@link-assistant/hive-mind 2.16.0 → 2.18.0

package/CHANGELOG.md

@@ -1,5 +1,130 @@
 # @link-assistant/hive-mind
 
+## 2.18.0
+
+### Minor Changes
+
+- 3fc12ef: Recover broken GitHub URLs instead of rejecting them, and say what was repaired (issue #2194).
+
+  A user sent `/Claude https://github.com/G-Ivan-A/aether-orbis/pulls/30`. Telegram drew a healthy GitHub preview card under it, because github.com really does answer `/owner/repo/pulls/30` with **HTTP 200** and a full set of Open Graph tags — a genuinely wrong path like `/pullz/30` 404s and gets no card. The bot then refused the command and told the user to "1. Open the repository: https://github.com/G-Ivan-A/aether-orbis/**pulls/30**" — the same broken link that had just failed. Meanwhile `parseGitHubUrl` had already extracted the number: the pre-fix `case 'pulls'` stored `'30'` in `result.subpath` and nothing ever read it. The data to restore the URL from was sitting in the result object.
+
+  - **`src/github-url-recovery.lib.mjs`** repairs a URL before it is parsed: strips invisible characters (`\p{Cf}`/`\p{Cc}`/`\p{Zl}`/`\p{Zp}`, U+034F, variation selectors), unwraps `[title](url)` / `<url>` / `(url).`, folds full-width and fraction punctuation and full-width digits to ASCII, lower-cases scheme and host, reads `git@github.com:owner/repo.git` and `api.github.com/repos/...` as their web addresses, and reads `/pulls/30` as `/pull/30`, `/issue/123` as `/issues/123`, `/pull/30/files` as the pull request itself.
+  - **Recovery is on by default inside `parseGitHubUrl`**, so all 48 call sites across 14 files get it without changing any of them. `{ recover: false }` reproduces the old code path exactly, which is what makes the before/after evidence reproducible.
+  - **It never invents a GitHub URL.** `gitlab.com`, `bitbucket.org`, `gist.github.com`, `raw.githubusercontent.com`, `github.com.evil.example` and `evil.example/github.com/...` are all still rejected — and so is over-reach in the other direction: `support@github.com` is an email address rather than a repository (`git@github.com:owner/repo.git` still works), and `[the PR](aether-orbis)` stays rejected because unwrapping prose is only worth doing when what comes out already names github.com.
+  - **It never repairs silently.** Every result carries `original`, `repairs[]` and `recovered`, plus `hidden`/`revealed` when something invisible was removed. The Telegram bot (new `telegram.url_recovered` string in `en`/`ru`/`hi`/`zh`), `solve` and `hive` each print what they understood before acting on it.
+  - **Two silent-corruption bugs went with it.** A zero-width space in a repository name used to produce `valid: true` for `aether-orbis%E2%80%8B` — a repository that does not exist. `HTTPS://GITHUB.COM/...` used to parse as a _relative path_ with `HTTPS:` as the owner; the bot's own `url.includes('github.com')` gate had the same flaw and rejected the URL before the parser saw it — that gate now asks the recovery layer whether the text names github.com as its _host_, so `evil.example/github.com/...` no longer passes it either.
+  - **The log could not have proved an invisible character even if there had been one** — it never recorded the message text. `/solve` and its aliases now log raw text through `revealHiddenCharacters()` (a zero-width space appears as `[U+200B]`), and `traceUrlRecovery()` reports each repair stage under `--verbose`.
+
+  `normalize-url@9` and `confusables@1` were installed and measured against these exact inputs rather than assumed: `normalize-url` percent-encodes the zero-width space instead of removing it and **throws** on a full-width colon, and `confusables` turns `github.com/Ćwikła/...` into `github.com/Cwikla/...` — it would silently retarget a real owner. Neither knows that `/pulls/30` means pull request 30.
+
+  77 assertions in `tests/test-issue-2194-broken-url-recovery.mjs`. Timeline, evidence and the full analysis are in `docs/case-studies/issue-2194/README.md`, with reproduction scripts in `experiments/issue-2194/` and `examples/github-url-recovery-demo.mjs`.
+
+## 2.17.0
+
+### Minor Changes
+
+- d37c412: Stop the unbounded agent snapshot leak: refuse pre-0.26.1 Agent CLIs, reclaim orphaned stores, and teach every disk check about `~/.local/share` (issue #2186).
+
+  One 9.5 h task left **115 directories / 31 GB** behind in `~/.local/share/link-assistant-agent/snapshot/`, growing at ~5 GB/h, while every disk check reported a healthy workspace. `@link-assistant/agent` keeps a rollback snapshot per project keyed on the worktree's _root commit_; Hive Mind runs each task in a throwaway checkout, so every run minted a new project, and up to agent 0.26.0 that store was a standalone git object database (no `objects/info/alternates`, ~270 MB each) that nothing ever removed. Hive Mind's own checks were blind to it: `disk-guard.lib.mjs` only looks at `/tmp`, cleanup only walks `/tmp` and `/var/tmp`, and the resource snapshots reported a flat `statfs` reading for `/`.
+
+  - **The leaking CLI is refused, not worked around.** `MIN_AGENT_SNAPSHOT_HYGIENE_VERSION = '0.26.1'` gates `validateAgentConnection` before any other probe, and both images pin `@link-assistant/agent@0.26.1` — the release that writes `objects/info/alternates` from `git rev-parse --git-path objects` and prunes projects whose worktree is gone (link-assistant/agent#298, PR #300). Verified by diffing the published 0.26.0 and 0.26.1 tarballs, not by reading a changelog.
