@link-assistant/hive-mind 2.15.0 → 2.15.2

package/src/solve.auto-merge.lib.mjs

@@ -30,7 +30,13 @@ const sentryLib = await import('./sentry.lib.mjs');
 const { reportError } = sentryLib;
 // Import GitHub merge functions
 const githubMergeLib = await import('./github-merge.lib.mjs');
-const { checkMergePermissions, mergePullRequest, getRepoVisibility, BILLING_LIMIT_ERROR_PATTERN, getDetailedCIStatus, rerunWorkflowRun, getWorkflowRunsForSha, getAllActiveRepoRuns, checkCIConsensus } = githubMergeLib;
+const { mergePullRequest, getRepoVisibility, BILLING_LIMIT_ERROR_PATTERN, getDetailedCIStatus, rerunWorkflowRun, getWorkflowRunsForSha, getAllActiveRepoRuns, checkCIConsensus } = githubMergeLib;
+// Issue #2182: guard rails for this loop (wall-clock ceiling, draft self-heal,
+// classified merge failures). See solve.auto-merge-guards.lib.mjs.
+const autoMergeGuards = await import('./solve.auto-merge-guards.lib.mjs');
+const { DRAFT_RECHECK_DELAY_MS, evaluateWatchTimeout, resolveDraftBlocker, resolveMergeFailure } = autoMergeGuards;
+// Re-exported so callers and tests keep a single entry point for the watch loop.
+export const { DEFAULT_WATCH_TIMEOUT_HOURS, normalizeWatchTimeoutHours } = autoMergeGuards;
 // Import GitHub functions for log attachment
 const githubLib = await import('./github.lib.mjs');
 const { sanitizeLogContent, attachLogToGitHub } = githubLib;
@@ -88,7 +94,6 @@ const { formatAutoIterationLimit, hasReachedAutoIterationLimit, normalizeAutoIte
 const autoRestartBudget = await import('./auto-restart-budget.lib.mjs');
 const { beginAutoRestartBudget, consumeAutoRestartIteration, formatAutoRestartLabel, formatAutoRestartLimit, hasExhaustedAutoRestartBudget } = autoRestartBudget;
 const { failOnAutoRestartBudgetExhausted } = await import('./auto-restart-exhaustion.lib.mjs');
-const { ensurePullRequestBaseBranch } = await import('./solve.pr-base-guard.lib.mjs');
 // Issue #2119: an empty pull request must not be reported as ready to merge.
 const { buildEmptyPullRequestBlocker, getPullRequestChangeStats } = await import('./pull-request-changes.lib.mjs');
 // Issue #1895: explicitly close linked issues after merging a PR into a
@@ -128,6 +133,16 @@ export const watchUntilMergeable = async params => {
   let lastKnownHeadSha = null;
   // Issue #1567: Initial cooldown to let CI register and solution logs post
   const INITIAL_COOLDOWN_SECONDS = MIN_CI_CHECK_INTERVAL_SECONDS;
+  // Issue #2182: this loop used to be `while (true)` with no wall-clock ceiling
+  // at all, so a permanently failing merge kept a single task "processing" for
+  // 4d 12h 13m. The timeout is the last-resort backstop below the specific
+  // fixes (draft detection, merge-failure classification).
+  const watchTimeoutHours = normalizeWatchTimeoutHours(argv.autoRestartUntilMergeableTimeoutHours ?? argv['auto-restart-until-mergeable-timeout-hours']);
+  const watchStartedAt = Date.now();
+  // Issue #2182: consecutive failed `gh pr merge` attempts, and how many times
+  // we silently restored "ready for review" on a pull request left as a draft.
+  // Mutable on purpose: the guard helpers update it in place.
+  const guardState = { consecutiveMergeFailures: 0, draftSelfHealCount: 0 };
 
