@link-assistant/hive-mind 2.10.0 → 2.10.2

package/src/sentry.lib.mjs

@@ -1,5 +1,24 @@
 // Sentry integration library for hive-mind
 import { isSentryEnabled, captureException, captureMessage, startTransaction } from './instrument.mjs';
+import { sanitizeCredentialText } from './credential-sanitization-core.lib.mjs';
+
+const sanitizeError = error => {
+  const source = error instanceof Error ? error : new Error(String(error));
+  const sanitized = new Error(sanitizeCredentialText(source.message));
+  sanitized.name = source.name;
+  if (source.stack) sanitized.stack = sanitizeCredentialText(source.stack);
+  return sanitized;
+};
+
+const sanitizeContext = (value, seen = new WeakSet()) => {
+  if (typeof value === 'string') return sanitizeCredentialText(value);
+  if (value instanceof Error) return sanitizeError(value);
+  if (!value || typeof value !== 'object') return value;
+  if (seen.has(value)) return '[Circular]';
+  seen.add(value);
+  if (Array.isArray(value)) return value.map(item => sanitizeContext(item, seen));
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, sanitizeContext(item, seen)]));
+};
 
 // Lazy import of Sentry to handle cases where it's not installed
 let Sentry = null;
@@ -84,7 +103,7 @@ export const withSentry = (fn, name, op = 'task') => {
       return result;
     } catch (error) {
       transaction.setStatus('internal_error');
-      captureException(error, {
+      captureException(sanitizeError(error), {
         operation: name,
         args: args.length > 0 ? `${args.length} arguments` : 'no arguments',
       });
@@ -139,7 +158,7 @@ export const logToSentry = (message, level = 'info', context = {}) => {
     return;
   }
 
-  captureMessage(message, level, context);
+  captureMessage(sanitizeCredentialText(message), level, sanitizeContext(context));
 };
 
 /**
@@ -153,7 +172,7 @@ export const reportError = (error, context = {}) => {
     return;
   }
 
-  captureException(error, { ...context, level: 'error' });
+  captureException(sanitizeError(error), { ...sanitizeContext(context), level: 'error' });
 };
 
 /**
@@ -169,7 +188,7 @@ export const reportWarning = (warning, context = {}) => {
 
   // Convert string warnings to Error objects for better stack traces
   const warningError = typeof warning === 'string' ? new Error(warning) : warning;
-  captureException(warningError, { ...context, level: 'warning' });
+  captureException(sanitizeError(warningError), { ...sanitizeContext(context), level: 'warning' });
 };
 
 /**
@@ -183,7 +202,7 @@ export const addBreadcrumb = async breadcrumb => {
 
   const sentry = await getSentry();
   if (sentry) {
-    sentry.addBreadcrumb(breadcrumb);
+    sentry.addBreadcrumb(sanitizeContext(breadcrumb));
   }
 };
 
@@ -198,7 +217,7 @@ export const setUserContext = async user => {
 
   const sentry = await getSentry();
   if (sentry) {
-    sentry.setUser(user);
+    sentry.setUser(sanitizeContext(user));
   }
 };
 
@@ -214,7 +233,7 @@ export const setExtraContext = async (key, value) => {
 
   const sentry = await getSentry();
   if (sentry) {
-    sentry.setExtra(key, value);
+    sentry.setExtra(key, sanitizeContext(value));
   }
 };
 
@@ -229,7 +248,7 @@ export const setTags = async tags => {
 
   const sentry = await getSentry();
   if (sentry) {
-    sentry.setTags(tags);
+    sentry.setTags(sanitizeContext(tags));
   }
 };
 

package/src/session-monitor.lib.mjs

@@ -25,8 +25,7 @@ import { promisify } from 'util';
 import { formatSessionCompletionMessage, getSessionCompletionExitCode, classifySessionOutcome } from './work-session-formatting.lib.mjs';
 import { notifySubscribers, getSubscriberCount } from './telegram-subscribers.lib.mjs';
 import { classifyExitStatus, normalizeExitCode } from './session-status.lib.mjs';
-import path from 'node:path';
-import { readLastSessionIdFromLog, findLatestSessionLogId, buildResumeCommand, formatResumeSection } from './session-resume.lib.mjs';
+import { readLastSessionIdFromLog, buildResumeCommand, formatResumeSection } from './session-resume.lib.mjs';
 
 export { formatSessionCompletionMessage, getSessionCompletionExitCode } from './work-session-formatting.lib.mjs';
 
