@link-assistant/hive-mind 2.10.0 → 2.10.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @link-assistant/hive-mind
 
+## 2.10.2
+
+### Patch Changes
+
+- 4e41ee5: Sanitize credentials consistently across terminal output, logs, development-log artifacts, error telemetry, uploads, and GitHub publication boundaries.
+
+## 2.10.1
+
+### Patch Changes
+
+- a9b0967: Fix killed Telegram task resume instructions by recovering the last tool session from the complete task log, rejecting unrelated shared-directory session logs, and preserving the original slash-command alias through queued and restarted sessions.
+
 ## 2.10.0
 
 ### Minor Changes

package/README.hi.md

@@ -86,6 +86,8 @@ Hive Mind में औसत प्रोग्रामर से अलग
 - कभी भी उत्पादन टोकन या क्रेडेंशियल का उपयोग न करना
 - इस सिस्टम के साथ उपयोग किए गए सभी टोकन को रद्द और प्रतिस्थापित करने के लिए तैयार रहना
 
+Hive Mind अपने प्रबंधित terminal, log, telemetry, upload और GitHub publication paths में पहचाने गए credentials को sanitize करता है। Scanner विफल होने पर publication रोक दिया जाता है, लेकिन यह किसी autonomous tool को किसी असंबंधित exfiltration path का उपयोग करने से नहीं रोकता। Masking contract, supported formats, maintenance process और incident-response guidance के लिए [Credential sanitization](./docs/CREDENTIAL-SANITIZATION.hi.md) देखें।
+
 `hive.mjs` चलाने के लिए न्यूनतम सिस्टम आवश्यकताएँ:
 
 ```

package/README.md

@@ -86,6 +86,8 @@ We strongly recommend:
 - Never using production tokens or credentials
 - Being prepared to revoke and replace all tokens used with this system
 
+Hive Mind sanitizes recognized credentials in its maintained terminal, log, telemetry, upload, and GitHub publication paths. Publication is blocked if the scanner fails, but this does not prevent an autonomous tool from using an unrelated exfiltration path. See [Credential sanitization](./docs/CREDENTIAL-SANITIZATION.md) for the masking contract, supported formats, maintenance process, and incident-response guidance.
+
 Minimum system requirements to run `hive.mjs`:
 
 ```

package/README.ru.md

@@ -86,6 +86,8 @@ Hive Mind обладает высоким уровнем творчества,
 - Никогда не использовать производственные токены или учётные данные
 - Быть готовыми отозвать и заменить все токены, используемые в этой системе
 
+Hive Mind скрывает распознанные учётные данные в обслуживаемых им путях вывода терминала, журналов, телеметрии, загрузок и публикаций GitHub. При сбое сканера публикация блокируется, однако это не мешает автономному инструменту использовать посторонний канал утечки. Соглашение о маскировании, поддерживаемые форматы, процесс сопровождения и рекомендации по реагированию на инциденты приведены в разделе [Санитизация учётных данных](./docs/CREDENTIAL-SANITIZATION.ru.md).
+
 Минимальные системные требования для запуска `hive.mjs`:
 
 ```

package/README.zh.md

@@ -86,6 +86,8 @@ Hive Mind 具备与普通程序员无异的高度创造力。当需求不明确
 - 切勿使用生产环境的 Token 或凭证
 - 做好随时撤销并替换本系统所用所有 Token 的准备
 
+Hive Mind 会在其维护的终端、日志、遥测、上传和 GitHub 发布路径中清理可识别的凭证。如果扫描器失败，发布会被阻止；但这无法阻止自主工具通过不相关的路径泄露数据。有关掩码约定、支持的格式、维护流程和事件响应指南，请参阅[凭证清理](./docs/CREDENTIAL-SANITIZATION.zh.md)。
+
 运行 `hive.mjs` 的最低系统要求：
 
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "2.10.0",
+  "version": "2.10.2",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",

package/src/claude.lib.mjs

@@ -601,10 +601,6 @@ export const executeClaudeCommand = async params => {
         $,
         log,
         verbose: argv.verbose,
-        // Issue #1745: thread the three independent dangerous-skip flags through
-        // so the comment-posting path can honor them; flags default to false.
