@link-assistant/hive-mind 2.11.2 → 2.11.4

package/src/pull-request-changes.lib.mjs

@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+
+/**
+ * Issue #2119: does the pull request actually contain any changes?
+ *
+ * Nobody asked that question before, and two separate false positives followed
+ * from it. In the reproduction runs the AI tool produced nothing, so the branch
+ * ended up with the solver's own scaffolding commit and a revert of it - a net
+ * diff of zero files:
+ *
+ *   https://github.com/konard/test-hello-world-019fb330-00e1-73b9-955e-f357a1600d5b/pull/2
+ *   https://github.com/konard/test-hello-world-019fb330-fa49-7c9d-a664-b7ea33bb698a/pull/2
+ *
+ * Yet the published pull request bodies claimed
+ *
+ *   ### Changes
+ *   - 1 file(s) modified
+ *   - 1 line(s) added
+ *
+ * (the stats were measured while the scaffolding commit was still in the diff
+ * and never revisited), and the Kotlin run went on to post "✅ Ready to merge -
+ * No pending changes" for a pull request that changed nothing at all.
+ *
+ * The third reproduction run failed before the AI committed anything, so its
+ * pull request kept the scaffolding file itself:
+ *
+ *   https://github.com/konard/test-hello-world-019fb331-c107-78c7-8ff6-9f127a3c593c/pull/2
+ *   .gitkeep | 1 +
+ *
+ * That is the same "nothing was implemented" state wearing a file count, so the
+ * solver's own placeholder is excluded from the counts here rather than being
+ * reported as the AI's work.
+ *
+ * This module is the single place that answers the question, so both the
+ * description writer and the mergeability watcher agree.
+ */
+
+import { ghWithRateLimitRetry } from './github-rate-limit.lib.mjs';
+
+/**
+ * The solver's own scaffolding files, recognised by the content it writes into
+ * them (`src/solve.auto-pr.lib.mjs`). A pull request whose whole diff is one of
+ * these contains no solution: the placeholder exists only to give an empty
+ * branch something to open a pull request from, and is reverted once the AI
+ * commits real work.
+ *
+ * Matching on content, not on the file name, keeps a repository's own
+ * `.gitkeep` or `CLAUDE.md` edits counted as the real changes they are.
+ */
+const PLACEHOLDER_CONTENT_PATTERNS = new Map([
+  ['.gitkeep', [/^\+#\s*\.gitkeep file auto-generated at .+ for PR creation at branch /m]],
+  ['CLAUDE.md', [/^\+Issue to solve: \S+/m, /^\+Your prepared branch: \S+/m]],
+]);
+
+/** Split a unified diff into one section per file. */
+const splitDiffByFile = diff => {
+  const sections = [];
+  for (const line of diff.split('\n')) {
+    if (line.startsWith('diff --git ')) {
+      const match = /^diff --git a\/(.+) b\/(.+)$/.exec(line);
+      sections.push({ path: match ? match[2] : '', body: '' });
+      continue;
+    }
+    if (sections.length > 0) sections[sections.length - 1].body += `${line}\n`;
+  }
+  return sections;
+};
+
+/** True when this file section is nothing but the solver's own placeholder. */
+const isPlaceholderSection = section => {
+  const patterns = PLACEHOLDER_CONTENT_PATTERNS.get(section.path);
+  return Boolean(patterns) && patterns.every(pattern => pattern.test(section.body));
+};
+
+/**
+ * Measure the net diff of a pull request.
+ *
+ * The counts come from the unified diff rather than from the PR's `additions` /
+ * `deletions` fields because those are per-commit sums: a commit and its revert
+ * report 1 addition and 1 deletion while the net diff is empty.
+ *
+ * @param {Object} params
+ * @param {string} params.owner
+ * @param {string} params.repo
+ * @param {number} params.prNumber
+ * @param {Function} params.$ command-stream tagged-template executor
+ * @returns {Promise<{hasChanges: boolean, filesChanged: number, additions: number, deletions: number, placeholderOnly: boolean, measured: boolean}>}
+ *   The counts cover the AI's own work: the solver's placeholder file is
+ *   excluded and reported through `placeholderOnly` instead. `measured` is
+ *   false when the diff could not be fetched, in which case callers must not
+ *   treat the pull request as empty.
+ */
+export const getPullRequestChangeStats = async ({ owner, repo, prNumber, $ }) => {
+  let diffOutput = '';
+  let measured = false;
+  try {
+    const result = await ghWithRateLimitRetry(() => $`gh pr diff ${prNumber} --repo ${owner}/${repo}`, { label: `pr diff ${owner}/${repo}#${prNumber}` });
+    if (result.code === 0) {
+      diffOutput = result.stdout.toString();
+      measured = true;
+    }
+  } catch {
+    // Leave measured false: an unreachable API must not read as "no changes".
+  }
+
+  const sections = splitDiffByFile(diffOutput);
+  const placeholderSections = sections.filter(isPlaceholderSection);
+  const realSections = sections.filter(section => !isPlaceholderSection(section));
+
+  const countMatches = (pattern, text) => (text.match(pattern) || []).length;
+  const filesChanged = realSections.length;
+  const additions = realSections.reduce((total, section) => total + countMatches(/^\+[^+]/gm, section.body), 0);
+  const deletions = realSections.reduce((total, section) => total + countMatches(/^-[^-]/gm, section.body), 0);
+
+  return {
+    hasChanges: filesChanged > 0,
+    filesChanged,
+    additions,
+    deletions,
+    placeholderOnly: filesChanged === 0 && placeholderSections.length > 0,
+    measured,
+  };
+};
+
+/**
+ * Render the "### Changes" section of a generated pull request description.
+ *
+ * When the diff is empty this says so instead of inventing a file count, so a
+ * reviewer reading the description learns the same thing the diff would tell
+ * them.
+ *
+ * @param {{hasChanges: boolean, filesChanged: number, additions: number, deletions: number, measured: boolean}} stats
+ * @returns {string}
+ */
+export const formatChangeSummary = stats => {
+  if (!stats.measured) {
+    return '- The diff could not be read, so the change summary is unavailable';
+  }
+  if (!stats.hasChanges) {
+    if (stats.placeholderOnly) {
+      return '- No files were changed by this pull request yet (it contains only the placeholder file the solver commits to open a pull request)';
+    }
+    return '- No files were changed by this pull request yet';
+  }
+  return [`- ${stats.filesChanged} file(s) modified`, `- ${stats.additions} line(s) added`, `- ${stats.deletions} line(s) removed`].join('\n');
+};
+
+/**
+ * The blocker to report when a pull request is otherwise mergeable but empty.
+ *
+ * Merging it would close the issue without changing anything, so this is
+ * treated as a reason to restart the AI rather than as success. The shared
+ * auto-restart budget bounds the retries and fails the run visibly once it is
+ * exhausted.
+ */
+export const EMPTY_PULL_REQUEST_BLOCKER = 'The pull request contains no changes (its net diff is empty), so there is nothing to merge';
+
+/**
+ * The same blocker, naming the placeholder when that is all the diff contains.
+ *
+ * @param {{placeholderOnly?: boolean}|null} stats
+ * @returns {string}
+ */
+export const buildEmptyPullRequestBlocker = (stats = null) => (stats?.placeholderOnly ? 'The pull request contains only the placeholder file the solver commits to open a pull request, so there is nothing to merge' : EMPTY_PULL_REQUEST_BLOCKER);
+
+export default { getPullRequestChangeStats, formatChangeSummary, EMPTY_PULL_REQUEST_BLOCKER, buildEmptyPullRequestBlocker };