@@ -913,14 +912,11 @@ export async function monitorSessions(bot, verbose = false, options = {}) {
             const logPath = statusResult?.logPath || sessionInfo?.logPath || null;
             // The id must be the AI TOOL's session id, not the isolation session
             //   id (sessionInfo.sessionId — wrong namespace for `solve --resume`).
-            //   Prefer the last `Session ID:` marker in the captured log; fall
-            //   back to the newest `<sessionId>.log` start-command wrote in the
-            //   same directory. If neither exists, offer no command (a bogus
-            //   resume id would be worse than none).
-            let lastSessionId = readLastSessionIdFromLog(logPath, { verbose });
-            if (!lastSessionId && logPath) {
-              lastSessionId = findLatestSessionLogId({ dir: path.dirname(logPath), verbose });
-            }
+            //   Scan backwards through this task's captured log for its last
+            //   `Session ID:` marker. Do not guess from neighboring UUID-named
+            //   logs: start-command stores unrelated tasks in the same backend
+            //   directory, which caused issue #2109's invalid resume id.
+            const lastSessionId = readLastSessionIdFromLog(logPath, { verbose });
             const resumeCommand = buildResumeCommand({ sessionInfo, lastSessionId });
             const resumeSection = formatResumeSection({ lastSessionId, command: resumeCommand });
             if (resumeSection) {

package/src/session-resume.lib.mjs

@@ -11,11 +11,10 @@
  *   1. **Use the LAST session id.** A single `/solve` run can spin up *many*
  *      tool sessions — auto-continue across usage-limit resets, uncommitted-
  *      changes restarts (`solve.watch`), and manual `--resume` chains. Every one
- *      prints a `Session ID:` marker to the captured log in chronological order,
- *      and start-command also renames the per-session log to `<sessionId>.log`.
+ *      prints a `Session ID:` marker to the captured log in chronological order.
  *      The most advanced context lives in the *last* of these, so resuming must
- *      pick the last id — never the first. {@link selectLastSessionId} /
- *      {@link findLatestSessionLogId} enforce that rule.
+ *      pick the last id — never the first. {@link selectLastSessionId} and
+ *      {@link readLastSessionIdFromLog} enforce that rule.
  *
  *   2. **Never storm.** Auto-resuming a killed session must be bounded so a job
  *      that reliably OOMs cannot spawn an infinite relaunch loop (which would be
@@ -41,6 +40,8 @@ const SESSION_ID_MARKER_RE = /Session ID:\s*`?([^\s`]+)`?/gi;
 // `<sessionId>.log` files start-command writes. Used to validate directory
 // scans so unrelated `*.log` files are never mistaken for a session.
 const SESSION_LOG_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const DEFAULT_LOG_SCAN_CHUNK_BYTES = 262144;
+const LOG_SCAN_OVERLAP_BYTES = 1024;
 
 /**
  * Extract every tool session id printed to a log, in the order they appear.
@@ -79,34 +80,52 @@ export function selectLastSessionId(text) {
 }
 
 /**
- * Read the LAST tool session id from a `/solve` execution log. Only the tail of
- * the file is scanned (the most recent session marker lives near the end), so
- * this stays cheap on multi-megabyte logs. Never throws — a missing/unreadable
- * log yields `null`.
+ * Read the LAST tool session id from a `/solve` execution log. The file is
+ * scanned backwards in bounded chunks: this normally stops after the tail
+ * chunk, while still finding a valid marker that precedes a long tool trace.
+ * Adjacent chunks overlap so a marker split at a chunk boundary is not lost.
+ * Never throws — a missing/unreadable log yields `null`.
  *
  * @param {string} logPath
  * @param {Object} [options]
  * @param {Object} [options.fsImpl=fs] - Injectable fs (for tests)
- * @param {number} [options.tailBytes=262144] - Trailing bytes to scan (256 KiB)
+ * @param {number} [options.tailBytes=262144] - Bytes per backwards scan chunk
  * @param {boolean} [options.verbose]
  * @returns {string|null}
  */
 export function readLastSessionIdFromLog(logPath, options = {}) {
-  const { fsImpl = fs, tailBytes = 262144, verbose = false } = options;
+  const { fsImpl = fs, tailBytes = DEFAULT_LOG_SCAN_CHUNK_BYTES, verbose = false } = options;
   if (!logPath) return null;
   try {
     const stat = fsImpl.statSync(logPath);
-    const start = Math.max(0, stat.size - tailBytes);
+    const chunkBytes = Number.isFinite(tailBytes) && tailBytes > 0 ? Math.floor(tailBytes) : DEFAULT_LOG_SCAN_CHUNK_BYTES;
     const fd = fsImpl.openSync(logPath, 'r');
     try {
-      const length = stat.size - start;
-      const buffer = Buffer.alloc(length);
-      fsImpl.readSync(fd, buffer, 0, length, start);
-      const id = selectLastSessionId(buffer.toString('utf8'));
-      if (verbose && id) {
-        console.log(`[VERBOSE] session-resume: last tool session id in ${logPath} is ${id}`);
+      let end = stat.size;
+      let laterPrefix = Buffer.alloc(0);
+      let chunksScanned = 0;
+      while (end > 0) {
+        const start = Math.max(0, end - chunkBytes);
+        const length = end - start;
+        const buffer = Buffer.alloc(length);
+        const bytesRead = fsImpl.readSync(fd, buffer, 0, length, start);
+        const current = bytesRead === length ? buffer : buffer.subarray(0, bytesRead);
+        const scanBuffer = laterPrefix.length > 0 ? Buffer.concat([current, laterPrefix]) : current;
+        const id = selectLastSessionId(scanBuffer.toString('utf8'));
+        chunksScanned += 1;
+        if (id) {
+          if (verbose) {
+            console.log(`[VERBOSE] session-resume: last tool session id in ${logPath} is ${id} (scanned ${chunksScanned} chunk${chunksScanned === 1 ? '' : 's'})`);
+          }
+          return id;
+        }
+        laterPrefix = current.subarray(0, Math.min(current.length, LOG_SCAN_OVERLAP_BYTES));
+        end = start;
       }
-      return id;
+      if (verbose) {
+        console.log(`[VERBOSE] session-resume: no tool session id found in ${logPath} after scanning ${chunksScanned} chunk${chunksScanned === 1 ? '' : 's'}`);
+      }
+      return null;
     } finally {
       fsImpl.closeSync(fd);
     }
@@ -121,10 +140,10 @@ export function readLastSessionIdFromLog(logPath, options = {}) {
 /**
  * Find the id of the most-recently-modified `<sessionId>.log` in a directory.
  *
- * start-command renames each tool session's log to `<sessionId>.log`, so the
- * newest such file is the last session of the run — a second, filesystem-based
- * source for the "use the last session" rule that works even when the captured
- * stdout log has been rotated away. Never throws.
+ * This helper is safe only when `dir` is already known to contain logs for one
+ * task. A shared start-command directory cannot attribute its newest UUID log
+ * to a particular `/solve` run, so completion notifications must not use this
+ * as a fallback. Never throws.
  *
  * @param {Object} options
  * @param {string} options.dir - Directory holding `<sessionId>.log` files
@@ -215,7 +234,8 @@ export function buildResumeCommand({ sessionInfo = {}, lastSessionId = null, bin
   const url = sessionInfo.url || (Array.isArray(sessionInfo.args) ? sessionInfo.args[0] : null);
   if (!url) return null;
 
