@link-assistant/hive-mind 2.12.4 → 2.13.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @link-assistant/hive-mind
 
+## 2.13.0
+
+### Minor Changes
+
+- aaf809a: Recognize subscription/account access blocks from every supported CLI (Claude, Codex, Qwen, Gemini, opencode) as their own error class: stop the run instead of retrying or switching model, auto-commit and push the in-flight work first, report what happened and what to do in the terminal, in the `/solve` exit message and in the Telegram completion message (en/ru/zh/hi), and stop the `/hive` queue so the fleet no longer rediscovers the block once per issue.
+
+## 2.12.5
+
+### Patch Changes
+
+- 77ed9bc: Keep Formal AI repository requests bounded, target the discovered pull request URL, and stop retrying explicit `planned_not_executed` results as successful work.
+
 ## 2.12.4
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "2.12.4",
+  "version": "2.13.0",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",

package/src/agent.prompts.lib.mjs

@@ -9,6 +9,8 @@ import { getThinkingPromptInstruction } from './thinking-prompt.lib.mjs';
 import { buildWorkLanguageDirective } from './work-language.prompts.lib.mjs';
 import { buildRequestedBaseBranchDirective } from './solve-option-contract.prompts.lib.mjs';
 import { buildIssueResearchPrompt } from './deep-analysis.lib.mjs';
+import { buildFormalAiRepositoryPrompt } from './formal-ai-prompt.lib.mjs';
+import { isFormalAiModel } from './formal-ai-model.lib.mjs';
 
 /**
  * Build the user prompt for Agent
@@ -16,6 +18,9 @@ import { buildIssueResearchPrompt } from './deep-analysis.lib.mjs';
  * @returns {string} The formatted user prompt
  */
 export const buildUserPrompt = params => {
+  const formalAiPrompt = buildFormalAiRepositoryPrompt(params);
+  if (formalAiPrompt !== null) return formalAiPrompt;
+
   const { issueUrl, issueNumber, prNumber, prUrl, branchName, tempDir, workspaceTmpDir, isContinueMode, forkedRepo, feedbackLines, forkActionsUrl, owner, repo, argv } = params;
 
   const promptLines = [];
@@ -92,6 +97,13 @@ export const buildUserPrompt = params => {
 export const buildSystemPrompt = params => {
   const { owner, repo, issueNumber, prNumber, branchName, workspaceTmpDir, argv, modelSupportsVision, forkedRepo } = params;
 
+  // Issue #2158: Formal AI's deterministic intent router considers the whole
+  // provider request, including this caller-owned workflow prompt. Command
+  // examples such as `sudo` and `pwd` were consequently executed as if the
+  // issue requested them. The compact user prompt remains the repository
+  // objective; Formal AI supplies its own execution policy.
+  if (isFormalAiModel(argv?.model)) return '';
+
   // When in fork mode, screenshots are pushed to the fork, not the original repo
   const screenshotRepoPath = argv?.fork && forkedRepo ? forkedRepo : `${owner}/${repo}`;
 

