@link-assistant/hive-mind 2.10.0 → 2.10.2

package/src/telegram-isolation.lib.mjs

@@ -90,11 +90,13 @@ export function createIsolationAwareQueueCallback(botIsolationBackend, botIsolat
             startTime: new Date(),
             url: item.url,
             command: item.command || 'solve',
+            commandAlias: item.commandAlias || null,
             isolationBackend: iso.backend,
             sessionId: sid,
             containerFilesystemStartBytes: Number.isFinite(r.containerFilesystemStartBytes) ? r.containerFilesystemStartBytes : null,
             tool,
             infoBlock: item.infoBlock,
+            args: Array.isArray(item.args) ? [...item.args] : undefined,
             // Issue #1688: propagate URL context + requester through the queue so the
             //   completion notification can append a 'Pull request:' line and skip
             //   notifying the requester twice via /subscribe.

package/src/telegram-log-command.lib.mjs

@@ -21,8 +21,10 @@
  */
 
 import path from 'path';
+import os from 'os';
 import fs from 'fs/promises';
 import { constants as fsConstants } from 'fs';
+import { sanitizeForPublication, writeSanitizedPublicationFile } from './token-sanitization.lib.mjs';
 
 const UUID_RE = /\b([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b/i;
 const ISOLATION_BACKENDS = new Set(['screen', 'tmux', 'docker']);
@@ -30,6 +32,29 @@ const ISOLATION_BACKENDS = new Set(['screen', 'tmux', 'docker']);
 // https://core.telegram.org/bots/api#senddocument
 const TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 
+/**
+ * Build a private, sanitized upload artifact without modifying the raw audit
+ * log. The returned cleanup function must be called after the network request.
+ */
+async function prepareSanitizedLogUpload(logPath, caption) {
+  const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hive-mind-telegram-log-'));
+  await fs.chmod(tempDir, 0o700);
+  const sanitizedPath = path.join(tempDir, path.basename(logPath));
+
+  try {
+    const [rawLog, safeCaption] = await Promise.all([fs.readFile(logPath, 'utf8'), sanitizeForPublication(caption)]);
+    await writeSanitizedPublicationFile(sanitizedPath, rawLog);
+    return {
+      path: sanitizedPath,
+      caption: safeCaption,
+      cleanup: () => fs.rm(tempDir, { recursive: true, force: true }),
+    };
+  } catch (error) {
+    await fs.rm(tempDir, { recursive: true, force: true });
+    throw error;
+  }
+}
+
 /**
  * Extract the first RFC 4122 v4-shaped UUID found in `text`.
  *
@@ -305,11 +330,15 @@ export async function registerLogCommand(bot, options) {
 
     if (decision.destination === 'chat') {
       // Public repository → reply with the document directly in the chat.
+      let upload;
       try {
-        await ctx.replyWithDocument({ source: logPath, filename }, { reply_to_message_id: message.message_id, caption, parse_mode: 'Markdown' });
+        upload = await prepareSanitizedLogUpload(logPath, caption);
+        await ctx.replyWithDocument({ source: upload.path, filename }, { reply_to_message_id: message.message_id, caption: upload.caption, parse_mode: 'Markdown' });
       } catch (error) {
         console.error('[ERROR] /log: replyWithDocument failed:', error);
-        await ctx.reply(`❌ Failed to upload log: ${error.message || String(error)}`, { reply_to_message_id: message.message_id });
+        await ctx.reply('❌ Failed to sanitize or upload the log.', { reply_to_message_id: message.message_id });
+      } finally {
+        await upload?.cleanup();
       }
       return;
     }
@@ -348,16 +377,21 @@ export async function registerLogCommand(bot, options) {
       console.error('[ERROR] /log: DM forwarding step failed:', error);
     }
 