+  - **Hive Mind reclaims orphans itself.** `src/agent-snapshot-store.lib.mjs` deletes a store only when the worktree recorded in `storage/project/<id>.json` no longer exists (or the record is gone) **and** the store has been idle for 15 minutes — agent's own `recentSnapshotAge`. The version floor alone would not be enough: the disk gate runs before agent does, `--tool codex` / `--tool claude` tasks never run agent at all, and a host upgraded from 0.26.0 still carries what it already leaked.
+  - **It runs unconditionally at the end of a task**, not only under `--auto-cleanup`: an orphaned store has no worktree left to restore into, so it has no debugging value.
+  - **The disk model knows about agent state.** The pre-flight disk guard reclaims orphaned stores _before_ solver workspaces (an orphan is pure garbage, a workspace may still be wanted), `hive-cleanup` gained an agent-snapshot category with `--dry-run` reporting and a `--no-agent-snapshots` opt-out, and the `📈 Resource usage` block now reports the store count and size, so `after_agent` shows this growth instead of a flat `/` reading. The size walk is bounded so measuring a 31 GB tree cannot become the next incident, and the resource markers only carry the new fields when there is agent state to report, so existing markers parse unchanged.
+
+  The rest of the stack moves with it: Formal AI 0.339.1 → 0.345.0, Rust 1.96 → 1.98 for the Formal AI builder, `konard/box` and `konard/box-dind` 2.3.5 → 2.4.0, `actions/checkout` and `actions/setup-node` v6 → v7, `@changesets/cli` 3.0.1 → 3.0.2. The Formal AI bump was checked the same way as the agent one: 0.345.0's `Cargo.lock` still carries no `openssl-sys` (so the builder keeps working on a stock `rust:slim` image) and its four memory-contract sources are byte-identical to 0.339.1, so the `memory upgrade-status` / `memory migrate` contract the container updater depends on is unchanged.
+
+  Evidence, reproduction scripts and the full analysis are in `docs/case-studies/issue-2186/README.md` and `experiments/issue-2186/`.
+
+- 5e918d5: Fix the release failure and the CI/CD gaps behind issue #2198.
+
+  - `changeset version` no longer resolves `bun` from a stale root `bun.lock`:
+    the lockfile is removed and `devEngines.packageManager` declares npm, so
+    `@changesets/format` cannot spawn a package manager the runner does not have.
+  - New `scripts/check-package-manager.mjs` guard, run in the lint job, fails
+    loudly if a foreign lockfile or a missing package manager declaration comes
+    back.
+  - Lockfile changes now count as package changes in `detect-code-changes.mjs`,
+    so the guard cannot be gated out.
+  - Every workflow now declares the narrowest default `permissions` that still
+    allows checkout, instead of `read-all`, clearing zizmor's
+    `excessive-permissions` findings.
+  - secretlint was installed on every build but never run as a linter and had no
+    config; `npm run check:secrets` now runs it in the lint job, fail-closed,
+    with a narrow `.secretlintignore` for the fixtures that hold fake secrets on
+    purpose.
+  - A Broken Link Checker workflow (lychee, with a Wayback Machine fallback) and
+    an offline relative-link test now cover documentation links. They catch the
+    `docs/FREE_MODELS.md` case-study link that had pointed at a file which never
+    existed in any commit, in all four translations.
+  - All eight Docker jobs booted buildx through a bare
+    `docker/setup-buildx-action`, so a transient registry outage failed the
+    publish; they now go through a `setup-buildx-resilient` composite action that
+    pre-pulls the pinned BuildKit image with backoff and falls back to a
+    pull-through mirror.
+  - Nothing audited the dependency tree: CodeQL analyses our own source, and
+    `dependency-review-action` only runs on pull requests and only inspects the
+    dependencies a PR changes, so an advisory against a long-pinned package was
+    invisible to both. `security.yml` gains an `npm-audit` job running
+    `npm audit --package-lock-only --audit-level=high`, which also runs on the
+    existing schedule.
+  - actionlint is pinned to 1.7.12 instead of 1.7.7.
+
+  - Eleven links pointed at this repository under its former owner
+    (`deep-assistant/hive-mind`). The GitHub API reports that name as
+    `301 Moved Permanently`, but the pages a reader actually clicks answer 404,
+    so every one of them was broken. All rewritten, including six in a directory
+    the link checker excludes and would never have reported. The suppression list
+    it needed alongside them was also wrong: it carried a `www.npmjs.com` pattern
+    while the README links the bare host, so the rule matched nothing. Both are
+    now asserted — the guard checks that each suppressed URL is genuinely
+    _matched_ by a pattern, not merely mentioned near one.
+  - Kept the 1350-line warning threshold met after merging `main`: issue #2186 grew
+    `src/agent.lib.mjs` to 1357 lines, so the Agent CLI version floors moved to
+    `src/agent.version-gates.lib.mjs` (re-exported, so no importer changed).
+  - The change detector no longer trusts a PR head that was never tested. Issue
+    #1665's incremental `before..after` diff is correct only if the previous head
+    passed, and `cancel-in-progress` means it often had not: a docs commit pushed
+    minutes after a code commit cancels that commit's run and then skips the code
+    jobs itself, leaving the branch green over code no job ever ran.
