@link-assistant/hive-mind 2.10.1 → 2.10.3

package/src/sentry.lib.mjs

@@ -1,5 +1,24 @@
 // Sentry integration library for hive-mind
 import { isSentryEnabled, captureException, captureMessage, startTransaction } from './instrument.mjs';
+import { sanitizeCredentialText } from './credential-sanitization-core.lib.mjs';
+
+const sanitizeError = error => {
+  const source = error instanceof Error ? error : new Error(String(error));
+  const sanitized = new Error(sanitizeCredentialText(source.message));
+  sanitized.name = source.name;
+  if (source.stack) sanitized.stack = sanitizeCredentialText(source.stack);
+  return sanitized;
+};
+
+const sanitizeContext = (value, seen = new WeakSet()) => {
+  if (typeof value === 'string') return sanitizeCredentialText(value);
+  if (value instanceof Error) return sanitizeError(value);
+  if (!value || typeof value !== 'object') return value;
+  if (seen.has(value)) return '[Circular]';
+  seen.add(value);
+  if (Array.isArray(value)) return value.map(item => sanitizeContext(item, seen));
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, sanitizeContext(item, seen)]));
+};
 
 // Lazy import of Sentry to handle cases where it's not installed
 let Sentry = null;
@@ -84,7 +103,7 @@ export const withSentry = (fn, name, op = 'task') => {
       return result;
     } catch (error) {
       transaction.setStatus('internal_error');
-      captureException(error, {
+      captureException(sanitizeError(error), {
         operation: name,
         args: args.length > 0 ? `${args.length} arguments` : 'no arguments',
       });
@@ -139,7 +158,7 @@ export const logToSentry = (message, level = 'info', context = {}) => {
     return;
   }
 
-  captureMessage(message, level, context);
+  captureMessage(sanitizeCredentialText(message), level, sanitizeContext(context));
 };
 
 /**
@@ -153,7 +172,7 @@ export const reportError = (error, context = {}) => {
     return;
   }
 
-  captureException(error, { ...context, level: 'error' });
+  captureException(sanitizeError(error), { ...sanitizeContext(context), level: 'error' });
 };
 
 /**
@@ -169,7 +188,7 @@ export const reportWarning = (warning, context = {}) => {
 
   // Convert string warnings to Error objects for better stack traces
   const warningError = typeof warning === 'string' ? new Error(warning) : warning;
-  captureException(warningError, { ...context, level: 'warning' });
+  captureException(sanitizeError(warningError), { ...sanitizeContext(context), level: 'warning' });
 };
 
 /**
@@ -183,7 +202,7 @@ export const addBreadcrumb = async breadcrumb => {
 
   const sentry = await getSentry();
   if (sentry) {
-    sentry.addBreadcrumb(breadcrumb);
+    sentry.addBreadcrumb(sanitizeContext(breadcrumb));
   }
 };
 
@@ -198,7 +217,7 @@ export const setUserContext = async user => {
 
   const sentry = await getSentry();
   if (sentry) {
-    sentry.setUser(user);
+    sentry.setUser(sanitizeContext(user));
   }
 };
 
@@ -214,7 +233,7 @@ export const setExtraContext = async (key, value) => {
 
   const sentry = await getSentry();
   if (sentry) {
-    sentry.setExtra(key, value);
+    sentry.setExtra(key, sanitizeContext(value));
   }
 };
 
@@ -229,7 +248,7 @@ export const setTags = async tags => {
 
   const sentry = await getSentry();
   if (sentry) {
-    sentry.setTags(tags);
+    sentry.setTags(sanitizeContext(tags));
   }
 };
 

package/src/solve.auto-merge.lib.mjs

@@ -1068,6 +1068,10 @@ No further AI sessions will be started automatically for this run. Please review
               prNumber,
               issueNumber,
               success: true,
+              publicPricingEstimate: toolResult.publicPricingEstimate,
+              anthropicTotalCostUSD: latestAnthropicCost,
+              pricingInfo: toolResult.pricingInfo,
+              budgetStatsData: autoMergeBudgetStatsData,
             });
           } catch (summaryError) {
             reportError(summaryError, {

package/src/solve.auto-pr.lib.mjs

@@ -11,6 +11,7 @@ import { handleCompareApiNotReady } from './solve.auto-pr-compare-readiness.lib.
 