+    let upload;
     try {
+      upload = await prepareSanitizedLogUpload(logPath, caption);
       const replyOpts = forwardedMessageId ? { reply_to_message_id: forwardedMessageId, caption, parse_mode: 'Markdown' } : { caption, parse_mode: 'Markdown' };
-      await ctx.telegram.sendDocument(userId, { source: logPath, filename }, replyOpts);
+      replyOpts.caption = upload.caption;
+      await ctx.telegram.sendDocument(userId, { source: upload.path, filename }, replyOpts);
     } catch (error) {
       console.error('[ERROR] /log: sendDocument to DM failed:', error);
       // Tell the user, in their original chat, that DM delivery failed
       // (commonly because they have not started a chat with the bot).
-      const friendly = error?.code === 403 || /chat not found|bot can't initiate conversation/i.test(error?.message || '') ? 'I could not send you a DM. Please open a private chat with me and send /start, then try again.' : `Failed to send the log via DM: ${error.message || String(error)}`;
+      const friendly = error?.code === 403 || /chat not found|bot can't initiate conversation/i.test(error?.message || '') ? 'I could not send you a DM. Please open a private chat with me and send /start, then try again.' : 'Failed to sanitize or send the log via DM.';
       await ctx.reply(`❌ ${friendly}`, { reply_to_message_id: message.message_id });
       return;
+    } finally {
+      await upload?.cleanup();
     }
 
     // Acknowledge in the original chat (only if it wasn't already a DM).

package/src/telegram-safe-reply.lib.mjs

@@ -1,4 +1,5 @@
 import { normalizeLocale, t } from './i18n.lib.mjs';
+import { sanitizeForPublication } from './token-sanitization.lib.mjs';
 
 const FORMATTING_FALLBACK_INSTALLED = Symbol.for('hiveMind.telegramFormattingFallbackInstalled');
 const DEFAULT_FORMATTING_FALLBACK_WARNING = '⚠️ Formatting error detected. Showing plain text fallback.';
@@ -385,7 +386,7 @@ export async function safeReply(ctx, text, options = {}) {
   const { telegramOptions, fallbackLocale, verbose } = splitOptions(options);
   const firstOptions = { parse_mode: 'Markdown', ...telegramOptions };
   return await sendTelegramTextChunks({
-    text,
+    text: await sanitizeForPublication(text),
     telegramOptions: firstOptions,
     fallbackLocale,
     verbose,
@@ -398,7 +399,7 @@ export async function safeEditMessageText(telegram, chatId, messageId, inlineMes
   const { telegramOptions, fallbackLocale, verbose } = splitOptions(options);
   const firstOptions = { parse_mode: 'Markdown', ...telegramOptions };
   return await editTelegramTextChunks({
-    text,
+    text: await sanitizeForPublication(text),
     telegramOptions: firstOptions,
     fallbackLocale,
     verbose,
@@ -419,9 +420,10 @@ function wrapTelegramSendMessage(telegram, defaults = {}) {
     args[2] = telegramOptions;
 
     if (typeof text !== 'string') return await original.apply(this, args);
+    const sanitizedText = await sanitizeForPublication(text);
 
     return await sendTelegramTextChunks({
-      text,
+      text: sanitizedText,
       telegramOptions,
       fallbackLocale: fallbackLocale || defaults.fallbackLocale,
       verbose: verbose || defaults.verbose,
@@ -447,9 +449,10 @@ function wrapTelegramEditMessageText(telegram, defaults = {}) {
     args[4] = telegramOptions;
 
     if (typeof text !== 'string') return await original.apply(this, args);
+    const sanitizedText = await sanitizeForPublication(text);
 
     return await editTelegramTextChunks({
-      text,
+      text: sanitizedText,
       telegramOptions,
       fallbackLocale: fallbackLocale || defaults.fallbackLocale,
       verbose: verbose || defaults.verbose,

