@link-assistant/hive-mind 2.11.5 → 2.11.7

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @link-assistant/hive-mind
 
+## 2.11.7
+
+### Patch Changes
+
+- 815a63c: Keep context/cost budget statistics out of the working session summary (issue #2132).
+
+  Cost estimation and token/context usage are now published only in the working
+  session log comment, and only when `--attach-logs` is enabled — previously every
+  session posted the identical blocks twice, and the summary could publish them even
+  with log attachment disabled. The per-session budget stats derivation used by the
+  top-level run, watch iterations and auto-restart-until-mergeable iterations is now
+  a single shared implementation.
+
+## 2.11.6
+
+### Patch Changes
+
+- 55b30c8: Make `--model formal-ai` work for every tool by talking to Formal AI directly instead of through the `formal-ai with` wrapper. Hive Mind now starts `formal-ai serve --agent-mode` and points each CLI at that endpoint through its own native configuration channel — `CODEX_HOME` for codex, a settings file for gemini, `OPENAI_MODEL` for qwen — so the wrapper can no longer rewrite the argv, drop the caller's prompt, or send codex traffic to `api.openai.com`. The operator's `HOME`, git, gh and ssh configuration is never shadowed.
+
+  Also removes the log noise and false verdicts the same runs exposed: read-only `gh`/`git` probes no longer mirror their raw payloads into the log that `--attach-logs` uploads (`gh auth status --show-token` was printing a live credential in clear text), codex no longer warns on every run, an expected 404 is no longer printed as an error, `gh auth setup-git` no longer fails on a bind-mounted `~/.gitconfig`, and "No working session summary available" is no longer reported for a session that produced one. The Formal AI wrapper version is recorded in the solve log, and the runtime logs its endpoint, protocol, config root and environment for the next iteration.
+
 ## 2.11.5
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "2.11.5",
+  "version": "2.11.7",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",

package/src/agent.lib.mjs

@@ -22,7 +22,7 @@ import { sanitizeObjectStrings } from './unicode-sanitization.lib.mjs';
 import Decimal from 'decimal.js-light';
 import semver from 'semver';
 import { agentModels, defaultModels, freeToBaseModelMap, isFormalAiModel } from './models/index.mjs';
-import { logPreparedToolCommand, resolveFormalAiToolInvocation } from './formal-ai.lib.mjs';
+import { isPrepareOnly, logPreparedToolCommand, resolveFormalAiToolExecution } from './formal-ai.lib.mjs';
 import { buildFormalAiPricingInfo } from './formal-ai-pricing.lib.mjs'; // Issue #2119
 import { checkPlaywrightMcpPackageAvailability, getAgentPlaywrightMcpDisableEnv } from './playwright-mcp.lib.mjs';
 import { createAgentTokenUsage, accumulateAgentStepFinishUsage, parseAgentTokenUsage } from './agent-token-usage.lib.mjs';
@@ -510,11 +510,9 @@ export const executeAgentCommand = async params => {
 
     // Map model alias to full ID
     const mappedModel = mapModelToId(argv.model);
-    const toolInvocation = resolveFormalAiToolInvocation({
-      tool: 'agent',
-      model: argv.model,
-      toolPath: agentPath,
-    });
+    // Issue #2130: Formal AI runs the native CLI against a local Formal AI server (no argv wrapper).
+    const toolInvocation = await resolveFormalAiToolExecution({ tool: 'agent', model: argv.model, toolPath: agentPath, workdir: tempDir, log, verbose: argv.verbose, prepareOnly: isPrepareOnly(argv), env: agentEnv });
+    Object.assign(agentEnv, toolInvocation.env);
 
     // Build agent command arguments
     let agentArgs = `--model ${mappedModel}`;
@@ -571,7 +569,7 @@ export const executeAgentCommand = async params => {
           mirror: false,
           env: agentEnv,
         });
-        execCommand = toolInvocation.formalAi ? commandRunner`${toolInvocation.command} ${toolInvocation.args} ${agentArgs}` : commandRunner`${toolInvocation.command} ${agentArgs}`;
+        execCommand = commandRunner`${toolInvocation.command} ${agentArgs}`;
         const attached = await attachStreamingInput(bidirectionalHandler, execCommand, combinedPrompt, log, !!argv.verbose, { toolLabel: 'Agent' });
         if (!attached) {
           throw new Error('Agent live stream-json input requested, but stdin attachment failed');
@@ -583,7 +581,7 @@ export const executeAgentCommand = async params => {
           mirror: false,
           env: agentEnv,
         });
-        execCommand = toolInvocation.formalAi ? commandRunner`cat ${promptFile} | ${toolInvocation.command} ${toolInvocation.args} ${agentArgs}` : commandRunner`cat ${promptFile} | ${toolInvocation.command} ${agentArgs}`;
+        execCommand = commandRunner`cat ${promptFile} | ${toolInvocation.command} ${agentArgs}`;
       }
 