   await log('');
   await log(formatAligned('🔄', 'AUTO-RESTART-UNTIL-MERGEABLE MODE ACTIVE', ''));
@@ -137,6 +152,7 @@ export const watchUntilMergeable = async params => {
   await log(formatAligned('', 'Initial cooldown:', `${INITIAL_COOLDOWN_SECONDS} seconds`, 2));
   await log(formatAligned('', 'Max restart iterations:', formatAutoRestartLimit(), 2));
   await log(formatAligned('', 'Max limit resumes:', formatAutoIterationLimit(maxAutoResumeIterations), 2));
+  await log(formatAligned('', 'Watch timeout:', watchTimeoutHours > 0 ? `${watchTimeoutHours} hour(s)` : 'unlimited', 2));
   await log(formatAligned('', 'Wait for all repo actions:', waitForAllRepoActionsFlag ? 'Yes (strict repo-wide safety)' : 'No (PR-scoped CI only)', 2));
   await log(formatAligned('', 'Stop conditions:', 'PR merged, PR closed, or becomes mergeable', 2));
   await log(formatAligned('', 'Restart triggers:', 'New non-bot comments, issue title/description edits, CI failures, merge conflicts', 2));
@@ -163,6 +179,15 @@ export const watchUntilMergeable = async params => {
   while (true) {
     iteration++;
     const currentTime = new Date();
+    // Issue #2182: hard wall-clock ceiling for the whole monitoring loop.
+    const watchTimeout = evaluateWatchTimeout({ watchTimeoutHours, watchStartedAt, now: Date.now(), checksCompleted: iteration - 1 });
+    if (watchTimeout) {
+      await log('');
+      await log(formatAligned('⏱️', 'WATCH TIMEOUT REACHED:', watchTimeout.message, 2), { level: 'error' });
+      await log('');
+      await reportAutomationStop({ $, owner, repo, targetNumber: prNumber, reason: 'watch_timeout', mode: 'auto-restart-until-mergeable', message: watchTimeout.message, details: watchTimeout.details, verbose: argv.verbose, log });
+      return { success: false, reason: 'watch_timeout', latestSessionId, latestAnthropicCost };
+    }
     const terminalState = await checkGitHubTerminalState({
       owner,
       repo,
@@ -217,6 +242,8 @@ export const watchUntilMergeable = async params => {
         }
         lastKnownHeadSha = currentHeadSha;
         consecutiveNoRunsChecks = 0;
+        // Issue #2182: a new commit is a genuinely new merge attempt.
+        guardState.consecutiveMergeFailures = 0;
         // Issue #1503: Also reset the readyToMergeCommentPosted flag when SHA changes,
         // so a new "Ready to merge" comment can be posted for the new commit's CI results.
         readyToMergeCommentPosted = false;
@@ -237,6 +264,23 @@ export const watchUntilMergeable = async params => {
         await reportAutomationStop({ $, owner, repo, targetNumber: prNumber, reason: 'terminal_github_entity_error', mode: 'auto-restart-until-mergeable', message: terminalGitHubBlocker.message, details: terminalGitHubBlocker.details, verbose: argv.verbose, log });
         return { success: false, reason: 'terminal_github_entity_error', latestSessionId, latestAnthropicCost };
       }
+      // Issue #2182: a pull request that is still a draft while no AI session is
+      // running is a leftover from a restart iteration (executeToolIteration
+      // drafts the PR on entry). GitHub answers mergeable=MERGEABLE/CLEAN for it,
+      // so nothing else in this loop notices — the merge then fails with
+      // "Pull Request is still a draft" on every single check. Restore
+      // "ready for review" here instead of burning an AI restart iteration.
+      if (blockers.find(b => b.type === 'draft')) {
+        const decision = await resolveDraftBlocker({ owner, repo, prNumber, $, log, formatAligned, reportError, reportAutomationStop, verbose: argv.verbose, state: guardState });
+        if (decision.action === 'stop') {
+          return { success: false, reason: decision.reason, latestSessionId, latestAnthropicCost };
+        }
+        if (decision.action === 'retry') {
+          lastCheckTime = currentTime;
+          await interruptibleSleep(DRAFT_RECHECK_DELAY_MS);
+          continue;
+        }
+      }
       // Issue #1503/#1918: Reset counter when CI checks exist (safety valve only for
       // consecutive "no runs"). Issue #1918: do NOT reset while getMergeBlockers is still
       // waiting for PR-triggered workflow runs to register (noWorkflowRunsForCommit). A
@@ -384,7 +428,21 @@ export const watchUntilMergeable = async params => {
             }
             return { success: true, reason: 'auto-merged', latestSessionId, latestAnthropicCost };
           } else {
-            await log(formatAligned('⚠️', 'Auto-merge failed:', mergeResult.error || 'Unknown error', 2));
+            // Issue #2182: an unclassified merge failure used to be logged as
+            // "Will continue monitoring..." and retried every 120 seconds
+            // forever (5384 identical failures in the reported run). Classify
+            // it: self-heal what we can, stop on terminal causes, and cap the
+            // number of consecutive failures for everything else.
+            const decision = await resolveMergeFailure({ error: mergeResult.error, owner, repo, prNumber, $, log, formatAligned, reportError, reportAutomationStop, verbose: argv.verbose, state: guardState });
+            if (decision.action === 'stop') {
+              return { success: false, reason: decision.reason, error: mergeResult.error, latestSessionId, latestAnthropicCost };
+            }
+            if (decision.action === 'retry') {
+              lastCheckTime = currentTime;
+              await interruptibleSleep(DRAFT_RECHECK_DELAY_MS);
+              continue;
+            }
+
             await log(formatAligned('', 'Will continue monitoring...', '', 2));