-  const bin = binary || command;
+  const commandAlias = typeof sessionInfo.commandAlias === 'string' && /^[a-z0-9_-]+$/i.test(sessionInfo.commandAlias) ? sessionInfo.commandAlias : null;
+  const bin = binary || (commandAlias ? `/${commandAlias}` : command);
   let args;
   if (Array.isArray(sessionInfo.args) && sessionInfo.args.length > 0) {
     args = stripResumeFlag(sessionInfo.args);

package/src/session-store.lib.mjs

@@ -33,7 +33,9 @@ import path from 'node:path';
 // excluded so the snapshot stays small and safe to reload.
 // `args` (#1927 review follow-up) is persisted so a killed /solve can be resumed
 // with its exact original invocation plus `--resume <lastSessionId>`.
-const PERSISTABLE_FIELDS = ['chatId', 'messageId', 'startTime', 'url', 'command', 'isolationBackend', 'sessionId', 'containerFilesystemStartBytes', 'containerFilesystemLastBytes', 'containerFilesystemLastObservedAt', 'tool', 'infoBlock', 'urlContext', 'requesterUserId', 'showLimits', 'locale', 'logPath', 'args'];
+// `commandAlias` (#2109) preserves the Telegram spelling (`solve`, `codex`,
+// `claude`, etc.) so a bot notification never suggests a terminal-only command.
+const PERSISTABLE_FIELDS = ['chatId', 'messageId', 'startTime', 'url', 'command', 'commandAlias', 'isolationBackend', 'sessionId', 'containerFilesystemStartBytes', 'containerFilesystemLastBytes', 'containerFilesystemLastObservedAt', 'tool', 'infoBlock', 'urlContext', 'requesterUserId', 'showLimits', 'locale', 'logPath', 'args'];
 
 /**
  * Resolve the directory durable bot state is written to. Honors

package/src/solve.auto-pr.lib.mjs

@@ -11,6 +11,7 @@ import { handleCompareApiNotReady } from './solve.auto-pr-compare-readiness.lib.
 
 import { wrapDollarWithGhRetry as _wrapDollarWithGhRetry, execGhWithRetry, isTransientCompareApiError } from './github-rate-limit.lib.mjs'; // rate-limit marker (#1726): gh API calls flow through $ wrapped by caller. Issue #1756: execGhWithRetry retries on transient 5xx (504) too. Issue #1829: isTransientCompareApiError lets the compare-API readiness gate degrade gracefully on transient diff-render failures.
 import { stagePlaceholderFileOrExplain, explainNothingStagedAndThrow } from './solve.auto-pr-placeholder.lib.mjs'; // Issue #1825: handles the seed placeholder when the target repo gitignores it.
+import { sanitizeForPublication, writeSanitizedPublicationFile } from './token-sanitization.lib.mjs';
 
 export async function handleAutoPrCreation({ argv, tempDir, branchName, issueNumber, owner, repo, defaultBranch, forkedRepo, isContinueMode, prNumber, log, formatAligned, $, reportError, path, fs }) {
   // Skip auto-PR creation if:
@@ -906,17 +907,19 @@ ${prBody}`,
         // single transient 5xx (e.g. `HTTP 504: 504 Gateway Timeout
         // (https://api.github.com/graphql)`) or rate-limit response retries
         // instead of aborting the whole solve session.
+        let prBodyFile = null;
+        let prTitleFile = null;
         try {
           // Write PR body to temp file to avoid shell escaping issues
-          const prBodyFile = `/tmp/pr-body-${Date.now()}.md`;
-          await fs.writeFile(prBodyFile, prBody);
+          prBodyFile = `/tmp/pr-body-${Date.now()}.md`;
+          await writeSanitizedPublicationFile(prBodyFile, prBody);
 