       await log(`${formatAligned('📋', 'Command details:', '')}`);
@@ -675,8 +673,13 @@ export const executeAgentCommand = async params => {
         }
         // Issue #1263: Track text content for result summary
         // Agent outputs text via 'text', 'assistant', or 'message' type events
-        if (data.type === 'text' && data.text) {
-          lastTextContent = data.text;
+        // Issue #2130: Agent CLI 0.25.x nests the assistant text under `part`
+        // (`{"type":"text","part":{"type":"text","text":"…"}}`) and never sets a
+        // top-level `data.text`. Reading only `data.text` left `resultSummary`
+        // null for every successful run, which surfaced as the false negative
+        // "ℹ️  No working session summary available from AI tool output".
+        if (data.type === 'text' && (data.text || data.part?.text)) {
+          lastTextContent = data.text || data.part.text;
         } else if (data.type === 'assistant' && data.message?.content) {
           // Extract text from assistant message content
           const content = Array.isArray(data.message.content) ? data.message.content : [data.message.content];

package/src/bidirectional-interactive.lib.mjs

@@ -23,6 +23,7 @@
  */
 
 import { wrapDollarWithGhRetry as _wrapDollarWithGhRetry } from './github-rate-limit.lib.mjs'; // rate-limit marker (#1726): gh API calls flow through $ wrapped by caller
+import { quietProbe } from './quiet-probe.lib.mjs'; // issue #2130: keep read-only probe payloads out of the attached log
 import { getLiveInputCapability, getLiveInputCapabilityRows, getLiveInputMode, isLiveInputSupported, LIVE_INPUT_MODE_FALLBACK, LIVE_INPUT_MODE_STREAM } from './live-input-capabilities.lib.mjs';
 // Configuration constants
 const CONFIG = {
@@ -186,7 +187,7 @@ export const createBidirectionalHandler = options => {
   const resolveOwnUserLogin = async () => {
     if (ownUserResolved) return ownUserLogin;
     try {
-      const result = await $`gh api user --jq .login`;
+      const result = await quietProbe($)`gh api user --jq .login`;
       ownUserLogin = (result.stdout?.toString() || '').trim() || null;
     } catch (error) {
       if (verbose) {

package/src/budget-stats-policy.lib.mjs

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+
+/**
+ * Issue #2132: single source of truth for *where* context/cost budget statistics
+ * may be published.
+ *
+ * Rules encoded here:
+ *   1. Budget stats belong to the working session **log** comment only. The
+ *      "Working session summary" comment reports what the AI did, never how many
+ *      tokens or dollars it took (see `attachSolutionSummary`).
+ *   2. `--attach-logs` disabled ⇒ no log comment ⇒ no published budget stats.
+ *      `--tokens-budget-stats` alone is not enough to publish them to GitHub; it
+ *      only controls the local terminal rendering of the same facts.
+ *
+ * Keeping this in one module means the top-level run, the watch loop and the
+ * auto-restart-until-mergeable loop cannot drift apart again.
+ *
+ * @see https://github.com/link-assistant/hive-mind/issues/2132
+ */
+
+/** Whether `--attach-logs` is enabled (both camelCase and kebab-case forms). */
+export const isAttachLogsEnabled = argv => !!(argv && (argv.attachLogs || argv['attach-logs']));
+
+/** Whether `--tokens-budget-stats` is enabled (both camelCase and kebab-case forms). */
+export const isTokensBudgetStatsEnabled = argv => !!(argv && (argv.tokensBudgetStats || argv['tokens-budget-stats']));
+
+/**
+ * Whether context/cost budget statistics may be published to GitHub for this run.
+ * Requires BOTH `--tokens-budget-stats` and `--attach-logs`.
+ */
+export const shouldPublishBudgetStats = argv => isTokensBudgetStatsEnabled(argv) && isAttachLogsEnabled(argv);