package/src/qwen.lib.mjs

@@ -18,12 +18,15 @@ import { reportError } from './sentry.lib.mjs';
 import { timeouts, retryLimits } from './config.lib.mjs';
 import { detectUsageLimit, formatUsageLimitMessage } from './usage-limit.lib.mjs';
 import { sanitizeObjectStrings } from './unicode-sanitization.lib.mjs';
-import { qwenModels, defaultModels } from './models/index.mjs';
+import { qwenModels, defaultModels, isFormalAiModel } from './models/index.mjs';
 import { logPreparedToolCommand, resolveFormalAiToolInvocation } from './formal-ai.lib.mjs';
+import { buildFormalAiPricingInfo } from './formal-ai-pricing.lib.mjs'; // Issue #2119
 import { checkPlaywrightMcpPackageAvailability } from './playwright-mcp.lib.mjs';
 import { classifyRetryableError, prepareRetryAfterError, waitWithCountdown } from './tool-retry.lib.mjs';
 import { getCumulativeContextInputTokens, getRestoredContextInputTokens, toTokenCount } from './context-fill.lib.mjs';
+import { ensureAiToolScratchIgnored, filterAiToolScratchFromStatus } from './ai-tool-scratch.lib.mjs';
 import { getTerminalEventCompletionHealth } from './tool-run-health.lib.mjs'; // Issue #1990
+import { takeJsonRecords } from './json-stream.lib.mjs'; // Issue #2119
 
 export const mapModelToId = model => qwenModels[model] || model;
 
@@ -249,7 +252,7 @@ const applyQwenUsageToState = (state, event) => {
   applyQwenUsageObject(state, rawUsage, findFirstValue(event, QWEN_USAGE_PATHS.model));
 };
 
-const buildQwenPricingInfo = (state, mappedModel) => {
+export const buildQwenPricingInfo = (state, mappedModel) => {
   const tokenUsage = cloneQwenTokenUsage(state?.tokenUsage);
   if (!tokenUsage || tokenUsage.stepCount === 0) {
     return {
@@ -264,6 +267,17 @@ const buildQwenPricingInfo = (state, mappedModel) => {
   tokenUsage.respondedModelId ||= tokenUsage.requestedModelId;
   const modelId = tokenUsage.respondedModelId || tokenUsage.requestedModelId;
 