 import { wrapDollarWithGhRetry as _wrapDollarWithGhRetry, execGhWithRetry, isTransientCompareApiError } from './github-rate-limit.lib.mjs'; // rate-limit marker (#1726): gh API calls flow through $ wrapped by caller. Issue #1756: execGhWithRetry retries on transient 5xx (504) too. Issue #1829: isTransientCompareApiError lets the compare-API readiness gate degrade gracefully on transient diff-render failures.
 import { stagePlaceholderFileOrExplain, explainNothingStagedAndThrow } from './solve.auto-pr-placeholder.lib.mjs'; // Issue #1825: handles the seed placeholder when the target repo gitignores it.
+import { sanitizeForPublication, writeSanitizedPublicationFile } from './token-sanitization.lib.mjs';
 
 export async function handleAutoPrCreation({ argv, tempDir, branchName, issueNumber, owner, repo, defaultBranch, forkedRepo, isContinueMode, prNumber, log, formatAligned, $, reportError, path, fs }) {
   // Skip auto-PR creation if:
@@ -906,17 +907,19 @@ ${prBody}`,
         // single transient 5xx (e.g. `HTTP 504: 504 Gateway Timeout
         // (https://api.github.com/graphql)`) or rate-limit response retries
         // instead of aborting the whole solve session.
+        let prBodyFile = null;
+        let prTitleFile = null;
         try {
           // Write PR body to temp file to avoid shell escaping issues
-          const prBodyFile = `/tmp/pr-body-${Date.now()}.md`;
-          await fs.writeFile(prBodyFile, prBody);
+          prBodyFile = `/tmp/pr-body-${Date.now()}.md`;
+          await writeSanitizedPublicationFile(prBodyFile, prBody);
 
           // Write PR title to temp file to avoid shell escaping issues with quotes/apostrophes
           // This solves the issue where titles containing apostrophes (e.g., "don't") would cause
           // "Unterminated quoted string" errors
-          const prTitle = `[WIP] ${issueTitle}`;
-          const prTitleFile = `/tmp/pr-title-${Date.now()}.txt`;
-          await fs.writeFile(prTitleFile, prTitle);
+          const prTitle = await sanitizeForPublication(`[WIP] ${issueTitle}`);
+          prTitleFile = `/tmp/pr-title-${Date.now()}.txt`;
+          await writeSanitizedPublicationFile(prTitleFile, prTitle);
 
           // Build command with optional assignee and handle forks
           // Note: targetBranch is already defined above
@@ -994,22 +997,6 @@ ${prBody}`,
             }
           }
 
-          // Clean up temp files
-          await fs.unlink(prBodyFile).catch(unlinkError => {
-            reportError(unlinkError, {
-              context: 'pr_body_file_cleanup',
-              prBodyFile,
-              operation: 'delete_temp_file',
-            });
-          });
-          await fs.unlink(prTitleFile).catch(unlinkError => {
-            reportError(unlinkError, {
-              context: 'pr_title_file_cleanup',
-              prTitleFile,
-              operation: 'delete_temp_file',
-            });
-          });
-
           // Log gh pr create output for debugging (Issue #1462)
           if (argv.verbose) {
             await log(`   gh pr create stdout: ${(output || '').trim() || '(empty)'}`, { verbose: true });
@@ -1279,6 +1266,9 @@ ${prBody}`,
           } else {
             throw new Error(`PR creation failed: ${cleanError}`, { cause: prCreateError });
           }
+        } finally {
+          if (prBodyFile) await fs.unlink(prBodyFile).catch(() => {});
+          if (prTitleFile) await fs.unlink(prTitleFile).catch(() => {});
         }
       }
     }

package/src/solve.error-handlers.lib.mjs

@@ -11,6 +11,7 @@ import { reportError } from './sentry.lib.mjs';
 
 // Import GitHub error reporter
 import { handleErrorWithIssueCreation } from './github-error-reporter.lib.mjs';
+import { sanitizeForPublication } from './token-sanitization.lib.mjs';
 
 export const isErrorIssueAutoCreationDisabled = argv => !!(argv?.disableReportIssue || argv?.disableIssueAutoCreationOnError);
 