package/src/claude.lib.mjs

@@ -23,7 +23,7 @@ import { SESSION_FORCE_KILLED_MARKER, postTrackedComment } from './tool-comments
 import { handleClaudeRuntimeSwitch } from './claude.runtime-switch.lib.mjs'; // see issue #1141
 import { CLAUDE_MODELS as availableModels, mapClaudeSubAgentModelToEnvValue } from './models/index.mjs'; // Issue #1221, #1978
 import { applyFormalAiPricingOverride } from './formal-ai-pricing.lib.mjs'; // Issue #2119
-import { logPreparedToolCommand, resolveFormalAiToolInvocation } from './formal-ai.lib.mjs';
+import { buildAuthRemedyLines, isPrepareOnly, logPreparedToolCommand, resolveFormalAiToolExecution } from './formal-ai.lib.mjs';
 import { buildMcpConfigWithoutPlaywright, ensureClaudePlaywrightMcpServer } from './playwright-mcp.lib.mjs';
 import { resolveClaudeSessionToolFlags } from './useless-tools.lib.mjs';
 import { ensureClaudeQuietConfig } from './claude-quiet-config.lib.mjs';
@@ -41,6 +41,8 @@ export { availableModels, fetchModelInfo }; // Re-export for backward compatibil
 export { formatNumber, mapModelToId, checkModelVisionCapability };
 export const validateClaudeConnection = async (model = 'haiku') => {
   const mappedModel = mapModelToId(model);
+  // Issue #2130: "run claude login" is wrong advice for a Formal-AI-served model.
+  const authRemedyLines = buildAuthRemedyLines({ model, vendorRemedy: 'Please run: claude login' });
   const maxRetries = 3;
   const baseDelay = timeouts.retryBaseDelay;
   let retryCount = 0;
@@ -137,7 +139,7 @@ export const validateClaudeConnection = async (model = 'haiku') => {
           if (stderr) await log(`   Error: ${stderr.trim()}`, { level: 'error' });
         }
         if (stderr.includes('Please run /login') || (jsonError && jsonError.type === 'forbidden')) {
-          await log('   💡 Please run: claude login', { level: 'error' });
+          for (const line of authRemedyLines) await log(line, { level: 'error' });
         }
         return false;
       }
@@ -158,7 +160,7 @@ export const validateClaudeConnection = async (model = 'haiku') => {
         }
         await log(`❌ Claude CLI returned error: ${jsonError.type} - ${jsonError.message}`, { level: 'error' });
         if (jsonError.type === 'forbidden') {
-          await log('   💡 Please run: claude login', { level: 'error' });
+          for (const line of authRemedyLines) await log(line, { level: 'error' });
         }
         return false;
       }
@@ -613,7 +615,8 @@ export const executeClaudeCommand = async params => {
     const progressMonitor = await initProgressMonitoring(argv, { owner, repo, prNumber, $, log }); // works with or without --interactive-mode
     let execCommand;
     const mappedModel = mapModelToId(argv.model);
-    const toolInvocation = resolveFormalAiToolInvocation({ tool: 'claude', model: argv.model, toolPath: claudePath });
+    // Issue #2130: Formal AI runs the native CLI against a local Formal AI server (no argv wrapper).
+    const toolInvocation = await resolveFormalAiToolExecution({ tool: 'claude', model: argv.model, toolPath: claudePath, workdir: tempDir, log, verbose: argv.verbose, prepareOnly: isPrepareOnly(argv) });
     const resolvedPlanModel = argv.planModel ? mapModelToId(argv.planModel) : undefined; // Issue #1223
     const resolvedSubAgentModel = argv.subAgentModel ? mapClaudeSubAgentModelToEnvValue(argv.subAgentModel) : undefined; // Issue #1978
     const effectiveModel = resolvedPlanModel ? 'opusplan' : mappedModel;
@@ -633,12 +636,7 @@ export const executeClaudeCommand = async params => {
       await log(`🔄 Resuming from session: ${argv.resume}`);
       claudeArgs = `--resume ${argv.resume} ${claudeArgs}`;
     }
-    let claudeWorkLanguage = null;
-    try {
-      claudeWorkLanguage = (await import('./i18n.lib.mjs')).getWorkLocale?.() ?? null;
-    } catch {
-      /* ignore */
-    }
+    const claudeWorkLanguage = await import('./i18n.lib.mjs').then(i18n => i18n.getWorkLocale?.() ?? null).catch(() => null);
     await ensureClaudeQuietConfig({ log, workLanguage: claudeWorkLanguage });
     const { mcpConfigPath, disallowedToolsList } = await resolveClaudeSessionToolFlags({ argv, log, fallbackBuildMcpConfigWithoutPlaywright: buildMcpConfigWithoutPlaywright });
     if (mcpConfigPath) claudeArgs += ` --strict-mcp-config --mcp-config "${mcpConfigPath}"`;
@@ -660,7 +658,8 @@ export const executeClaudeCommand = async params => {
       const { thinkingBudget: resolvedThinkingBudget, thinkLevel, isNewVersion, maxBudget } = await resolveThinkingSettings(argv, log);
       const { parsed: parsedSubSessionSize, contextWindowTokens } = await resolveSubSessionSize({ rawValue: argv.subSessionSize, tool: 'claude', modelId: effectiveModel, fetchModelInfo, log });
       // Issue #817: streaming mode sets exitAfterStopDelayMs=60000 so the headless Claude process stays alive between NDJSON turns.