+  // Issue #2119: `--model formal-ai` is served by the local Link.Assistant model
+  // server, so the session belongs to Link.Assistant at $0.00 - not to Qwen Code.
+  if (isFormalAiModel(mappedModel) || isFormalAiModel(modelId)) {
+    return {
+      pricingInfo: { ...buildFormalAiPricingInfo(modelId, tokenUsage), source: 'qwen-stream-json' },
+      publicPricingEstimate: 0,
+      tokenUsage,
+      resultModelUsage: buildQwenResultModelUsage(tokenUsage),
+    };
+  }
+
   return {
     pricingInfo: {
       provider: 'Qwen Code',
@@ -315,35 +329,19 @@ export const parseQwenStreamJsonOutput = (output, state = {}) => {
   const text = output?.toString?.() ?? String(output || '');
   nextState.plainText += text;
 
-  const parseCandidate = value => {
-    const trimmed = value.trim();
-    if (!trimmed) return true;
-
-    try {
-      const parsed = JSON.parse(trimmed);
-      if (Array.isArray(parsed)) {
-        for (const item of parsed) addQwenEventToState(nextState, item);
-      } else {
-        addQwenEventToState(nextState, parsed);
-      }
-      return true;
-    } catch {
-      return false;
-    }
-  };
-
-  const combined = `${nextState.buffer}${text}`;
-  nextState.buffer = '';
-
-  const lines = combined.split(/\r?\n/);
-  for (let index = 0; index < lines.length; index++) {
-    const line = lines[index];
-    const isLastLine = index === lines.length - 1;
-    if (!line.trim()) continue;
-
-    const parsed = parseCandidate(line);
-    if (!parsed && isLastLine) {
-      nextState.buffer = line;
+  // Issue #2119: frame the stream by balanced JSON values instead of by lines.
+  // `formal-ai with qwen` emits pretty-printed, multi-line records, so every
+  // line failed to parse and every event - including the token usage - was
+  // dropped. Scanning for balanced values also covers records concatenated
+  // without a separator and records split across two process chunks.
+  const { records, rest } = takeJsonRecords(`${nextState.buffer}${text}`);
+  nextState.buffer = rest;
+
+  for (const record of records) {
+    if (Array.isArray(record)) {
+      for (const item of record) addQwenEventToState(nextState, item);
+    } else {
+      addQwenEventToState(nextState, record);
     }
   }
 
@@ -739,11 +737,14 @@ export const executeQwenCommand = async params => {
 
 export const checkForUncommittedChanges = async (tempDir, owner, repo, branchName, $, log, autoCommit = false, autoRestartEnabled = true) => {
   await log('\n🔍 Checking for uncommitted changes...');
+  // Issue #2119: AI tools leave scratch state (.formal-ai/, .playwright-mcp/) in
+  // the workspace. Ignoring it here keeps it out of both this check and 'git add -A'.
+  await ensureAiToolScratchIgnored(tempDir, log);
   try {
     const gitStatusResult = await $({ cwd: tempDir })`git status --porcelain 2>&1`;
 
     if (gitStatusResult.code === 0) {
-      const statusOutput = gitStatusResult.stdout.toString().trim();
+      const statusOutput = filterAiToolScratchFromStatus(gitStatusResult.stdout.toString().trim());
 
       if (statusOutput) {
         await log('📝 Found uncommitted changes');

package/src/reviewers-hive.mjs

@@ -322,10 +322,10 @@ async function reviewer(reviewerId) {
           await log(`   🚀 Executing review.mjs for ${prUrl}...`);
 
           const startTime = Date.now();
-          let reviewCommand = $`./review.mjs "${prUrl}" --model ${argv.model} --focus ${argv.focus}`;
+          let reviewCommand = $`./review.mjs ${prUrl} --model ${argv.model} --focus ${argv.focus}`;
 
           if (argv.autoApprove) {
-            reviewCommand = $`./review.mjs "${prUrl}" --model ${argv.model} --focus ${argv.focus} --approve`;
+            reviewCommand = $`./review.mjs ${prUrl} --model ${argv.model} --focus ${argv.focus} --approve`;
           }
 
           // Stream output and capture result

package/src/solve.auto-merge.lib.mjs

@@ -67,7 +67,7 @@ const { buildCancelledCIReviewComment, getRetriggerableWorkflowRuns, shouldStopF
 