@@ -115,7 +116,7 @@ export const handleFailure = async options => {
   if (argv.autoClosePullRequestOnFail && global.createdPR && global.createdPR.number) {
     await log('\n🔒 Auto-closing pull request due to failure...');
     try {
-      const closeMessage = errorType === 'uncaughtException' ? 'Auto-closed due to uncaught exception. Logs have been attached for debugging.' : errorType === 'unhandledRejection' ? 'Auto-closed due to unhandled rejection. Logs have been attached for debugging.' : 'Auto-closed due to execution failure. Logs have been attached for debugging.';
+      const closeMessage = await sanitizeForPublication(errorType === 'uncaughtException' ? 'Auto-closed due to uncaught exception. Logs have been attached for debugging.' : errorType === 'unhandledRejection' ? 'Auto-closed due to unhandled rejection. Logs have been attached for debugging.' : 'Auto-closed due to execution failure. Logs have been attached for debugging.');
 
       const result = await $`gh pr close ${global.createdPR.number} --repo ${global.owner || owner}/${global.repo || repo} --comment ${closeMessage}`;
       if (result.exitCode === 0) {

package/src/solve.mjs

@@ -1228,13 +1228,8 @@ try {
 
   // Issue #2048: commit+push dev log BEFORE any PR readiness signal so its CI gates readiness (was last, breaking CI post-signal; PR #2046, docs/case-studies/issue-2048). Idempotent: trailing call is a no-op. prettier-ignore
   await finalizeDevelopmentLog();
-  // Issue #1263 / #1728: Working session summary attachment.
-  // Routed through the shared maybeAttachWorkingSessionSummary helper so that
-  // top-level solve, auto-restart-until-mergeable, and watch-mode iterations
-  // all use identical attach logic. The helper internally honours
-  // --attach-solution-summary (always attach) and --auto-attach-solution-summary
-  // (attach only if no AI comment was posted during the session).
-  await maybeAttachWorkingSessionSummary({
+  // Issue #1263 / #1728 / #2115: shared summary attachment and usage display.
+  const { budgetStatsData: workingSessionBudgetStatsData = null } = await maybeAttachWorkingSessionSummary({
     argv,
     resultSummary,
     workStartTime,
@@ -1243,10 +1238,14 @@ try {
     prNumber,
     issueNumber,
     success,
+    publicPricingEstimate,
+    anthropicTotalCostUSD,
+    pricingInfo,
+    sessionUsage: { sessionId, tempDir, resultModelUsage, streamTokenUsage, subAgentCalls },
   });
 
   // Search for newly created pull requests and comments
-  const verifyResult = await verifyResults(owner, repo, branchName, issueNumber, prNumber, prUrl, referenceTime, argv, shouldAttachLogs, shouldRestart, sessionId, tempDir, anthropicTotalCostUSD, publicPricingEstimate, pricingInfo, errorDuringExecution, sessionType, resultModelUsage, streamTokenUsage, subAgentCalls);
+  const verifyResult = await verifyResults(owner, repo, branchName, issueNumber, prNumber, prUrl, referenceTime, argv, shouldAttachLogs, shouldRestart, sessionId, tempDir, anthropicTotalCostUSD, publicPricingEstimate, pricingInfo, errorDuringExecution, sessionType, resultModelUsage, streamTokenUsage, subAgentCalls, workingSessionBudgetStatsData);
   const logsAlreadyUploaded = verifyResult?.logUploadSuccess || false;
 
   // Issue #1162: Auto-restart when PR title/description still has placeholder content

package/src/solve.progress-monitoring.lib.mjs

@@ -27,6 +27,7 @@
 // Issue #1625: centralized markers + tracking helpers so the live-progress
 // comment is excluded from --auto-attach-solution-summary's AI-comment check.
 import { LIVE_PROGRESS_SECTION_START_MARKER, LIVE_PROGRESS_SECTION_END_MARKER, postTrackedCommentFromFile, trackToolCommentId } from './tool-comments.lib.mjs';
+import { writeSanitizedPublicationFile } from './token-sanitization.lib.mjs';
 
