@link-assistant/hive-mind 2.12.5 → 2.13.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @link-assistant/hive-mind
 
+## 2.13.1
+
+### Patch Changes
+
+- 736f6f9: Stop reporting a host that ran out of disk space as failed tasks: `/hive` now checks free space before each task, requeues the task as a deferral while peers are still running, reclaims only temp directories that no process is using, and exits with `EX_TEMPFAIL` (75) when work remains blocked. Also fix the false alarms around it — `getLogFile is not a function` in the restart paths, the bogus `.gitkeep` cleanup warning, benign in-session tool results and defaulted source cleanup being reported as problems, merged solution drafts being summarized as `(no PR found)`, and `--auto-cleanup` being a no-op at one call site.
+
+## 2.13.0
+
+### Minor Changes
+
+- aaf809a: Recognize subscription/account access blocks from every supported CLI (Claude, Codex, Qwen, Gemini, opencode) as their own error class: stop the run instead of retrying or switching model, auto-commit and push the in-flight work first, report what happened and what to do in the terminal, in the `/solve` exit message and in the Telegram completion message (en/ru/zh/hi), and stop the `/hive` queue so the fleet no longer rediscovers the block once per issue.
+
 ## 2.12.5
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "2.12.5",
+  "version": "2.13.1",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",

package/src/claude.budget-stats.lib.mjs

@@ -356,9 +356,11 @@ export const displaySessionTokenUsage = async ({ sessionId, tempDir, resultModel
   try {
     const tokenUsage = await calculateSessionTokens(sessionId, tempDir, resultModelUsage);
     if (!tokenUsage) return;
-    // Issue #1501: Log deduplication stats in verbose mode
+    // Issue #1501: Log deduplication stats in verbose mode.
+    // Issue #2160: informational, not a warning — the duplicates are a known upstream Claude Code
+    // accounting quirk and skipping them is exactly what keeps the token totals correct here.
     if (tokenUsage.duplicateEntriesSkipped > 0) {
-      await log(`\n⚠️  JSONL deduplication: skipped ${tokenUsage.duplicateEntriesSkipped} duplicate entries (upstream: anthropics/claude-code#6805)`, { verbose: true });
+      await log(`\nℹ️  JSONL deduplication: skipped ${tokenUsage.duplicateEntriesSkipped} duplicate entries so token totals stay correct (known upstream behaviour: anthropics/claude-code#87303)`, { verbose: true });
     }
     if (tokenUsage.peakContextUsage > 0) {
       await log(`📊 Peak restored-context input: ${formatNumber(tokenUsage.peakContextUsage)} tokens`, { verbose: true });

package/src/claude.lib.mjs

@@ -9,6 +9,7 @@ import { isENOSPC, buildToolErrorMessage } from './lib.mjs';
 import { reportError } from './sentry.lib.mjs';
 import { timeouts, retryLimits, claudeCode, getClaudeEnv, getMaxOutputTokensForModel } from './config.lib.mjs';
 import { detectUsageLimit, formatUsageLimitMessage, isUsageLimitError } from './usage-limit.lib.mjs';
+import { detectSubscriptionError, SUBSCRIPTION_BLOCKED_MARKER } from './subscription-error.lib.mjs'; // Issue #2161
 import { createInteractiveHandler } from './interactive-mode.lib.mjs';
 import { setupBidirectionalHandler, finalizeBidirectionalHandler, validateBidirectionalModeConfig, attachStreamingInput } from './bidirectional-interactive.lib.mjs';
 import { initProgressMonitoring } from './solve.progress-monitoring.lib.mjs';
@@ -34,6 +35,7 @@ import { deployHandoffSkill } from './handoff-skill.lib.mjs'; // Issue #1877
 import { createThinkingBlockRecovery } from './claude.thinking-block-recovery.lib.mjs'; // Issue #1834 (PR #1835 feedback)
 import { buildMissingClaudeResultMessage, collectClaudeStreamEventFacts, getClaudeMessageContent, shouldFailClaudeStreamWithoutResult } from './claude.stream-events.lib.mjs';
 import { formatNumber, mapModelToId, checkModelVisionCapability } from './claude.model-utils.lib.mjs';
+import { renameLogToSessionId } from './session-log-rename.lib.mjs'; // Issue #2160
 import { showResumeCommand } from './claude.resume-output.lib.mjs';
 import { stringifyErrorValue } from './error-text.lib.mjs'; // Issue #2141
 import { createPullRequestBaseBranchCommandIntervention } from './solve.pr-base-command-intervention.lib.mjs';
@@ -376,6 +378,10 @@ export const executeClaudeCommand = async params => {
     let isInternalServerError = false;
     let isRequestTimeout = false;
     let isRateLimitError = false; // Issue #1924: server-side 429 temporary rate limiting
+    // Issue #2161: account/subscription-level block (e.g. oauth_org_not_allowed).