package/src/claude.lib.mjs

@@ -9,6 +9,7 @@ import { isENOSPC, buildToolErrorMessage } from './lib.mjs';
 import { reportError } from './sentry.lib.mjs';
 import { timeouts, retryLimits, claudeCode, getClaudeEnv, getMaxOutputTokensForModel } from './config.lib.mjs';
 import { detectUsageLimit, formatUsageLimitMessage, isUsageLimitError } from './usage-limit.lib.mjs';
+import { detectSubscriptionError, SUBSCRIPTION_BLOCKED_MARKER } from './subscription-error.lib.mjs'; // Issue #2161
 import { createInteractiveHandler } from './interactive-mode.lib.mjs';
 import { setupBidirectionalHandler, finalizeBidirectionalHandler, validateBidirectionalModeConfig, attachStreamingInput } from './bidirectional-interactive.lib.mjs';
 import { initProgressMonitoring } from './solve.progress-monitoring.lib.mjs';
@@ -376,6 +377,10 @@ export const executeClaudeCommand = async params => {
     let isInternalServerError = false;
     let isRequestTimeout = false;
     let isRateLimitError = false; // Issue #1924: server-side 429 temporary rate limiting
+    // Issue #2161: account/subscription-level block (e.g. oauth_org_not_allowed).
+    // Terminal — never retried, never model-switched; carried out to the caller
+    // so /solve can stop with a specific diagnosis instead of a generic failure.
+    let subscriptionError = null;
     let apiMarkedNotRetryable = false;
     let resultNumTurns = 0;
     let stderrErrors = [];
@@ -731,6 +736,24 @@ export const executeClaudeCommand = async params => {
                     isRateLimitError = true;
                     await log(`⚠️ Detected server-side rate limiting (429) from Claude CLI (will retry with --resume). request_id=${data.request_id || 'unknown'}`, { verbose: true });
                   }
+                  // Issue #2161: account/subscription block. `data.error` carries the
+                  // machine-readable code ("oauth_org_not_allowed" for the reported
+                  // case) alongside api_error_status 403 — a far stronger signal than
+                  // the rendered sentence, so it is passed to the detector first.
+                  if (!subscriptionError) {
+                    subscriptionError = detectSubscriptionError({
+                      message: lastMessage,
+                      tool: 'claude',
+                      errorCode: typeof data.error === 'string' ? data.error : null,
+                      apiErrorStatus: data.api_error_status,
+                      terminalReason: data.terminal_reason,
+                    });
+                    if (subscriptionError) {
+                      // Not verbose: this is the reason the whole run is about to end.
+                      await log(`${SUBSCRIPTION_BLOCKED_MARKER} — ${subscriptionError.label}`);
+                      await log(`   code=${subscriptionError.code || 'n/a'} http=${data.api_error_status || 'n/a'} terminal_reason=${data.terminal_reason || 'n/a'} request_id=${data.request_id || 'unknown'}`, { verbose: true });
+                    }
+                  }
                   // Issue #1834: Detect corrupted extended-thinking-block 400 (un-resumable session).
                   // Capture diagnostics (request id, content path) to aid debugging and upstream reports.
                   if ((lastMessage.includes('thinking') || lastMessage.includes('redacted_thinking')) && lastMessage.includes('cannot be modified')) {
@@ -765,6 +788,26 @@ export const executeClaudeCommand = async params => {
                   await log(`🤖 Sub-agent "${callEntry.description || 'unknown'}" completed: ${data.usage.total_tokens} total tokens`, { verbose: true });
                 }
               }
+              // Issue #2161: Claude Code injects API failures as synthetic assistant
+              // messages flagged `is_api_error_message` and carrying the error code.
+              // In the reported run this arrived ~40s before the terminal result
+              // event, so detecting it here surfaces the diagnosis earlier.
+              if (data.type === 'assistant' && data.is_api_error_message === true && !subscriptionError) {
+                const apiErrorText = getClaudeMessageContent(data)
+                  .filter(item => item.type === 'text' && item.text)
+                  .map(item => item.text)
+                  .join('\n');
+                subscriptionError = detectSubscriptionError({
+                  message: apiErrorText,
+                  tool: 'claude',
+                  errorCode: typeof data.error === 'string' ? data.error : null,
+                });
+                if (subscriptionError) {
+                  if (apiErrorText) lastMessage = apiErrorText;
+                  await log(`${SUBSCRIPTION_BLOCKED_MARKER} — ${subscriptionError.label}`);
+                  await log(`   code=${subscriptionError.code || 'n/a'} request_id=${data.request_id || 'unknown'} uuid=${data.uuid || 'unknown'}`, { verbose: true });
+                }
+              }
               if (data.type === 'assistant' && data.message && data.message.content) {
                 const content = getClaudeMessageContent(data);
                 for (const item of content) {
@@ -977,7 +1020,12 @@ export const executeClaudeCommand = async params => {
       }
       // Issues #1331, #1353, #1472/#1475: Unified transient error retry (exponential backoff, session preservation)
       const isTransientError = isStartupTimeout || isActivityTimeout || isOverloadError || isInternalServerError || is503Error || isRequestTimeout || isRateLimitError || retryableLastError.isRetryable || (lastMessage.includes('API Error: 500') && (lastMessage.includes('Overloaded') || lastMessage.includes('Internal server error'))) || (lastMessage.includes('API Error: 529') && (lastMessage.includes('overloaded_error') || lastMessage.includes('Overloaded'))) || (lastMessage.includes('api_error') && lastMessage.includes('Overloaded')) || (lastMessage.includes('overloaded_error') && lastMessage.includes('Overloaded')) || lastMessage.includes('API Error: 503') || (lastMessage.includes('503') && (lastMessage.includes('upstream connect error') || lastMessage.includes('remote connection failure'))) || lastMessage === 'Request timed out' || lastMessage.includes('Request timed out');
-      if ((commandFailed || isTransientError) && isTransientError) {
+      // Issue #2161: an account/subscription block short-circuits every retry
+      // path. Stale transient flags from earlier in the run (an overload at hour
+      // one, say) must not schedule a retry that is guaranteed to fail the same
+      // way — and each retry would burn another full startup against a provider
+      // that has already refused the credentials.
+      if ((commandFailed || isTransientError) && isTransientError && !subscriptionError) {
         // Issue #1472/#1475: Startup/activity timeout → 30s–2min backoff; #1353: Request timeout → 5min–1hr; general → 2min–30min
         const isTimeoutRetry = isStartupTimeout || isActivityTimeout;
         const maxRetries = isTimeoutRetry ? retryLimits.maxTransientErrorRetries : isRequestTimeout ? retryLimits.maxRequestTimeoutRetries : retryLimits.maxTransientErrorRetries;
@@ -1005,6 +1053,7 @@ export const executeClaudeCommand = async params => {
             resultSummary,
             // Issue #1845/#1941: surface the actual error, rejecting meaningless fragments (e.g. a lone "}")
             errorInfo: { message: buildToolErrorMessage({ lastMessage, exitCode, fallback: 'API explicitly marked error as not retryable', toolLabel: 'Claude' }), exitCode },
+            subscriptionError, // Issue #2161
             queuedFeedback, // Issue #817: Bidirectional mode feedback
           };
         }
@@ -1055,6 +1104,7 @@ export const executeClaudeCommand = async params => {
             resultSummary, // Issue #1263: Include result summary
             // Issue #1845/#1941: surface the actual error, rejecting meaningless fragments (e.g. a lone "}")
             errorInfo: { message: buildToolErrorMessage({ lastMessage, exitCode, fallback: `Transient API error persisted after ${maxRetries} retries`, toolLabel: 'Claude' }), exitCode },
+            subscriptionError, // Issue #2161
             queuedFeedback, // Issue #817: Bidirectional mode feedback
           };
         }
@@ -1123,6 +1173,7 @@ export const executeClaudeCommand = async params => {
           // Issue #1845: surface the core error (e.g. "API Error: Output blocked by content filtering policy").
           // Issue #1941: a lone "}" fragment at interrupt time must not become "CLAUDE execution failed with }".
           errorInfo: { message: buildToolErrorMessage({ lastMessage, exitCode, fallback: `Claude command failed with exit code ${exitCode}`, toolLabel: 'Claude' }), exitCode },
+          subscriptionError, // Issue #2161: terminal account block — /solve stops and preserves the work
           queuedFeedback, // Issue #817: Bidirectional mode feedback
         };
       }