 import { wrapDollarWithGhRetry as _wrapDollarWithGhRetry } from './github-rate-limit.lib.mjs'; // rate-limit marker (#1726): gh API calls flow through $ wrapped by caller
 /**
@@ -225,9 +226,12 @@ export const createProgressMonitor = ({ owner, repo, prNumber, $, log, verbose =
         // Edit existing comment
         const fs = (await import('fs')).promises;
         const tempFile = `/tmp/pr-progress-comment-${prNumber}-${Date.now()}.md`;
-        await fs.writeFile(tempFile, progressSection);
-        await $`gh api repos/${owner}/${repo}/issues/comments/${state.commentId} --method PATCH --field body=@${tempFile}`;
-        await fs.unlink(tempFile).catch(() => {});
+        await writeSanitizedPublicationFile(tempFile, progressSection);
+        try {
+          await $`gh api repos/${owner}/${repo}/issues/comments/${state.commentId} --method PATCH --field body=@${tempFile}`;
+        } finally {
+          await fs.unlink(tempFile).catch(() => {});
+        }
       } else {
         // Create new comment. Issue #1625: post via postTrackedCommentFromFile
         // so the comment ID is captured directly from the GitHub API response
@@ -235,9 +239,13 @@ export const createProgressMonitor = ({ owner, repo, prNumber, $, log, verbose =
         // posted comments from the "did the AI post anything?" check).
         const fs = (await import('fs')).promises;
         const tempFile = `/tmp/pr-progress-comment-${prNumber}-${Date.now()}.md`;
-        await fs.writeFile(tempFile, progressSection);
-        const posted = await postTrackedCommentFromFile({ $, owner, repo, targetNumber: prNumber, bodyFile: tempFile });
-        await fs.unlink(tempFile).catch(() => {});
+        await writeSanitizedPublicationFile(tempFile, progressSection);
+        let posted;
+        try {
+          posted = await postTrackedCommentFromFile({ $, owner, repo, targetNumber: prNumber, bodyFile: tempFile });
+        } finally {
+          await fs.unlink(tempFile).catch(() => {});
+        }
 
         if (posted.ok && posted.commentId) {
           state.commentId = posted.commentId;
@@ -300,9 +308,12 @@ export const createProgressMonitor = ({ owner, repo, prNumber, $, log, verbose =
       // Write to temp file and update PR
       const fs = (await import('fs')).promises;
       const tempBodyFile = `/tmp/pr-progress-${prNumber}-${Date.now()}.md`;
-      await fs.writeFile(tempBodyFile, updatedBody);
-      await $`gh pr edit ${prNumber} --repo ${owner}/${repo} --body-file ${tempBodyFile}`;
-      await fs.unlink(tempBodyFile).catch(() => {});
+      await writeSanitizedPublicationFile(tempBodyFile, updatedBody);
+      try {
+        await $`gh pr edit ${prNumber} --repo ${owner}/${repo} --body-file ${tempBodyFile}`;
+      } finally {
+        await fs.unlink(tempBodyFile).catch(() => {});
+      }
 
       const stats = calculateProgress(todos);
       await log(`📊 Updated PR progress: ${stats.percentage}% (${stats.completed}/${stats.total} tasks completed)`);

package/src/solve.results.lib.mjs

@@ -28,13 +28,15 @@ import { safeExit } from './exit-handler.lib.mjs';
 // Import GitHub-related functions
 const githubLib = await import('./github.lib.mjs');
 const { sanitizeLogContent, attachLogToGitHub } = githubLib;
+const { buildCostInfoString } = await import('./github-cost-info.lib.mjs');
+const { buildBudgetStatsString } = await import('./claude.budget-stats.lib.mjs');
 
 // Issue #1745: process-wide sanitization counters used to print a one-line
 // "we masked N secrets" summary at the end of each run.
-const { formatSanitizationSummary } = await import('./token-sanitization.lib.mjs');
+const { formatSanitizationSummary, sanitizeForPublication, writeSanitizedPublicationFile } = await import('./token-sanitization.lib.mjs');
 // Issue #1745: post-finish retroactive sanitization of bot-authored PR
-// comments and the PR description. Runs by default; can be skipped via
-// --dangerously-skip-output-sanitization.
+// comments and the PR description. This external repair boundary always runs
+// when PR coordinates are available.
 const { runPostFinishSweep } = await import('./post-finish-sanitization-sweep.lib.mjs');
 
 // Import continuation functions (session resumption, PR detection)
@@ -153,7 +155,7 @@ export const ensurePullRequestIssueLink = async ({ prNumber, issueNumber, owner,
 
   const fs = (await use('fs')).promises;
   const tempBodyFile = `/tmp/pr-body-update-${prNumber}-${Date.now()}.md`;
-  await fs.writeFile(tempBodyFile, linkResult.body);
+  await writeSanitizedPublicationFile(tempBodyFile, linkResult.body);
 