+    // Terminal — never retried, never model-switched; carried out to the caller
+    // so /solve can stop with a specific diagnosis instead of a generic failure.
+    let subscriptionError = null;
     let apiMarkedNotRetryable = false;
     let resultNumTurns = 0;
     let stderrErrors = [];
@@ -388,6 +394,11 @@ export const executeClaudeCommand = async params => {
     let resultSummary = null;
     let resultModelUsage = null;
     let lastToolResultError = null;
+    // Issue #2160: an in-session tool failure the AI handles itself (a blocked command, its own
+    // Bash timeout, a bare non-zero exit status). Kept apart from lastToolResultError so it is not
+    // reported as the session error, but still available as the last-resort detail for a
+    // truncated stream that has nothing better to point at (issue #2023).
+    let lastBenignToolResultError = null;
     // Issue #1590: Track sub-agent calls (Agent tool invocations) for per-call stats
     const subAgentCalls = [];
     // Issue #1590: Map tool_use_id -> subAgentCalls index for accumulating per-call usage from parent_tool_use_id events
@@ -628,16 +639,16 @@ export const executeClaudeCommand = async params => {
               if (!sessionId && data.session_id) {
                 sessionId = data.session_id;
                 await log(`📌 Session ID: ${sessionId}`);
-                let sessionLogFile;
-                try {
-                  const currentLogFile = getLogFile();
-                  sessionLogFile = path.join(path.dirname(currentLogFile), `${sessionId}.log`);
-                  await fs.rename(currentLogFile, sessionLogFile);
-                  setLogFile(sessionLogFile);
-                  await log(`📁 Log renamed to: ${sessionLogFile}`);
-                } catch (renameError) {
-                  reportError(renameError, { context: 'rename_session_log', sessionId, sessionLogFile, operation: 'rename_log_file' });
-                  await log(`⚠️ Could not rename log file: ${renameError.message}`, { verbose: true });
+                // Issue #2160: shared implementation, so restart/watch iterations rename their
+                // logs too and a caller that forgets the accessors gets a named reason.
+                const renameResult = await renameLogToSessionId({ sessionId, getLogFile, setLogFile, log });
+                if (!renameResult.ok && renameResult.error) {
+                  reportError(renameResult.error, {
+                    context: 'rename_session_log',
+                    sessionId,
+                    sessionLogFile: renameResult.sessionLogFile,
+                    operation: 'rename_log_file',
+                  });
                 }
               }
               const eventFacts = collectClaudeStreamEventFacts(data);
@@ -649,9 +660,16 @@ export const executeClaudeCommand = async params => {
                 await log('📝 Captured fallback summary from Claude compaction context', { verbose: true });
               }
               if (eventFacts.toolResultError) {
-                lastToolResultError = eventFacts.toolResultError;
-                lastMessage = eventFacts.toolResultError;
-                await log(`⚠️ Tool result error detected: ${eventFacts.toolResultError.substring(0, 200)}`, { verbose: true });
+                // Issue #2160: an in-session tool failure the AI handles itself is not a warning,
+                // and it must not replace the last assistant message — that message is what a
+                // truncated-stream failure is reported "after".
+                if (eventFacts.toolResultErrorIsBenign) {
+                  lastBenignToolResultError = eventFacts.toolResultError;
+                  await log(`ℹ️ In-session tool result (${eventFacts.toolResultErrorCategory}): ${eventFacts.toolResultError.substring(0, 200)}`, { verbose: true });
+                } else {
+                  lastToolResultError = eventFacts.toolResultError;
+                  await log(`⚠️ Tool result error detected: ${eventFacts.toolResultError.substring(0, 200)}`, { verbose: true });
+                }
               }
               // Issue #1708: signal busy/idle to the bidirectional handler so
               // queue-comments-to-input mode can hold frames until the AI is
@@ -731,6 +749,24 @@ export const executeClaudeCommand = async params => {
                     isRateLimitError = true;
                     await log(`⚠️ Detected server-side rate limiting (429) from Claude CLI (will retry with --resume). request_id=${data.request_id || 'unknown'}`, { verbose: true });
                   }
+                  // Issue #2161: account/subscription block. `data.error` carries the
+                  // machine-readable code ("oauth_org_not_allowed" for the reported
+                  // case) alongside api_error_status 403 — a far stronger signal than
+                  // the rendered sentence, so it is passed to the detector first.