package/src/telegram-solve-queue.lib.mjs

@@ -53,6 +53,7 @@ class SolveQueueItem {
     this.ctx = options.ctx;
     this.requester = options.requester;
     this.infoBlock = options.infoBlock;
+    this.commandAlias = options.commandAlias || null; // #2109: retain Telegram spelling for resume guidance
     this.tool = options.tool || 'claude';
     // Issue #1983: preserve per-command isolation through queued execution.
     this.perCommandIsolation = options.perCommandIsolation || null;
@@ -1442,16 +1443,14 @@ export function createQueueExecuteCallback(executeStartScreen, trackSessionFn) {
           startTime: new Date(),
           url: item.url,
           command: 'solve',
+          commandAlias: item.commandAlias || null,
           tool: item.tool || 'claude',
           infoBlock: item.infoBlock,
-          // Issue #1688: propagate URL context + requester so the completion
-          //   notification can append a 'Pull request:' line and skip
-          //   notifying the requester twice via /subscribe.
+          args: Array.isArray(item.args) ? [...item.args] : undefined,
+          // #1688: propagate URL context and requester to completion.
           urlContext: item.urlContext || null,
           requesterUserId: item.requesterUserId ?? null,
-          // Issue #594: --show-limits virtual option carries the start-of-task
-          //   snapshot from the queueing point through to the completion
-          //   handler so it can render an end-of-task delta.
+          // #594: carry the start-of-task limits snapshot to completion.
           showLimits: item.showLimits === true,
           limitsAtStart: item.limitsAtStart || null,
           locale: item.locale || null,

package/src/telegram-tokens-command.lib.mjs

@@ -66,7 +66,7 @@ const isOperatorOfAnyAllowedChat = async ({ telegram, userId, allowedChatIds })
 
 /**
  * Format the token list for display. Each line: `name (source): masked`.
- * The masked form is `first-3 *** last-3` per maskToken's new default.
+ * The masked form is `first-3…last-3` per maskToken's default.
  */
 export const formatTokenList = tokens => {
   if (!tokens || tokens.length === 0) {

package/src/token-sanitization.lib.mjs

@@ -15,10 +15,14 @@ import { ensureUseM } from './use-m-bootstrap.lib.mjs';
  * @module token-sanitization
  */
 
-// Import shared utility from lib.mjs
-import { maskToken, log, isENOSPC } from './lib.mjs';
+// Import shared utilities. The dependency-free core is also used directly by
+// lib.mjs, so it must not depend on this asynchronous Secretlint layer.
+import { log, isENOSPC } from './lib.mjs';
+import { CREDENTIAL_SANITIZATION_ERROR_CODE, CREDENTIAL_SANITIZATION_FAILURE_MESSAGE, createCredentialStreamSanitizer, findCredentialResiduals, maskToken, sanitizeCredentialText } from './credential-sanitization-core.lib.mjs';
 import { reportError } from './sentry.lib.mjs';
 
+export { createCredentialStreamSanitizer };
+
 import { wrapDollarWithGhRetry as _wrapDollarWithGhRetry } from './github-rate-limit.lib.mjs'; // rate-limit marker (#1726): gh API calls flow through $ wrapped by caller
 // Dynamic imports for runtime dependencies
 const getOsModule = async () => (await import('os')).default;
@@ -28,6 +32,7 @@ const getFsModule = async () => (await import('fs')).promises;
 // Lazy-loaded secretlint modules (initialized on first use)
 let secretlintCore = null;
 let secretlintConfig = null;
+let githubCommandTokensCache = null;
 
 // Issue #1745: process-wide counters for how many tokens were masked. The
 // final-summary path (solve.mjs / hive.mjs) reads these to print a one-line
@@ -107,10 +112,10 @@ const initSecretlint = async () => {
     };
 
     return true;
-  } catch (error) {
+  } catch (_error) {
     // secretlint not available - fall back to custom patterns only
     if (global.verboseMode) {
-      await log(`  ⚠️  Secretlint not available, using fallback patterns: ${error.message}`, { verbose: true });
+      await log('  ⚠️  Secretlint is not available; publication boundaries will remain blocked.', { verbose: true });
     }
     secretlintConfig = false;
     return false;
@@ -240,6 +245,9 @@ export const getGitHubTokensFromFiles = async () => {
  * @returns {Promise<string[]>} Array of tokens found
  */
 export const getGitHubTokensFromCommand = async () => {
+  if (githubCommandTokensCache) {
+    return [...githubCommandTokensCache];
+  }
   if (typeof globalThis.use === 'undefined') {
     await ensureUseM();
   }
@@ -276,6 +284,7 @@ export const getGitHubTokensFromCommand = async () => {
     }
   }
 