           }
         } else {
@@ -1250,89 +1308,17 @@ Once the billing issue is resolved, you can re-run the CI checks or push a new c
 const autoMergeAttempt = await import('./solve.auto-merge-attempt.lib.mjs');
 export const { attemptAutoMerge, reportAutoMergeBlockedByIssue } = autoMergeAttempt;
 /**
- * Start auto-restart-until-mergeable mode
+ * Start auto-restart-until-mergeable mode.
+ *
+ * The pre-flight checks (mode detection, base-branch guard, fork detection,
+ * merge permissions) live in solve.auto-merge-preflight.lib.mjs so this file
+ * stays under the 1350-line advisory threshold (issue #1593).
  */
+const { runAutoMergePreflight } = await import('./solve.auto-merge-preflight.lib.mjs');
 export const startAutoRestartUntilMergeable = async params => {
-  const { argv, owner, repo, prNumber } = params;
-  // Determine the mode
-  const isAutoMerge = argv.autoMerge || false;
-  const isAutoRestartUntilMergeable = argv.autoRestartUntilMergeable || false;
-  if (!isAutoMerge && !isAutoRestartUntilMergeable) {
-    return null; // Neither mode enabled
-  }
-  if (!prNumber) {
-    await log('');
-    await log(formatAligned('⚠️', 'Auto-restart-until-mergeable:', 'Requires a pull request'));
-    await log(formatAligned('', 'Note:', 'This mode only works with existing PRs', 2));
-    return null;
-  }
-  await ensurePullRequestBaseBranch({
-    owner,
-    repo,
-    prNumber,
-    argv,
-    log,
-    formatAligned,
-    $,
-    onMismatch: isAutoMerge ? 'throw' : 'restore',
-    operation: isAutoMerge ? 'auto-merge' : 'auto-restart-until-mergeable',
-  });
-  // Issue #1226: Check if running in fork mode — auto-merge cannot work without write access
-  if (argv.fork && isAutoMerge) {
-    await log('');
-    await log(formatAligned('⚠️', 'Auto-merge:', 'Cannot auto-merge fork PRs'));
-    await log(formatAligned('', 'Reason:', 'Fork contributors do not have write access to merge PRs to upstream repositories', 2));
-    await log(formatAligned('', 'Action:', 'PR is ready for manual merge by a repository maintainer', 2));
-    await log('');
-
-    // Issue #1323: Post a comment to the PR notifying the maintainer (with deduplication)
-    try {
-      const readyToMergeSignature = `## ✅ ${READY_TO_MERGE_MARKER}`;
-      const hasExistingComment = await checkForExistingComment(owner, repo, prNumber, readyToMergeSignature, argv.verbose);
-      if (!hasExistingComment) {
-        const commentBody = `## ✅ ${READY_TO_MERGE_MARKER}\n\nThis pull request is ready to be merged. Auto-merge was requested (\`--auto-merge\`) but cannot be performed because this PR was created from a fork (no write access to the target repository).\n\nPlease merge manually.\n\n---\n*hive-mind with --auto-merge flag (fork mode)*`;
-        // Issue #1625: Track so this doesn't falsely count as AI-authored.
-        await postTrackedComment({ $, owner, repo, targetNumber: prNumber, body: commentBody });
-        await log(formatAligned('', '💬 Posted merge readiness notification to PR', '', 2));
-      } else {
-        await log(formatAligned('', `Skipping duplicate "${READY_TO_MERGE_MARKER}" comment`, '', 2));
-      }
-    } catch {
-      // Don't fail if comment posting fails
-    }
-    return { success: false, reason: 'fork_no_write_access' };
-  }
-  // Issue #1226: Verify merge permissions before entering the auto-merge/restart loop
-  if (isAutoMerge && owner && repo) {
-    const { canMerge, permission } = await checkMergePermissions(owner, repo, argv.verbose);
-    if (!canMerge) {
-      await log('');
-      await log(formatAligned('⚠️', 'Auto-merge:', 'Insufficient permissions to merge'));
-      await log(formatAligned('', 'Permission level:', permission || 'unknown', 2));
-      await log(formatAligned('', 'Required:', 'push, maintain, or admin access', 2));
-      await log(formatAligned('', 'Action:', 'PR is ready for manual merge by a repository maintainer', 2));
-      await log('');
-      // Issue #1323: Post a comment to the PR notifying the maintainer (with deduplication)
-      try {
-        const readyToMergeSignature = `## ✅ ${READY_TO_MERGE_MARKER}`;
-        const hasExistingComment = await checkForExistingComment(owner, repo, prNumber, readyToMergeSignature, argv.verbose);
-        if (!hasExistingComment) {
-          const commentBody = `## ✅ ${READY_TO_MERGE_MARKER}\n\nThis pull request is ready to be merged. Auto-merge was requested (\`--auto-merge\`) but cannot be performed because the authenticated user lacks write access to \`${owner}/${repo}\` (current permission: \`${permission || 'unknown'}\`).\n\nPlease merge manually.\n\n---\n*hive-mind with --auto-merge flag*`;
-          // Issue #1625: Track so this doesn't falsely count as AI-authored.
-          await postTrackedComment({ $, owner, repo, targetNumber: prNumber, body: commentBody });
-          await log(formatAligned('', '💬 Posted merge readiness notification to PR', '', 2));
-        } else {
-          await log(formatAligned('', `Skipping duplicate "${READY_TO_MERGE_MARKER}" comment`, '', 2));
-        }
-      } catch {
-        // Don't fail if comment posting fails
-      }
-      return { success: false, reason: 'insufficient_permissions' };
-    }
-  }
-  // If --auto-merge implies --auto-restart-until-mergeable
-  if (isAutoMerge) {
-    argv.autoRestartUntilMergeable = true;
+  const preflight = await runAutoMergePreflight(params);
+  if (preflight.stop) {
+    return preflight.result ?? null;
   }
   // Start the watch loop
   return await watchUntilMergeable(params);