 // Issue #1625: Shared marker constants + posting/tracking helpers
 const toolComments = await import('./tool-comments.lib.mjs');
-const { READY_TO_MERGE_MARKER, READY_FOR_REVIEW_MARKER, AUTO_RESTART_MARKER, AUTO_MERGED_MARKER, postTrackedComment } = toolComments;
+const { READY_TO_MERGE_MARKER, READY_FOR_REVIEW_MARKER, AUTO_RESTART_MARKER, AUTO_RESTART_UNTIL_MERGEABLE_LOG_MARKER, AUTO_MERGED_MARKER, postTrackedComment } = toolComments;
 
 const externalReviewLimitLib = await import('./external-review-limit.lib.mjs');
 const { buildReadyForReviewComment } = externalReviewLimitLib;
@@ -81,8 +81,18 @@ const { maybeAttachWorkingSessionSummary, ensurePullRequestIssueLink } = results
 // Issue #1574: Interruptible sleep so CTRL+C is never blocked by a lingering timer
 const { interruptibleSleep } = await import('./interruptible-sleep.lib.mjs');
 const { formatAutoIterationLimit, hasReachedAutoIterationLimit, normalizeAutoIterationLimit, shouldSyncBeforeRestart } = await import('./auto-iteration-limits.lib.mjs');
+// Issue #2119: one auto-restart budget shared with solve.watch.lib.mjs. solve.mjs
+// runs both loops in the same process, so before this a limit of 5 allowed 10 AI
+// sessions and the two loops published incompatible progress labels
+// ("Auto-restart triggered (iteration 1)" vs "Auto-restart 1/5 Log").
+const autoRestartBudget = await import('./auto-restart-budget.lib.mjs');
+const { beginAutoRestartBudget, consumeAutoRestartIteration, formatAutoRestartLabel, formatAutoRestartLimit, hasExhaustedAutoRestartBudget } = autoRestartBudget;
+const { failOnAutoRestartBudgetExhausted } = await import('./auto-restart-exhaustion.lib.mjs');
 const { ensurePullRequestBaseBranch } = await import('./solve.pr-base-guard.lib.mjs');
 
+// Issue #2119: an empty pull request must not be reported as ready to merge.
+const { buildEmptyPullRequestBlocker, getPullRequestChangeStats } = await import('./pull-request-changes.lib.mjs');
+
 // Issue #1895: explicitly close linked issues after merging a PR into a
 // non-default branch, where GitHub does not auto-close them.
 const { ensureLinkedIssueClosedAfterMerge } = await import('./github-issue-auto-close.lib.mjs');
@@ -101,7 +111,8 @@ export const watchUntilMergeable = async params => {
   const MIN_CI_CHECK_INTERVAL_SECONDS = 120;
   const watchInterval = Math.max(rawWatchInterval, MIN_CI_CHECK_INTERVAL_SECONDS);
   const isAutoMerge = argv.autoMerge || false;
-  const maxAutoRestartIterations = normalizeAutoIterationLimit(argv.autoRestartMaxIterations);
+  // Issue #2119: join the shared budget instead of starting a second counter.
+  const maxAutoRestartIterations = beginAutoRestartBudget({ maxIterations: argv.autoRestartMaxIterations });
   const maxAutoResumeIterations = normalizeAutoIterationLimit(argv.autoResumeMaxIterations);
   // Issue #1503/#1573/#1612: repo-wide action gating is opt-in strict mode.
   // The config default may be bypassed when this module is reused directly, so normalize here.
@@ -112,7 +123,8 @@ export const watchUntilMergeable = async params => {
   let latestAnthropicCost = null;
 
   // Issue #1323: Track actual AI restarts separately from check cycle iterations
-  let restartCount = 0;
+  // Issue #2119: the count now lives in the shared budget module, so restarts
+  // already spent by the watch loop earlier in this run are counted here too.
   let limitResumeCount = 0;
 
   // Issue #1371: In-memory dedup for "Ready to merge" comment (per-session, not all-time)
@@ -133,7 +145,7 @@ export const watchUntilMergeable = async params => {
   await log(formatAligned('', 'Mode:', isAutoMerge ? 'Auto-merge (will merge when ready)' : 'Auto-restart-until-mergeable (will NOT auto-merge)', 2));
   await log(formatAligned('', 'Checking interval:', `${watchInterval} seconds (minimum: ${MIN_CI_CHECK_INTERVAL_SECONDS}s)`, 2));
   await log(formatAligned('', 'Initial cooldown:', `${INITIAL_COOLDOWN_SECONDS} seconds`, 2));
-  await log(formatAligned('', 'Max restart iterations:', formatAutoIterationLimit(maxAutoRestartIterations), 2));
+  await log(formatAligned('', 'Max restart iterations:', formatAutoRestartLimit(), 2));
   await log(formatAligned('', 'Max limit resumes:', formatAutoIterationLimit(maxAutoResumeIterations), 2));
   await log(formatAligned('', 'Wait for all repo actions:', waitForAllRepoActionsFlag ? 'Yes (strict repo-wide safety)' : 'No (PR-scoped CI only)', 2));
   await log(formatAligned('', 'Stop conditions:', 'PR merged, PR closed, or becomes mergeable', 2));
@@ -277,9 +289,20 @@ export const watchUntilMergeable = async params => {
         }
       }
 