+                  if (!subscriptionError) {
+                    subscriptionError = detectSubscriptionError({
+                      message: lastMessage,
+                      tool: 'claude',
+                      errorCode: typeof data.error === 'string' ? data.error : null,
+                      apiErrorStatus: data.api_error_status,
+                      terminalReason: data.terminal_reason,
+                    });
+                    if (subscriptionError) {
+                      // Not verbose: this is the reason the whole run is about to end.
+                      await log(`${SUBSCRIPTION_BLOCKED_MARKER} — ${subscriptionError.label}`);
+                      await log(`   code=${subscriptionError.code || 'n/a'} http=${data.api_error_status || 'n/a'} terminal_reason=${data.terminal_reason || 'n/a'} request_id=${data.request_id || 'unknown'}`, { verbose: true });
+                    }
+                  }
                   // Issue #1834: Detect corrupted extended-thinking-block 400 (un-resumable session).
                   // Capture diagnostics (request id, content path) to aid debugging and upstream reports.
                   if ((lastMessage.includes('thinking') || lastMessage.includes('redacted_thinking')) && lastMessage.includes('cannot be modified')) {
@@ -765,6 +801,26 @@ export const executeClaudeCommand = async params => {
                   await log(`🤖 Sub-agent "${callEntry.description || 'unknown'}" completed: ${data.usage.total_tokens} total tokens`, { verbose: true });
                 }
               }
+              // Issue #2161: Claude Code injects API failures as synthetic assistant
+              // messages flagged `is_api_error_message` and carrying the error code.
+              // In the reported run this arrived ~40s before the terminal result
+              // event, so detecting it here surfaces the diagnosis earlier.
+              if (data.type === 'assistant' && data.is_api_error_message === true && !subscriptionError) {
+                const apiErrorText = getClaudeMessageContent(data)
+                  .filter(item => item.type === 'text' && item.text)
+                  .map(item => item.text)
+                  .join('\n');
+                subscriptionError = detectSubscriptionError({
+                  message: apiErrorText,
+                  tool: 'claude',
+                  errorCode: typeof data.error === 'string' ? data.error : null,
+                });
+                if (subscriptionError) {
+                  if (apiErrorText) lastMessage = apiErrorText;
+                  await log(`${SUBSCRIPTION_BLOCKED_MARKER} — ${subscriptionError.label}`);
+                  await log(`   code=${subscriptionError.code || 'n/a'} request_id=${data.request_id || 'unknown'} uuid=${data.uuid || 'unknown'}`, { verbose: true });
+                }
+              }
               if (data.type === 'assistant' && data.message && data.message.content) {
                 const content = getClaudeMessageContent(data);
                 for (const item of content) {
@@ -860,9 +916,11 @@ export const executeClaudeCommand = async params => {
           toolUseCount += eventFacts.toolUseCountDelta;
           if (eventFacts.lastText) lastMessage = eventFacts.lastText;
           if (!resultSummary && eventFacts.compactionSummary) resultSummary = eventFacts.compactionSummary;
-          if (eventFacts.toolResultError) {
+          // Issue #2160: same classification as the streaming path above.