package/src/claude.prompts.lib.mjs

@@ -11,6 +11,8 @@ import { getThinkingPromptInstruction } from './thinking-prompt.lib.mjs';
 import { buildWorkLanguageDirective } from './work-language.prompts.lib.mjs';
 import { buildRequestedBaseBranchDirective } from './solve-option-contract.prompts.lib.mjs';
 import { buildIssueResearchPrompt } from './deep-analysis.lib.mjs';
+import { buildFormalAiRepositoryPrompt } from './formal-ai-prompt.lib.mjs';
+import { isFormalAiModel } from './formal-ai-model.lib.mjs';
 
 /**
  * Build the user prompt for Claude
@@ -18,6 +20,9 @@ import { buildIssueResearchPrompt } from './deep-analysis.lib.mjs';
  * @returns {string} The formatted user prompt
  */
 export const buildUserPrompt = params => {
+  const formalAiPrompt = buildFormalAiRepositoryPrompt(params);
+  if (formalAiPrompt !== null) return formalAiPrompt;
+
   const { issueUrl, issueNumber, prNumber, prUrl, branchName, tempDir, workspaceTmpDir, isContinueMode, forkedRepo, feedbackLines, owner, repo, argv, contributingGuidelines, claudeVersion } = params;
 
   if (argv?.minimalRestartContext && argv.resume) {
@@ -105,6 +110,10 @@ export const buildUserPrompt = params => {
 export const buildSystemPrompt = params => {
   const { owner, repo, issueNumber, prNumber, branchName, workspaceTmpDir, argv, modelSupportsVision, forkedRepo } = params;
 
+  // Issue #2158: keep caller workflow instructions out of Formal AI's task
+  // classifier. Formal AI provides its own execution policy.
+  if (isFormalAiModel(argv?.model)) return '';
+
   if (argv?.minimalRestartContext && argv.resume) {
     return '';
   }

package/src/codex.prompts.lib.mjs

@@ -10,6 +10,8 @@ import { getThinkingPromptInstruction } from './thinking-prompt.lib.mjs';
 import { buildWorkLanguageDirective } from './work-language.prompts.lib.mjs';
 import { buildRequestedBaseBranchDirective } from './solve-option-contract.prompts.lib.mjs';
 import { buildIssueResearchPrompt } from './deep-analysis.lib.mjs';
+import { buildFormalAiRepositoryPrompt } from './formal-ai-prompt.lib.mjs';
+import { isFormalAiModel } from './formal-ai-model.lib.mjs';
 