-        skipOutputSanitization: argv['dangerously-skip-output-sanitization'] === true,
-        skipActiveTokensOutputSanitization: argv['dangerously-skip-active-tokens-output-sanitization'] === true,
         // Issue #1843: upload & embed images by default; --no-interactive-image-upload opts out.
         imageUploadEnabled: argv['interactive-image-upload'] !== false,
       });

package/src/cleanup.mjs

@@ -39,6 +39,10 @@ import { isConfirmationYes, readConfirmationLine } from './confirmation.lib.mjs'
 import { classifyEntries, summarize, formatBytes, describeReason, buildActiveMatchers, DEFAULT_PROTECTED_NAMES, formatEntryContext, formatTaskSummary, DEFAULT_DOCKER_ISOLATION_CLEANUP_MODE, describeDockerIsolationReason, formatDockerIsolationContainerSummary, normalizeDockerIsolationCleanupMode, planDockerIsolationCleanup } from './cleanup.lib.mjs';
 import { getTempRoot, listTempEntries, getPathSize, readFolderGitInfo, listProcessHeldPaths, getActiveTasks, listSessionTasks, removePath, runSystemCleanup, collectProcessDebugReport, signalOrphanedAgentTrees, listDockerIsolationContainers, removeDockerContainer } from './cleanup.os.lib.mjs';
 import { formatProcessDebugReport } from './process-debug.lib.mjs';
+import { setupStdioLogInterceptor } from './lib.mjs';
+import { sanitizeCredentialText } from './credential-sanitization-core.lib.mjs';
+
+setupStdioLogInterceptor();
 
 const args = process.argv.slice(2);
 
@@ -179,15 +183,22 @@ const scriptDir = path.dirname(process.argv[1]);
 const logFile = path.join(scriptDir, `cleanup-${timestamp}.log`);
 
 async function log(message, { level = 'info' } = {}) {
-  await fsp.appendFile(logFile, `[${new Date().toISOString()}] [${level.toUpperCase()}] ${message}\n`).catch(() => {});
-  if (level === 'error') console.error(message);
-  else if (level === 'warn' || level === 'warning') console.warn(message);
-  else console.log(message);
+  const sanitizedMessage = sanitizeCredentialText(message);
+  await fsp
+    .appendFile(logFile, `[${new Date().toISOString()}] [${level.toUpperCase()}] ${sanitizedMessage}\n`, { mode: 0o600 })
+    .then(() => fsp.chmod(logFile, 0o600))
+    .catch(() => {});
+  if (level === 'error') console.error(sanitizedMessage);
+  else if (level === 'warn' || level === 'warning') console.warn(sanitizedMessage);
+  else console.log(sanitizedMessage);
 }
 
 function vlog(message) {
   if (options.verbose) return log(message);
-  return fsp.appendFile(logFile, `[${new Date().toISOString()}] [DEBUG] ${message}\n`).catch(() => {});
+  return fsp
+    .appendFile(logFile, `[${new Date().toISOString()}] [DEBUG] ${sanitizeCredentialText(message)}\n`, { mode: 0o600 })
+    .then(() => fsp.chmod(logFile, 0o600))
+    .catch(() => {});
 }
 
 /**
@@ -210,7 +221,8 @@ function computeSelfPaths(tempRoot) {
 }
 
 async function main() {
-  await fsp.writeFile(logFile, `# Cleanup Log - ${new Date().toISOString()}\n\n`).catch(() => {});
+  await fsp.writeFile(logFile, `# Cleanup Log - ${new Date().toISOString()}\n\n`, { mode: 0o600 }).catch(() => {});
+  await fsp.chmod(logFile, 0o600).catch(() => {});
 
   const tempRoot = getTempRoot();
   await log('🧹 hive-mind cleanup');

package/src/codex.lib.mjs

@@ -911,10 +911,6 @@ export const executeCodexCommand = async params => {
           $,
           log,
           verbose: argv.verbose,
-          // Issue #1745: pass the three independent dangerous-skip flags so the
-          // comment-posting path can honor them. All default to false.
-          skipOutputSanitization: argv['dangerously-skip-output-sanitization'] === true,
-          skipActiveTokensOutputSanitization: argv['dangerously-skip-active-tokens-output-sanitization'] === true,
           // Issue #1843: upload & embed images by default; --no-interactive-image-upload opts out.
           imageUploadEnabled: argv['interactive-image-upload'] !== false,
         });

package/src/configure-claude.mjs

@@ -15,6 +15,9 @@
  */
 
 import { CONFIGURE_CLAUDE_HELP, formatVerifyReport, parseConfigureClaudeArgs, resolveSettingsPath, runConfigureClaude, verifyConfigureClaude } from './configure-claude.lib.mjs';
+import { setupStdioLogInterceptor } from './lib.mjs';
+
+setupStdioLogInterceptor();
 
 const args = parseConfigureClaudeArgs(process.argv.slice(2));
 

package/src/credential-sanitization-core.lib.mjs

@@ -0,0 +1,231 @@
+/**
+ * Dependency-free credential sanitization primitives.