-      const claudeEnv = getClaudeEnv({ thinkingBudget: resolvedThinkingBudget, model: effectiveModel, thinkLevel, maxBudget, planModel: resolvedPlanModel, executionModel: resolvedExecutionModel, subAgentModel: resolvedSubAgentModel, showThinkingContent: argv.showThinkingContent, exitAfterStopDelayMs: streamingInput ? 60_000 : undefined, disable1mContext: !!argv.disable1mContext, subSessionSize: parsedSubSessionSize, contextWindowTokens });
+      // Issue #2130: `toolInvocation.env` points the native CLI at the local Formal AI server (base URL + API key).
+      const claudeEnv = { ...getClaudeEnv({ thinkingBudget: resolvedThinkingBudget, model: effectiveModel, thinkLevel, maxBudget, planModel: resolvedPlanModel, executionModel: resolvedExecutionModel, subAgentModel: resolvedSubAgentModel, showThinkingContent: argv.showThinkingContent, exitAfterStopDelayMs: streamingInput ? 60_000 : undefined, disable1mContext: !!argv.disable1mContext, subSessionSize: parsedSubSessionSize, contextWindowTokens }), ...toolInvocation.env };
       if (argv.verbose) claudeEnv.ANTHROPIC_LOG = 'debug';
       const modelMaxOutputTokens = getMaxOutputTokensForModel(effectiveModel);
       if (argv.verbose) {
@@ -682,15 +681,15 @@ export const executeClaudeCommand = async params => {
       if (useClaudeFallbackModel && argv.verbose) await log(`📊 Claude --fallback-model: ${mappedFallbackModel} (Issue #1949 — primary --model ${effectiveModel} stays stable across overload retries)`, { verbose: true });
       if (argv.resume) {
         const simpleEscapedPrompt = promptForAttempt.replace(/"/g, '\\"');
-        execCommand = toolInvocation.formalAi ? $({ cwd: tempDir, mirror: false, env: claudeEnv })`${toolInvocation.command} ${toolInvocation.args} --resume ${argv.resume} --output-format stream-json --verbose --dangerously-skip-permissions --model ${effectiveModel} ${fallbackModelArgs} ${mcpDisableArgs} ${disallowedToolsArgs} -p "${simpleEscapedPrompt}" --append-system-prompt "${simpleEscapedSystem}"` : $({ cwd: tempDir, mirror: false, env: claudeEnv })`${toolInvocation.command} --resume ${argv.resume} --output-format stream-json --verbose --dangerously-skip-permissions --model ${effectiveModel} ${fallbackModelArgs} ${mcpDisableArgs} ${disallowedToolsArgs} -p "${simpleEscapedPrompt}" --append-system-prompt "${simpleEscapedSystem}"`;
+        execCommand = $({ cwd: tempDir, mirror: false, env: claudeEnv })`${toolInvocation.command} --resume ${argv.resume} --output-format stream-json --verbose --dangerously-skip-permissions --model ${effectiveModel} ${fallbackModelArgs} ${mcpDisableArgs} ${disallowedToolsArgs} -p "${simpleEscapedPrompt}" --append-system-prompt "${simpleEscapedSystem}"`;
       } else if (streamingInput) {
         // Issue #817: Drive Claude via --input-format stream-json on a pipe
         // stdin. Initial prompt + later PR comments are written as NDJSON
         // frames by attachStreamingInput (see bidirectional-interactive.lib.mjs).
         const streamingInputArgs = ['-p', '--input-format', 'stream-json'];
-        execCommand = toolInvocation.formalAi ? $({ cwd: tempDir, stdin: 'pipe', mirror: false, env: claudeEnv })`${toolInvocation.command} ${toolInvocation.args} --output-format stream-json --verbose --dangerously-skip-permissions --model ${effectiveModel} ${fallbackModelArgs} ${mcpDisableArgs} ${disallowedToolsArgs} ${streamingInputArgs} --append-system-prompt "${simpleEscapedSystem}"` : $({ cwd: tempDir, stdin: 'pipe', mirror: false, env: claudeEnv })`${toolInvocation.command} --output-format stream-json --verbose --dangerously-skip-permissions --model ${effectiveModel} ${fallbackModelArgs} ${mcpDisableArgs} ${disallowedToolsArgs} ${streamingInputArgs} --append-system-prompt "${simpleEscapedSystem}"`;
+        execCommand = $({ cwd: tempDir, stdin: 'pipe', mirror: false, env: claudeEnv })`${toolInvocation.command} --output-format stream-json --verbose --dangerously-skip-permissions --model ${effectiveModel} ${fallbackModelArgs} ${mcpDisableArgs} ${disallowedToolsArgs} ${streamingInputArgs} --append-system-prompt "${simpleEscapedSystem}"`;
       } else {
-        execCommand = toolInvocation.formalAi ? $({ cwd: tempDir, stdin: promptForAttempt, mirror: false, env: claudeEnv })`${toolInvocation.command} ${toolInvocation.args} --output-format stream-json --verbose --dangerously-skip-permissions --model ${effectiveModel} ${fallbackModelArgs} ${mcpDisableArgs} ${disallowedToolsArgs} --append-system-prompt "${simpleEscapedSystem}"` : $({ cwd: tempDir, stdin: promptForAttempt, mirror: false, env: claudeEnv })`${toolInvocation.command} --output-format stream-json --verbose --dangerously-skip-permissions --model ${effectiveModel} ${fallbackModelArgs} ${mcpDisableArgs} ${disallowedToolsArgs} --append-system-prompt "${simpleEscapedSystem}"`;
+        execCommand = $({ cwd: tempDir, stdin: promptForAttempt, mirror: false, env: claudeEnv })`${toolInvocation.command} --output-format stream-json --verbose --dangerously-skip-permissions --model ${effectiveModel} ${fallbackModelArgs} ${mcpDisableArgs} ${disallowedToolsArgs} --append-system-prompt "${simpleEscapedSystem}"`;
       }
       if (streamingInput) {
         await attachStreamingInput(bidirectionalHandler, execCommand, promptForAttempt, log, !!argv.verbose);