+  githubCommandTokensCache = [...tokens];
   return tokens;
 };
 
@@ -284,11 +293,14 @@ export const getGitHubTokensFromCommand = async () => {
  * @param {string} content - Content to scan
  * @returns {Promise<Array<{start: number, end: number, token: string, ruleId: string}>>} Array of detected secrets with rule info
  */
-const detectSecretsWithSecretlint = async content => {
+const detectSecretsWithSecretlint = async (content, options = {}) => {
   const secrets = [];
 
   const available = await initSecretlint();
   if (!available || !secretlintCore || !secretlintConfig) {
+    if (options.required) {
+      throw new Error('Secretlint scanner is unavailable.');
+    }
     return secrets;
   }
 
@@ -309,6 +321,12 @@ const detectSecretsWithSecretlint = async content => {
       if (message.range && message.range.length === 2) {
         const [start, end] = message.range;
         const token = content.substring(start, end);
+        // The synchronous core may already have sanitized the credential
+        // portion of a larger structured value (for example a database DSN).
+        // Do not let a broad Secretlint range erase the remaining safe context.
+        if (token.includes('[REDACTED]') || /…/.test(token)) {
+          continue;
+        }
         secrets.push({
           start,
           end,
@@ -319,8 +337,11 @@ const detectSecretsWithSecretlint = async content => {
       }
     }
   } catch (error) {
+    if (options.required) {
+      throw new Error('Secretlint scanner failed.', { cause: error });
+    }
     if (global.verboseMode) {
-      await log(`  ⚠️  Secretlint detection error: ${error.message}`, { verbose: true });
+      await log('  ⚠️  Secretlint detection failed.', { verbose: true });
     }
   }
 
@@ -404,7 +425,7 @@ const detectSecretsWithCustomPatterns = content => {
     while ((match = pattern.exec(content)) !== null) {
       const token = match[0];
       // Skip if already masked (contains consecutive asterisks)
-      if (/\*{3,}/.test(token)) {
+      if (/\*{3,}/.test(token) || token.includes('[REDACTED]') || /…/.test(token)) {
         continue;
       }
       secrets.push({
@@ -454,6 +475,44 @@ const compareDetectionResults = async (secretlintSecrets, customSecrets) => {
   return { secretlintOnly, customOnly, both };
 };
 
+/**
+ * Run the dependency-free sanitizer without changing exact strings covered by
+ * the legacy local-output exclusion carve-out. Publication callers never pass
+ * exclusions and therefore cannot reach this compatibility behavior.
+ */
+const sanitizeCredentialTextPreservingExclusions = (input, excludedSet) => {
+  const text = String(input ?? '');
+  if (excludedSet.size === 0) return sanitizeCredentialText(text);
+
+  const excludedTokens = [...excludedSet].sort((a, b) => b.length - a.length);
+  let output = '';
+  let cursor = 0;
+
+  while (cursor < text.length) {
+    let nextIndex = -1;
+    let nextToken = '';
+    for (const token of excludedTokens) {
+      const index = text.indexOf(token, cursor);
+      if (index === -1) continue;
+      if (nextIndex === -1 || index < nextIndex || (index === nextIndex && token.length > nextToken.length)) {
+        nextIndex = index;
+        nextToken = token;
+      }
+    }
+
+    if (nextIndex === -1) {
+      output += sanitizeCredentialText(text.slice(cursor));
+      break;
+    }
+
+    output += sanitizeCredentialText(text.slice(cursor, nextIndex));
+    output += nextToken;
+    cursor = nextIndex + nextToken.length;
+  }
+
+  return output;
+};
+
 /**
  * Sanitize arbitrary outbound output by masking sensitive tokens while avoiding false positives
  * Uses DUAL APPROACH: Both secretlint AND custom patterns run independently
@@ -470,7 +529,7 @@ const compareDetectionResults = async (secretlintSecrets, customSecrets) => {
  * @returns {Promise<string>} Sanitized output with tokens masked
  */
 export const sanitizeOutput = async (output, options = {}) => {
-  let sanitized = output;
+  let sanitized = String(output ?? '');
   const { warnOnMismatch = global.verboseMode, skipOutputSanitization = false, skipActiveTokensOutputSanitization = false, excludeTokens = [] } = options;
   const excludedSet = new Set((excludeTokens || []).filter(t => typeof t === 'string' && t.length > 0));
   const isExcluded = token => excludedSet.has(token);
@@ -513,6 +572,29 @@ export const sanitizeOutput = async (output, options = {}) => {
       return sanitized;
     }
 