+ *
+ * This module deliberately has no project imports. It is safe to use from the
+ * lowest-level terminal and logging code, before asynchronous scanners such as
+ * Secretlint have been initialized.
+ */
+
+import { StringDecoder } from 'node:string_decoder';
+
+export const CREDENTIAL_SANITIZATION_ERROR_CODE = 'ERR_CREDENTIAL_SANITIZATION';
+export const CREDENTIAL_SANITIZATION_FAILURE_MESSAGE = 'Credential sanitization failed; publication was blocked.';
+
+const MASKED_VALUE = /^(?:\[REDACTED\]|.{3}….{3})$/u;
+
+export const maskToken = token => {
+  const value = String(token ?? '');
+  if (value.length <= 12) return '[REDACTED]';
+  return `${value.slice(0, 3)}…${value.slice(-3)}`;
+};
+
+const maskValue = value => {
+  if (!value || MASKED_VALUE.test(value)) return value;
+  return maskToken(value);
+};
+
+const escapeRegExp = value => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+const VENDOR_PATTERNS = Object.freeze([
+  // GitHub: classic, fine-grained, OAuth, user-to-server, server-to-server,
+  // refresh, and the stateless server token family.
+  /\b(?:github_pat_|gh[pousr]_)[A-Za-z0-9_]{16,}\b/g,
+  /\bghs_[A-Za-z0-9_]{16,}\b/g,
+  // GitLab personal/project/group/access, OAuth, deploy, runner, CI,
+  // feature-flag, session and agent token families.
+  /\b(?:glpat|gloas|gldt|glrt|glrtr|glcbt|glptt|glft|glimt|glagent|glwt|glsoat|glffct)-[A-Za-z0-9_-]{16,}\b/g,
+  // OpenAI and Anthropic.
+  /\bsk-(?:proj-|svcacct-|admin-)?[A-Za-z0-9_-]{16,}\b/g,
+  /\bsk-ant-(?:api\d{2}-)?[A-Za-z0-9_-]{16,}\b/g,
+  // AWS access-key IDs. Secret keys and session tokens are caught by their
+  // assignment/header context below.
+  /\b(?:A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}\b/g,
+  // Google/GCP API keys and OAuth client secrets.
+  /\bAIza[0-9A-Za-z_-]{32,40}\b/g,
+  /\bGOCSPX-[0-9A-Za-z_-]{16,}\b/g,
+  // Azure application secrets are additionally caught by generic key names
+  // such as AccountKey and client_secret. SAS values need a structured rule
+  // below so the SharedAccessSignature scheme remains visible.
+  // Slack app, bot, user, workspace and configuration tokens.
+  /\b(?:xox[a-z]|xapp|xwfp)-[0-9A-Za-z-]{20,}\b/g,
+  // Stripe secret/restricted/publishable keys and webhook signing secrets.
+  /\b(?:sk|rk|pk)_(?:live|test)_[0-9A-Za-z]{16,}\b/g,
+  /\bwhsec_[0-9A-Za-z]{16,}\b/g,
+  // SendGrid, Twilio, npm and PyPI.
+  /\bSG\.[0-9A-Za-z_-]{10,}\.[0-9A-Za-z_-]{20,}\b/g,
+  /\bSK[0-9a-fA-F]{32}\b/g,
+  /\bnpm_[0-9A-Za-z]{20,}\b/g,
+  /\bpypi-[0-9A-Za-z_-]{30,}\b/g,
+  // Telegram, Discord, Hugging Face and common additional service formats.
+  /\b[0-9]{8,12}:[0-9A-Za-z_-]{30,}\b/g,
+  /\b[MN][0-9A-Za-z_-]{23,}\.[0-9A-Za-z_-]{6}\.[0-9A-Za-z_-]{20,}\b/g,
+  /\bhf_[0-9A-Za-z]{20,}\b/g,
+  /\bshpat_[0-9a-fA-F]{32}\b/g,
+  /\bdapi[0-9a-fA-F]{32}\b/g,
+  /\bsq0(?:atp|csp)-[0-9A-Za-z_-]{20,}\b/g,
+  // JWT/JWS access, ID, and CI job tokens.
+  /\beyJ[0-9A-Za-z_-]{8,}\.eyJ[0-9A-Za-z_-]{8,}\.[0-9A-Za-z_-]{8,}\b/g,
+  // Opaque CI/test credentials sometimes carry only an all-caps semantic
+  // marker and appear without a useful assignment name.