package/src/codex.lib.mjs

@@ -27,12 +27,13 @@ const __codexBuildSolveResumeCmd = (argv, sessionId, tempDir) => (sessionId && a
 import { sanitizeObjectStrings } from './unicode-sanitization.lib.mjs';
 import { createLineBuffer } from './json-stream.lib.mjs'; // Issue #2119
 import { mapModelToId, resolveCodexReasoningEffort } from './codex.options.lib.mjs';
+import { buildCodexRunDiagnostics, codexRunAlreadyFailed, describeCodexLastMessageOutcome } from './codex.run-diagnostics.lib.mjs'; // Issue #2130
 import { createInteractiveHandler } from './interactive-mode.lib.mjs';
 import { initProgressMonitoring } from './solve.progress-monitoring.lib.mjs';
 import { ensureCodexPlaywrightMcpServer, getCodexPlaywrightMcpDisableConfigArgs } from './playwright-mcp.lib.mjs';
 import { fetchModelInfo } from './model-info.lib.mjs';
 import { defaultModels, isFormalAiModel } from './models/index.mjs';
-import { logPreparedToolCommand, resolveFormalAiToolInvocation } from './formal-ai.lib.mjs';
+import { buildAuthRemedyLines, buildFormalAiEnvExports, isPrepareOnly, logPreparedToolCommand, resolveFormalAiToolExecution } from './formal-ai.lib.mjs';
 import { buildFormalAiPricingInfo } from './formal-ai-pricing.lib.mjs'; // Issue #2119
 import { classifyRetryableError, prepareRetryAfterError, waitWithCountdown } from './tool-retry.lib.mjs';
 import { parseSubSessionSize, buildCodexSubSessionSizeConfigArgs, buildCodexDisable1mContextConfigArgs } from './sub-session-size.lib.mjs'; // Issue #1706
@@ -641,7 +642,7 @@ export const validateCodexConnection = async (model = defaultModels.codex, verbo
           const authError = new Error('Codex authentication failed - 401 Unauthorized');
           authError.isAuthError = true;
           await log('❌ Codex authentication failed', { level: 'error' });
-          await log('   💡 Please run: codex login', { level: 'error' });
+          for (const line of buildAuthRemedyLines({ model, vendorRemedy: 'Please run: codex login' })) await log(line, { level: 'error' });
           throw authError;
         }
 
@@ -823,17 +824,17 @@ export const executeCodexCommand = async params => {
 
     let execCommand;
     const mappedModel = mapModelToId(argv.model);
-    const toolInvocation = resolveFormalAiToolInvocation({
-      tool: 'codex',
-      model: argv.model,
-      toolPath: codexPath,
-    });
     const { reasoningEffort, source: reasoningEffortSource, rolloutTokenBudget } = resolveCodexReasoningEffort(argv);
     const isResumeMode = !!argv.resume;
     const codexEnv = applyCodexCapabilityEnv(capabilityPreflight?.codexBaseEnv || getCodexExecEnv(argv.verbose), {
       codexHome: capabilityPreflight?.codexHome,
       baseCodexHome: capabilityPreflight?.baseCodexHome,
     });
+    // Issue #2130: run the native CLI against a local Formal AI server (no argv wrapper); `codexEnv` seeds the isolated CODEX_HOME.
+    const toolInvocation = await resolveFormalAiToolExecution({ tool: 'codex', model: argv.model, toolPath: codexPath, workdir: tempDir, log, verbose: argv.verbose, prepareOnly: isPrepareOnly(argv), env: codexEnv });
+    // Issue #2130: "run codex login" is wrong advice for a Formal-AI-served model.
+    const codexAuthRemedyLines = buildAuthRemedyLines({ model: argv.model, vendorRemedy: 'Please run: codex login' });
+    Object.assign(codexEnv, toolInvocation.env);
 
     // For Codex, we combine system and user prompts into a single message
     // Codex doesn't have separate system prompt support in CLI mode
@@ -901,7 +902,9 @@ export const executeCodexCommand = async params => {
       if (subSessionSizeArgs.length) await log(`📊 Codex --sub-session-size: ${subSessionSizeArgs.join(' ')}`, { verbose: true });
     }
 