+    `detect-code-changes.mjs` now asks the Actions API whether a successful run is
+    recorded for the previous head, and widens to the full PR diff whenever the
+    answer is anything else — including when the lookup itself fails, since an
+    unanswerable lookup must not be read as a "yes".
+  - F16: the F4 test matched npm's `allow-scripts` log prefix verbatim, so npm 11.19
+    renaming it to `install-scripts` turned `test-suites` red under a message claiming
+    npm had fixed the underlying bug. It had not — `linkPkg()` still resolves no
+    allowScripts policy, and `--ignore-scripts` is still the only lever that works.
+    The check now keys on the sentence that states the defect, pins both shipped
+    labels as samples, and no longer asserts a cause it cannot distinguish.
+  - F17: CodeQL flagged two of this PR's own test assertions as incomplete URL
+    sanitization. The alert was wrong about the security property — the flagged value
+    is a log the test's own mock wrote, not a URL anyone trusts — and right about the
+    code: `calls.includes('mirror.gcr.io')` was never what "the mirror was contacted"
+    meant. The assertions now compare registry hosts by equality, which retires both
+    alerts at the source and, being exact, immediately caught a retry budget no test
+    had been asserting.
+
+- ce43cc9: Resume a killed session in the container it died in, reconcile executions that outlived their supervisor, and move the whole dependency set forward (issue #2189).
+
+  The first half of #2189 shipped in 2.16.0 with one requirement left open: R2 asked for a killed session to be continued **in the same `$` session / container**, and `$` could not do that yet. The three upstream issues this repository filed — `link-foundation/start#162` (`--resume`), `#164` (argv flattened with `join(' ')`), `#165` (a V8 self-abort reported as `oomKilled=false`) — are delivered in `start-command@0.33.0`, so R2 is closed here and the rest of the toolchain is brought up with it.
+
+  - **Same-container resume.** `src/isolation-runner.resume.lib.mjs` wraps `$ --resume <id> [-- <command>]`, and `src/session-kill-resume.in-place.lib.mjs` prefers it over a fresh isolated run: the clone, the caches and the half-finished branch survive the kill instead of being rebuilt from scratch. When in-place resume is unavailable or refused, the previous behaviour — a new isolated session — still runs, and the reason is recorded on the session record (`killRecoveryInPlace`, `killRecoveryResumeMode`) and in the operator's report.
+  - **No more limbo executions.** The bot reconciles at startup with `$ --resume-all`: a container still running is re-attached to, and one that ended while unsupervised is finalized with the exit code it actually had, rather than being polled forever as "executing".
+  - **`$` refusals are read as refusals.** `command-stream`'s `$` _resolves_ on a non-zero exit instead of throwing, so `$ --stop <unknown>` ("No execution found…", exit 1) had been reported to the operator as a stop that happened. Every `$` invocation now inspects the exit code, and both resume wrappers additionally distinguish an older `$` that does not know the verb (`unsupported: true`, so callers keep their old path) from a genuine refusal.
+  - **0.33.0's kill hints are consumed.** `exitReason` and `memoryExhausted` from `$ --status` feed `describeKillCause` directly, so a runtime self-abort is named as out of memory from the supervisor's own answer rather than only from log forensics.
+  - **The dependency set is current, and what changed in it is used.** `@changesets/cli` 2 → 3, `jscpd` 4 → 5, `@sentry/node` 10.62 → 10.73, `prettier` 3.8.5 → 3.9.6, `agent-commander` 0.8 → 0.10, `dayjs` 1.11.21 → 1.11.23, `eslint` 10.5 → 10.9, `lint-staged` 17.0 → 17.4, secretlint 13.0.2 → 13.0.5, `lino-objects-codec` 0.4 → 0.8, `lino-i18n` 0.1 → 0.2.
+
+  Three of those bumps were behaviour changes that needed work rather than a version number:
+
+  - `changeset version` **exits 1** when there are no unreleased changesets in 3.0, where 2.x warned and exited 0. The release job reads the changeset count before rebasing onto the remote, and the rebase can consume the very changesets the decision was made on — a race that turned into a red release. `versionAndCommit` re-reads the count after the rebase and reports the already-published version through the existing `already_released` path.
+  - `jscpd` 5 is a Rust rewrite that treats `skipComments` as an **unknown field**: it warned and silently fell back to `mode: mild`, quietly loosening the duplication gate. `.jscpd.json` now says `"mode": "weak"`, which is what that option means in 5.
+  - `@sentry/node` 10.71+ turns structured logs on by default, and they bypass `beforeSend` entirely. The redaction this repository relies on was therefore no longer covering everything it left through; `src/instrument.sanitize.lib.mjs` is now shared between `beforeSend` and a new `beforeSendLog` hook, so both surfaces are scrubbed by the same code.
+
+  `node-pty` (pulled in by `agent-commander` 0.10's real-TUI capture) is denied a native build in `allowScripts`: it runs in a separate spawned pty host that this repository never launches headlessly.
+
+  Evidence for every claim above — including the two dependency behaviours that were checked and found _not_ to affect this repository — is in `docs/case-studies/issue-2189/README.md` under "Dependency Follow-Through", with the reproduction scripts in `experiments/issue-2189/`.
+
 ## 2.16.0
 