+      // Issue #2119: an empty pull request is not "ready to merge". The Kotlin
+      // reproduction run posted "✅ Ready to merge - No pending changes" for a
+      // pull request whose net diff was empty, so merging it would have closed
+      // the issue without implementing anything.
+      const changeStats = await getPullRequestChangeStats({ owner, repo, prNumber, $ });
+      const isEmptyPullRequest = changeStats.measured && !changeStats.hasChanges;
+      const emptyPullRequestBlocker = buildEmptyPullRequestBlocker(changeStats);
+      if (isEmptyPullRequest) {
+        await log(formatAligned('⚠️', 'PR is empty:', changeStats.placeholderOnly ? 'only the solver placeholder file is in the diff - not treating it as mergeable' : 'net diff contains no files - not treating it as mergeable', 2), { level: 'warning' });
+      }
+
       // If PR is mergeable, no blockers, no new comments, no issue metadata
-      // edits, and no uncommitted changes
-      if (blockers.length === 0 && !hasNewComments && !hasIssueMetadataChanges && !hasUncommittedChanges) {
+      // edits, no uncommitted changes and it actually changes something
+      if (blockers.length === 0 && !hasNewComments && !hasIssueMetadataChanges && !hasUncommittedChanges && !isEmptyPullRequest) {
         // Issue #1503 (enhanced): Multi-mechanism consensus + repo-wide action check.
         // Before declaring PR mergeable, run multiple independent CI detection mechanisms
         // and require all to agree. This catches race conditions where CI starts between
@@ -434,6 +457,15 @@ export const watchUntilMergeable = async params => {
         feedbackLines.push('Please review and address the feedback from these comments.');
       }
 
+      // Issue #2119: Reason 1a: the pull request does not change anything yet.
+      if (isEmptyPullRequest) {
+        shouldRestart = true;
+        restartReason = restartReason ? `${restartReason}; ${emptyPullRequestBlocker}` : emptyPullRequestBlocker;
+        feedbackLines.push(`📭 ${emptyPullRequestBlocker}.`);
+        feedbackLines.push('');
+        feedbackLines.push('Implement the requested change and commit it to the pull request branch. Do not report the work as done while the diff is empty.');
+      }
+
       // Issue #2007: Reason 1b: Issue title/description edited by the user.
       if (hasIssueMetadataChanges) {
         shouldRestart = true;
@@ -691,38 +723,24 @@ Once the billing issue is resolved, you can re-run the CI checks or push a new c
       }
 
       if (shouldRestart) {
-        if (hasReachedAutoIterationLimit(restartCount, maxAutoRestartIterations)) {
-          await log('');
-          await log(formatAligned('⚠️', 'AUTO-RESTART LIMIT REACHED', `Stopping after ${restartCount} restart iteration${restartCount !== 1 ? 's' : ''}`));
-          await log(formatAligned('', 'Configured limit:', formatAutoIterationLimit(maxAutoRestartIterations), 2));
-          await log(formatAligned('', 'Remaining blockers:', restartReason, 2));
-          await log('');
-
-          try {
-            const limitComment = `## ⚠️ Auto-restart limit reached
-
-Hive Mind stopped auto-restart-until-mergeable after ${restartCount} restart iteration${restartCount !== 1 ? 's' : ''}.
-
-**Configured limit:** ${formatAutoIterationLimit(maxAutoRestartIterations)}
-**Remaining reason:** ${restartReason}
-
-No further AI sessions will be started automatically for this run. Please review the remaining blockers manually or rerun with a higher \`--auto-restart-max-iterations\` value.
-
----
-*Auto-restart-until-mergeable stopped by the safety limit.*`;
-            await postTrackedComment({ $, owner, repo, targetNumber: prNumber, body: limitComment });
-          } catch (commentError) {
-            reportError(commentError, {
-              context: 'post_auto_restart_limit_comment',
-              owner,
-              repo,
-              prNumber,
-              operation: 'comment_on_pr',
-            });
-            await log(formatAligned('', '⚠️  Could not post auto-restart limit comment to PR', '', 2));
-          }
-
-          return { success: false, reason: 'auto_restart_limit_reached', latestSessionId, latestAnthropicCost };
+        // Issue #2119: the run-wide budget is exhausted (it may already have been
+        // spent by the watch loop). Fail and auto-commit through the same shared
+        // exhaustion path the uncommitted-changes loop uses, so the outcome and
+        // the published comment are identical no matter which loop hit the limit.
+        if (hasExhaustedAutoRestartBudget()) {
+          const exhaustion = await failOnAutoRestartBudgetExhausted({
+            owner,
+            repo,
+            prNumber,
+            tempDir,
+            branchName: prBranch || branchName,
+            $,
+            log,
+            formatAligned,
+            blocker: restartReason,
+            subsystem: 'auto-restart-until-mergeable',
+          });
+          return { success: false, reason: exhaustion.reason, latestSessionId, latestAnthropicCost };
         }
 
         // Add standard instructions for auto-restart-until-mergeable mode using shared utility
@@ -759,17 +777,21 @@ No further AI sessions will be started automatically for this run. Please review
         }
 