package/src/solve.config.lib.mjs

@@ -230,6 +230,14 @@ export const SOLVE_OPTION_DEFINITIONS = {
     description: 'Maximum number of auto-restart iterations before stopping (default: 5, 0 = unlimited)',
     default: 5,
   },
+  // Issue #2182: the auto-restart-until-mergeable watch loop had no wall-clock
+  // ceiling, so a pull request that could never merge kept a task "processing"
+  // for 4d 12h 13m.
+  'auto-restart-until-mergeable-timeout-hours': {
+    type: 'number',
+    description: 'Maximum wall-clock hours the --auto-restart-until-mergeable/--auto-merge monitoring loop may run before stopping and reporting (default: 24, 0 = unlimited)',
+    default: 24,
+  },
   'resume-on-auto-restart': {
     type: 'boolean',
     description: '[EXPERIMENTAL] Resume the previous Claude session on uncommitted-change auto-restart and send only a minimal restart prompt. Disabled by default.',

package/src/solve.interrupt.lib.mjs

@@ -1,7 +1,8 @@
 /**
  * Interrupt wrapper factory for CTRL+C handling in solve sessions.
  *
- * On SIGINT, auto-commits uncommitted changes and uploads session logs if --attach-logs is enabled.
+ * On SIGINT, auto-commits uncommitted changes, restores the pull request draft state and
+ * uploads session logs if --attach-logs is enabled.
  */
 
 /**
@@ -59,6 +60,22 @@ export const createInterruptWrapper = ({ cleanupContext, checkForUncommittedChan
       }
     }
 
+    // Issue #2182: CTRL+C ends the working session, so the pull request must go back to
+    // "ready for review" exactly like a normal session end. This runs before the log upload
+    // on purpose: it is two fast gh calls, while attaching a multi-MB log can be cut off by
+    // the isolation backend's SIGKILL (#2052). A pull request left in draft can never be
+    // merged by --auto-merge, so restoring it is the more important of the two.
+    try {
+      const { restorePullRequestsLeftInDraft } = await import('./pr-draft-state.lib.mjs');
+      await trace('draft-restore: start');
+      await restorePullRequestsLeftInDraft({ $, log, reason: 'session interrupted (CTRL+C)' });
+      await trace('draft-restore: done');
+    } catch (restoreError) {
+      await log(`⚠️  Could not restore pull request draft state on interrupt: ${restoreError.message}`, {
+        level: 'warning',
+      });
+    }
+
     // Upload logs if --attach-logs is enabled and we have a PR
     if (shouldAttachLogs && ctx.prNumber && ctx.owner && ctx.repo) {
       await log('📎 Uploading interrupted session logs to Pull Request...');