+  /\b(?:[A-Z0-9]+[_-])+(?:TOKEN|SECRET|PASSWORD|CREDENTIAL|API[_-]?KEY)(?:[_-][A-Z0-9]+)+\b/g,
+]);
+
+const SENSITIVE_KEY = String.raw`(?:[A-Za-z0-9_.-]*(?:api[-_]?key|account[-_]?key|client[-_]?secret|consumer[-_]?secret|webhook[-_]?secret|access[-_]?token|refresh[-_]?token|auth[-_]?token|password|passwd|pwd|private[-_]?key|secret|token|session[-_]?key|session[-_]?token|cookie|docker[-_]?auth|registry[-_]?auth|shared[-_]?access[-_]?signature|sas[-_]?token)[A-Za-z0-9_.-]*|auth|authorization)`;
+const SENSITIVE_ENV_NAME = /(?:API_?KEY|ACCOUNT_?KEY|CLIENT_?SECRET|CONSUMER_?SECRET|WEBHOOK_?SECRET|ACCESS_?TOKEN|REFRESH_?TOKEN|AUTH_?TOKEN|PASSWORD|PASSWD|PRIVATE_?KEY|SECRET|TOKEN|COOKIE|AUTH)$/i;
+const QUOTED_ASSIGNMENT = new RegExp(`((?:["']?${SENSITIVE_KEY}["']?)\\s*(?:=>|[:=])\\s*)(["'])([^"'\\r\\n]*)(\\2)`, 'gi');
+const UNQUOTED_ASSIGNMENT = new RegExp(`((?:["']?${SENSITIVE_KEY}["']?)\\s*(?:=>|[:=])\\s*)(?!["']|(?:Bearer|Basic|SharedAccessSignature)\\s)([^\\s,;}&'"\\r\\n]+)`, 'gi');
+const XML_CREDENTIAL = new RegExp(`(<(${SENSITIVE_KEY})\\b[^>]*>)([\\s\\S]*?)(<\\/\\2\\s*>)`, 'gi');
+const CLI_CREDENTIAL_QUOTED = new RegExp(`(--${SENSITIVE_KEY}(?:\\s+|=))(["'])([^"'\\r\\n]*)(\\2)`, 'gi');
+const CLI_CREDENTIAL = new RegExp(`(--${SENSITIVE_KEY}(?:\\s+|=))(?!["'])([^\\s"'\\r\\n]+)`, 'gi');
+const QUERY_CREDENTIAL = new RegExp(`([?&]${SENSITIVE_KEY}=)([^&#\\s]+)`, 'gi');
+
+const replaceVendorSecrets = text => {
+  let output = text;
+  for (const pattern of VENDOR_PATTERNS) {
+    pattern.lastIndex = 0;
+    output = output.replace(pattern, match => maskValue(match));
+  }
+  return output;
+};
+
+const replaceCookieHeader = (_match, prefix, cookieText) => {
+  const sanitized = cookieText.replace(/(^|;\s*)([^=;\s]+)(=)([^;\r\n]*)/g, (pair, separator, name, equals, value) => {
+    return `${separator}${name}${equals}${maskValue(value.trim())}`;
+  });
+  return `${prefix}${sanitized}`;
+};
+
+/**
+ * Synchronously sanitize known vendor credentials and credential-like
+ * structured values. The operation is deterministic and idempotent.
+ */
+export const sanitizeCredentialText = (input, options = {}) => {
+  let output = String(input ?? '');
+
+  // Known active credentials are the strongest signal and are replaced before
+  // format matching, regardless of their shape or length.
+  const environmentTokens =
+    options.includeEnvironmentCredentials === false
+      ? []
+      : Object.entries(process.env)
+          .filter(([name, value]) => SENSITIVE_ENV_NAME.test(name) && typeof value === 'string' && value.length > 0)
+          .map(([, value]) => value);
+  for (const token of [...environmentTokens, ...(options.knownTokens || [])]) {
+    const value = typeof token === 'string' ? token : token?.value;
+    if (!value || !output.includes(value)) continue;
+    output = output.replace(new RegExp(escapeRegExp(value), 'g'), maskValue(value));
+  }
+
+  // Keep PEM markers for diagnostic context, but never preserve key material.
+  output = output.replace(/(-----BEGIN ([A-Z0-9 ]*PRIVATE KEY)-----)[\s\S]*?(-----END \2-----)/g, (_match, begin, _label, end) => `${begin}\n[REDACTED]\n${end}`);
+  // An interrupted process may never print the closing PEM marker. Treat the
+  // remainder as key material instead of releasing it during stream flush.