         // Issue #1323: Increment restart count only when a tool execution is about to start.
-        restartCount++;
+        // Issue #2119: claim it from the run-wide shared budget.
+        const restartCount = consumeAutoRestartIteration();
 
         await log(formatAligned('🔄', 'RESTART TRIGGERED:', restartReason));
-        await log(formatAligned('', 'Restart iteration:', maxAutoRestartIterations === 0 ? `${restartCount}` : `${restartCount}/${maxAutoRestartIterations}`, 2));
+        await log(formatAligned('', 'Restart iteration:', formatAutoRestartLabel(restartCount), 2));
         await log('');
 
         // Post a comment to PR about the restart after preflight succeeds, so every
         // posted restart notification corresponds to an actual tool session.
         try {
-          const limitText = maxAutoRestartIterations === 0 ? 'No automatic restart limit is configured.' : `This run will stop after ${maxAutoRestartIterations} restart iteration${maxAutoRestartIterations !== 1 ? 's' : ''}.`;
-          const commentBody = `## 🔄 ${AUTO_RESTART_MARKER} triggered (iteration ${restartCount})\n\n**Reason:** ${restartReason}\n\nStarting new session to address the issues.\n\n---\n*Auto-restart-until-mergeable mode is active. ${limitText}*`;
+          const limitText = maxAutoRestartIterations === 0 ? 'No automatic restart limit is configured.' : `This run will stop after ${maxAutoRestartIterations} restart iteration${maxAutoRestartIterations !== 1 ? 's' : ''} in total.`;
+          // Issue #2119: the same `N/M` heading the uncommitted-changes loop posts.
+          // "triggered (iteration N)" hid the limit and made one auto-restart
+          // system look like two.
+          const commentBody = `## 🔄 ${AUTO_RESTART_MARKER} ${formatAutoRestartLabel(restartCount)}\n\n**Reason:** ${restartReason}\n\nStarting new session to address the issues.\n\n---\n*Auto-restart-until-mergeable mode is active. ${limitText}*`;
           // Issue #1625: Track so this doesn't falsely count as an AI-authored comment
           await postTrackedComment({ $, owner, repo, targetNumber: prNumber, body: commentBody });
           await log(formatAligned('', '💬 Posted auto-restart notification to PR', '', 2));
@@ -1093,8 +1115,10 @@ No further AI sessions will be started automatically for this run. Please review
             try {
               const logFile = getLogFile();
               if (logFile) {
-                // Issue #1323: Use restartCount (actual AI executions) instead of iteration (check cycles)
-                const customTitle = `🔄 Auto-restart-until-mergeable Log (iteration ${restartCount})`;
+                // Issue #1323: Use the restart count (actual AI executions) instead of iteration (check cycles)
+                // Issue #2119: `N/M` like every other auto-restart label, so the
+                // limit is visible in the log title too.
+                const customTitle = `🔄 ${AUTO_RESTART_UNTIL_MERGEABLE_LOG_MARKER} ${formatAutoRestartLabel()}`;
                 await attachLogToGitHub({
                   logFile,
                   targetType: 'pr',

package/src/solve.auto-pr.lib.mjs

@@ -1126,8 +1126,14 @@ ${prBody}`,
               // Link the issue to the PR in GitHub's Development section using GraphQL API
               await log(formatAligned('🔗', 'Linking:', `Issue #${issueNumber} to PR #${localPrNumber}...`));
               try {
+                // Issue #2119: the double quotes below are GraphQL string syntax,
+                // not shell quoting. command-stream escapes interpolated values, so
+                // the queries are assembled in JS and passed as one argument.
+                const repositorySelector = `repository(owner: ${JSON.stringify(owner)}, name: ${JSON.stringify(repo)})`;
+
                 // First, get the node IDs for both the issue and the PR
-                const issueNodeResult = await $`gh api graphql -f query='query { repository(owner: "${owner}", name: "${repo}") { issue(number: ${issueNumber}) { id } } }' --jq .data.repository.issue.id`;
+                const issueNodeQuery = `query { ${repositorySelector} { issue(number: ${issueNumber}) { id } } }`;
+                const issueNodeResult = await $`gh api graphql -f query=${issueNodeQuery} --jq .data.repository.issue.id`;
 
                 if (issueNodeResult.code !== 0) {
                   throw new Error(`Failed to get issue node ID: ${issueNodeResult.stderr}`);
@@ -1136,7 +1142,8 @@ ${prBody}`,
                 const issueNodeId = issueNodeResult.stdout.toString().trim();
                 await log(`   Issue node ID: ${issueNodeId}`, { verbose: true });
 
-                const prNodeResult = await $`gh api graphql -f query='query { repository(owner: "${owner}", name: "${repo}") { pullRequest(number: ${localPrNumber}) { id } } }' --jq .data.repository.pullRequest.id`;
+                const prNodeQuery = `query { ${repositorySelector} { pullRequest(number: ${localPrNumber}) { id } } }`;
+                const prNodeResult = await $`gh api graphql -f query=${prNodeQuery} --jq .data.repository.pullRequest.id`;
 
                 if (prNodeResult.code !== 0) {
                   throw new Error(`Failed to get PR node ID: ${prNodeResult.stderr}`);
@@ -1152,7 +1159,8 @@ ${prBody}`,
                 // 2. For cross-repo (fork) PRs, we need "Fixes owner/repo#N"
 