-    const fullCommand = `(cd ${shellQuote(tempDir)} && cat ${shellQuote(promptFile)} | ${toolInvocation.displayCommand} ${codexArgs})`;
+    // Issue #2130: re-export the Formal AI environment inside the `sh -lc` script so a
+    // stale `formal-ai with --global` block in the operator profile cannot override it.
+    const fullCommand = `(${buildFormalAiEnvExports(toolInvocation.env)}cd ${shellQuote(tempDir)} && cat ${shellQuote(promptFile)} | ${toolInvocation.displayCommand} ${codexArgs})`;
 
     const preparedResult = await logPreparedToolCommand({ argv, fullCommand, log, formatAligned });
     if (preparedResult) return preparedResult;
@@ -1031,7 +1034,7 @@ export const executeCodexCommand = async params => {
             authError = true;
             await log('\n❌ Authentication error detected in Codex JSON stream', { level: 'error' });
             await log('   This error cannot be resolved by retrying.', { level: 'error' });
-            await log('   💡 Please run: codex login', { level: 'error' });
+            for (const line of codexAuthRemedyLines) await log(line, { level: 'error' });
           }
         }
 
@@ -1066,76 +1069,32 @@ export const executeCodexCommand = async params => {
         authError = true;
         await log('\n❌ Authentication error detected in Codex JSON stream', { level: 'error' });
         await log('   This error cannot be resolved by retrying.', { level: 'error' });
-        await log('   💡 Please run: codex login', { level: 'error' });
+        for (const line of codexAuthRemedyLines) await log(line, { level: 'error' });
       }
 
       if (interactiveHandler) {
         await interactiveHandler.flush();
       }
 
+      // Issue #2130: a failed run legitimately has no final message and no
+      // turn.completed usage, so those outcomes must not be logged as warnings.
+      const runFailed = codexRunAlreadyFailed({ state: codexJsonState, exitCode });
+      let lastMessageFromFile = null;
+      let lastMessageReadError = null;
       try {
-        const lastMessageFromFile = (await fs.readFile(lastMessageFile, 'utf8')).trim();
-        if (lastMessageFromFile) {
-          await log(`📝 Final Codex message captured in ${lastMessageFile}`, { verbose: true });
-          await log(lastMessageFromFile, { verbose: true });
-          lastTextContent = lastTextContent || lastMessageFromFile;
-        } else {
-          await log(`⚠️ Final Codex message file was empty: ${lastMessageFile}`, { level: 'warning', verbose: true });
-        }
+        lastMessageFromFile = (await fs.readFile(lastMessageFile, 'utf8')).trim();
       } catch (readError) {
-        await log(`⚠️ Could not read Codex final message file: ${readError.message}`, { level: 'warning', verbose: true });
-      }
-
-      if (Object.keys(codexJsonState.eventCounts).length > 0) {
-        const eventSummary = Object.entries(codexJsonState.eventCounts)
-          .map(([eventType, count]) => `${eventType}=${count}`)
-          .join(', ');
-        await log(`📊 Codex JSON events: ${eventSummary}`, { verbose: true });
-      }
-      if (Object.keys(codexJsonState.itemTypeCounts).length > 0) {
-        const itemSummary = Object.entries(codexJsonState.itemTypeCounts)
-          .map(([itemType, count]) => `${itemType}=${count}`)
-          .join(', ');
-        await log(`📦 Codex item types: ${itemSummary}`, { verbose: true });
-      }
-      if (codexJsonState.tokenUsage.stepCount > 0) {
-        await log(`📈 Codex usage from turn.completed: ${codexJsonState.tokenUsage.inputTokens.toLocaleString()} input, ${codexJsonState.tokenUsage.cacheReadTokens.toLocaleString()} cache read, ${codexJsonState.tokenUsage.outputTokens.toLocaleString()} output across ${codexJsonState.tokenUsage.stepCount} turn(s)`, { verbose: true });
-      } else {
-        await log('📈 No Codex usage found in turn.completed events', { level: 'warning', verbose: true });
-      }
-      if (codexJsonState.subAgentCalls.length > 0) {
-        await log(`🤝 Codex collab/sub-agent calls observed: ${codexJsonState.subAgentCalls.length}`, { verbose: true });
+        lastMessageReadError = readError;
       }
-      if (codexJsonState.reasoningSummaries.length > 0) {
-        await log(`🧠 Codex reasoning summaries observed: ${codexJsonState.reasoningSummaries.length}`, { verbose: true });
+      const lastMessageOutcome = describeCodexLastMessageOutcome({ lastMessageFile, lastMessage: lastMessageFromFile, readError: lastMessageReadError, runFailed });
+      await log(lastMessageOutcome.message, lastMessageOutcome.options);
+      if (lastMessageFromFile) {
+        await log(lastMessageFromFile, { verbose: true });
+        lastTextContent = lastTextContent || lastMessageFromFile;
       }
-      if (codexJsonState.commandExecutions.length > 0) {
-        await log(`💻 Codex command executions observed: ${codexJsonState.commandExecutions.length}`, { verbose: true });
-      }
-      if (codexJsonState.fileChanges.length > 0) {
-        await log(`📝 Codex file change items observed: ${codexJsonState.fileChanges.length}`, { verbose: true });
-      }
-      if (codexJsonState.mcpToolCalls.length > 0) {
-        await log(`🔌 Codex MCP tool calls observed: ${codexJsonState.mcpToolCalls.length}`, { verbose: true });
-      }
-      if (codexJsonState.webSearches.length > 0) {
-        await log(`🌐 Codex web searches observed: ${codexJsonState.webSearches.length}`, { verbose: true });
-      }
-      if (codexJsonState.todoLists.length > 0) {
-        const latestTodoCount = codexJsonState.todoLists.at(-1)?.items?.length || 0;
-        await log(`📋 Codex todo list updates observed: ${codexJsonState.todoLists.length} (latest: ${latestTodoCount} items)`, { verbose: true });
-      }
-      if (codexJsonState.itemErrors.length > 0 || codexJsonState.turnFailures.length > 0 || codexJsonState.streamErrors.length > 0) {
-        await log(`⚠️ Codex error events observed: item=${codexJsonState.itemErrors.length}, turn=${codexJsonState.turnFailures.length}, stream=${codexJsonState.streamErrors.length}`, { verbose: true });
-      }
-      if (codexJsonState.observedUsageFieldSets.length > 0) {
-        const lastUsageFieldSet = codexJsonState.observedUsageFieldSets.at(-1);
-        await log(`📐 Codex usage fields observed: ${lastUsageFieldSet.join(', ')}`, { verbose: true });
-      }
-      if (codexJsonState.observedModelDiagnosticPaths.length > 0) {
-        await log(`🔎 Undocumented model-related JSON fields observed but ignored for accounting: ${codexJsonState.observedModelDiagnosticPaths.join(', ')}`, { verbose: true });
-      } else {
-        await log(`🤖 Codex exec JSON did not expose model IDs; using requested model for reporting: ${mappedModel}`, { verbose: true });
+
+      for (const line of buildCodexRunDiagnostics({ state: codexJsonState, exitCode, mappedModel })) {
+        await log(line.message, line.options);
       }
 