   try {
     const updateResult = await command`gh pr edit ${prNumber} --repo ${owner}/${repo} --body-file "${tempBodyFile}"`;
@@ -638,25 +640,19 @@ export const showSessionSummary = async (sessionId, limitReached, argv, issueUrl
   // Issue #1745: post-finish retroactive sanitization sweep. Re-reads
   // bot-authored PR comments and the PR description, runs them through
   // sanitizeOutput, and edits in place if a leak slipped past the live
-  // sanitizer. Honors --dangerously-skip-output-sanitization and the related
-  // active-tokens flag.
+  // sanitizer. Publication repair is a strict external boundary, so local
+  // diagnostic bypass flags never disable it.
   try {
     const owner = argv.owner;
     const repo = argv.repo;
     const prNumber = argv.prNumber;
-    const skipOutputSanitization = argv['dangerously-skip-output-sanitization'] === true;
-    const skipActiveTokensOutputSanitization = argv['dangerously-skip-active-tokens-output-sanitization'] === true;
-    if (owner && repo && prNumber && !skipOutputSanitization) {
+    if (owner && repo && prNumber) {
       const sweepResult = await runPostFinishSweep({
         $,
         owner,
         repo,
         prNumber,
         log,
-        sanitizationOptions: {
-          warnOnMismatch: false,
-          skipActiveTokensOutputSanitization,
-        },
       });
       if (sweepResult.totalEdited > 0) {
         await log(`🔒 Post-finish sweep: edited ${sweepResult.totalEdited} bot-authored item(s) to mask leaked tokens.`);
@@ -669,11 +665,9 @@ export const showSessionSummary = async (sessionId, limitReached, argv, issueUrl
   }
 };
 
-// Verify results by searching for new PRs and comments
-export const verifyResults = async (owner, repo, branchName, issueNumber, prNumber, prUrl, referenceTime, argv, shouldAttachLogs, shouldRestart = false, sessionId = null, tempDir = null, anthropicTotalCostUSD = null, publicPricingEstimate = null, pricingInfo = null, errorDuringExecution = false, sessionType = 'new', resultModelUsage = null, streamTokenUsage = null, subAgentCalls = null) => {
-  await log('\n🔍 Searching for created pull requests or comments...');
-
-  // Issue #1491, #1526: Build budget stats data for GitHub comment (computed once, used in both PR and issue paths)
+// Build token/context data once so every end-of-session publication can use the
+// same observed facts (working-session summary and attached log alike).
+export const buildSessionBudgetStatsData = async ({ argv, sessionId = null, tempDir = null, resultModelUsage = null, streamTokenUsage = null, subAgentCalls = null, pricingInfo = null }) => {
   let budgetStatsData = null;
   if (argv.tokensBudgetStats && sessionId && tempDir) {
     try {
@@ -698,6 +692,26 @@ export const verifyResults = async (owner, repo, branchName, issueNumber, prNumb
       if (argv.verbose) await log(`  ⚠️  Could not build agent budget stats: ${agentBudgetError.message}`, { verbose: true });
     }
   }
+  return budgetStatsData;
+};
+
+// Verify results by searching for new PRs and comments
+export const verifyResults = async (owner, repo, branchName, issueNumber, prNumber, prUrl, referenceTime, argv, shouldAttachLogs, shouldRestart = false, sessionId = null, tempDir = null, anthropicTotalCostUSD = null, publicPricingEstimate = null, pricingInfo = null, errorDuringExecution = false, sessionType = 'new', resultModelUsage = null, streamTokenUsage = null, subAgentCalls = null, precomputedBudgetStatsData = null) => {
+  await log('\n🔍 Searching for created pull requests or comments...');
+
+  // Issue #1491, #1526, #2115: reuse data already calculated for the working
+  // session summary; retain the fallback for callers that do not precompute it.
+  const budgetStatsData =
+    precomputedBudgetStatsData ??
+    (await buildSessionBudgetStatsData({
+      argv,
+      sessionId,
+      tempDir,
+      resultModelUsage,
+      streamTokenUsage,
+      subAgentCalls,
+      pricingInfo,
+    }));
 
   try {
     // Get the current user's GitHub username
@@ -771,7 +785,7 @@ export const verifyResults = async (owner, repo, branchName, issueNumber, prNumb
           // Skip cleanup if auto-restart-on-non-updated-pull-request-description is enabled
           // (let the agent handle it on restart instead)
           if (prTitleHasPlaceholder && !argv.autoRestartOnNonUpdatedPullRequestDescription) {
-            const updatedTitle = pr.title.replace(/^\[WIP\]\s*/, '');
+            const updatedTitle = await sanitizeForPublication(pr.title.replace(/^\[WIP\]\s*/, ''));
             await log(`  📝 Removing [WIP] prefix from PR title...`);
             const titleResult = await $`gh pr edit ${pr.number} --repo ${owner}/${repo} --title "${updatedTitle}"`;
             if (titleResult.code === 0) {
@@ -819,7 +833,7 @@ Fixes ${issueRef}
 *This PR was created automatically by the AI issue solver*`;
 