+          if (eventFacts.toolResultError && eventFacts.toolResultErrorIsBenign) {
+            lastBenignToolResultError = eventFacts.toolResultError;
+          } else if (eventFacts.toolResultError) {
             lastToolResultError = eventFacts.toolResultError;
-            lastMessage = eventFacts.toolResultError;
           }
           if (data?.type === 'result') {
             resultEventReceived = true;
@@ -963,7 +1021,7 @@ export const executeClaudeCommand = async params => {
       }
       if (shouldFailClaudeStreamWithoutResult({ commandFailed, streamingInput, resultEventReceived })) {
         commandFailed = true;
-        lastMessage = buildMissingClaudeResultMessage({ lastToolResultError, lastMessage });
+        lastMessage = buildMissingClaudeResultMessage({ lastToolResultError, lastMessage, lastBenignToolResultError });
         await log(`\n\n❌ Command failed: ${lastMessage}`, { level: 'error' });
       }
       const retryableLastError = classifyRetryableError(lastMessage);
@@ -977,7 +1035,12 @@ export const executeClaudeCommand = async params => {
       }
       // Issues #1331, #1353, #1472/#1475: Unified transient error retry (exponential backoff, session preservation)
       const isTransientError = isStartupTimeout || isActivityTimeout || isOverloadError || isInternalServerError || is503Error || isRequestTimeout || isRateLimitError || retryableLastError.isRetryable || (lastMessage.includes('API Error: 500') && (lastMessage.includes('Overloaded') || lastMessage.includes('Internal server error'))) || (lastMessage.includes('API Error: 529') && (lastMessage.includes('overloaded_error') || lastMessage.includes('Overloaded'))) || (lastMessage.includes('api_error') && lastMessage.includes('Overloaded')) || (lastMessage.includes('overloaded_error') && lastMessage.includes('Overloaded')) || lastMessage.includes('API Error: 503') || (lastMessage.includes('503') && (lastMessage.includes('upstream connect error') || lastMessage.includes('remote connection failure'))) || lastMessage === 'Request timed out' || lastMessage.includes('Request timed out');
-      if ((commandFailed || isTransientError) && isTransientError) {
+      // Issue #2161: an account/subscription block short-circuits every retry
+      // path. Stale transient flags from earlier in the run (an overload at hour
+      // one, say) must not schedule a retry that is guaranteed to fail the same
+      // way — and each retry would burn another full startup against a provider
+      // that has already refused the credentials.
+      if ((commandFailed || isTransientError) && isTransientError && !subscriptionError) {
         // Issue #1472/#1475: Startup/activity timeout → 30s–2min backoff; #1353: Request timeout → 5min–1hr; general → 2min–30min
         const isTimeoutRetry = isStartupTimeout || isActivityTimeout;
         const maxRetries = isTimeoutRetry ? retryLimits.maxTransientErrorRetries : isRequestTimeout ? retryLimits.maxRequestTimeoutRetries : retryLimits.maxTransientErrorRetries;
@@ -1005,6 +1068,7 @@ export const executeClaudeCommand = async params => {
             resultSummary,
             // Issue #1845/#1941: surface the actual error, rejecting meaningless fragments (e.g. a lone "}")
             errorInfo: { message: buildToolErrorMessage({ lastMessage, exitCode, fallback: 'API explicitly marked error as not retryable', toolLabel: 'Claude' }), exitCode },
+            subscriptionError, // Issue #2161
             queuedFeedback, // Issue #817: Bidirectional mode feedback
           };
         }
@@ -1055,6 +1119,7 @@ export const executeClaudeCommand = async params => {
             resultSummary, // Issue #1263: Include result summary
             // Issue #1845/#1941: surface the actual error, rejecting meaningless fragments (e.g. a lone "}")
             errorInfo: { message: buildToolErrorMessage({ lastMessage, exitCode, fallback: `Transient API error persisted after ${maxRetries} retries`, toolLabel: 'Claude' }), exitCode },
+            subscriptionError, // Issue #2161
             queuedFeedback, // Issue #817: Bidirectional mode feedback
           };
         }
@@ -1123,6 +1188,7 @@ export const executeClaudeCommand = async params => {
           // Issue #1845: surface the core error (e.g. "API Error: Output blocked by content filtering policy").
           // Issue #1941: a lone "}" fragment at interrupt time must not become "CLAUDE execution failed with }".
           errorInfo: { message: buildToolErrorMessage({ lastMessage, exitCode, fallback: `Claude command failed with exit code ${exitCode}`, toolLabel: 'Claude' }), exitCode },
+          subscriptionError, // Issue #2161: terminal account block — /solve stops and preserves the work
           queuedFeedback, // Issue #817: Bidirectional mode feedback
         };
       }

package/src/claude.stream-events.lib.mjs

@@ -19,12 +19,46 @@ const normalizeToolResultError = value => {
   }
 };
 
+/**
+ * Issue #2160: not every `tool_result` marked `is_error` says something about the session.
