, tokenUsage, modelInfo);
@@ -976,13 +982,21 @@ export const executeCodexCommand = async params => {
         observedModelDiagnosticPaths: [],
       };
 
+      // Issue #2119: a process chunk boundary can fall in the middle of an
+      // NDJSON record. Parsing each raw chunk dropped both halves of a split
+      // record (token usage, session id, auth errors). Buffer whole lines so
+      // the line-oriented Codex parser never sees a partial record.
+      const codexStdoutLines = createLineBuffer();
+      const codexStderrLines = createLineBuffer();
+
       for await (const chunk of execCommand.stream()) {
         if (chunk.type === 'stdout') {
-          const output = chunk.data.toString();
+          const raw = chunk.data.toString();
           if (argv.verbose) {
-            await log(output);
+            await log(raw);
           }
-          lastMessage = output;
+          lastMessage = raw;
+          const output = codexStdoutLines.write(raw);
 
           codexJsonState = parseCodexExecJsonOutput(output, codexJsonState, mappedModel);
           await baseBranchCommandIntervention.handleCommandExecutions(codexJsonState.commandExecutions);
@@ -1022,10 +1036,11 @@ export const executeCodexCommand = async params => {
         }
 
         if (chunk.type === 'stderr') {
-          const errorOutput = chunk.data.toString();
-          if (errorOutput && argv.verbose) {
-            await log(errorOutput, { stream: 'stderr' });
+          const rawError = chunk.data.toString();
+          if (rawError && argv.verbose) {
+            await log(rawError, { stream: 'stderr' });
           }
+          const errorOutput = codexStderrLines.write(rawError);
           codexJsonState = parseCodexExecJsonOutput(errorOutput, codexJsonState, mappedModel);
           await baseBranchCommandIntervention.handleCommandExecutions(codexJsonState.commandExecutions);
         } else if (chunk.type === 'exit') {
@@ -1033,6 +1048,27 @@ export const executeCodexCommand = async params => {
         }
       }
 
+      // Release any line that was still being assembled when the stream ended.
+      for (const remaining of [codexStdoutLines.flush(), codexStderrLines.flush()]) {
+        if (!remaining.trim()) continue;
+        codexJsonState = parseCodexExecJsonOutput(remaining, codexJsonState, mappedModel);
+        await baseBranchCommandIntervention.handleCommandExecutions(codexJsonState.commandExecutions);
+      }
+
+      if (codexJsonState.sessionId && codexJsonState.sessionId !== sessionId) {
+        sessionId = codexJsonState.sessionId;
+        await log(`📌 Session ID: ${sessionId}`);
+      }
+      if (codexJsonState.resultSummary) {
+        lastTextContent = codexJsonState.resultSummary;
+      }
+      if (codexJsonState.authError && !authError) {
+        authError = true;
+        await log('\n❌ Authentication error detected in Codex JSON stream', { level: 'error' });
+        await log('   This error cannot be resolved by retrying.', { level: 'error' });
+        await log('   💡 Please run: codex login', { level: 'error' });
+      }
+
       if (interactiveHandler) {
         await interactiveHandler.flush();
       }
@@ -1369,11 +1405,13 @@ export const executeCodexCommand = async params => {
 export const checkForUncommittedChanges = async (tempDir, owner, repo, branchName, $, log, autoCommit = false, autoRestartEnabled = true) => {
   // Similar to Claude and OpenCode version, check for uncommitted changes
   await log('\n🔍 Checking for uncommitted changes...');
+  // Issue #2119: keep AI tool scratch state out of this check and of `git add -A`.
+  await ensureAiToolScratchIgnored(tempDir, log);
   try {
     const gitStatusResult = await $({ cwd: tempDir })`git status --porcelain 2>&1`;
 
     if (gitStatusResult.code === 0) {
-      const statusOutput = gitStatusResult.stdout.toString().trim();
+      const statusOutput = filterAiToolScratchFromStatus(gitStatusResult.stdout.toString().trim());
 
       if (statusOutput) {
         await log('📝 Found uncommitted changes');

package/src/credential-sanitization-core.lib.mjs

@@ -71,9 +71,33 @@ const VENDOR_PATTERNS = Object.freeze([
 ]);
 