           // Write PR title to temp file to avoid shell escaping issues with quotes/apostrophes
           // This solves the issue where titles containing apostrophes (e.g., "don't") would cause
           // "Unterminated quoted string" errors
-          const prTitle = `[WIP] ${issueTitle}`;
-          const prTitleFile = `/tmp/pr-title-${Date.now()}.txt`;
-          await fs.writeFile(prTitleFile, prTitle);
+          const prTitle = await sanitizeForPublication(`[WIP] ${issueTitle}`);
+          prTitleFile = `/tmp/pr-title-${Date.now()}.txt`;
+          await writeSanitizedPublicationFile(prTitleFile, prTitle);
 
           // Build command with optional assignee and handle forks
           // Note: targetBranch is already defined above
@@ -994,22 +997,6 @@ ${prBody}`,
             }
           }
 
-          // Clean up temp files
-          await fs.unlink(prBodyFile).catch(unlinkError => {
-            reportError(unlinkError, {
-              context: 'pr_body_file_cleanup',
-              prBodyFile,
-              operation: 'delete_temp_file',
-            });
-          });
-          await fs.unlink(prTitleFile).catch(unlinkError => {
-            reportError(unlinkError, {
-              context: 'pr_title_file_cleanup',
-              prTitleFile,
-              operation: 'delete_temp_file',
-            });
-          });
-
           // Log gh pr create output for debugging (Issue #1462)
           if (argv.verbose) {
             await log(`   gh pr create stdout: ${(output || '').trim() || '(empty)'}`, { verbose: true });
@@ -1279,6 +1266,9 @@ ${prBody}`,
           } else {
             throw new Error(`PR creation failed: ${cleanError}`, { cause: prCreateError });
           }
+        } finally {
+          if (prBodyFile) await fs.unlink(prBodyFile).catch(() => {});
+          if (prTitleFile) await fs.unlink(prTitleFile).catch(() => {});
         }
       }
     }

package/src/solve.error-handlers.lib.mjs

@@ -11,6 +11,7 @@ import { reportError } from './sentry.lib.mjs';
 
 // Import GitHub error reporter
 import { handleErrorWithIssueCreation } from './github-error-reporter.lib.mjs';
+import { sanitizeForPublication } from './token-sanitization.lib.mjs';
 
 export const isErrorIssueAutoCreationDisabled = argv => !!(argv?.disableReportIssue || argv?.disableIssueAutoCreationOnError);
 
@@ -115,7 +116,7 @@ export const handleFailure = async options => {
   if (argv.autoClosePullRequestOnFail && global.createdPR && global.createdPR.number) {
     await log('\n🔒 Auto-closing pull request due to failure...');
     try {
-      const closeMessage = errorType === 'uncaughtException' ? 'Auto-closed due to uncaught exception. Logs have been attached for debugging.' : errorType === 'unhandledRejection' ? 'Auto-closed due to unhandled rejection. Logs have been attached for debugging.' : 'Auto-closed due to execution failure. Logs have been attached for debugging.';
+      const closeMessage = await sanitizeForPublication(errorType === 'uncaughtException' ? 'Auto-closed due to uncaught exception. Logs have been attached for debugging.' : errorType === 'unhandledRejection' ? 'Auto-closed due to unhandled rejection. Logs have been attached for debugging.' : 'Auto-closed due to execution failure. Logs have been attached for debugging.');
 
       const result = await $`gh pr close ${global.createdPR.number} --repo ${global.owner || owner}/${global.repo || repo} --comment ${closeMessage}`;
       if (result.exitCode === 0) {

package/src/solve.progress-monitoring.lib.mjs

@@ -27,6 +27,7 @@
 // Issue #1625: centralized markers + tracking helpers so the live-progress
 // comment is excluded from --auto-attach-solution-summary's AI-comment check.
 import { LIVE_PROGRESS_SECTION_START_MARKER, LIVE_PROGRESS_SECTION_END_MARKER, postTrackedCommentFromFile, trackToolCommentId } from './tool-comments.lib.mjs';
+import { writeSanitizedPublicationFile } from './token-sanitization.lib.mjs';
 