+ * Most of them are the AI's own command failing inside the session — the AI sees the result and
+ * carries on. Run 4c1dedd8 logged 26 "⚠️ Tool result error detected" lines, all of them of this
+ * kind (11 harness-blocked `sleep`s, 9 × `Exit code 143` Bash timeouts, 4 × `Exit code 1`,
+ * 2 × `Exit code 127`), and each one also overwrote the
+ * last assistant message, so a truncated stream could be reported as having failed "after:
+ * Blocked: sleep 240 …" instead of after what the AI actually said.
+ *
+ * Categories:
+ *   - `harness_blocked`     the AI tool's own harness refused the command (e.g. foreground sleep)
+ *   - `command_timeout`     the AI's command hit its Bash timeout (SIGTERM ⇒ exit code 143)
+ *   - `command_exit_code`   a bare non-zero exit status with no further detail
+ * Anything else is left unclassified and keeps being treated as a real error signal.
+ *
+ * @param {string|null} toolResultError - normalized tool_result error text
+ * @returns {{benign: boolean, category: string|null}}
+ */
+export const classifyToolResultError = toolResultError => {
+  if (typeof toolResultError !== 'string' || !toolResultError.trim()) return { benign: false, category: null };
+  const text = toolResultError.trim();
+
+  if (/^Blocked:/i.test(text)) return { benign: true, category: 'harness_blocked' };
+  if (/Command timed out after/i.test(text)) return { benign: true, category: 'command_timeout' };
+  // A bare "Exit code 143" is the SIGTERM the AI tool sends when its own Bash timeout fires.
+  if (/^Exit code 143\.?$/i.test(text)) return { benign: true, category: 'command_timeout' };
+  if (/^Exit code \d+\.?$/i.test(text)) return { benign: true, category: 'command_exit_code' };
+
+  return { benign: false, category: null };
+};
+
 export const collectClaudeStreamEventFacts = data => {
   const facts = {
     messageCountDelta: 0,
     toolUseCountDelta: 0,
     lastText: null,
     toolResultError: null,
+    // Issue #2160: set when toolResultError is an in-session, self-handled tool failure.
+    toolResultErrorIsBenign: false,
+    toolResultErrorCategory: null,
     compactionSummary: null,
   };
   if (!data || typeof data !== 'object') return facts;
@@ -47,6 +81,12 @@ export const collectClaudeStreamEventFacts = data => {
     facts.toolResultError = data.tool_use_result.trim();
   }
 
+  if (facts.toolResultError) {
+    const classification = classifyToolResultError(facts.toolResultError);
+    facts.toolResultErrorIsBenign = classification.benign;
+    facts.toolResultErrorCategory = classification.category;
+  }
+
   return facts;
 };
 
@@ -54,8 +94,22 @@ export const shouldFailClaudeStreamWithoutResult = ({ commandFailed, streamingIn
   return !commandFailed && !streamingInput && !resultEventReceived;
 };
 
-export const buildMissingClaudeResultMessage = ({ lastToolResultError, lastMessage }) => {
-  const detail = lastToolResultError || lastMessage;
+/**
+ * Describe a stream that ended without a terminal result event (issue #2023).
+ *
+ * Detail preference, in order (issue #2160): a real tool error explains the truncation best; the
+ * last thing the AI said is next; a benign in-session tool result (a blocked command, a Bash
+ * timeout) is only used when there is nothing else, so it stays out of the message whenever the
+ * assistant actually said something.
+ *
+ * @param {Object} params
+ * @param {string|null} [params.lastToolResultError] - last non-benign tool_result error
+ * @param {string|null} [params.lastMessage] - last assistant text
+ * @param {string|null} [params.lastBenignToolResultError] - last self-handled tool_result error
+ * @returns {string}
+ */
+export const buildMissingClaudeResultMessage = ({ lastToolResultError, lastMessage, lastBenignToolResultError = null }) => {
+  const detail = lastToolResultError || lastMessage || lastBenignToolResultError;
   if (!detail) return 'Claude stream ended without a terminal result event';
   return `Claude stream ended without a terminal result event after: ${String(detail).slice(0, 500)}`;
 };

package/src/disk-guard.lib.mjs

@@ -0,0 +1,256 @@
+/**
+ * Disk-space guard for solver workspaces (issue #2160).