+  output = output.replace(/(-----BEGIN ([A-Z0-9 ]*PRIVATE KEY)-----)(?![\s\S]*?-----END \2-----)[\s\S]*/g, '$1\n[REDACTED]');
+
+  output = replaceVendorSecrets(output);
+
+  // Authentication headers and URL credentials.
+  output = output.replace(/((?:Proxy-)?Authorization\s*:\s*(?:Bearer|Basic)\s+)([^\s"',;]+)/gi, (_match, prefix, value) => `${prefix}${maskValue(value)}`);
+  output = output.replace(/(\b[a-z][a-z0-9+.-]*:\/\/[^:\s/@]+:)([^@\s/]+)(@)/gi, (_match, prefix, value, suffix) => `${prefix}${maskValue(value)}${suffix}`);
+  output = output.replace(/(\bSharedAccessSignature\s+)(sr=[^\s,;]+(?:&[^\s,;]+)+)/gi, (_match, prefix, value) => `${prefix}${maskValue(value)}`);
+  output = output.replace(/(\bSharedAccessSignature\s*=\s*)([^\s"',;]+)/gi, (_match, prefix, value) => `${prefix}${maskValue(value)}`);
+
+  // Cookie values are credentials at output boundaries even when their names
+  // are vendor-specific and therefore unknown to us.
+  output = output.replace(/((?:Set-)?Cookie\s*:\s*)([^\r\n]*)/gi, replaceCookieHeader);
+
+  // XML and JSON/YAML/TOML/INI/shell-style assignments.
+  output = output.replace(XML_CREDENTIAL, (_match, start, _key, value, end) => `${start}${maskValue(value.trim())}${end}`);
+  output = output.replace(QUOTED_ASSIGNMENT, (_match, prefix, quote, value) => `${prefix}${quote}${maskValue(value)}${quote}`);
+  output = output.replace(UNQUOTED_ASSIGNMENT, (_match, prefix, value) => `${prefix}${maskValue(value)}`);
+
+  // CLI arguments and sensitive query parameters.
+  output = output.replace(CLI_CREDENTIAL_QUOTED, (_match, prefix, quote, value) => `${prefix}${quote}${maskValue(value)}${quote}`);
+  output = output.replace(CLI_CREDENTIAL, (_match, prefix, value) => `${prefix}${maskValue(value)}`);
+  output = output.replace(QUERY_CREDENTIAL, (_match, prefix, value) => `${prefix}${maskValue(value)}`);
+
+  // Vendor webhook URLs encode credentials in their path rather than a named
+  // field. Preserve the service endpoint and sanitize only the credential.
+  output = output.replace(/(https:\/\/hooks\.slack\.com\/services\/)([0-9A-Za-z/_-]+)/gi, (_match, prefix, value) => `${prefix}${maskValue(value)}`);
+  output = output.replace(/(https:\/\/(?:canary\.)?discord(?:app)?\.com\/api\/webhooks\/)([0-9A-Za-z/_-]+)/gi, (_match, prefix, value) => `${prefix}${maskValue(value)}`);
+
+  return output;
+};
+
+/**
+ * Return a non-sensitive indication that another sanitizer pass would change
+ * the text. Callers never receive the matching value.
+ */
+export const findCredentialResiduals = input => {
+  const text = String(input ?? '');
+  return sanitizeCredentialText(text) === text ? [] : [{ ruleId: 'credential-pattern' }];
+};
+
+/**
+ * Record-oriented sanitizer for child-process stdout/stderr chunks. An
+ * incomplete record is retained until a newline arrives (or flush is called),
+ * so credentials split at arbitrary chunk boundaries are never emitted raw.
+ */
+export const createCredentialStreamSanitizer = options => {
+  let pending = '';
+  let decoder = new StringDecoder('utf8');
+
+  const appendChunk = chunk => {
+    if (Buffer.isBuffer(chunk) || ArrayBuffer.isView(chunk)) {
+      const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength);
+      pending += decoder.write(bytes);
+      return;
+    }
+    pending += decoder.end();
+    decoder = new StringDecoder('utf8');
+    pending += String(chunk ?? '');
+  };
+
+  const drain = () => {
+    let output = '';
+    const beginPattern = /-----BEGIN ([A-Z0-9 ]*PRIVATE KEY)-----/;
+
+    while (pending) {
+      const begin = beginPattern.exec(pending);
+      if (begin) {
+        const endMarker = `-----END ${begin[1]}-----`;
+        const endIndex = pending.indexOf(endMarker, begin.index + begin[0].length);
+        if (endIndex < 0) {
+          // Text before the marker can be released, but the marker and every
+          // following byte stay private until the matching end or flush.