             const tempBodyFile = `/tmp/pr-body-finalize-${pr.number}-${Date.now()}.md`;
-            await fs.writeFile(tempBodyFile, newDescription);
+            await writeSanitizedPublicationFile(tempBodyFile, newDescription);
 
             try {
               const descResult = await $`gh pr edit ${pr.number} --repo ${owner}/${repo} --body-file "${tempBodyFile}"`;
@@ -1247,7 +1261,15 @@ export const checkForAiCreatedComments = async (sessionStartTime, owner, repo, p
  * @param {string} options.repo - Repository name
  * @returns {Promise<boolean>} - True if comment was posted successfully
  */
-export const attachSolutionSummary = async ({ resultSummary, prNumber, issueNumber, owner, repo }) => {
+export const buildWorkingSessionSummaryDetails = ({ publicPricingEstimate = null, anthropicTotalCostUSD = null, pricingInfo = null, budgetStatsData = null } = {}) => {
+  const costInfo = buildCostInfoString(publicPricingEstimate, anthropicTotalCostUSD, pricingInfo, {
+    includeTokenUsage: false,
+  });
+  const budgetStats = budgetStatsData ? buildBudgetStatsString(budgetStatsData.tokenUsage, budgetStatsData.subAgentCalls) : '';
+  return `${costInfo}${budgetStats}`.trim();
+};
+
+export const attachSolutionSummary = async ({ resultSummary, prNumber, issueNumber, owner, repo, publicPricingEstimate = null, anthropicTotalCostUSD = null, pricingInfo = null, budgetStatsData = null }) => {
   if (!resultSummary || typeof resultSummary !== 'string') {
     await log('⚠️  No working session summary available to attach', { verbose: true });
     return false;
@@ -1262,10 +1284,16 @@ export const attachSolutionSummary = async ({ resultSummary, prNumber, issueNumb
   }
 
   try {
+    const usageDetails = buildWorkingSessionSummaryDetails({
+      publicPricingEstimate,
+      anthropicTotalCostUSD,
+      pricingInfo,
+      budgetStatsData,
+    });
     const comment = `${toolComments.WORKING_SESSION_SUMMARY_AUTOMATION_MARKER}
 ## ${toolComments.WORKING_SESSION_SUMMARY_MARKER}
 
-${resultSummary}
+${resultSummary}${usageDetails ? `\n\n${usageDetails}` : ''}
 
 ---
 *${toolComments.WORKING_SESSION_SUMMARY_AUTOMATED_FOOTER}*`;
@@ -1322,7 +1350,7 @@ ${resultSummary}
  * @param {boolean} [options.success=true] - skip attachment for failed iterations
  * @returns {Promise<{attached: boolean, reason: string}>}
  */
-export const maybeAttachWorkingSessionSummary = async ({ argv, resultSummary, workStartTime, owner, repo, prNumber, issueNumber, success = true }) => {
+export const maybeAttachWorkingSessionSummary = async ({ argv, resultSummary, workStartTime, owner, repo, prNumber, issueNumber, success = true, publicPricingEstimate = null, anthropicTotalCostUSD = null, pricingInfo = null, budgetStatsData = null, sessionUsage = null }) => {
   if (!success) {
     return { attached: false, reason: 'iteration_failed' };
   }
@@ -1358,6 +1386,25 @@ export const maybeAttachWorkingSessionSummary = async ({ argv, resultSummary, wo
     return { attached: false, reason: 'no_attach_decision' };
   }
 
-  const ok = await attachSolutionSummary({ resultSummary, prNumber, issueNumber, owner, repo });
-  return { attached: !!ok, reason: ok ? 'attached' : 'post_failed' };
+  const resolvedBudgetStatsData =
+    budgetStatsData ??
+    (sessionUsage
+      ? await buildSessionBudgetStatsData({
+          argv,
+          pricingInfo,
+          ...sessionUsage,
+        })
+      : null);
+  const ok = await attachSolutionSummary({
+    resultSummary,
+    prNumber,
+    issueNumber,
+    owner,
+    repo,
+    publicPricingEstimate,
+    anthropicTotalCostUSD,
+    pricingInfo,
+    budgetStatsData: resolvedBudgetStatsData,
+  });
+  return { attached: !!ok, reason: ok ? 'attached' : 'post_failed', budgetStatsData: resolvedBudgetStatsData };
 };