 /**
  * Build the user prompt for Codex
@@ -17,6 +19,9 @@ import { buildIssueResearchPrompt } from './deep-analysis.lib.mjs';
  * @returns {string} The formatted user prompt
  */
 export const buildUserPrompt = params => {
+  const formalAiPrompt = buildFormalAiRepositoryPrompt(params);
+  if (formalAiPrompt !== null) return formalAiPrompt;
+
   const { issueUrl, issueNumber, prNumber, prUrl, branchName, tempDir, workspaceTmpDir, isContinueMode, forkedRepo, feedbackLines, forkActionsUrl, owner, repo, argv } = params;
 
   const promptLines = [];
@@ -93,6 +98,10 @@ export const buildUserPrompt = params => {
 export const buildSystemPrompt = params => {
   const { owner, repo, issueNumber, prNumber, branchName, workspaceTmpDir, argv, modelSupportsVision, forkedRepo } = params;
 
+  // Issue #2158: keep caller workflow instructions out of Formal AI's task
+  // classifier. Formal AI provides its own execution policy.
+  if (isFormalAiModel(argv?.model)) return '';
+
   // When in fork mode, screenshots are pushed to the fork, not the original repo
   const screenshotRepoPath = argv?.fork && forkedRepo ? forkedRepo : `${owner}/${repo}`;
 

package/src/formal-ai-prompt.lib.mjs

@@ -0,0 +1,29 @@
+/**
+ * Build the small repository objective sent through native CLIs to Formal AI.
+ *
+ * Formal AI owns the agent policy for its model. Repeating Hive Mind's native
+ * provider policy in the request both wastes context and exposes incidental
+ * shell-language cues to Formal AI's deterministic intent router (#2158).
+ */
+
+import { isFormalAiModel } from './formal-ai-model.lib.mjs';
+
+export const buildFormalAiRepositoryPrompt = params => {
+  if (!isFormalAiModel(params?.argv?.model)) return null;
+
+  const { issueUrl, issueNumber, prNumber, prUrl, branchName, isContinueMode, feedbackLines, owner, repo } = params;
+  const issueReference = isContinueMode && issueNumber && owner && repo ? `https://github.com/${owner}/${repo}/issues/${issueNumber}` : issueUrl || `the issue linked to pull request ${prNumber}`;
+  const lines = [`Resolve the GitHub issue at ${issueReference} in this repository.`];
+
+  if (branchName) lines.push(`Keep the solution on branch ${branchName}.`);
+  if (prUrl) lines.push(`Update the pull request at ${prUrl}.`);
+  // The review text is caller-controlled and can contain command snippets.
+  // Point Formal AI to the canonical PR instead of copying those snippets into
+  // the intent-classification request.
+  if (feedbackLines?.length && prUrl) lines.push('Review and address all feedback recorded on that pull request.');
+
+  lines.push('', 'Implement and verify the solution before reporting completion.', isContinueMode ? 'Continue.' : 'Proceed.');
+  return `${lines.join('\n')}\n`;
+};
+
+export default { buildFormalAiRepositoryPrompt };

package/src/formal-ai.lib.mjs

@@ -217,6 +217,36 @@ export const createPreparedToolResult = preparedCommand => ({
   errorDuringExecution: false,
 });
 
+const FORMAL_AI_NON_EXECUTION_PATTERNS = [/^\s*planned,\s*not executed\b/im, /^\s*planned_not_executed\s*$/im, /^\s*terminal_state\s+["']?planned_not_executed\b/im];
+
+/**
+ * Turn Formal AI's explicit non-execution terminal state into a failed tool
+ * result (issue #2158).
+ *
+ * Formal AI 0.339.1 truthfully reports repository work as
+ * `planned_not_executed`, but each native CLI exits zero. Treating that process
+ * exit as a successful solve made `--auto-restart-until-mergeable` repeat the
+ * same deterministic plan five times. Keep the model's summary for evidence,
+ * while giving Hive Mind an actionable terminal failure.
+ */
+export const classifyFormalAiToolResult = ({ model, toolResult } = {}) => {
+  if (!toolResult || !isFormalAiModel(model) || toolResult.success === false) return toolResult;
+
+  const evidence = [toolResult.resultSummary, toolResult.result, toolResult.lastMessage, toolResult.output].filter(value => typeof value === 'string').join('\n');
+  if (!FORMAL_AI_NON_EXECUTION_PATTERNS.some(pattern => pattern.test(evidence))) return toolResult;
+
+  return {
+    ...toolResult,
+    success: false,
+    errorDuringExecution: true,
+    formalAiNonExecution: true,
+    errorInfo: {
+      code: 'FORMAL_AI_PLANNED_NOT_EXECUTED',
+      message: "Formal AI did not execute repository work; it returned the terminal state planned_not_executed. Fix or upgrade Formal AI's repository-work executor before retrying.",
+    },
+  };
+};
+
 export const logPreparedToolCommand = async ({ argv, fullCommand, log, formatAligned }) => {
   await log(`\n${formatAligned('📝', 'Raw command:', '')}`);
   await log(fullCommand);