 ### Minor Changes

package/README.hi.md

@@ -797,6 +797,18 @@ solve https://github.com/owner/repo/issues/123 --resume 657e6db1-6eb3-4a8d
 (cd /tmp/gh-issue-solver-123456789 && claude --resume session-id)
 ```
 
+**मारे गए सत्र स्वयं को पुनर्प्राप्त करते हैं।** `--on-session-kill=resume` (डिफ़ॉल्ट) के साथ, आउट-ऑफ़-मेमोरी
+किलर, भरी हुई डिस्क या फोर्स्ड किल से मारा गया कार्य सत्र स्वचालित रूप से पुनः आरंभ होता है, जिसकी सीमा
+`--session-kill-resume-attempts` तय करती है। जब आइसोलेशन बैकएंड अनुमति देता है और `$`
+(`start-command`) कम से कम 0.33.0 है, तब रिकवरी सत्र शून्य से शुरू करने के बजाय **उसी कंटेनर में
+फिर से प्रवेश करता है**, इसलिए क्लोन, कैश और अधूरी ब्रांच सुरक्षित रहते हैं।
+
+**बॉट के पुनः आरंभ से चालू काम अनाथ नहीं होता।** शुरू होते समय Telegram बॉट आइसोलेशन बैकएंड के अपने
+चालू निष्पादनों के दृश्य से मिलान करता है (`$ --resume-all`): जो अभी जीवित है उसे उसका कंप्लीशन वॉचर
+वापस मिल जाता है, और जो बिना निगरानी के समाप्त हो गया उसे अंतिम रूप देकर रिपोर्ट किया जाता है।
+`--on-session-kill` और `--session-kill-resume-attempts` के लिए
+[docs/CONFIGURATION.hi.md](./docs/CONFIGURATION.hi.md) देखें।
+
 ### डिस्क क्लीनअप
 
 `hive-cleanup` पुरानी hive-mind अस्थायी डायरेक्टरी/फ़ाइलों (जैसे प्रति-कार्य क्लोन

package/README.md

@@ -815,6 +815,21 @@ solve https://github.com/owner/repo/issues/123 --resume 657e6db1-6eb3-4a8d
 (cd /tmp/gh-issue-solver-123456789 && claude --resume session-id)
 ```
 
+**Killed sessions recover themselves.** With `--on-session-kill=resume` (the
+default) a working session killed by the out-of-memory killer, a full disk or a
+forced kill is restarted automatically, bounded by
+`--session-kill-resume-attempts`. When the isolation backend allows it and `$`
+(`start-command`) is at least 0.33.0, the recovery session **re-enters the same
+container** instead of starting from scratch, so the clone, the caches and the
+half-finished branch survive.
+
+**A bot restart never orphans in-flight work.** On startup the Telegram bot
+reconciles the isolation backend's own view of still-running executions
+(`$ --resume-all`): what is still alive gets its completion watcher back, what
+died unsupervised is finalized and reported. See
+[docs/CONFIGURATION.md](./docs/CONFIGURATION.md) for `--on-session-kill` and
+`--session-kill-resume-attempts`.
+
 ### Disk Cleanup
 