+    // Always apply the dependency-free structured/vendor pass before optional
+    // scanners. Record custom-pattern matches before that pass because the
+    // core deliberately masks them first; otherwise the legacy local-output
+    // summary counters would no longer observe those replacements.
+    const preCoreCustomSecrets = detectSecretsWithCustomPatterns(sanitized);
+    let corePatternMasks = 0;
+    for (const secret of preCoreCustomSecrets) {
+      if (isExcluded(secret.token)) continue;
+      if (sanitizeCredentialText(secret.token, { includeEnvironmentCredentials: false }) !== secret.token) {
+        corePatternMasks++;
+      }
+    }
+
+    const beforeCore = sanitized;
+    sanitized = sanitizeCredentialTextPreservingExclusions(sanitized, excludedSet);
+    if (sanitized !== beforeCore) {
+      // Structured credentials that do not have a standalone vendor pattern
+      // still count as one sanitization event for the operator-facing summary.
+      const coreMaskCount = Math.max(corePatternMasks, 1);
+      sanitizationStats.patternMasks += coreMaskCount;
+      sanitizationStats.totalMasked += coreMaskCount;
+    }
+
     // Step 2: DUAL APPROACH - Run both detection methods independently
     const [secretlintSecrets, customSecrets] = await Promise.all([detectSecretsWithSecretlint(sanitized), Promise.resolve(detectSecretsWithCustomPatterns(sanitized))]);
 
@@ -524,9 +606,8 @@ export const sanitizeOutput = async (output, options = {}) => {
       stats.secretlintOnlyWarnings = secretlintOnly;
       await log(`  ⚠️  PATTERN GAP: Secretlint found ${secretlintOnly.length} secret(s) that our custom patterns missed:`, { verbose: true });
       for (const secret of secretlintOnly) {
-        // Show truncated token and rule that detected it
-        const truncated = secret.token.length > 20 ? `${secret.token.substring(0, 10)}...${secret.token.substring(secret.token.length - 5)}` : secret.token;
-        await log(`      • Rule: ${secret.ruleId}, Token preview: ${truncated}`, { verbose: true });
+        // Rule identifiers are useful diagnostics; token previews are not.
+        await log(`      • Rule: ${secret.ruleId}`, { verbose: true });
       }
       await log(`      Consider adding custom patterns for these secret types to improve our detection.`, { verbose: true });
     }
@@ -634,16 +715,94 @@ export const sanitizeOutput = async (output, options = {}) => {
       level: isNoSpace ? 'error' : 'warning',
     });
     if (isNoSpace) {
-      await log(`  ❌ ENOSPC: No space left on device during log sanitization. Skipping sanitization.`);
+      await log(`  ❌ ENOSPC: No space left on device during output sanitization. Output was blocked.`);
       await log(`     Consider freeing disk space (e.g., rm -rf ~/.claude/debug/*.txt) and retrying.`);
     } else {
-      await log(`  ⚠️  Warning: Could not fully sanitize log content: ${error.message}`, { verbose: true });
+      await log(`  ⚠️  Warning: Output sanitization failed; unsafe output was blocked.`, { verbose: true });
     }
+    return CREDENTIAL_SANITIZATION_FAILURE_MESSAGE;
   }
 
   return sanitized;
 };
 