package/src/gemini.prompts.lib.mjs

@@ -9,6 +9,8 @@ import { getThinkingPromptInstruction } from './thinking-prompt.lib.mjs';
 import { buildWorkLanguageDirective } from './work-language.prompts.lib.mjs';
 import { buildRequestedBaseBranchDirective } from './solve-option-contract.prompts.lib.mjs';
 import { buildIssueResearchPrompt } from './deep-analysis.lib.mjs';
+import { buildFormalAiRepositoryPrompt } from './formal-ai-prompt.lib.mjs';
+import { isFormalAiModel } from './formal-ai-model.lib.mjs';
 
 /**
  * Build the user prompt for Gemini
@@ -16,6 +18,9 @@ import { buildIssueResearchPrompt } from './deep-analysis.lib.mjs';
  * @returns {string} The formatted user prompt
  */
 export const buildUserPrompt = params => {
+  const formalAiPrompt = buildFormalAiRepositoryPrompt(params);
+  if (formalAiPrompt !== null) return formalAiPrompt;
+
   const { issueUrl, issueNumber, prNumber, prUrl, branchName, tempDir, workspaceTmpDir, isContinueMode, forkedRepo, feedbackLines, forkActionsUrl, owner, repo, argv } = params;
 
   const promptLines = [];
@@ -81,6 +86,10 @@ export const buildUserPrompt = params => {
 export const buildSystemPrompt = params => {
   const { owner, repo, issueNumber, prNumber, branchName, workspaceTmpDir, argv, modelSupportsVision, forkedRepo } = params;
 
+  // Issue #2158: keep caller workflow instructions out of Formal AI's task
+  // classifier. Formal AI provides its own execution policy.
+  if (isFormalAiModel(argv?.model)) return '';
+
   const screenshotRepoPath = argv?.fork && forkedRepo ? forkedRepo : `${owner}/${repo}`;
 
   let workspaceInstructions = '';

package/src/github-url-parser.lib.mjs

@@ -241,6 +241,14 @@ export function normalizeGitHubUrl(url) {
   const parsed = parseGitHubUrl(url);
   return parsed.valid ? parsed.normalized : null;
 }
+
+/** Build the canonical web URL for a pull request already identified by GitHub. */
+export function buildGitHubPullRequestUrl({ owner, repo, number } = {}) {
+  if (!owner || !repo || !Number.isInteger(Number(number)) || Number(number) <= 0) {
+    throw new TypeError('A GitHub pull request URL requires owner, repo, and a positive integer number');
+  }
+  return `https://github.com/${owner}/${repo}/pull/${Number(number)}`;
+}
 /**
  * Check if a URL is a valid GitHub URL of a specific type
  * @param {string} url - The URL to check

package/src/github.lib.mjs

@@ -20,8 +20,8 @@ export { buildCostInfoString };
 // #1756: route gh exec calls through transient + rate-limit retry wrapper
 import { execGhWithRetry } from './github-rate-limit.lib.mjs';
 import { QUIET_PROBE } from './quiet-probe.lib.mjs'; // issues #2130, #2135: keep read-only probe payloads out of the attached log
-import { isGitHubUrlType, normalizeGitHubUrl, parseGitHubUrl } from './github-url-parser.lib.mjs';
-export { isGitHubUrlType, normalizeGitHubUrl, parseGitHubUrl };
+import { buildGitHubPullRequestUrl, isGitHubUrlType, normalizeGitHubUrl, parseGitHubUrl } from './github-url-parser.lib.mjs';
+export { buildGitHubPullRequestUrl, isGitHubUrlType, normalizeGitHubUrl, parseGitHubUrl };
 // Issue #1625: Named marker constants (single source of truth) + in-memory tracking for tool-posted comments. See tool-comments.lib.mjs for design.
 import { SOLUTION_DRAFT_LOG_MARKER, SOLUTION_DRAFT_FAILED_MARKER, SOLUTION_DRAFT_FINISHED_WITH_ERRORS_MARKER, USAGE_LIMIT_REACHED_MARKER, NOW_WORKING_SESSION_IS_ENDED_MARKER, postTrackedComment, postTrackedCommentFromFile } from './tool-comments.lib.mjs';
 export const maskGitHubToken = maskToken; // Alias for backward compatibility
@@ -1168,6 +1168,7 @@ export default {
   fetchProjectIssues,
   isRateLimitError,
   batchCheckPullRequestsForIssues,
+  buildGitHubPullRequestUrl,
   parseGitHubUrl,
   normalizeGitHubUrl,
   isGitHubUrlType,