+ *
+ * Reported symptom: `hive … --all-issues` finished with `❌ 4 task(s) failed (completed: 6)` even
+ * though nothing was wrong with those 4 issues. The run log shows why:
+ *
+ *   - the target repository was public, so solve's auto-cleanup default resolved to OFF and every
+ *     `/tmp/gh-issue-solver-*` workspace (~10 GB each) was kept;
+ *   - hive checked free disk space exactly once, at startup (73.2 GB free), and kept dequeuing;
+ *   - after 6 completed tasks only 9.8 GB were left, so each remaining task tripped solve's
+ *     pre-flight check (`❌ Insufficient disk space: 10047MB available, 10240MB required`), exited
+ *     after ~12s, posted a "Solution Draft Failed" comment and was counted as a *task* failure.
+ *
+ * An exhausted disk is an environment condition: the task is still perfectly solvable once space is
+ * available. This module lets the orchestrator (a) reclaim workspaces nobody is using any more,
+ * (b) wait for in-flight work to release space, and (c) report the condition as a deferral instead
+ * of a task failure.
+ *
+ * Everything that touches the outside world (df, readdir, rm, clock, sleep) is injectable so the
+ * behaviour can be tested without a full disk.
+ *
+ * @see https://github.com/link-assistant/hive-mind/issues/2160
+ */
+
+import fsPromises from 'node:fs/promises';
+import path from 'node:path';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+
+/**
+ * Exit code a solver uses when it refuses to start because the host is out of disk space.
+ * 75 is EX_TEMPFAIL ("temporary failure, the user is invited to retry") from sysexits.h — the
+ * closest standard meaning to "nothing is wrong with the request, retry later".
+ */
+export const EXIT_CODE_INSUFFICIENT_DISK_SPACE = 75;
+
+/** Prefix of the temporary directories solve clones repositories into. */
+export const SOLVER_WORKSPACE_PREFIX = 'gh-issue-solver-';
+
+export const DEFAULT_TMP_ROOT = '/tmp';
+
+/** A workspace whose contents changed this recently is never reclaimed. */
+export const DEFAULT_MIN_IDLE_MS = 5 * 60 * 1000;
+
+const defaultSleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+const defaultRemove = async targetPath => fsPromises.rm(targetPath, { recursive: true, force: true });
+
+/**
+ * Free space in MB on the filesystem holding `targetPath`, or null when it cannot be determined.
+ * `df -Pk` is POSIX-portable output (single line per filesystem, 1K blocks).
+ */
+export const getFreeDiskSpaceMB = async (targetPath = DEFAULT_TMP_ROOT, { exec = execFileAsync } = {}) => {
+  try {
+    const { stdout } = await exec('df', ['-Pk', targetPath]);
+    const lines = String(stdout).trim().split('\n');
+    if (lines.length < 2) return null;
+    const columns = lines[lines.length - 1].trim().split(/\s+/);
+    const availableKB = Number.parseInt(columns[3], 10);
+    if (!Number.isFinite(availableKB)) return null;
+    return Math.floor(availableKB / 1024);
+  } catch {
+    return null;
+  }
+};
+
+/** Every `/tmp/gh-issue-solver-*` directory, oldest modification first. */
+export const listSolverWorkspaces = async ({ tmpRoot = DEFAULT_TMP_ROOT, fileSystem = fsPromises } = {}) => {
+  let entries;
+  try {
+    entries = await fileSystem.readdir(tmpRoot);
+  } catch {
+    return [];
+  }
+  const workspaces = [];
+  for (const entry of entries) {
+    const name = typeof entry === 'string' ? entry : entry.name;
+    if (!name || !name.startsWith(SOLVER_WORKSPACE_PREFIX)) continue;
+    const workspacePath = path.join(tmpRoot, name);
+    let stats;
+    try {
+      stats = await fileSystem.stat(workspacePath);
+    } catch {
+      continue;
+    }
+    if (typeof stats.isDirectory === 'function' && !stats.isDirectory()) continue;
+    workspaces.push({ path: workspacePath, name, mtimeMs: Number(stats.mtimeMs) || 0 });
+  }
+  return workspaces.sort((a, b) => a.mtimeMs - b.mtimeMs);
+};
+
+/**
+ * Workspaces that a live process is currently sitting in. The AI tool runs with its workspace as
+ * cwd, so /proc/<pid>/cwd is an authoritative "do not touch" signal on Linux. When /proc cannot be
+ * read (macOS, restricted container) every workspace is reported as busy — refusing to guess is the
+ * only safe answer, since deleting a live workspace would destroy real work.