+export class CredentialSanitizationError extends Error {
+  constructor(options = {}) {
+    super(CREDENTIAL_SANITIZATION_FAILURE_MESSAGE, options);
+    this.name = 'CredentialSanitizationError';
+    this.code = CREDENTIAL_SANITIZATION_ERROR_CODE;
+  }
+}
+
+/**
+ * Exact publication-boundary sanitizer.
+ *
+ * Unlike best-effort local diagnostics, outbound mutations require both the
+ * synchronous maintained patterns and Secretlint to complete successfully.
+ * The final bytes are scanned again immediately before a caller publishes
+ * them. Any scanner failure or residual finding blocks publication.
+ */
+export const sanitizeForPublication = async (input, options = {}) => {
+  try {
+    const scanner =
+      options.scanner ||
+      (async value => {
+        const sanitized = await sanitizeOutput(value, {
+          warnOnMismatch: false,
+          // Publication boundaries intentionally ignore all dangerous bypass
+          // flags and user-content exclusions.
+          skipOutputSanitization: false,
+          skipActiveTokensOutputSanitization: false,
+          excludeTokens: [],
+        });
+        if (sanitized === CREDENTIAL_SANITIZATION_FAILURE_MESSAGE) {
+          throw new Error('Primary sanitizer failed.');
+        }
+        return sanitized;
+      });
+    const sanitized = String(await scanner(String(input ?? '')));
+    const residualScanner =
+      options.residualScanner ||
+      (async value => {
+        const residuals = findCredentialResiduals(value);
+        const secretlintResiduals = await detectSecretsWithSecretlint(value, { required: true });
+        const knownTokenResiduals = await containsKnownToken(value);
+        return [...residuals, ...secretlintResiduals, ...knownTokenResiduals];
+      });
+    const residuals = await residualScanner(sanitized);
+    if (!Array.isArray(residuals) || residuals.length > 0) {
+      throw new Error('Residual credential material detected.');
+    }
+    return sanitized;
+  } catch (cause) {
+    reportError(new Error('Credential publication boundary blocked unsafe output.'), {
+      context: 'credential_publication_boundary',
+      level: 'warning',
+    });
+    throw new CredentialSanitizationError({ cause });
+  }
+};
+
+/**
+ * Write an exact outbound payload to an owner-readable file after the
+ * fail-closed publication scan. Returns the bytes written for callers that
+ * also need to compare or reuse them.
+ */
+export const writeSanitizedPublicationFile = async (filePath, input) => {
+  const sanitized = await sanitizeForPublication(input);
+  const fs = await getFsModule();
+  // Publication intermediates are always new files. Exclusive creation avoids
+  // following a pre-planted symlink in a shared temporary directory.
+  const handle = await fs.open(filePath, 'wx', 0o600);
+  try {
+    await handle.writeFile(sanitized, { encoding: 'utf8' });
+    await handle.chmod(0o600);
+  } finally {
+    await handle.close();
+  }
+  return sanitized;
+};
+
 // Export detection functions for testing and visibility
 export { detectSecretsWithSecretlint, detectSecretsWithCustomPatterns, compareDetectionResults };
 
@@ -706,7 +865,7 @@ export const getEnvironmentTokens = () => {
   const out = [];
   for (const name of KNOWN_LOCAL_TOKEN_ENV_VARS) {
     const value = process.env[name];
-    if (typeof value === 'string' && value.length >= 12) {
+    if (typeof value === 'string' && value.length > 0) {
       out.push({ name, value });
     }
   }
@@ -888,6 +1047,8 @@ export const extractTokensFromUserContent = async (text, options = {}) => {
 