package/src/hive.mjs

@@ -36,6 +36,7 @@ if (earlyArgs.includes('--help') || earlyArgs.includes('-h')) {
 }
 export { createYargsConfig } from './hive.config.lib.mjs';
 import { attachChildExitHandlers } from './child-exit.lib.mjs';
+import { SUBSCRIPTION_BLOCKED_MARKER } from './subscription-error.lib.mjs'; // Issue #2161
 import { isDirectExecution, withTimeout } from './hive.bootstrap.lib.mjs';
 import { createShutdownManager } from './hive.shutdown.lib.mjs';
 const isRunningDirectly = isDirectExecution(process.argv[1], import.meta.url);
@@ -653,6 +654,22 @@ if (isRunningDirectly) {
     // controlled SIGTERM to each (they run in their own detached process group, so the
     // terminal's SIGINT never reaches them); a *second* interrupt force-kills the groups.
     const activeSolveChildren = new Set();
+    // Issue #2161: an account/subscription block is hive-wide, not per-issue. The
+    // credentials every worker shares have been refused, so each remaining issue
+    // would spin up a full solve run only to die the same way — burning clones,
+    // containers and PR comments while the queue drains into "failed". The first
+    // worker to see the marker in its child's output records it here and stops the
+    // queue; the rest exit as soon as their current child returns.
+    let subscriptionBlock = null;
+    const noteSubscriptionBlock = (workerId, line) => {
+      if (subscriptionBlock) return;
+      subscriptionBlock = { workerId, line: line.trim() };
+      log(`\n${SUBSCRIPTION_BLOCKED_MARKER} — worker ${workerId} reported that the account can no longer use the tool:`, { level: 'error' }).catch(() => {});
+      log(`   ${subscriptionBlock.line}`, { level: 'error' }).catch(() => {});
+      log('   Stopping the hive: every remaining issue would fail the same way until access is restored.', { level: 'error' }).catch(() => {});
+      log('   In-flight workers finish (and auto-commit their work) before the run ends.', { level: 'error' }).catch(() => {});
+      issueQueue.stop();
+    };
     // Worker function to process issues from queue
     async function worker(workerId) {
       await log(`🔧 Worker ${workerId} started`, { verbose: true });
@@ -758,6 +775,9 @@ if (isRunningDirectly) {
                 const lines = data.toString().split('\n');
                 for (const line of lines) {
                   if (line.trim()) {
+                    // Issue #2161: solve prints SUBSCRIPTION_BLOCKED_MARKER on a terminal
+                    // account block. Seen here, it stops the whole hive (see noteSubscriptionBlock).
+                    if (line.includes(SUBSCRIPTION_BLOCKED_MARKER)) noteSubscriptionBlock(workerId, line);
                     log(`   [${solveCommand} worker-${workerId}] ${line}`).catch(logError => {
                       reportError(logError, {
                         context: 'worker_stdout_log',
@@ -777,6 +797,7 @@ if (isRunningDirectly) {
                 const lines = data.toString().split('\n');
                 for (const line of lines) {
                   if (line.trim()) {
+                    if (line.includes(SUBSCRIPTION_BLOCKED_MARKER)) noteSubscriptionBlock(workerId, line); // Issue #2161
                     log(`   [${solveCommand} worker-${workerId} stderr] ${line}`).catch(logError => {
                       reportError(logError, {
                         context: 'worker_stderr_log',
@@ -813,6 +834,14 @@ if (isRunningDirectly) {
               await log(`   🛑 Worker ${workerId} stopped gracefully during shutdown on ${issueUrl} (exit ${exitCode}, ${duration}s)`);
               gracefulStop = true;
               break; // stop processing more PRs for this issue
+            } else if (subscriptionBlock) {
+              // Issue #2161: the run did not fail because of this issue — the account
+              // lost access mid-flight. Report the real reason and stop; solve has
+              // already auto-committed whatever work existed.
+              await log(`   ${SUBSCRIPTION_BLOCKED_MARKER} Worker ${workerId} stopped on ${issueUrl} after ${duration}s: the tool account can no longer be used (exit ${exitCode}).`, { level: 'error' });
+              await log(`   Restore access, then re-run the hive — this issue stays queued, not failed.`, { level: 'error' });
+              gracefulStop = true;
+              break;
             } else {
               throw new Error(`${solveCommand} exited with code ${exitCode}`);
             }
@@ -1260,6 +1289,16 @@ if (isRunningDirectly) {
       }
       await log('\n👋 Hive Mind monitoring stopped');
       await log(`   📁 Full log file: ${absoluteLogPath}`);
+      // Issue #2161: the hive did not simply "finish" — it was cut short because the
+      // account lost access. Say so last (that is what a human scrolls to) and exit
+      // non-zero so supervisors and the Telegram monitor report a failure, not a
+      // clean completion.
+      if (subscriptionBlock) {
+        await log(`\n${SUBSCRIPTION_BLOCKED_MARKER} Hive stopped early: the tool account can no longer be used.`, { level: 'error' });
+        await log(`   Reported by worker ${subscriptionBlock.workerId}: ${subscriptionBlock.line}`, { level: 'error' });
+        await log('   Restore subscription/account access, then start the hive again.', { level: 'error' });
+        await safeExit(1, 'Subscription/account access blocked');
+      }
     }
     // Issue #1823: Graceful-shutdown + force-kill logic lives in hive.shutdown.lib.mjs.
     // gracefulShutdown waits (uncapped) for in-flight solve workers to finish on the first