 import { wrapDollarWithGhRetry as _wrapDollarWithGhRetry } from './github-rate-limit.lib.mjs'; // rate-limit marker (#1726): gh API calls flow through $ wrapped by caller
 /**
@@ -225,9 +226,12 @@ export const createProgressMonitor = ({ owner, repo, prNumber, $, log, verbose =
         // Edit existing comment
         const fs = (await import('fs')).promises;
         const tempFile = `/tmp/pr-progress-comment-${prNumber}-${Date.now()}.md`;
-        await fs.writeFile(tempFile, progressSection);
-        await $`gh api repos/${owner}/${repo}/issues/comments/${state.commentId} --method PATCH --field body=@${tempFile}`;
-        await fs.unlink(tempFile).catch(() => {});
+        await writeSanitizedPublicationFile(tempFile, progressSection);
+        try {
+          await $`gh api repos/${owner}/${repo}/issues/comments/${state.commentId} --method PATCH --field body=@${tempFile}`;
+        } finally {
+          await fs.unlink(tempFile).catch(() => {});
+        }
       } else {
         // Create new comment. Issue #1625: post via postTrackedCommentFromFile
         // so the comment ID is captured directly from the GitHub API response
@@ -235,9 +239,13 @@ export const createProgressMonitor = ({ owner, repo, prNumber, $, log, verbose =
         // posted comments from the "did the AI post anything?" check).
         const fs = (await import('fs')).promises;
         const tempFile = `/tmp/pr-progress-comment-${prNumber}-${Date.now()}.md`;
-        await fs.writeFile(tempFile, progressSection);
-        const posted = await postTrackedCommentFromFile({ $, owner, repo, targetNumber: prNumber, bodyFile: tempFile });
-        await fs.unlink(tempFile).catch(() => {});
+        await writeSanitizedPublicationFile(tempFile, progressSection);
+        let posted;
+        try {
+          posted = await postTrackedCommentFromFile({ $, owner, repo, targetNumber: prNumber, bodyFile: tempFile });
+        } finally {
+          await fs.unlink(tempFile).catch(() => {});
+        }
 
         if (posted.ok && posted.commentId) {
           state.commentId = posted.commentId;
@@ -300,9 +308,12 @@ export const createProgressMonitor = ({ owner, repo, prNumber, $, log, verbose =
       // Write to temp file and update PR
       const fs = (await import('fs')).promises;
       const tempBodyFile = `/tmp/pr-progress-${prNumber}-${Date.now()}.md`;
-      await fs.writeFile(tempBodyFile, updatedBody);
-      await $`gh pr edit ${prNumber} --repo ${owner}/${repo} --body-file ${tempBodyFile}`;
-      await fs.unlink(tempBodyFile).catch(() => {});
+      await writeSanitizedPublicationFile(tempBodyFile, updatedBody);
+      try {
+        await $`gh pr edit ${prNumber} --repo ${owner}/${repo} --body-file ${tempBodyFile}`;
+      } finally {
+        await fs.unlink(tempBodyFile).catch(() => {});
+      }
 
       const stats = calculateProgress(todos);
       await log(`📊 Updated PR progress: ${stats.percentage}% (${stats.completed}/${stats.total} tasks completed)`);

package/src/solve.results.lib.mjs

@@ -31,10 +31,10 @@ const { sanitizeLogContent, attachLogToGitHub } = githubLib;
 
 // Issue #1745: process-wide sanitization counters used to print a one-line
 // "we masked N secrets" summary at the end of each run.
-const { formatSanitizationSummary } = await import('./token-sanitization.lib.mjs');
+const { formatSanitizationSummary, sanitizeForPublication, writeSanitizedPublicationFile } = await import('./token-sanitization.lib.mjs');
 // Issue #1745: post-finish retroactive sanitization of bot-authored PR
-// comments and the PR description. Runs by default; can be skipped via
-// --dangerously-skip-output-sanitization.
+// comments and the PR description. This external repair boundary always runs
+// when PR coordinates are available.
 const { runPostFinishSweep } = await import('./post-finish-sanitization-sweep.lib.mjs');
 
 // Import continuation functions (session resumption, PR detection)
@@ -153,7 +153,7 @@ export const ensurePullRequestIssueLink = async ({ prNumber, issueNumber, owner,
 
   const fs = (await use('fs')).promises;
   const tempBodyFile = `/tmp/pr-body-update-${prNumber}-${Date.now()}.md`;
-  await fs.writeFile(tempBodyFile, linkResult.body);
+  await writeSanitizedPublicationFile(tempBodyFile, linkResult.body);
 