 // Default export for convenience
 export default {
+  CredentialSanitizationError,
+  createCredentialStreamSanitizer,
   isSafeToken,
   isHexInSafeContext,
   getGitHubTokensFromFiles,
@@ -900,6 +1061,8 @@ export default {
   getEnvironmentTokens,
   getAllKnownLocalTokens,
   containsKnownToken,
+  sanitizeForPublication,
+  writeSanitizedPublicationFile,
   sanitizeCommentBody,
   getSanitizationStats,
   resetSanitizationStats,

package/src/tool-comments.lib.mjs

@@ -215,7 +215,7 @@ export const resetTrackedToolCommentIds = () => {
  * @param {string} options.body
  * @returns {Promise<{ok: boolean, commentId: string|null, stderr?: string}>}
  */
-export const postTrackedComment = async ({ $, owner, repo, targetNumber, body, sanitizationOptions }) => {
+export const postTrackedComment = async ({ $, owner, repo, targetNumber, body, sanitizationOptions: _sanitizationOptions }) => {
   if (!$) {
     throw new Error('postTrackedComment requires a command-stream $ helper');
   }
@@ -225,10 +225,10 @@ export const postTrackedComment = async ({ $, owner, repo, targetNumber, body, s
   // We use the /issues/<n>/comments endpoint because it works identically
   // for both PRs and issues (a PR is an issue at this endpoint).
   const apiPath = `repos/${owner}/${repo}/issues/${targetNumber}/comments`;
-  const { sanitizeOutput } = await import('./token-sanitization.lib.mjs');
-  // Issue #1745: caller may pass dangerous-skip flags + carve-out tokens.
-  // Defaults preserve fail-closed behavior: full sanitization.
-  const sanitizedBody = await sanitizeOutput(body, sanitizationOptions || {});
+  const { sanitizeForPublication } = await import('./token-sanitization.lib.mjs');
+  // This is the exact outbound mutation boundary. Dangerous local-output
+  // bypasses and user-content carve-outs must not weaken GitHub publication.
+  const sanitizedBody = await sanitizeForPublication(body);
   const payload = JSON.stringify({ body: sanitizedBody });
 
   // command-stream's options key is `stdin`, not `input` — unknown keys are

package/src/youtrack/youtrack-sync.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { wrapDollarWithGhRetry as _wrapDollarWithGhRetry } from '../github-rate-limit.lib.mjs'; // rate-limit marker (#1726): gh API calls flow through $ wrapped by caller
+import { sanitizeForPublication } from '../token-sanitization.lib.mjs';
 
 /**
  * YouTrack to GitHub Issue Synchronization Module
@@ -66,10 +67,10 @@ export async function syncYouTrackIssueToGitHub(youTrackIssue, owner, repo, youT
 
   // Format title with YouTrack ID for automatic linking
   // Format: "[PROJECT-123] Original Title" or "PROJECT-123: Original Title"
-  const ghTitle = `[${youTrackId}] ${youTrackIssue.summary}`;
+  const ghTitle = await sanitizeForPublication(`[${youTrackId}] ${youTrackIssue.summary}`);
 
   // Build issue body with YouTrack details
-  const ghBody = `## YouTrack Issue
+  const ghBody = await sanitizeForPublication(`## YouTrack Issue
 
 **ID:** ${youTrackId}
 **Link:** ${youTrackUrl}
@@ -82,7 +83,7 @@ ${youTrackIssue.description || 'No description provided.'}
 ---
 *This issue is automatically synchronized from YouTrack. Any commits or PRs that reference \`${youTrackId}\` will be automatically linked in YouTrack.*
 
-**Note:** To process this issue, ensure the 'help wanted' label exists in your repository.`;
+**Note:** To process this issue, ensure the 'help wanted' label exists in your repository.`);
 
   // Check if issue already exists
   const existingIssue = await findGitHubIssueForYouTrack(youTrackId, owner, repo, $);