package/src/limits-i18n.lib.mjs

@@ -85,6 +85,14 @@ const ENGLISH_LIMITS = {
   subscription_detail_trial_ends: 'trial ends {{time}}',
   subscription_detail_trial_ends_in: 'trial ends in {{duration}}; {{time}}',
   subscription_status: 'Subscription: {{status}}',
+  subscription_blocked_title: 'Subscription/account access blocked',
+  subscription_blocked_provider: 'Provider said',
+  subscription_blocked_code: 'Error code',
+  subscription_blocked_reason: 'Why the run stopped',
+  subscription_blocked_note: 'This is not a usage limit: waiting, retrying or switching model cannot fix it.',
+  subscription_blocked_steps: 'What to do',
+  subscription_blocked_preserved: 'Uncommitted work was auto-committed before stopping.',
+  subscription_blocked_resume: 'Resume after access is restored',
   telegram_api: 'Telegram Bot API',
   telegram_flood_control: 'flood control',
   telegram_last_rate_limit: 'Last 429: {{method}}',

package/src/locales/en.lino

@@ -322,6 +322,15 @@ en
     session "session"
     start "Start"
     subscription
+      blocked
+        title "Subscription/account access blocked"
+        provider "Provider said"
+        code "Error code"
+        reason "Why the run stopped"
+        note "This is not a usage limit: waiting, retrying or switching model cannot fix it."
+        steps "What to do"
+        preserved "Uncommitted work was auto-committed before stopping."
+        resume "Resume after access is restored"
       detail
         ends
           label "ends {{time}}"

package/src/locales/hi.lino

@@ -322,6 +322,15 @@ hi
     session "सत्र"
     start "शुरुआत"
     subscription
+      blocked
+        title "सदस्यता/खाता पहुँच अवरुद्ध"
+        provider "प्रदाता ने कहा"
+        code "त्रुटि कोड"
+        reason "रन क्यों रुका"
+        note "यह उपयोग सीमा नहीं है: प्रतीक्षा, पुनः प्रयास या मॉडल बदलना इसे ठीक नहीं करेगा।"
+        steps "क्या करें"
+        preserved "रुकने से पहले बिना कमिट किए बदलाव स्वतः कमिट कर दिए गए।"
+        resume "पहुँच बहाल होने पर फिर से शुरू करें"
       detail
         ends
           label "{{time}} को समाप्त होगी"

package/src/locales/ru.lino

@@ -322,6 +322,15 @@ ru
     session "сеанс"
     start "Начало"
     subscription
+      blocked
+        title "Доступ по подписке/аккаунту заблокирован"
+        provider "Ответ провайдера"
+        code "Код ошибки"
+        reason "Почему запуск остановлен"
+        note "Это не лимит использования: ожидание, повтор или смена модели не помогут."
+        steps "Что делать"
+        preserved "Незакоммиченные изменения были автоматически закоммичены перед остановкой."
+        resume "Продолжить после восстановления доступа"
       detail
         ends
           label "заканчивается {{time}}"