   try {
     const updateResult = await command`gh pr edit ${prNumber} --repo ${owner}/${repo} --body-file "${tempBodyFile}"`;
@@ -638,25 +638,19 @@ export const showSessionSummary = async (sessionId, limitReached, argv, issueUrl
   // Issue #1745: post-finish retroactive sanitization sweep. Re-reads
   // bot-authored PR comments and the PR description, runs them through
   // sanitizeOutput, and edits in place if a leak slipped past the live
-  // sanitizer. Honors --dangerously-skip-output-sanitization and the related
-  // active-tokens flag.
+  // sanitizer. Publication repair is a strict external boundary, so local
+  // diagnostic bypass flags never disable it.
   try {
     const owner = argv.owner;
     const repo = argv.repo;
     const prNumber = argv.prNumber;
-    const skipOutputSanitization = argv['dangerously-skip-output-sanitization'] === true;
-    const skipActiveTokensOutputSanitization = argv['dangerously-skip-active-tokens-output-sanitization'] === true;
-    if (owner && repo && prNumber && !skipOutputSanitization) {
+    if (owner && repo && prNumber) {
       const sweepResult = await runPostFinishSweep({
         $,
         owner,
         repo,
         prNumber,
         log,
-        sanitizationOptions: {
-          warnOnMismatch: false,
-          skipActiveTokensOutputSanitization,
-        },
       });
       if (sweepResult.totalEdited > 0) {
         await log(`🔒 Post-finish sweep: edited ${sweepResult.totalEdited} bot-authored item(s) to mask leaked tokens.`);
@@ -771,7 +765,7 @@ export const verifyResults = async (owner, repo, branchName, issueNumber, prNumb
           // Skip cleanup if auto-restart-on-non-updated-pull-request-description is enabled
           // (let the agent handle it on restart instead)
           if (prTitleHasPlaceholder && !argv.autoRestartOnNonUpdatedPullRequestDescription) {
-            const updatedTitle = pr.title.replace(/^\[WIP\]\s*/, '');
+            const updatedTitle = await sanitizeForPublication(pr.title.replace(/^\[WIP\]\s*/, ''));
             await log(`  📝 Removing [WIP] prefix from PR title...`);
             const titleResult = await $`gh pr edit ${pr.number} --repo ${owner}/${repo} --title "${updatedTitle}"`;
             if (titleResult.code === 0) {
@@ -819,7 +813,7 @@ Fixes ${issueRef}
 *This PR was created automatically by the AI issue solver*`;
 
             const tempBodyFile = `/tmp/pr-body-finalize-${pr.number}-${Date.now()}.md`;
-            await fs.writeFile(tempBodyFile, newDescription);
+            await writeSanitizedPublicationFile(tempBodyFile, newDescription);
 
             try {
               const descResult = await $`gh pr edit ${pr.number} --repo ${owner}/${repo} --body-file "${tempBodyFile}"`;

package/src/start-screen.mjs

@@ -4,6 +4,9 @@
 import { exec } from 'child_process';
 import { promisify } from 'util';
 import { parseCliArgumentsWithLino } from './cli-arguments.lib.mjs';
+import { setupStdioLogInterceptor } from './lib.mjs';
+
+setupStdioLogInterceptor();
 
 const execAsync = promisify(exec);
 

package/src/task.issue-creation.lib.mjs

@@ -3,6 +3,7 @@ import path from 'path';
 import { spawn } from 'child_process';
 import { promises as fs } from 'fs';
 import { parseGitHubUrl } from './github.lib.mjs';
+import { sanitizeForPublication, writeSanitizedPublicationFile } from './token-sanitization.lib.mjs';
 
 export const TASK_ISSUE_TITLE_MAX_LENGTH = 256;
 
@@ -216,9 +217,10 @@ export async function createTaskIssue({ repository, title, body, issueType = nul
   const bodyFile = path.join(tempDir, 'body.md');
 
   try {
-    await fs.writeFile(bodyFile, body);
+    await writeSanitizedPublicationFile(bodyFile, body);
+    const sanitizedTitle = await sanitizeForPublication(title);
 
-    const result = await run('gh', buildCreateIssueArgs({ repository, title, bodyFile, issueType, labels }));
+    const result = await run('gh', buildCreateIssueArgs({ repository, title: sanitizedTitle, bodyFile, issueType, labels }));
     if (result.code === 0) return parseCreatedTaskIssueOutput(result.stdout);
 
     const output = `${result.stderr || ''}${result.stdout || ''}`.trim();
@@ -228,7 +230,7 @@ export async function createTaskIssue({ repository, title, body, issueType = nul
     }
 
     await log?.(`⚠️  Could not create issue with type/labels (${output || `exit code ${result.code}`}); retrying without them`);
-    const retry = await run('gh', buildCreateIssueArgs({ repository, title, bodyFile }));
+    const retry = await run('gh', buildCreateIssueArgs({ repository, title: sanitizedTitle, bodyFile }));
     if (retry.code !== 0) {
       const retryOutput = `${retry.stderr || ''}${retry.stdout || ''}`.trim();
       throw new Error(retryOutput || `gh issue create exited with code ${retry.code}`);

package/src/task.mjs

@@ -8,6 +8,11 @@ import { buildStartAgentArgs, resolveStartAgentCommand } from './task.agent-comm
 import { getDefaultTaskModel, parseTaskArguments } from './task.config.lib.mjs';
 import { validateModelName } from './models/index.mjs';
 import { appendOrReplaceParentSplitSection, buildAddSubIssueApiArgs, buildIssueRestIdApiArgs, buildTaskSplitPrompt, buildTaskSplitSystemPrompt, extractTaskSplitJson, formatChildIssueBody, normalizeSplitTasks, parseCreatedIssueUrl, parseTaskIssueUrl } from './task.split.lib.mjs';
+import { setupStdioLogInterceptor } from './lib.mjs';
+import { sanitizeCredentialText } from './credential-sanitization-core.lib.mjs';
+import { sanitizeForPublication } from './token-sanitization.lib.mjs';
+
+setupStdioLogInterceptor();
 
 const earlyArgs = process.argv.slice(2);
 