 `hive-cleanup` frees disk space by removing stale hive-mind temporary

package/README.ru.md

@@ -798,6 +798,21 @@ solve https://github.com/owner/repo/issues/123 --resume 657e6db1-6eb3-4a8d
 (cd /tmp/gh-issue-solver-123456789 && claude --resume session-id)
 ```
 
+**Убитые сессии восстанавливаются сами.** При `--on-session-kill=resume` (по
+умолчанию) рабочая сессия, убитая OOM-киллером, переполненным диском или
+принудительным завершением, перезапускается автоматически — в пределах
+`--session-kill-resume-attempts`. Если это позволяет бэкенд изоляции, а `$`
+(`start-command`) не ниже 0.33.0, восстановительная сессия **входит в тот же
+контейнер**, а не начинает с нуля: клон, кэши и незавершённая ветка остаются на
+месте.
+
+**Перезапуск бота не бросает работу на полпути.** При старте Telegram-бот
+сверяет собственный список выполняющихся запусков бэкенда изоляции
+(`$ --resume-all`): к живым возвращается наблюдатель за завершением, а те, что
+умерли без присмотра, финализируются и попадают в отчёт. Параметры
+`--on-session-kill` и `--session-kill-resume-attempts` описаны в
+[docs/CONFIGURATION.ru.md](./docs/CONFIGURATION.ru.md).
+
 ### Очистка диска
 
 `hive-cleanup` освобождает место на диске, удаляя устаревшие временные каталоги/файлы

package/README.zh.md

@@ -21,18 +21,18 @@
 
 Hive Mind 是一款**通用 AI**（迷你 AGI），能够处理广泛的任务，不仅限于编程。几乎所有可以通过操作仓库文件完成的事情，都可以实现自动化。
 
-| 特性                       | 对您的意义                                                                                                    |
-| -------------------------- | ------------------------------------------------------------------------------------------------------------- |
-| **无需全程盯守**           | 完全自主模式，拥有 sudo 权限。AI 享有像真实程序员一样的创造自由。                                             |
-| **云端隔离**               | 运行在专用虚拟机或 Docker 上，出现问题易于恢复。                                                              |
-| **完整互联网 + Sudo 权限** | AI 可以按需安装软件包、获取文档并配置系统。                                                                   |
-| **预装工具链**             | 25GB+ 开箱即用：10 种语言运行时、2 个定理证明器、构建工具，还可继续安装更多。                                 |
-| **高效利用 Token**         | 常规任务通过代码自动化完成，让 AI Token 专注于创造性问题解决。                                                |
-| **节省时间**               | 人类需要 2~8 小时的工作，AI 每个工作会话仅需 10~25 分钟完成。可批量执行仓库中的任务。"代码在你睡觉时已写好。" |
-| **编排式扩展**             | 并行工作进程犹如一支开发团队。可将 Claude MAX 和 ChatGPT Pro（各 $200）配对，获得两份独立的近乎无限预算。     |
-| **人工控制**               | AI 创建草稿 PR——由您决定是否合并。在关键节点设置质量把关。                                                    |
-| **任意设备编程**           | 通过 Telegram 机器人使用 `/solve` 和 `/hive` 命令，在任意设备上管理 AI，无需 PC、IDE 或笔记本电脑。           |
-| **100% 开源**              | Unlicense（公共领域）。完全透明，无供应商锁定。                                                               |
+| 特性                       | 对您的意义                                                                                                      |
+| -------------------------- | --------------------------------------------------------------------------------------------------------------- |
+| **无需全程盯守**           | 完全自主模式，拥有 sudo 权限。AI 享有像真实程序员一样的创造自由。                                               |
+| **云端隔离**               | 运行在专用虚拟机或 Docker 上，出现问题易于恢复。                                                                |
+| **完整互联网 + Sudo 权限** | AI 可以按需安装软件包、获取文档并配置系统。                                                                     |
+| **预装工具链**             | 25GB+ 开箱即用：10 种语言运行时、2 个定理证明器、构建工具，还可继续安装更多。                                   |
+| **高效利用 Token**         | 常规任务通过代码自动化完成，让 AI Token 专注于创造性问题解决。                                                  |
+| **节省时间**               | 人类需要 2～8 小时的工作，AI 每个工作会话仅需 10～25 分钟完成。可批量执行仓库中的任务。"代码在你睡觉时已写好。" |
+| **编排式扩展**             | 并行工作进程犹如一支开发团队。可将 Claude MAX 和 ChatGPT Pro（各 $200）配对，获得两份独立的近乎无限预算。       |
+| **人工控制**               | AI 创建草稿 PR——由您决定是否合并。在关键节点设置质量把关。                                                      |
+| **任意设备编程**           | 通过 Telegram 机器人使用 `/solve` 和 `/hive` 命令，在任意设备上管理 AI，无需 PC、IDE 或笔记本电脑。             |
+| **100% 开源**              | Unlicense（公共领域）。完全透明，无供应商锁定。                                                                 |
 
 **费用**：Hive Mind 支持两种 $200/月订阅作为功能完整、近乎“无限”的选项：
 
@@ -788,6 +788,18 @@ solve https://github.com/owner/repo/issues/123 --resume 657e6db1-6eb3-4a8d
 (cd /tmp/gh-issue-solver-123456789 && claude --resume session-id)
 ```
 
+**被杀死的会话会自我恢复。** 使用 `--on-session-kill=resume`（默认值）时，被
+OOM killer、磁盘写满或强制终止杀死的工作会话会自动重启，次数受
+`--session-kill-resume-attempts` 限制。当隔离后端允许且 `$`（`start-command`）
+不低于 0.33.0 时，恢复会话会**重新进入同一个容器**，而不是从零开始，因此克隆、
+缓存和未完成的分支都得以保留。
+
+**重启机器人不会遗弃进行中的工作。** Telegram 机器人启动时会与隔离后端自身记录的
+运行中执行进行对账（`$ --resume-all`）：仍存活的会重新挂上完成监视器，在无人监管
+时已经结束的则被最终确认并上报。`--on-session-kill` 与
+`--session-kill-resume-attempts` 的说明参见
+[docs/CONFIGURATION.zh.md](./docs/CONFIGURATION.zh.md)。
+
 ### 磁盘清理
 