                 // Let's verify the link was created
-                const linkCheckResult = await $`gh api graphql -f query='query { repository(owner: "${owner}", name: "${repo}") { pullRequest(number: ${localPrNumber}) { closingIssuesReferences(first: 10) { nodes { number } } } } }' --jq '.data.repository.pullRequest.closingIssuesReferences.nodes[].number'`;
+                const linkCheckQuery = `query { ${repositorySelector} { pullRequest(number: ${localPrNumber}) { closingIssuesReferences(first: 10) { nodes { number } } } } }`;
+                const linkCheckResult = await $`gh api graphql -f query=${linkCheckQuery} --jq '.data.repository.pullRequest.closingIssuesReferences.nodes[].number'`;
 
                 if (linkCheckResult.code === 0) {
                   const linkedIssues = parseClosingIssueNumbers(linkCheckResult.stdout);

package/src/solve.finalize.lib.mjs

@@ -1,3 +1,9 @@
+// Issue #2119: "after 5 we must actually stop (fail + auto-commit on fail
+// recovery). So the result will be actually visible." Both auto-restart loops
+// record their exhaustion in this shared module, so the run exits non-zero
+// instead of reporting success with the blocker still unresolved.
+import { getAutoRestartLimitFailure, hasAutoRestartLimitFailure } from './auto-restart-exhaustion.lib.mjs';
+
 export async function finalizeSolveProcess({ tempDir, argv, limitReached, path, getLogFile, log, closeSentry, logActiveHandles, cleanupTempDirectory, safeExit }) {
   const runFinalizationStep = async (label, step) => {
     try {
@@ -31,6 +37,15 @@ export async function finalizeSolveProcess({ tempDir, argv, limitReached, path,
   // drainHandles() inside safeExit() will unref/close these before process.exit().
   await runFinalizationStep('active handle diagnostics', () => logActiveHandles(msg => log(msg)));
 
+  // Issue #2119: an exhausted auto-restart budget is a failure, not a completed run.
+  if (hasAutoRestartLimitFailure()) {
+    const failure = getAutoRestartLimitFailure();
+    await log(`\n❌ Auto-restart limit reached after ${failure.iterationsUsed} iteration${failure.iterationsUsed !== 1 ? 's' : ''} - the blocker was never resolved.`, { level: 'error' });
+    await log(failure.committed ? '   Uncommitted work was auto-committed before exit, so the partial result is visible.' : '   No uncommitted work was left to preserve.', { level: 'error' });
+    await safeExit(1, 'Auto-restart limit reached');
+    return;
+  }
+
   // Issue #1431: safeExit() unrefs handles so the event loop exits naturally, then calls process.exit(0)
   await safeExit(0, 'Process completed');
 }

package/src/solve.repository.lib.mjs

@@ -29,6 +29,7 @@ const { log, formatAligned } = lib;
 
 // Import exit handler
 import { safeExit } from './exit-handler.lib.mjs';
+import { ensureAiToolScratchIgnored } from './ai-tool-scratch.lib.mjs';
 import { parseForkFullNameFromGhOutput } from './github-repository-names.lib.mjs';
 import { checkReplacementRepositoryBranchSafety } from './solve.repository-safety.lib.mjs';
 import { buildForkReplacementBlockedReason, buildForkReplacementSafetyCheckDescription } from './solve.repository-recovery-message.lib.mjs';
@@ -59,7 +60,11 @@ export const checkExistingForkOfRoot = async rootRepo => {
     const userResult = await lib.ghCmdRetry(() => $`gh api user --jq .login`, { label: 'get user (fork check)' });
     if (userResult.code !== 0) return null;
     const currentUser = userResult.stdout.toString().trim();
-    const forksResult = await lib.ghCmdRetry(() => $`gh api repos/${rootRepo}/forks --paginate --jq '.[] | select(.owner.login == "${currentUser}") | .full_name'`, { label: `check forks of ${rootRepo}` });
+    // Issue #2119: build the jq expression in JS. Its double quotes belong to jq,
+    // not to the shell, and command-stream quotes interpolated values itself - so
+    // interpolating inside the quotes would leak shell quotes into the comparison.
+    const forkFilter = `.[] | select(.owner.login == ${JSON.stringify(currentUser)}) | .full_name`;
+    const forksResult = await lib.ghCmdRetry(() => $`gh api repos/${rootRepo}/forks --paginate --jq ${forkFilter}`, { label: `check forks of ${rootRepo}` });
     if (forksResult.code !== 0) return null;
 
     const forks = forksResult.stdout
@@ -324,9 +329,13 @@ export const tryInitializeEmptyRepository = async (owner, repo) => {
     const base64Content = Buffer.from(readmeContent).toString('base64');
 