+          if (begin.index > 0) {
+            output += sanitizeCredentialText(pending.slice(0, begin.index), options);
+            pending = pending.slice(begin.index);
+          }
+          break;
+        }
+
+        const keyEnd = endIndex + endMarker.length;
+        output += sanitizeCredentialText(pending.slice(0, keyEnd), options);
+        pending = pending.slice(keyEnd);
+        continue;
+      }
+
+      const boundary = Math.max(pending.lastIndexOf('\n'), pending.lastIndexOf('\r'));
+      if (boundary < 0) break;
+      output += sanitizeCredentialText(pending.slice(0, boundary + 1), options);
+      pending = pending.slice(boundary + 1);
+    }
+
+    return output;
+  };
+
+  return {
+    write(chunk) {
+      appendChunk(chunk);
+      return drain();
+    },
+    flush() {
+      pending += decoder.end();
+      decoder = new StringDecoder('utf8');
+      const complete = pending;
+      pending = '';
+      return sanitizeCredentialText(complete, options);
+    },
+  };
+};

package/src/development-log.lib.mjs

@@ -1,8 +1,7 @@
 import fs from 'node:fs/promises';
-import { createReadStream, createWriteStream } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { pipeline } from 'node:stream/promises';
+import { sanitizeForPublication } from './token-sanitization.lib.mjs';
 
 const sanitizePathSegment = (value, fallback) => {
   const raw = value === null || value === undefined || value === '' ? fallback : String(value);
@@ -87,9 +86,21 @@ const fileExists = async filePath => {
   }
 };
 
+const writePrivatePublicationFile = async (destinationPath, content) => {
+  const sanitized = await sanitizeForPublication(content);
+  await fs.writeFile(destinationPath, sanitized, { encoding: 'utf8', mode: 0o600 });
+  // writeFile preserves the mode of an existing file, so enforce it after
+  // every write as well.
+  await fs.chmod(destinationPath, 0o600);
+};
+
 const copyIfExists = async ({ sourcePath, destinationPath }) => {
   if (!(await fileExists(sourcePath))) return false;
-  await fs.copyFile(sourcePath, destinationPath);
+  // Raw local audit sources remain available to the operator but must not be
+  // group/world-readable. Only the sanitized copy enters the repository.
+  await fs.chmod(sourcePath, 0o600);
+  const content = await fs.readFile(sourcePath, 'utf8');
+  await writePrivatePublicationFile(destinationPath, content);
   return true;
 };
 
@@ -122,13 +133,15 @@ const findCodexSessionFile = async ({ sessionId, homeDir }) => {
 // prefix. Returns the byte offset right after the copied slice.
 const copyLogSlice = async ({ logFile, destinationPath, logStartByte = 0 }) => {
   const stat = await fs.stat(logFile);
+  await fs.chmod(logFile, 0o600);
   // The log was rotated/truncated since the previous collection: copy it whole.