package/src/solve.watch.lib.mjs

@@ -580,6 +580,10 @@ export const watchForFeedback = async params => {
               prNumber,
               issueNumber,
               success: true,
+              publicPricingEstimate: toolResult.publicPricingEstimate,
+              anthropicTotalCostUSD: latestAnthropicCost,
+              pricingInfo: toolResult.pricingInfo,
+              budgetStatsData: autoRestartBudgetStatsData,
             });
           } catch (summaryError) {
             reportError(summaryError, {

package/src/start-screen.mjs

@@ -4,6 +4,9 @@
 import { exec } from 'child_process';
 import { promisify } from 'util';
 import { parseCliArgumentsWithLino } from './cli-arguments.lib.mjs';
+import { setupStdioLogInterceptor } from './lib.mjs';
+
+setupStdioLogInterceptor();
 
 const execAsync = promisify(exec);
 

package/src/task.issue-creation.lib.mjs

@@ -3,6 +3,7 @@ import path from 'path';
 import { spawn } from 'child_process';
 import { promises as fs } from 'fs';
 import { parseGitHubUrl } from './github.lib.mjs';
+import { sanitizeForPublication, writeSanitizedPublicationFile } from './token-sanitization.lib.mjs';
 
 export const TASK_ISSUE_TITLE_MAX_LENGTH = 256;
 
@@ -216,9 +217,10 @@ export async function createTaskIssue({ repository, title, body, issueType = nul
   const bodyFile = path.join(tempDir, 'body.md');
 
   try {
-    await fs.writeFile(bodyFile, body);
+    await writeSanitizedPublicationFile(bodyFile, body);
+    const sanitizedTitle = await sanitizeForPublication(title);
 
-    const result = await run('gh', buildCreateIssueArgs({ repository, title, bodyFile, issueType, labels }));
+    const result = await run('gh', buildCreateIssueArgs({ repository, title: sanitizedTitle, bodyFile, issueType, labels }));
     if (result.code === 0) return parseCreatedTaskIssueOutput(result.stdout);
 
     const output = `${result.stderr || ''}${result.stdout || ''}`.trim();
@@ -228,7 +230,7 @@ export async function createTaskIssue({ repository, title, body, issueType = nul
     }
 
     await log?.(`⚠️  Could not create issue with type/labels (${output || `exit code ${result.code}`}); retrying without them`);
-    const retry = await run('gh', buildCreateIssueArgs({ repository, title, bodyFile }));
+    const retry = await run('gh', buildCreateIssueArgs({ repository, title: sanitizedTitle, bodyFile }));
     if (retry.code !== 0) {
       const retryOutput = `${retry.stderr || ''}${retry.stdout || ''}`.trim();
       throw new Error(retryOutput || `gh issue create exited with code ${retry.code}`);

package/src/task.mjs

@@ -8,6 +8,11 @@ import { buildStartAgentArgs, resolveStartAgentCommand } from './task.agent-comm
 import { getDefaultTaskModel, parseTaskArguments } from './task.config.lib.mjs';
 import { validateModelName } from './models/index.mjs';
 import { appendOrReplaceParentSplitSection, buildAddSubIssueApiArgs, buildIssueRestIdApiArgs, buildTaskSplitPrompt, buildTaskSplitSystemPrompt, extractTaskSplitJson, formatChildIssueBody, normalizeSplitTasks, parseCreatedIssueUrl, parseTaskIssueUrl } from './task.split.lib.mjs';
+import { setupStdioLogInterceptor } from './lib.mjs';
+import { sanitizeCredentialText } from './credential-sanitization-core.lib.mjs';
+import { sanitizeForPublication } from './token-sanitization.lib.mjs';
+
+setupStdioLogInterceptor();
 
 const earlyArgs = process.argv.slice(2);
 