package/src/solve.mjs

@@ -1185,6 +1185,17 @@ try {
       logsAttached = true;
     }
   }
+  // Issue #2182: the AI working session is over at this point — everything below is
+  // monitoring and merging, not working. The pull request must therefore be back in
+  // "ready for review" BEFORE the auto-merge watch loop starts, because that loop can
+  // run for days and endWorkSession() (further down) is unreachable until it returns.
+  // In the reported run the PR was left in draft by an auto-restart iteration and
+  // `gh pr merge` answered "Pull Request is still a draft" 2692 times over 4d 12h.
+  if (prNumber) {
+    const { ensurePullRequestIsReady } = await import('./pr-draft-state.lib.mjs');
+    await ensurePullRequestIsReady({ owner, repo, prNumber, $, log, formatAligned, reason: 'AI working session finished', reportError });
+  }
+
   // Start auto-restart-until-mergeable mode if enabled This runs after the normal watch mode completes (if any) --auto-merge implies --auto-restart-until-mergeable
   if (argv.autoMerge || argv.autoRestartUntilMergeable) {
     const autoMergeResult = await startAutoRestartUntilMergeable({
@@ -1220,6 +1231,14 @@ try {
   await endWorkSession({ isContinueMode, prNumber, argv, log, formatAligned, $, logsAttached });
 } catch (error) {
   await finalizeDevelopmentLog(); // Preserve failed/interrupted sessions too.
+  // Issue #2182: a failed session is still a finished session. Restore every pull request
+  // this process put into draft, otherwise the failure leaves it permanently unmergeable.
+  try {
+    const { restorePullRequestsLeftInDraft } = await import('./pr-draft-state.lib.mjs');
+    await restorePullRequestsLeftInDraft({ $, log, formatAligned, reason: 'working session failed', reportError });
+  } catch (restoreError) {
+    await log(`Warning: Could not restore pull request draft state: ${restoreError.message}`, { level: 'warning' });
+  }
   // Don't report authentication errors to Sentry as they are user configuration issues
   if (!error.isAuthError) {
     reportError(error, {

package/src/solve.repo-setup.lib.mjs

@@ -7,8 +7,18 @@
 // issue comment so it's excluded from --auto-attach-solution-summary's check.
 import { REPOSITORY_INITIALIZATION_REQUIRED_MARKER, postTrackedComment } from './tool-comments.lib.mjs';
 import { QUIET_PROBE } from './quiet-probe.lib.mjs'; // issue #2130: keep read-only probe payloads out of the attached log
+// Issue #2192: a credential helper is never consulted for a *public* clone
+// (github.com answers 200, so git never asks), which is why an authenticated
+// container still got throttled as anonymous. The token has to be sent
+// preemptively, before the first git network call.
+import { ensureAuthenticatedGitTransport } from './git-auth-transport.lib.mjs';
 
 export async function setupRepositoryAndClone({ argv, owner, repo, forkOwner, forkRepoName, tempDir, isContinueMode, issueUrl, log, $, needsClone = true }) {
+  // Issue #2192: authenticate git *before* the first clone/fetch. Doing this
+  // afterwards (as setupGitCredentialHelper does) is too late — the clone is the
+  // call GitHub rejected with "temporarily limiting some unauthenticated downloads".
+  await ensureAuthenticatedGitTransport({ $, log, reason: 'repository setup' });
+
   // Set up repository and handle forking
   const { repoToClone, forkedRepo, upstreamRemote, prForkOwner } = await setupRepository(argv, owner, repo, forkOwner, issueUrl, forkRepoName);
 

package/src/solve.repository.lib.mjs

@@ -31,6 +31,9 @@ import { ensureAiToolScratchIgnored } from './ai-tool-scratch.lib.mjs';
 import { parseForkFullNameFromGhOutput } from './github-repository-names.lib.mjs';
 import { checkReplacementRepositoryBranchSafety } from './solve.repository-safety.lib.mjs';
 import { buildForkReplacementBlockedReason, buildForkReplacementSafetyCheckDescription } from './solve.repository-recovery-message.lib.mjs';
+// Issue #2192: GitHub throttles *anonymous* git downloads; a token must be sent
+// preemptively (a credential helper is never consulted for a public repository).
+import { GIT_AUTH_TRANSPORT_DISABLE, ensureAuthenticatedGitTransport, isAnonymousDownloadLimit } from './git-auth-transport.lib.mjs';
 