+ */
+export const findBusySolverWorkspaces = async ({ workspaces = [], procRoot = '/proc', fileSystem = fsPromises } = {}) => {
+  if (!workspaces.length) return new Set();
+  let pids;
+  try {
+    pids = (await fileSystem.readdir(procRoot)).map(entry => (typeof entry === 'string' ? entry : entry.name)).filter(name => /^\d+$/.test(name));
+  } catch {
+    return new Set(workspaces.map(workspace => workspace.path));
+  }
+  const cwds = [];
+  for (const pid of pids) {
+    try {
+      cwds.push(String(await fileSystem.readlink(path.join(procRoot, pid, 'cwd'))));
+    } catch {
+      // The process exited, or its cwd is not readable by this user — nothing to protect here.
+    }
+  }
+  const busy = new Set();
+  for (const workspace of workspaces) {
+    if (cwds.some(cwd => cwd === workspace.path || cwd.startsWith(`${workspace.path}/`))) busy.add(workspace.path);
+  }
+  return busy;
+};
+
+/**
+ * Entries of the given temp roots that `--auto-cleanup` may delete.
+ *
+ * The old implementation ran `sudo rm -rf /tmp/* /var/tmp/*`, which also destroys the workspaces,
+ * lock directories and log files of any *concurrent* hive/solve run on the same host — the run
+ * doing the cleanup is rarely the only tenant of /tmp. This builds an explicit list instead and
+ * leaves alone anything a live process is sitting in, anything the caller marked as protected, and
+ * the run's own log file.
+ *
+ * @param {Object} [options]
+ * @param {Array<string>} [options.roots=['/tmp','/var/tmp']] - Directories to clean
+ * @param {Iterable<string>} [options.protectedPaths] - Paths that must survive
+ * @returns {Promise<{remove: Array<string>, keep: Array<{path: string, reason: string}>}>}
+ */
+export const listCleanableTempEntries = async ({ roots = ['/tmp', '/var/tmp'], protectedPaths = new Set(), fileSystem = fsPromises, procRoot = '/proc' } = {}) => {
+  const protectedSet = new Set(Array.from(protectedPaths).filter(Boolean).map(String));
+  const remove = [];
+  const keep = [];
+  const candidates = [];
+  for (const root of roots) {
+    let entries;
+    try {
+      entries = await fileSystem.readdir(root);
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const name = typeof entry === 'string' ? entry : entry.name;
+      if (!name || name === '.' || name === '..') continue;
+      candidates.push({ path: path.join(root, name), name, mtimeMs: 0 });
+    }
+  }
+  const busy = await findBusySolverWorkspaces({ workspaces: candidates, procRoot, fileSystem });
+  for (const candidate of candidates) {
+    const isProtected = protectedSet.has(candidate.path) || Array.from(protectedSet).some(protectedPath => protectedPath.startsWith(`${candidate.path}/`));
+    if (isProtected) {
+      keep.push({ path: candidate.path, reason: 'protected' });
+      continue;
+    }
+    if (busy.has(candidate.path)) {
+      keep.push({ path: candidate.path, reason: 'process_cwd' });
+      continue;
+    }
+    remove.push(candidate.path);
+  }
+  return { remove, keep };
+};
+
+/** Workspace paths mentioned in a line of solver output, used to protect in-flight workspaces. */
+export const extractSolverWorkspacePaths = (text, { tmpRoot = DEFAULT_TMP_ROOT } = {}) => {
+  if (!text) return [];
+  const pattern = new RegExp(`${tmpRoot.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}/${SOLVER_WORKSPACE_PREFIX}[A-Za-z0-9_-]+`, 'g');
+  return Array.from(new Set(String(text).match(pattern) || []));
+};
+
+/**
+ * Remove idle solver workspaces, oldest first, until `requiredMB` is free.
+ * A workspace is skipped when it is in flight, is some process's cwd, or was modified recently.