 `hive-cleanup` 通过删除过时的 hive-mind 临时目录/文件（如每个任务的克隆

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "2.16.0",
+  "version": "2.18.0",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",
@@ -24,12 +24,13 @@
     "lint": "eslint 'src/**/*.{js,mjs,cjs}' 'scripts/**/*.{js,mjs,cjs}' 'eslint-rules/**/*.{js,mjs,cjs}' 'tests/**/*.{js,mjs,cjs}'",
     "lint:fix": "eslint 'src/**/*.{js,mjs,cjs}' 'scripts/**/*.{js,mjs,cjs}' 'eslint-rules/**/*.{js,mjs,cjs}' 'tests/**/*.{js,mjs,cjs}' --fix",
     "check:duplication": "jscpd .",
+    "check:secrets": "secretlint --secretlintignore .secretlintignore \"**/*\"",
     "format": "prettier --write \"**/*.{js,mjs,json,md}\" --ignore-path .prettierignore",
     "format:check": "prettier --check \"**/*.{js,mjs,json,md}\" --ignore-path .prettierignore",
     "changeset": "changeset",
     "changeset:version": "changeset version",
     "changeset:publish": "npm run build:pre && changeset publish",
-    "build:pre": "chmod +x src/hive.mjs && chmod +x src/solve.mjs && chmod +x src/fix.mjs && chmod +x src/configure-claude.mjs && chmod +x src/hive-screens.mjs",
+    "build:pre": "chmod +x src/hive.mjs && chmod +x src/solve.mjs && chmod +x src/task.mjs && chmod +x src/fix.mjs && chmod +x src/cleanup.mjs && chmod +x src/review.mjs && chmod +x src/configure-claude.mjs && chmod +x src/start-screen.mjs && chmod +x src/hive-screens.mjs && chmod +x src/telegram-bot.mjs",
     "prepare": "husky"
   },
   "repository": {
@@ -53,34 +54,39 @@
   "engines": {
     "node": ">=24.0.0"
   },
+  "devEngines": {
+    "packageManager": {
+      "name": "npm"
+    }
+  },
   "files": [
     "src",
     "*.md"
   ],
   "devDependencies": {
-    "@changesets/cli": "^2.31.0",
+    "@changesets/cli": "^3.0.2",
     "@eslint/js": "^10.0.1",
-    "eslint": "^10.5.0",
+    "eslint": "^10.9.1",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-prettier": "^5.5.6",
     "husky": "^9.1.7",
-    "jscpd": "^4.0.5",
-    "lint-staged": "^17.0.8",
-    "prettier": "^3.8.5",
+    "jscpd": "^5.1.2",
+    "lint-staged": "^17.4.1",
+    "prettier": "^3.9.6",
     "test-anywhere": "^0.9.1"
   },
   "dependencies": {
-    "@secretlint/core": "^13.0.2",
-    "@secretlint/secretlint-rule-preset-recommend": "^13.0.2",
-    "@sentry/node": "^10.62.0",
-    "@sentry/profiling-node": "^10.62.0",
-    "agent-commander": "^0.8.0",
-    "dayjs": "^1.11.21",
+    "@secretlint/core": "^13.0.5",
+    "@secretlint/secretlint-rule-preset-recommend": "^13.0.5",
+    "@sentry/node": "^10.73.0",
+    "@sentry/profiling-node": "^10.73.0",
+    "agent-commander": "^0.10.1",
+    "dayjs": "^1.11.23",
     "decimal.js-light": "^2.5.1",
     "lino-arguments": "^0.3.0",
-    "lino-i18n": "^0.1.1",
-    "lino-objects-codec": "^0.4.0",
-    "secretlint": "^13.0.2",
+    "lino-i18n": "^0.2.0",
+    "lino-objects-codec": "^0.8.0",
+    "secretlint": "^13.0.5",
     "semver": "^7.8.5",
     "tinyld": "^1.3.4"
   },
@@ -90,6 +96,7 @@
     ]
   },
   "allowScripts": {
-    "@sentry/node-cpu-profiler@2.4.2": true
+    "@sentry/node-cpu-profiler@2.4.3": true,
+    "node-pty@1.2.0-beta.15": false
   }
 }