 const SENSITIVE_KEY = String.raw`(?:[A-Za-z0-9_.-]*(?:api[-_]?key|account[-_]?key|client[-_]?secret|consumer[-_]?secret|webhook[-_]?secret|access[-_]?token|refresh[-_]?token|auth[-_]?token|password|passwd|pwd|private[-_]?key|secret|token|session[-_]?key|session[-_]?token|cookie|docker[-_]?auth|registry[-_]?auth|shared[-_]?access[-_]?signature|sas[-_]?token)[A-Za-z0-9_.-]*|auth|authorization)`;
+
+// Issue #2119: token *accounting* is not a credential. Every AI provider SDK
+// spells usage telemetry with the plural "tokens" (`tokens`, `inputTokens`,
+// `prompt_tokens`, `total_tokens`) or with an explicit quantity suffix
+// (`token_count`, `tokenLimit`). Masking those numbers corrupted the NDJSON
+// telemetry in published logs and destroyed token/cost accounting, while
+// protecting nothing: a credential is never a bare number under a plural name.
+// The exemption stays deliberately narrow - it requires both a counter-shaped
+// key and a purely numeric value, so `access_token=123456` is still masked.
+const TOKEN_COUNTER_KEY = /(?:tokens|token(?:count|limit|usage|budget|used|size|s?remaining)|(?:count|limit|usage|budget|used|size)tokens?)$/;
+const NUMERIC_VALUE = /^[+-]?(?:\d+(?:\.\d+)?|\.\d+)(?:e[+-]?\d+)?$/i;
+
+const normalizeAssignmentKey = prefix =>
+  String(prefix ?? '')
+    .replace(/\s*(?:=>|[:=])\s*$/, '')
+    .replace(/[^A-Za-z0-9]/g, '')
+    .toLowerCase();
+
+const isTokenCounterAssignment = (prefix, value) => NUMERIC_VALUE.test(String(value ?? '').trim()) && TOKEN_COUNTER_KEY.test(normalizeAssignmentKey(prefix));
 const SENSITIVE_ENV_NAME = /(?:API_?KEY|ACCOUNT_?KEY|CLIENT_?SECRET|CONSUMER_?SECRET|WEBHOOK_?SECRET|ACCESS_?TOKEN|REFRESH_?TOKEN|AUTH_?TOKEN|PASSWORD|PASSWD|PRIVATE_?KEY|SECRET|TOKEN|COOKIE|AUTH)$/i;
 const QUOTED_ASSIGNMENT = new RegExp(`((?:["']?${SENSITIVE_KEY}["']?)\\s*(?:=>|[:=])\\s*)(["'])([^"'\\r\\n]*)(\\2)`, 'gi');
-const UNQUOTED_ASSIGNMENT = new RegExp(`((?:["']?${SENSITIVE_KEY}["']?)\\s*(?:=>|[:=])\\s*)(?!["']|(?:Bearer|Basic|SharedAccessSignature)\\s)([^\\s,;}&'"\\r\\n]+)`, 'gi');
+// Issue #2119: a value that *opens* a JSON/JS structure is punctuation, not a
+// secret. Without this guard `"tokens": {` was rewritten to `"tokens": [REDACTED]`,
+// which silently truncated the object and made the whole record unparseable.
+// The guard only rejects a structural character in first position, so a
+// credential that merely contains a brace (`password=ab{cd`) is still masked whole.
+const UNQUOTED_ASSIGNMENT = new RegExp(`((?:["']?${SENSITIVE_KEY}["']?)\\s*(?:=>|[:=])\\s*)(?!["']|[{[]|(?:Bearer|Basic|SharedAccessSignature)\\s)([^\\s,;}&'"\\r\\n]+)`, 'gi');
 const XML_CREDENTIAL = new RegExp(`(<(${SENSITIVE_KEY})\\b[^>]*>)([\\s\\S]*?)(<\\/\\2\\s*>)`, 'gi');
 const CLI_CREDENTIAL_QUOTED = new RegExp(`(--${SENSITIVE_KEY}(?:\\s+|=))(["'])([^"'\\r\\n]*)(\\2)`, 'gi');
 const CLI_CREDENTIAL = new RegExp(`(--${SENSITIVE_KEY}(?:\\s+|=))(?!["'])([^\\s"'\\r\\n]+)`, 'gi');
@@ -136,8 +160,8 @@ export const sanitizeCredentialText = (input, options = {}) => {
 
   // XML and JSON/YAML/TOML/INI/shell-style assignments.
   output = output.replace(XML_CREDENTIAL, (_match, start, _key, value, end) => `${start}${maskValue(value.trim())}${end}`);
-  output = output.replace(QUOTED_ASSIGNMENT, (_match, prefix, quote, value) => `${prefix}${quote}${maskValue(value)}${quote}`);
-  output = output.replace(UNQUOTED_ASSIGNMENT, (_match, prefix, value) => `${prefix}${maskValue(value)}`);
+  output = output.replace(QUOTED_ASSIGNMENT, (match, prefix, quote, value) => (isTokenCounterAssignment(prefix, value) ? match : `${prefix}${quote}${maskValue(value)}${quote}`));
+  output = output.replace(UNQUOTED_ASSIGNMENT, (match, prefix, value) => (isTokenCounterAssignment(prefix, value) ? match : `${prefix}${maskValue(value)}`));
 
   // CLI arguments and sensitive query parameters.
   output = output.replace(CLI_CREDENTIAL_QUOTED, (_match, prefix, quote, value) => `${prefix}${quote}${maskValue(value)}${quote}`);