       const baseBranchIntervention = baseBranchCommandIntervention.getIntervention();
@@ -1195,7 +1154,7 @@ export const executeCodexCommand = async params => {
         await logCodexResourceSnapshot({ getResourceSnapshot, log });
 
         // Throw an error to stop retries and propagate the auth failure
-        const error = new Error('Codex authentication failed - 401 Unauthorized. Please run: codex login');
+        const error = new Error(`Codex authentication failed - 401 Unauthorized.${codexAuthRemedyLines.map(line => ` ${line.replace(/^\s*💡\s*/, '')}`).join('')}`);
         error.isAuthError = true;
         throw error;
       }

package/src/codex.run-diagnostics.lib.mjs

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+
+/**
+ * Post-run diagnostics for a `codex exec --json` stream (issue #2130).
+ *
+ * Split out of codex.lib.mjs to keep that file under the max-lines budget, and
+ * kept pure so the "is this line a real warning?" decisions are unit-testable.
+ *
+ * The motivating defect: when a run already failed (`turn.failed`, non-zero
+ * exit), Codex never writes the `--output-last-message` file and never emits a
+ * `turn.completed` usage block. Hive Mind reported both of those *expected*
+ * consequences as WARNINGs, so the log for a single upstream failure carried two
+ * extra warnings that pointed at nothing actionable:
+ *
+ *   [WARNING] ⚠️ Could not read Codex final message file: ENOENT: no such file …
+ *   [WARNING] 📈 No Codex usage found in turn.completed events
+ *
+ * See docs/case-studies/issue-2130 (data/tool-logs/codex-02-rv2k7W.log.gz:752).
+ */
+
+/**
+ * Did this Codex run already report a failure of its own?
+ *
+ * @param {object} params
+ * @param {object} [params.state] - accumulated parseCodexExecJsonOutput state.
+ * @param {number|null} [params.exitCode] - the CLI exit code, if known.
+ * @returns {boolean}
+ */
+export const codexRunAlreadyFailed = ({ state = {}, exitCode = null } = {}) => {
+  if (typeof exitCode === 'number' && exitCode !== 0) return true;
+  if (state.authError) return true;
+  return !!(state.turnFailures?.length || state.itemErrors?.length || state.streamErrors?.length);
+};
+
+const isMissingFileError = error => error?.code === 'ENOENT' || /ENOENT/.test(error?.message || '');
+
+/**
+ * Describe the `--output-last-message` file outcome.
+ *
+ * @param {object} params
+ * @param {string} params.lastMessageFile - the path Codex was asked to write.
+ * @param {string|null} [params.lastMessage] - trimmed contents, when readable.
+ * @param {Error|null} [params.readError] - the read failure, when unreadable.
+ * @param {boolean} [params.runFailed] - result of codexRunAlreadyFailed.
+ * @returns {{message: string, options: object}} a single log line.
+ */
+export const describeCodexLastMessageOutcome = ({ lastMessageFile, lastMessage = null, readError = null, runFailed = false }) => {
+  if (readError) {
+    // A failed run never gets far enough to write the file; saying so at
+    // warning level invents a second problem on top of the reported one.
+    if (isMissingFileError(readError) && runFailed) {
+      return { message: '📝 Codex wrote no final message file (the run ended with an error)', options: { verbose: true } };
+    }
+    return { message: `⚠️ Could not read Codex final message file: ${readError.message}`, options: { level: 'warning', verbose: true } };
+  }
+
+  if (lastMessage) {
+    return { message: `📝 Final Codex message captured in ${lastMessageFile}`, options: { verbose: true } };
+  }
+
+  if (runFailed) {