package/src/agent-snapshot-store.lib.mjs

@@ -0,0 +1,252 @@
+/**
+ * Reclaim orphaned `@link-assistant/agent` snapshot stores (issue #2186).
+ *
+ * Agent keeps a rollback snapshot per project in
+ * `$XDG_DATA_HOME/link-assistant-agent/snapshot/<project id>`, where the project
+ * id is the worktree's *root commit*, and records the worktree it belongs to in
+ * `storage/project/<project id>.json`. Hive Mind runs its tools in throwaway
+ * checkouts, so every fresh `git init` looks like a brand-new project and gets
+ * its own store; up to agent 0.26.0 that store was a standalone object database
+ * (no `objects/info/alternates`) that nothing ever removed. One 9.5 h task left
+ * 115 stores / 31 GB behind, ~270 MB each, at ~5 GB/h.
+ *
+ * Agent 0.26.1 fixes both halves upstream — it shares the repository's objects
+ * and prunes dead projects itself (link-assistant/agent#298) — and
+ * `src/agent.lib.mjs` refuses to run on anything older. That is not the whole
+ * story for Hive Mind, for three reasons:
+ *
+ *   - agent only prunes when agent runs, and the disk gate that decides whether
+ *     a task may start at all runs *before* that (and before any `--tool codex`
+ *     / `--tool claude` task, which never runs agent);
+ *   - a host upgraded from 0.26.0 still carries whatever it leaked before;
+ *   - `disk-guard.lib.mjs`, `cleanup.lib.mjs` and the 10 GB pre-flight gate only
+ *     ever looked at `/tmp`, so this growth was invisible to every disk check
+ *     Hive Mind owns — the exact blind spot issue #2186 reported.
+ *
+ * The pruning rule is the conservative one from the issue: a store is garbage
+ * only when the worktree its project record points at no longer exists (or the
+ * record is gone entirely) *and* the store has been idle for `minIdleMs`. A
+ * store whose worktree is still on disk belongs to a live checkout and is never
+ * touched, so this cannot interfere with a concurrent session. Orphans have no
+ * debugging value either — there is nothing left to restore them into — so this
+ * is not gated on `--auto-cleanup`.
+ *
+ * Every side effect (readdir, stat, rm, clock) is injectable so the behaviour is
+ * unit-testable without a real agent installation.
+ *
+ * @see https://github.com/link-assistant/hive-mind/issues/2186
+ * @see https://github.com/link-assistant/agent/issues/298
+ */
+
+import fsPromises from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+/** Directory agent creates under the XDG data home. */
+export const AGENT_DATA_DIR_NAME = 'link-assistant-agent';
+
+/**
+ * A store modified this recently is never reclaimed. 15 minutes is agent's own
+ * `recentSnapshotAge` (src/project/project.ts), which is what keeps a store that
+ * was just created — before its project record has been written — from being
+ * mistaken for an orphan.
+ */
+export const DEFAULT_AGENT_SNAPSHOT_MIN_IDLE_MS = 15 * 60 * 1000;
+
+/** `$XDG_DATA_HOME/link-assistant-agent`, or `~/.local/share/link-assistant-agent`. */
+export const getAgentDataHome = ({ env = process.env, homeDir = os.homedir } = {}) => {
+  const xdgDataHome = String(env?.XDG_DATA_HOME || '').trim();
+  const dataRoot = xdgDataHome || path.join(homeDir(), '.local', 'share');
+  return path.join(dataRoot, AGENT_DATA_DIR_NAME);
+};
+
+/** Every `snapshot/<project id>` directory, oldest modification first. */
+export const listAgentSnapshotStores = async ({ dataHome = getAgentDataHome(), fileSystem = fsPromises } = {}) => {
+  const snapshotRoot = path.join(dataHome, 'snapshot');
+  let names;
+  try {
+    names = await fileSystem.readdir(snapshotRoot);
+  } catch {
+    return [];
+  }
+  const stores = [];
+  for (const entry of names) {
+    const name = typeof entry === 'string' ? entry : entry?.name;
+    if (!name) continue;
+    const storePath = path.join(snapshotRoot, name);
+    try {
+      const stats = await fileSystem.stat(storePath);
+      if (!stats.isDirectory()) continue;
+      stores.push({ id: name, path: storePath, mtimeMs: Number(stats.mtimeMs) || 0 });
+    } catch {
+      continue;
+    }
+  }
+  return stores.sort((a, b) => a.mtimeMs - b.mtimeMs);
+};
+
+/**
+ * The worktree agent recorded for a project id, `null` when there is no usable
+ * record. A missing record is not an error: agent writes the store first.
+ */
+export const readAgentProjectWorktree = async ({ dataHome = getAgentDataHome(), projectId, fileSystem = fsPromises } = {}) => {
+  try {
+    const raw = await fileSystem.readFile(path.join(dataHome, 'storage', 'project', `${projectId}.json`), 'utf8');
+    const worktree = JSON.parse(String(raw))?.worktree;
+    return typeof worktree === 'string' && worktree ? worktree : null;
+  } catch {
+    return null;
+  }
+};
+
+/** True when `worktree` still exists as a directory. */
+const isWorktreeAlive = async (worktree, fileSystem) => {
+  if (!worktree) return false;
+  try {
+    return (await fileSystem.stat(worktree)).isDirectory();
+  } catch {
+    return false;
+  }
+};
+
+/**
+ * Split the stores into the ones that are safe to delete and the ones that must
+ * stay, with the reason for each so `hive-cleanup --dry-run` can explain itself.
+ *
+ * @returns {Promise<{orphaned: Array<{id: string, path: string, mtimeMs: number, worktree: string|null, reason: string}>, keep: Array<{id: string, path: string, mtimeMs: number, worktree: string|null, reason: string}>}>}
+ */
+export const classifyAgentSnapshotStores = async ({ dataHome = getAgentDataHome(), minIdleMs = DEFAULT_AGENT_SNAPSHOT_MIN_IDLE_MS, now = Date.now, fileSystem = fsPromises, stores = null } = {}) => {