 // Import GitHub utilities for permission checks
 const githubLib = await import('./github.lib.mjs');
@@ -949,6 +952,14 @@ export const classifyCloneError = errorOutput => {
     return { type: 'NETWORK', retryable: true, description: 'Network connectivity issue (interrupted transfer)' };
   }
 
+  // Issue #2192: GitHub refusing an *unauthenticated* download. Retryable, but
+  // waiting is not the remedy — the clone has to be authenticated. Checked
+  // before PERMISSION/NOT_FOUND/RATE_LIMIT because GitHub's wording ("limiting",
+  // "retry later or authenticate") overlaps all three.
+  if (isAnonymousDownloadLimit(errorOutput)) {
+    return { type: 'ANONYMOUS_RATE_LIMIT', retryable: true, description: 'GitHub is limiting unauthenticated downloads (this clone was not authenticated)' };
+  }
+
   // Authentication/permission errors - not retryable
   if (output.includes('error: 401') || output.includes('error: 403') || output.includes('authentication failed') || output.includes('permission denied')) {
     return { type: 'PERMISSION', retryable: false, description: 'Authentication or permission error' };
@@ -1075,6 +1086,9 @@ export const cloneRepository = async (repoToClone, tempDir, argv, owner, repo) =
         await log('     • Network connectivity issues');
         if (errorClassification.type === 'TRANSIENT') await log('     • GitHub server issues (temporary)');
         if (errorClassification.type === 'RATE_LIMIT') await log('     • API rate limiting exceeded');
+        // Issue #2192: the request never carried an Authorization header, so
+        // GitHub counted it against the anonymous budget regardless of `gh auth status`.
+        if (errorClassification.type === 'ANONYMOUS_RATE_LIMIT') await log('     • The clone was sent anonymously — GitHub throttles unauthenticated downloads');
         // Issue #1957: the transfer started but was interrupted (e.g. the connection
         // dropped while reading the pack). The retries above were already exhausted.
         if (errorClassification.type === 'NETWORK') await log('     • Connection dropped mid-transfer (the clone was interrupted before completing)');
@@ -1087,6 +1101,11 @@ export const cloneRepository = async (repoToClone, tempDir, argv, owner, repo) =
         if (argv.fork) await log(`     4. Check fork: gh repo view ${repoToClone}`);
         if (errorClassification.type === 'TRANSIENT') await log('     5. Wait and retry / check: https://www.githubstatus.com');
         if (errorClassification.type === 'RATE_LIMIT') await log('     5. Wait for rate limit to reset or use --token with different token');
+        if (errorClassification.type === 'ANONYMOUS_RATE_LIMIT') {
+          await log('     5. Make sure a token is available to git: gh auth token (or set GH_TOKEN)');
+          await log('     6. Repair the git/gh state non-interactively: gh-setup-git-identity --repair');
+          await log(`     7. Hive Mind normally authenticates git itself; if that was turned off, unset ${GIT_AUTH_TRANSPORT_DISABLE}`);
+        }
         if (errorClassification.type === 'NETWORK') {
           await log('     5. Check your network connection / VPN / proxy, then re-run the command');
           await log('     6. On slow or unstable links, a shallower history transfers faster and is less');
@@ -1100,6 +1119,13 @@ export const cloneRepository = async (repoToClone, tempDir, argv, owner, repo) =
     // Retryable error and we have attempts left
     const delay = baseDelay * Math.pow(2, attempt - 1); // Exponential backoff
     await log(`${formatAligned('⚠️', 'Clone failed:', errorClassification.description)}`);
+    // Issue #2192: auto-recovery. GitHub rejected the download as anonymous, so a
+    // plain retry would be rejected the same way. Authenticate the transport (and,
+    // if no token is reachable, let `gh-setup-git-identity --repair` restore the
+    // gh state non-interactively) before spending the next attempt.
+    if (errorClassification.type === 'ANONYMOUS_RATE_LIMIT') {
+      await ensureAuthenticatedGitTransport({ $, log, repair: true, reason: 'GitHub rejected the clone as unauthenticated' });
+    }
     await log(`${formatAligned('⏳', 'Retrying:', `Waiting ${delay / 1000}s before attempt ${attempt + 1}/${maxRetries}...`)}`);
     if (errorClassification.type === 'RATE_LIMIT') {
       await log('     💡 Tip: Rate limiting detected - using longer delay');