   const start = Number.isFinite(logStartByte) && logStartByte > 0 && logStartByte <= stat.size ? logStartByte : 0;
   if (stat.size === 0 || start >= stat.size) {
-    await fs.writeFile(destinationPath, '');
+    await writePrivatePublicationFile(destinationPath, '');
     return { logStartByte: start, logEndByte: stat.size };
   }
-  await pipeline(createReadStream(logFile, { start, end: stat.size - 1 }), createWriteStream(destinationPath));
+  const bytes = await fs.readFile(logFile);
+  await writePrivatePublicationFile(destinationPath, bytes.subarray(start, stat.size).toString('utf8'));
   return { logStartByte: start, logEndByte: stat.size };
 };
 
@@ -245,7 +258,7 @@ export const writeDevelopmentLogArtifacts = async ({ repositoryPath, logFile, is
     },
   };
 
-  await fs.writeFile(path.join(repositoryPath, metadataRelativePath), `${JSON.stringify(metadata, null, 2)}\n`, 'utf8');
+  await writePrivatePublicationFile(path.join(repositoryPath, metadataRelativePath), `${JSON.stringify(metadata, null, 2)}\n`);
 
   return {
     developmentLogDirectory,
@@ -260,6 +273,21 @@ export const writeDevelopmentLogArtifacts = async ({ repositoryPath, logFile, is
   };
 };
 
+const verifyDevelopmentLogDirectory = async directoryPath => {
+  const entries = await fs.readdir(directoryPath, { recursive: true, withFileTypes: true });
+  for (const entry of entries) {
+    if (!entry.isFile()) continue;
+    const parentPath = entry.parentPath || entry.path;
+    const filePath = path.join(parentPath, entry.name);
+    const exactBytes = await fs.readFile(filePath, 'utf8');
+    const rescanned = await sanitizeForPublication(exactBytes);
+    if (rescanned !== exactBytes) {
+      throw new Error('Development-log publication rescan found residual credential material.');
+    }
+    await fs.chmod(filePath, 0o600);
+  }
+};
+
 const getCommandOutput = result => (result?.stderr?.toString?.() || result?.stdout?.toString?.() || '').trim();
 
 export const collectAndCommitDevelopmentLogArtifacts = async ({ enabled, repositoryPath, logFile, issueNumber, prNumber, tool, sessionId, branchName, rawCommand, logStartByte = 0, $, log }) => {
@@ -295,6 +323,11 @@ export const collectAndCommitDevelopmentLogArtifacts = async ({ enabled, reposit
       return { ...artifacts, committed: false, pushed: false };
     }
 
+    // Scan the exact directory bytes immediately before staging. This catches
+    // future artifacts added by this workflow even if their writer forgot to
+    // call the publication helper.
+    await verifyDevelopmentLogDirectory(path.join(repositoryPath, artifacts.relativeDirectory));
+
     const addResult = await $({ cwd: repositoryPath })`git add -f -- ${artifacts.relativeDirectory}`;
     if (addResult.code !== 0) {
       await log?.(`⚠️  Could not stage development log: ${getCommandOutput(addResult)}`, { level: 'warning' });

package/src/fix.mjs

@@ -17,6 +17,9 @@ import path from 'path';
 import { spawn } from 'child_process';
 import { fileURLToPath } from 'url';
 import { CI_CD_ISSUE_LABELS, CI_CD_ISSUE_TYPE, buildCiCdIssueBody, buildCiCdIssueTitle, buildSolveArgs, partitionFixArgs, summarizeRunFailures } from './fix.ci-cd.lib.mjs';
+import { setupStdioLogInterceptor } from './lib.mjs';
+
+setupStdioLogInterceptor();
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 

package/src/github-error-reporter.lib.mjs

@@ -8,6 +8,7 @@ import { ensureUseM } from './use-m-bootstrap.lib.mjs';
 import { createInterface } from 'readline';
 import { log, cleanErrorMessage, getAbsoluteLogPath } from './lib.mjs';
 import { reportError, isSentryEnabled } from './sentry.lib.mjs';
+import { sanitizeForPublication, writeSanitizedPublicationFile } from './token-sanitization.lib.mjs';
 
 if (typeof globalThis.use === 'undefined') {
   await ensureUseM();
@@ -85,14 +86,13 @@ const getCurrentGitHubUser = async () => {
  * @returns {Promise<string|null>} Gist URL or null on failure
  */
 const createSecretGist = async (logContent, filename) => {
+  const tempFile = `/tmp/${filename}`;
   try {
-    const tempFile = `/tmp/${filename}`;
-    await fs.writeFile(tempFile, logContent);
+    await writeSanitizedPublicationFile(tempFile, logContent);
 
     const result = await $`gh gist create ${tempFile} --secret --desc "Error log for hive-mind"`;
     if (result.exitCode === 0) {
       const gistUrl = result.stdout.toString().trim();
-      await fs.unlink(tempFile).catch(() => {});
       return gistUrl;
     }
   } catch (error) {
@@ -100,6 +100,8 @@ const createSecretGist = async (logContent, filename) => {
       context: 'create_secret_gist',
       operation: 'gh_gist_create',
     });
+  } finally {
+    await fs.unlink(tempFile).catch(() => {});
   }
   return null;
 };