+    return { message: '📝 Codex left the final message file empty (the run ended with an error)', options: { verbose: true } };
+  }
+  return { message: `⚠️ Final Codex message file was empty: ${lastMessageFile}`, options: { level: 'warning', verbose: true } };
+};
+
+/**
+ * Build every verbose diagnostic line for a finished Codex run.
+ *
+ * @param {object} params
+ * @param {object} params.state - accumulated parseCodexExecJsonOutput state.
+ * @param {number|null} [params.exitCode] - the CLI exit code, if known.
+ * @param {string} params.mappedModel - the model id used for reporting.
+ * @returns {Array<{message: string, options: object}>} lines in log order.
+ */
+export const buildCodexRunDiagnostics = ({ state = {}, exitCode = null, mappedModel = null } = {}) => {
+  const runFailed = codexRunAlreadyFailed({ state, exitCode });
+  const lines = [];
+  const push = (message, options = { verbose: true }) => lines.push({ message, options });
+
+  const counts = pairs =>
+    Object.entries(pairs || {})
+      .map(([key, count]) => `${key}=${count}`)
+      .join(', ');
+
+  if (Object.keys(state.eventCounts || {}).length > 0) push(`📊 Codex JSON events: ${counts(state.eventCounts)}`);
+  if (Object.keys(state.itemTypeCounts || {}).length > 0) push(`📦 Codex item types: ${counts(state.itemTypeCounts)}`);
+
+  const usage = state.tokenUsage || {};
+  if (usage.stepCount > 0) {
+    push(`📈 Codex usage from turn.completed: ${usage.inputTokens.toLocaleString()} input, ${usage.cacheReadTokens.toLocaleString()} cache read, ${usage.outputTokens.toLocaleString()} output across ${usage.stepCount} turn(s)`);
+  } else if (runFailed) {
+    // No `turn.completed` is the definition of a failed turn, not a second fault.
+    push('📈 Codex reported no usage (the turn never completed)');
+  } else {
+    push('📈 No Codex usage found in turn.completed events', { level: 'warning', verbose: true });
+  }
+
+  if (state.subAgentCalls?.length > 0) push(`🤝 Codex collab/sub-agent calls observed: ${state.subAgentCalls.length}`);
+  if (state.reasoningSummaries?.length > 0) push(`🧠 Codex reasoning summaries observed: ${state.reasoningSummaries.length}`);
+  if (state.commandExecutions?.length > 0) push(`💻 Codex command executions observed: ${state.commandExecutions.length}`);
+  if (state.fileChanges?.length > 0) push(`📝 Codex file change items observed: ${state.fileChanges.length}`);
+  if (state.mcpToolCalls?.length > 0) push(`🔌 Codex MCP tool calls observed: ${state.mcpToolCalls.length}`);
+  if (state.webSearches?.length > 0) push(`🌐 Codex web searches observed: ${state.webSearches.length}`);
+  if (state.todoLists?.length > 0) push(`📋 Codex todo list updates observed: ${state.todoLists.length} (latest: ${state.todoLists.at(-1)?.items?.length || 0} items)`);
+  if (state.itemErrors?.length || state.turnFailures?.length || state.streamErrors?.length) {
+    push(`⚠️ Codex error events observed: item=${state.itemErrors?.length || 0}, turn=${state.turnFailures?.length || 0}, stream=${state.streamErrors?.length || 0}`);
+  }
+  if (state.observedUsageFieldSets?.length > 0) push(`📐 Codex usage fields observed: ${state.observedUsageFieldSets.at(-1).join(', ')}`);
+  if (state.observedModelDiagnosticPaths?.length > 0) {
+    push(`🔎 Undocumented model-related JSON fields observed but ignored for accounting: ${state.observedModelDiagnosticPaths.join(', ')}`);
+  } else {
+    push(`🤖 Codex exec JSON did not expose model IDs; using requested model for reporting: ${mappedModel}`);
+  }
+
+  return lines;
+};