     // Try to create README.md using GitHub API
+    // Issue #2119: `--field content="${base64Content}"` would leak literal quotes
+    // into the field value as soon as command-stream decides the value needs
+    // quoting, so the whole `key=value` token is built in JS instead.
+    const contentField = `content=${base64Content}`;
     const createResult = await $`gh api repos/${owner}/${repo}/contents/README.md --method PUT --silent \
-      --field message="Initialize repository with README" \
-      --field content="${base64Content}" 2>&1`;
+      --field message=${'Initialize repository with README'} \
+      --field ${contentField} 2>&1`;
 
     if (createResult.code === 0) {
       await log(`${formatAligned('✅', 'Success:', 'README.md created successfully')}`);
@@ -1062,6 +1071,11 @@ export const cloneRepository = async (repoToClone, tempDir, argv, owner, repo) =
     if (cloneResult.code === 0 && repoIsValid) {
       await log(`${formatAligned('✅', 'Cloned to:', tempDir)}`);
 
+      // Issue #2119: AI tools drop scratch state (`.formal-ai/`, `.playwright-mcp/`)
+      // into the workspace. Exclude it here, once, so every later `git status` and
+      // `git add -A` agrees instead of reading it as the AI's uncommitted work.
+      await ensureAiToolScratchIgnored(tempDir, log);
+
       // Verify and fix remote configuration
       const remoteCheckResult = await $({ cwd: tempDir })`git remote -v 2>&1`;
       if (!remoteCheckResult.stdout || !remoteCheckResult.stdout.toString().includes('origin')) {
@@ -1207,7 +1221,10 @@ export const setupPrForkRemote = async (tempDir, argv, prForkOwner, repo, isCont
   // Strategy 1: Query the upstream repo's forks to find this user's fork
   if (owner) {
     await log(`${formatAligned('🔍', 'Discovering fork name:', `Searching ${owner}/${repo}/forks for ${prForkOwner}'s fork...`)}`);
-    const forksResult = await $`gh api repos/${owner}/${repo}/forks --paginate --jq '.[] | select(.owner.login == "${prForkOwner}") | .name'`;
+    // Issue #2119: the double quotes here are jq syntax, so the expression is
+    // built in JS and interpolated as one already-escaped argument.
+    const forkNameFilter = `.[] | select(.owner.login == ${JSON.stringify(prForkOwner)}) | .name`;
+    const forksResult = await $`gh api repos/${owner}/${repo}/forks --paginate --jq ${forkNameFilter}`;
     if (forksResult.code === 0 && forksResult.stdout) {
       const forkName = forksResult.stdout.toString().trim().split('\n')[0]; // Take first match
       if (forkName) {

package/src/solve.restart-shared.lib.mjs

@@ -32,6 +32,7 @@ const fs = (await use('fs')).promises;
 const lib = await import('./lib.mjs');
 const { log, formatAligned, extractToolErrorCore } = lib;
 const { ensurePullRequestBaseBranch } = await import('./solve.pr-base-guard.lib.mjs');
+const { ensureAiToolScratchIgnored, filterAiToolScratchFromStatus } = await import('./ai-tool-scratch.lib.mjs');
 const { RESOURCE_PHASE_RESTART_AFTER, RESOURCE_PHASE_RESTART_BEFORE, recordResourceSnapshot } = await import('./solve.resource-diagnostics.lib.mjs');
 // Issue #2123: shared draft/ready transitions for working sessions.
 const { ensurePullRequestIsDraft } = await import('./pr-draft-state.lib.mjs');
@@ -128,11 +129,14 @@ export const cleanupPlaywrightMcpFolder = async (tempDir, argv = {}) => {
 export const checkForUncommittedChanges = async (tempDir, argv = {}) => {
   // First, clean up .playwright-mcp/ folder to prevent false positives (Issue #1124)
   await cleanupPlaywrightMcpFolder(tempDir, argv);
+  // Issue #2119: the same false positive, generalized - `.formal-ai/` and any
+  // other AI tool scratch directory must not read as the AI's uncommitted work.
+  await ensureAiToolScratchIgnored(tempDir, log);
 
   try {
     const gitStatusResult = await $({ cwd: tempDir })`git status --porcelain 2>&1`;
     if (gitStatusResult.code === 0) {
-      const statusOutput = gitStatusResult.stdout.toString().trim();
+      const statusOutput = filterAiToolScratchFromStatus(gitStatusResult.stdout.toString().trim());
       return statusOutput.length > 0;
     }
   } catch (error) {
@@ -156,7 +160,7 @@ export const getUncommittedChangesDetails = async tempDir => {
   try {
     const gitStatusResult = await $({ cwd: tempDir })`git status --porcelain 2>&1`;
     if (gitStatusResult.code === 0) {
-      const statusOutput = gitStatusResult.stdout.toString().trim();
+      const statusOutput = filterAiToolScratchFromStatus(gitStatusResult.stdout.toString().trim());
       if (statusOutput) {
         changes.push(...statusOutput.split('\n'));
       }