@@ -183,7 +185,7 @@ export const createIssueForError = async options => {
 
     await log('\n🔄 Creating GitHub issue...');
 
-    const issueTitle = error.message || errorMessage || `${errorType} in hive-mind`;
+    const issueTitle = await sanitizeForPublication(error.message || errorMessage || `${errorType} in hive-mind`);
 
     let issueBody = '## Error Details\n\n';
     issueBody += `**Type**: ${errorType}\n`;
@@ -232,11 +234,14 @@ export const createIssueForError = async options => {
     issueBody += `*This issue was automatically created by @${currentUser} using hive-mind error reporting*\n`;
 
     const tempBodyFile = `/tmp/hive-mind-issue-body-${Date.now()}.md`;
-    await fs.writeFile(tempBodyFile, issueBody);
+    await writeSanitizedPublicationFile(tempBodyFile, issueBody);
 
-    const result = await $`gh issue create --repo link-assistant/hive-mind --title ${issueTitle} --body-file ${tempBodyFile} --label bug`;
-
-    await fs.unlink(tempBodyFile).catch(() => {});
+    let result;
+    try {
+      result = await $`gh issue create --repo link-assistant/hive-mind --title ${issueTitle} --body-file ${tempBodyFile} --label bug`;
+    } finally {
+      await fs.unlink(tempBodyFile).catch(() => {});
+    }
 
     if (result.exitCode === 0) {
       const issueUrl = result.stdout.toString().trim();

package/src/github-issue-auto-close.lib.mjs

@@ -27,6 +27,7 @@
 
 import { prClosesIssue, extractLinkedIssueNumber } from './github-linking.lib.mjs';
 import { wrapDollarWithGhRetry } from './github-rate-limit.lib.mjs';
+import { sanitizeForPublication } from './token-sanitization.lib.mjs';
 
 /**
  * Determine whether GitHub will automatically close a PR's linked issues when
@@ -216,7 +217,7 @@ export async function ensureLinkedIssueClosedAfterMerge({ $: rawDollar, log = nu
     }
 
     // Close the issue explicitly, leaving an explanatory trail.
-    const comment = [`Closed by #${prNumber}, which targeted the non-default branch \`${baseBranch}\` (repository default: \`${defaultBranch}\`).`, '', 'GitHub only auto-closes linked issues for pull requests merged into the default branch,', 'so hive-mind closed this issue explicitly after the merge.', '', '_Automated by hive-mind ([#1895](https://github.com/link-assistant/hive-mind/issues/1895))._'].join('\n');
+    const comment = await sanitizeForPublication([`Closed by #${prNumber}, which targeted the non-default branch \`${baseBranch}\` (repository default: \`${defaultBranch}\`).`, '', 'GitHub only auto-closes linked issues for pull requests merged into the default branch,', 'so hive-mind closed this issue explicitly after the merge.', '', '_Automated by hive-mind ([#1895](https://github.com/link-assistant/hive-mind/issues/1895))._'].join('\n'));
 
     const closeResult = await $`gh issue close ${issueNumber} --repo ${owner}/${repo} --reason completed --comment ${comment}`;
     if (closeResult.code === 0) {

package/src/github-merge-issue-close.lib.mjs

@@ -22,6 +22,7 @@ import { ghWithRateLimitRetry } from './github-rate-limit.lib.mjs';
 import { extractLinkedIssueNumber } from './github-linking.lib.mjs';
 import { classifyIssueLinkStatus } from './github-issue-auto-close.lib.mjs';
 import { getDefaultBranch } from './github-merge.lib.mjs';
+import { sanitizeForPublication } from './token-sanitization.lib.mjs';
 
 const execRaw = promisify(execCallback);
 
@@ -76,7 +77,7 @@ export async function closeLinkedIssueIfNotAutoClosed(owner, repo, prNumber, ver
       // If state lookup fails, fall through and attempt the close.
     }
 
-    const comment = `Closed by #${prNumber}, which targeted the non-default branch \`${baseBranch}\` (repository default: \`${defaultBranch}\`).\n\nGitHub only auto-closes linked issues for pull requests merged into the default branch, so hive-mind closed this issue explicitly after the merge.\n\n_Automated by hive-mind ([#1895](https://github.com/link-assistant/hive-mind/issues/1895))._`;
+    const comment = await sanitizeForPublication(`Closed by #${prNumber}, which targeted the non-default branch \`${baseBranch}\` (repository default: \`${defaultBranch}\`).\n\nGitHub only auto-closes linked issues for pull requests merged into the default branch, so hive-mind closed this issue explicitly after the merge.\n\n_Automated by hive-mind ([#1895](https://github.com/link-assistant/hive-mind/issues/1895))._`);
     await exec(`gh issue close ${issueNumber} --repo ${owner}/${repo} --reason completed --comment ${JSON.stringify(comment)}`);
     if (verbose) console.log(`[VERBOSE] /merge: Closed issue #${issueNumber} explicitly (PR #${prNumber} merged into non-default branch '${baseBranch}')`);
     return { closed: true, skipped: false, reason: 'closed-explicitly', issueNumber: Number(issueNumber) };