@@ -73,10 +78,14 @@ const logFile = path.join(scriptDir, `task-${timestamp}.log`);
 async function log(message, options = {}) {
   const { level = 'info', verbose = false } = options;
   if (verbose && !argv.verbose) return;
-  await fs.appendFile(logFile, `[${new Date().toISOString()}] [${level.toUpperCase()}] ${message}\n`).catch(() => {});
-  if (level === 'error') console.error(message);
-  else if (level === 'warning' || level === 'warn') console.warn(message);
-  else console.log(message);
+  const sanitizedMessage = sanitizeCredentialText(message);
+  await fs
+    .appendFile(logFile, `[${new Date().toISOString()}] [${level.toUpperCase()}] ${sanitizedMessage}\n`, { mode: 0o600 })
+    .then(() => fs.chmod(logFile, 0o600))
+    .catch(() => {});
+  if (level === 'error') console.error(sanitizedMessage);
+  else if (level === 'warning' || level === 'warn') console.warn(sanitizedMessage);
+  else console.log(sanitizedMessage);
 }
 
 function formatAligned(icon, label, value, indent = 0) {
@@ -172,7 +181,8 @@ async function fetchIssueRestId(issue) {
 }
 
 async function createChildIssue(parentIssue, task, index, splitCount) {
-  const args = ['issue', 'create', '--repo', `${parentIssue.owner}/${parentIssue.repo}`, '--title', task.title, '--body', formatChildIssueBody({ parentIssue, task, index, splitCount })];
+  const [safeTitle, safeBody] = await Promise.all([sanitizeForPublication(task.title), sanitizeForPublication(formatChildIssueBody({ parentIssue, task, index, splitCount }))]);
+  const args = ['issue', 'create', '--repo', `${parentIssue.owner}/${parentIssue.repo}`, '--title', safeTitle, '--body', safeBody];
   if (parentIssue.labels.length > 0) {
     args.push('--label', parentIssue.labels.join(','));
   }
@@ -196,9 +206,11 @@ async function linkChildIssue(parentIssue, childIssue) {
 
 async function updateParentIssue(parentIssue, childIssues) {
   const body = appendOrReplaceParentSplitSection(parentIssue.body, childIssues);
-  await commandOutput('gh', ['issue', 'edit', String(parentIssue.number), '--repo', `${parentIssue.owner}/${parentIssue.repo}`, '--body', body]);
+  const safeBody = await sanitizeForPublication(body);
+  await commandOutput('gh', ['issue', 'edit', String(parentIssue.number), '--repo', `${parentIssue.owner}/${parentIssue.repo}`, '--body', safeBody]);
   const childList = childIssues.map(issue => `- #${issue.number} ${issue.title}`).join('\n');
-  await commandOutput('gh', ['issue', 'comment', String(parentIssue.number), '--repo', `${parentIssue.owner}/${parentIssue.repo}`, '--body', `Split into ${childIssues.length} tasks:\n\n${childList}`]);
+  const safeComment = await sanitizeForPublication(`Split into ${childIssues.length} tasks:\n\n${childList}`);
+  await commandOutput('gh', ['issue', 'comment', String(parentIssue.number), '--repo', `${parentIssue.owner}/${parentIssue.repo}`, '--body', safeComment]);
 }
 
 async function runSplitMode() {
@@ -268,7 +280,8 @@ ${results.clarification ? `Clarification analysis:\n${results.clarification}\n\n
 }
 
 try {
-  await fs.writeFile(logFile, `# Task Log - ${new Date().toISOString()}\n\n`);
+  await fs.writeFile(logFile, `# Task Log - ${new Date().toISOString()}\n\n`, { mode: 0o600 });
+  await fs.chmod(logFile, 0o600);
   await log(`📁 Log file: ${logFile}`);
   await log('\n🎯 Task Processing Started');
   await log(formatAligned('📝', 'Task input:', taskInput));

package/src/telegram-bot.mjs

@@ -1,5 +1,8 @@
 #!/usr/bin/env node
 import { ensureUseM } from './use-m-bootstrap.lib.mjs';
+import { maskToken, setupStdioLogInterceptor } from './lib.mjs';
+
+setupStdioLogInterceptor();
 // Early exit for --version (issue #1318: avoid dotenvx MISSING_ENV_FILE warnings)
 if (process.argv.includes('--version')) {
   const v = await import('./version.lib.mjs').then(m => m.getVersion()).catch(() => 'unknown');
@@ -212,7 +215,7 @@ if (hiveEnabled && hiveOverrides.length > 0) {
 if (config.dryRun) {
   console.log('\n✅ Dry-run mode: All validations passed successfully!');
   console.log('\nConfiguration summary:');
-  console.log('  Token:', BOT_TOKEN ? `${BOT_TOKEN.substring(0, 10)}...` : 'not set');
+  console.log('  Token:', BOT_TOKEN ? maskToken(BOT_TOKEN) : 'not set');
   if (allowedChats && allowedChats.length > 0) {
     console.log('  Allowed chats:', lino.format(allowedChats));
   } else {