package/src/locales/zh.lino

@@ -322,6 +322,15 @@ zh
     session "会话"
     start "开始"
     subscription
+      blocked
+        title "订阅/账号访问被阻止"
+        provider "服务方提示"
+        code "错误代码"
+        reason "运行停止的原因"
+        note "这不是用量限制：等待、重试或切换模型都无法解决。"
+        steps "如何处理"
+        preserved "停止前已自动提交未提交的改动。"
+        resume "恢复访问后继续"
       detail
         ends
           label "结束于 {{time}}"

package/src/opencode.prompts.lib.mjs

@@ -9,6 +9,8 @@ import { getThinkingPromptInstruction } from './thinking-prompt.lib.mjs';
 import { buildWorkLanguageDirective } from './work-language.prompts.lib.mjs';
 import { buildRequestedBaseBranchDirective } from './solve-option-contract.prompts.lib.mjs';
 import { buildIssueResearchPrompt } from './deep-analysis.lib.mjs';
+import { buildFormalAiRepositoryPrompt } from './formal-ai-prompt.lib.mjs';
+import { isFormalAiModel } from './formal-ai-model.lib.mjs';
 
 /**
  * Build the user prompt for OpenCode
@@ -16,6 +18,9 @@ import { buildIssueResearchPrompt } from './deep-analysis.lib.mjs';
  * @returns {string} The formatted user prompt
  */
 export const buildUserPrompt = params => {
+  const formalAiPrompt = buildFormalAiRepositoryPrompt(params);
+  if (formalAiPrompt !== null) return formalAiPrompt;
+
   const { issueUrl, issueNumber, prNumber, prUrl, branchName, tempDir, workspaceTmpDir, isContinueMode, forkedRepo, feedbackLines, forkActionsUrl, owner, repo, argv } = params;
 
   const promptLines = [];
@@ -92,6 +97,10 @@ export const buildUserPrompt = params => {
 export const buildSystemPrompt = params => {
   const { owner, repo, issueNumber, prNumber, branchName, workspaceTmpDir, argv, modelSupportsVision, forkedRepo } = params;
 
+  // Issue #2158: keep caller workflow instructions out of Formal AI's task
+  // classifier. Formal AI provides its own execution policy.
+  if (isFormalAiModel(argv?.model)) return '';
+
   // When in fork mode, screenshots are pushed to the fork, not the original repo
   const screenshotRepoPath = argv?.fork && forkedRepo ? forkedRepo : `${owner}/${repo}`;
 

package/src/qwen.prompts.lib.mjs

@@ -9,6 +9,8 @@ import { getThinkingPromptInstruction } from './thinking-prompt.lib.mjs';
 import { buildWorkLanguageDirective } from './work-language.prompts.lib.mjs';
 import { buildRequestedBaseBranchDirective } from './solve-option-contract.prompts.lib.mjs';
 import { buildIssueResearchPrompt } from './deep-analysis.lib.mjs';
+import { buildFormalAiRepositoryPrompt } from './formal-ai-prompt.lib.mjs';
+import { isFormalAiModel } from './formal-ai-model.lib.mjs';
 
 /**
  * Build the user prompt for Qwen Code
@@ -16,6 +18,9 @@ import { buildIssueResearchPrompt } from './deep-analysis.lib.mjs';
  * @returns {string} The formatted user prompt
  */
 export const buildUserPrompt = params => {
+  const formalAiPrompt = buildFormalAiRepositoryPrompt(params);
+  if (formalAiPrompt !== null) return formalAiPrompt;
+
   const { issueUrl, issueNumber, prNumber, prUrl, branchName, tempDir, workspaceTmpDir, isContinueMode, forkedRepo, feedbackLines, forkActionsUrl, owner, repo, argv, tool = 'qwen' } = params;
 
   const promptLines = [];
@@ -81,6 +86,10 @@ export const buildUserPrompt = params => {
 export const buildSystemPrompt = params => {
   const { owner, repo, issueNumber, prNumber, branchName, workspaceTmpDir, argv, modelSupportsVision, forkedRepo } = params;
 
+  // Issue #2158: keep caller workflow instructions out of Formal AI's task
+  // classifier. Formal AI provides its own execution policy.
+  if (isFormalAiModel(argv?.model)) return '';
+
   const screenshotRepoPath = argv?.fork && forkedRepo ? forkedRepo : `${owner}/${repo}`;
 
   let workspaceInstructions = '';