+ */
+export const reclaimSolverWorkspaces = async ({ requiredMB = 0, tmpRoot = DEFAULT_TMP_ROOT, protectedPaths = new Set(), minIdleMs = DEFAULT_MIN_IDLE_MS, now = Date.now, log = async () => {}, fileSystem = fsPromises, procRoot = '/proc', getFreeMB = getFreeDiskSpaceMB, remove = defaultRemove } = {}) => {
+  const removed = [];
+  const skipped = [];
+  let freeMB = await getFreeMB(tmpRoot);
+  const workspaces = await listSolverWorkspaces({ tmpRoot, fileSystem });
+  if (!workspaces.length) return { removed, skipped, freeMB };
+  const busy = await findBusySolverWorkspaces({ workspaces, procRoot, fileSystem });
+  const currentTime = now();
+  for (const workspace of workspaces) {
+    if (freeMB !== null && freeMB >= requiredMB) break;
+    if (protectedPaths.has(workspace.path)) {
+      skipped.push({ path: workspace.path, reason: 'in_flight' });
+      continue;
+    }
+    if (busy.has(workspace.path)) {
+      skipped.push({ path: workspace.path, reason: 'process_cwd' });
+      continue;
+    }
+    if (currentTime - workspace.mtimeMs < minIdleMs) {
+      skipped.push({ path: workspace.path, reason: 'recently_modified' });
+      continue;
+    }
+    try {
+      await remove(workspace.path);
+      removed.push(workspace.path);
+      await log(`   🧹 Reclaimed idle solver workspace: ${workspace.path}`);
+    } catch (error) {
+      skipped.push({ path: workspace.path, reason: 'remove_failed', error });
+      await log(`   ⚠️  Could not remove ${workspace.path}: ${error.message}`, { level: 'warning' });
+      continue;
+    }
+    freeMB = await getFreeMB(tmpRoot);
+  }
+  return { removed, skipped, freeMB };
+};
+
+/**
+ * Make sure `requiredMB` is free before a worker starts a task.
+ *
+ * Returns `{ ok: true }` when there is (or there now is) enough space, and
+ * `{ ok: false, reason: 'insufficient_disk_space' }` when the caller should defer the task instead
+ * of spawning a solver that would die in its pre-flight check.
+ *
+ * An unreadable `df` never blocks work: the guard is an optimisation over solve's own pre-flight
+ * check, not a replacement for it.
+ */
+export const ensureDiskSpaceForWorker = async ({ requiredMB = 10240, tmpRoot = DEFAULT_TMP_ROOT, protectedPaths = new Set(), minIdleMs = DEFAULT_MIN_IDLE_MS, maxWaitMs = 0, pollIntervalMs = 30000, log = async () => {}, now = Date.now, sleep = defaultSleep, getFreeMB = getFreeDiskSpaceMB, fileSystem = fsPromises, procRoot = '/proc', remove = defaultRemove } = {}) => {
+  const startedAt = now();
+  const reclaimed = [];
+  let freeMB = await getFreeMB(tmpRoot);
+  if (freeMB === null) {
+    await log('   💾 Could not determine free disk space — continuing and letting the solver pre-flight check decide', { verbose: true });
+    return { ok: true, freeMB: null, reason: 'unknown_free_space', reclaimed, waitedMs: 0 };
+  }
+  if (freeMB >= requiredMB) {
+    await log(`   💾 Disk space before starting work: ${freeMB}MB free (${requiredMB}MB required)`, { verbose: true });
+    return { ok: true, freeMB, reason: 'sufficient', reclaimed, waitedMs: 0 };
+  }
+  await log(`   💾 Low disk space: ${freeMB}MB free, ${requiredMB}MB required — reclaiming idle solver workspaces before starting work`, { level: 'warning' });
+  for (;;) {
+    const result = await reclaimSolverWorkspaces({ requiredMB, tmpRoot, protectedPaths, minIdleMs, now, log, fileSystem, procRoot, getFreeMB, remove });
+    reclaimed.push(...result.removed);
+    if (result.freeMB !== null && result.freeMB !== undefined) freeMB = result.freeMB;
+    if (freeMB >= requiredMB) {
+      await log(`   ✅ Disk space recovered: ${freeMB}MB free after reclaiming ${result.removed.length} workspace(s)`);
+      return { ok: true, freeMB, reason: 'reclaimed', reclaimed, waitedMs: now() - startedAt };
+    }
+    const elapsedMs = now() - startedAt;
+    if (elapsedMs + pollIntervalMs > maxWaitMs) {
+      return { ok: false, freeMB, reason: 'insufficient_disk_space', reclaimed, waitedMs: elapsedMs, skipped: result.skipped };
+    }
+    await log(`   ⏳ Still ${freeMB}MB free of the ${requiredMB}MB required — waiting ${Math.round(pollIntervalMs / 1000)}s for in-flight work to release disk space`);
+    await sleep(pollIntervalMs);
+  }
+};