+  const candidates = stores || (await listAgentSnapshotStores({ dataHome, fileSystem }));
+  const currentTime = now();
+  const orphaned = [];
+  const keep = [];
+  for (const store of candidates) {
+    const worktree = await readAgentProjectWorktree({ dataHome, projectId: store.id, fileSystem });
+    if (await isWorktreeAlive(worktree, fileSystem)) {
+      keep.push({ ...store, worktree, reason: 'worktree_alive' });
+      continue;
+    }
+    if (currentTime - store.mtimeMs < minIdleMs) {
+      keep.push({ ...store, worktree, reason: 'recently_modified' });
+      continue;
+    }
+    orphaned.push({ ...store, worktree, reason: worktree ? 'worktree_gone' : 'no_project_record' });
+  }
+  return { orphaned, keep };
+};
+
+/** Human-readable form of the reasons produced by {@link classifyAgentSnapshotStores}. */
+export const describeAgentSnapshotReason = reason =>
+  ({
+    worktree_alive: 'worktree still exists',
+    recently_modified: 'modified too recently to be considered idle',
+    worktree_gone: 'recorded worktree no longer exists',
+    no_project_record: 'no project record, idle',
+    remove_failed: 'could not be removed',
+  })[reason] || reason;
+
+const defaultRemove = async targetPath => fsPromises.rm(targetPath, { recursive: true, force: true });
+
+/**
+ * Delete every orphaned store. Stops early once `stopWhenFreeMB` megabytes are
+ * free, which is what lets the disk guard reclaim only as much as a task needs.
+ *
+ * @returns {Promise<{removed: Array<string>, skipped: Array<object>, freeMB: number|null}>}
+ */
+export const reclaimAgentSnapshotStores = async ({ dataHome = getAgentDataHome(), minIdleMs = DEFAULT_AGENT_SNAPSHOT_MIN_IDLE_MS, stopWhenFreeMB = null, getFreeMB = null, now = Date.now, log = async () => {}, fileSystem = fsPromises, remove = defaultRemove } = {}) => {
+  const { orphaned, keep } = await classifyAgentSnapshotStores({ dataHome, minIdleMs, now, fileSystem });
+  const removed = [];
+  const skipped = keep.map(store => ({ path: store.path, reason: store.reason }));
+  let freeMB = getFreeMB ? await getFreeMB(dataHome) : null;
+  for (const store of orphaned) {
+    if (stopWhenFreeMB !== null && freeMB !== null && freeMB >= stopWhenFreeMB) break;
+    try {
+      await remove(store.path);
+      removed.push(store.path);
+      await log(`   🧹 Reclaimed orphaned agent snapshot store: ${store.path} (${describeAgentSnapshotReason(store.reason)})`);
+    } catch (error) {
+      skipped.push({ path: store.path, reason: 'remove_failed', error });
+      await log(`   ⚠️  Could not remove ${store.path}: ${error.message}`, { level: 'warning' });
+      continue;
+    }
+    if (getFreeMB) freeMB = await getFreeMB(dataHome);
+  }
+  return { removed, skipped, freeMB };
+};
+
+/**
+ * Upper bound on directory entries visited while sizing the agent data home.
+ * The whole point of issue #2186 is that this tree can hold tens of gigabytes of
+ * loose git objects, so an unbounded `du` in the middle of a logging call would
+ * be the second bug. When the cap is hit the result is reported as `truncated`
+ * and the byte count is a lower bound.
+ */
+export const AGENT_SNAPSHOT_USAGE_ENTRY_LIMIT = 20_000;
+
+/**
+ * How much disk the agent snapshot stores currently occupy, for the resource
+ * snapshots in `solve.resource-diagnostics.lib.mjs`. Before issue #2186 the
+ * `RESOURCE_PHASE_AFTER_AGENT` line only showed a flat `/` reading, so 5 GB/h of
+ * growth under `~/.local/share` was invisible in the solve log.
+ *
+ * @returns {Promise<{path: string, count: number, bytes: number, truncated: boolean}>}
+ */
+export const measureAgentSnapshotUsage = async ({ dataHome = getAgentDataHome(), fileSystem = fsPromises, entryLimit = AGENT_SNAPSHOT_USAGE_ENTRY_LIMIT } = {}) => {
+  const stores = await listAgentSnapshotStores({ dataHome, fileSystem });
+  const statPath = fileSystem.lstat ? fileSystem.lstat.bind(fileSystem) : fileSystem.stat.bind(fileSystem);
+  let bytes = 0;
+  let visited = 0;
+  let truncated = false;
+
+  const walk = async directory => {
+    let names;
+    try {
+      names = await fileSystem.readdir(directory);
+    } catch {
+      return;
+    }
+    for (const entry of names) {
+      if (visited >= entryLimit) {
+        truncated = true;
+        return;
+      }
+      const name = typeof entry === 'string' ? entry : entry?.name;
+      if (!name) continue;
+      visited += 1;
+      const child = path.join(directory, name);
+      let stats;
+      try {
+        stats = await statPath(child);
+      } catch {
+        continue;
+      }
+      if (stats.isDirectory()) {
+        await walk(child);
+        continue;
+      }
+      // Symlinks are counted as their own (tiny) size, never followed: agent
+      // 0.26.1 links stores to the repository object database, and following
+      // those would report the checkout's objects as agent state.
+      bytes += Number(stats.size) || 0;
+    }
+  };
+
+  for (const store of stores) {
+    await walk(store.path);
+  }
+
+  return { path: dataHome, count: stores.length, bytes, truncated };
+};
+
+export default {
+  AGENT_DATA_DIR_NAME,
+  AGENT_SNAPSHOT_USAGE_ENTRY_LIMIT,
+  classifyAgentSnapshotStores,
+  DEFAULT_AGENT_SNAPSHOT_MIN_IDLE_MS,
+  describeAgentSnapshotReason,
+  getAgentDataHome,
+  listAgentSnapshotStores,
+  measureAgentSnapshotUsage,
+  readAgentProjectWorktree,
+  reclaimAgentSnapshotStores,
+};