@@ -73,10 +78,14 @@ const logFile = path.join(scriptDir, `task-${timestamp}.log`);
 async function log(message, options = {}) {
   const { level = 'info', verbose = false } = options;
   if (verbose && !argv.verbose) return;
-  await fs.appendFile(logFile, `[${new Date().toISOString()}] [${level.toUpperCase()}] ${message}\n`).catch(() => {});
-  if (level === 'error') console.error(message);
-  else if (level === 'warning' || level === 'warn') console.warn(message);
-  else console.log(message);
+  const sanitizedMessage = sanitizeCredentialText(message);
+  await fs
+    .appendFile(logFile, `[${new Date().toISOString()}] [${level.toUpperCase()}] ${sanitizedMessage}\n`, { mode: 0o600 })
+    .then(() => fs.chmod(logFile, 0o600))
+    .catch(() => {});
+  if (level === 'error') console.error(sanitizedMessage);
+  else if (level === 'warning' || level === 'warn') console.warn(sanitizedMessage);
+  else console.log(sanitizedMessage);
 }
 
 function formatAligned(icon, label, value, indent = 0) {
@@ -172,7 +181,8 @@ async function fetchIssueRestId(issue) {
 }
 
 async function createChildIssue(parentIssue, task, index, splitCount) {
-  const args = ['issue', 'create', '--repo', `${parentIssue.owner}/${parentIssue.repo}`, '--title', task.title, '--body', formatChildIssueBody({ parentIssue, task, index, splitCount })];
+  const [safeTitle, safeBody] = await Promise.all([sanitizeForPublication(task.title), sanitizeForPublication(formatChildIssueBody({ parentIssue, task, index, splitCount }))]);
+  const args = ['issue', 'create', '--repo', `${parentIssue.owner}/${parentIssue.repo}`, '--title', safeTitle, '--body', safeBody];
   if (parentIssue.labels.length > 0) {
     args.push('--label', parentIssue.labels.join(','));
   }
@@ -196,9 +206,11 @@ async function linkChildIssue(parentIssue, childIssue) {
 
 async function updateParentIssue(parentIssue, childIssues) {
   const body = appendOrReplaceParentSplitSection(parentIssue.body, childIssues);
-  await commandOutput('gh', ['issue', 'edit', String(parentIssue.number), '--repo', `${parentIssue.owner}/${parentIssue.repo}`, '--body', body]);
+  const safeBody = await sanitizeForPublication(body);
+  await commandOutput('gh', ['issue', 'edit', String(parentIssue.number), '--repo', `${parentIssue.owner}/${parentIssue.repo}`, '--body', safeBody]);
   const childList = childIssues.map(issue => `- #${issue.number} ${issue.title}`).join('\n');
-  await commandOutput('gh', ['issue', 'comment', String(parentIssue.number), '--repo', `${parentIssue.owner}/${parentIssue.repo}`, '--body', `Split into ${childIssues.length} tasks:\n\n${childList}`]);
+  const safeComment = await sanitizeForPublication(`Split into ${childIssues.length} tasks:\n\n${childList}`);
+  await commandOutput('gh', ['issue', 'comment', String(parentIssue.number), '--repo', `${parentIssue.owner}/${parentIssue.repo}`, '--body', safeComment]);
 }
 
 async function runSplitMode() {
@@ -268,7 +280,8 @@ ${results.clarification ? `Clarification analysis:\n${results.clarification}\n\n
 }
 
 try {
-  await fs.writeFile(logFile, `# Task Log - ${new Date().toISOString()}\n\n`);
+  await fs.writeFile(logFile, `# Task Log - ${new Date().toISOString()}\n\n`, { mode: 0o600 });
+  await fs.chmod(logFile, 0o600);
   await log(`📁 Log file: ${logFile}`);
   await log('\n🎯 Task Processing Started');
   await log(formatAligned('📝', 'Task input:', taskInput));

package/src/telegram-bot.mjs

@@ -1,5 +1,8 @@
 #!/usr/bin/env node
 import { ensureUseM } from './use-m-bootstrap.lib.mjs';
+import { maskToken, setupStdioLogInterceptor } from './lib.mjs';
+
+setupStdioLogInterceptor();
 // Early exit for --version (issue #1318: avoid dotenvx MISSING_ENV_FILE warnings)
 if (process.argv.includes('--version')) {
   const v = await import('./version.lib.mjs').then(m => m.getVersion()).catch(() => 'unknown');
@@ -212,7 +215,7 @@ if (hiveEnabled && hiveOverrides.length > 0) {
 if (config.dryRun) {
   console.log('\n✅ Dry-run mode: All validations passed successfully!');
   console.log('\nConfiguration summary:');
-  console.log('  Token:', BOT_TOKEN ? `${BOT_TOKEN.substring(0, 10)}...` : 'not set');
+  console.log('  Token:', BOT_TOKEN ? maskToken(BOT_TOKEN) : 'not set');
   if (allowedChats && allowedChats.length > 0) {
     console.log('  Allowed chats:', lino.format(allowedChats));
   } else {
@@ -820,13 +823,13 @@ async function handleSolveCommand(ctx) {
 
   if (check.canStart && check.startReserved) {
     const startingMessage = await safeReply(ctx, formatStartingWorkSessionMessage({ infoBlock, locale: solveLocale }), { reply_to_message_id: ctx.message.message_id });
-    await executeAndUpdateMessage(ctx, startingMessage, 'solve', argsWithLocale, infoBlock, effectiveSolveIsolation, solveTool, solveUrlContext, { showLimits: solveShowLimits, limitsAtStart: solveLimitsAtStart, locale: solveLocale });
+    await executeAndUpdateMessage(ctx, startingMessage, 'solve', argsWithLocale, infoBlock, effectiveSolveIsolation, solveTool, solveUrlContext, { showLimits: solveShowLimits, limitsAtStart: solveLimitsAtStart, locale: solveLocale, commandAlias: solveCommandName });
   } else {
     if (!solveQueue.executeCallback) {
       const _t = (s, i) => trackSession(s, i, VERBOSE);
       solveQueue.executeCallback = createIsolationAwareQueueCallback(ISOLATION_BACKEND, isolationRunner, _t, createQueueExecuteCallback(executeStartScreen, _t), VERBOSE);
     }
-    const queueItem = solveQueue.enqueue({ url: normalizedUrl, args: argsWithLocale, ctx, requester, infoBlock, tool: solveTool, perCommandIsolation: effectiveSolveIsolation, urlContext: solveUrlContext, showLimits: solveShowLimits, limitsAtStart: solveLimitsAtStart, locale: solveLocale });
+    const queueItem = solveQueue.enqueue({ url: normalizedUrl, args: argsWithLocale, ctx, requester, infoBlock, commandAlias: solveCommandName, tool: solveTool, perCommandIsolation: effectiveSolveIsolation, urlContext: solveUrlContext, showLimits: solveShowLimits, limitsAtStart: solveLimitsAtStart, locale: solveLocale });
     const queueMessage = buildSolveQueuedMessage({ locale: solveLocale, tool: solveTool, position: toolQueuedCount + 1, infoBlock, reason: check.reason ? escapeMarkdown(check.reason) : '' }); // tool-specific position (#1551)
     const queuedMessage = await safeReply(ctx, queueMessage, { reply_to_message_id: ctx.message.message_id });
     queueItem.messageInfo = { chatId: queuedMessage.chat.id, messageId: queuedMessage.message_id };

package/src/telegram-command-execution.lib.mjs

@@ -99,7 +99,7 @@ function executeWithCommand(startScreenCmd, command, args, verbose = false) {
  */
 export function buildExecuteAndUpdateMessage(deps) {
   const { resolveIsolation, ISOLATION_BACKEND, isolationRunner, VERBOSE, executeStartScreen, trackSession, untrackSession, AUTO_WATCH_MESSAGE, startAutoTerminalWatchForSession, bot, formatExecutingWorkSessionMessage, formatStartingWorkSessionMessage } = deps;
-  return async function executeAndUpdateMessage(ctx, startingMessage, commandName, args, infoBlock, perCommandIsolation = null, tool = 'claude', urlContext = null, { showLimits = false, limitsAtStart = null, locale = null } = {}) {
+  return async function executeAndUpdateMessage(ctx, startingMessage, commandName, args, infoBlock, perCommandIsolation = null, tool = 'claude', urlContext = null, { showLimits = false, limitsAtStart = null, locale = null, commandAlias = null } = {}) {
     const { chat, message_id: msgId } = startingMessage;
     const safeEdit = async text => {
       try {
@@ -111,7 +111,7 @@ export function buildExecuteAndUpdateMessage(deps) {
     const requesterUserId = ctx.from?.id ?? null; // Issue #1688: suppress duplicate /subscribe DM
     // #1927 review follow-up: persist the full args so a killed /solve can be
     //   resumed with its exact original invocation + `--resume <lastSessionId>`.
-    const baseSessionInfo = { chatId: ctx.chat.id, messageId: msgId, startTime: new Date(), url: args[0], command: commandName, tool, infoBlock, urlContext, requesterUserId, showLimits, limitsAtStart, locale, args: Array.isArray(args) ? [...args] : undefined }; // #594: showLimits/limitsAtStart
+    const baseSessionInfo = { chatId: ctx.chat.id, messageId: msgId, startTime: new Date(), url: args[0], command: commandName, commandAlias, tool, infoBlock, urlContext, requesterUserId, showLimits, limitsAtStart, locale, args: Array.isArray(args) ? [...args] : undefined }; // #594: showLimits/limitsAtStart
     const iso = await resolveIsolation(perCommandIsolation, ISOLATION_BACKEND, isolationRunner, VERBOSE);
     let result, session, sessionInfo;
     if (iso) {