@link-assistant/hive-mind 2.11.4 → 2.11.6

package/src/gemini.lib.mjs

@@ -18,7 +18,7 @@ import { buildSolveResumeCommand } from './solve.resume-command.lib.mjs'; // Iss
 const __geminiBuildSolveResumeCmd = (argv, sessionId, tempDir) => (sessionId && argv?.url ? buildSolveResumeCommand({ issueUrl: argv.url, sessionId, tool: 'gemini', model: argv.model, fallbackModel: argv.fallbackModel, tempDir }) : null);
 import { sanitizeObjectStrings } from './unicode-sanitization.lib.mjs';
 import { defaultModels, geminiModels, isFormalAiModel } from './models/index.mjs';
-import { logPreparedToolCommand, resolveFormalAiToolInvocation } from './formal-ai.lib.mjs';
+import { isPrepareOnly, logPreparedToolCommand, resolveFormalAiToolExecution } from './formal-ai.lib.mjs';
 import { buildFormalAiPricingInfo } from './formal-ai-pricing.lib.mjs'; // Issue #2119
 import { checkPlaywrightMcpPackageAvailability } from './playwright-mcp.lib.mjs';
 import { classifyRetryableError, prepareRetryAfterError, waitWithCountdown } from './tool-retry.lib.mjs';
@@ -412,11 +412,9 @@ export const executeGeminiCommand = async params => {
     await log(`   Load: ${resourcesBefore.load}`, { verbose: true });
 
     const mappedModel = mapModelToId(argv.model || defaultModels.gemini);
-    const toolInvocation = resolveFormalAiToolInvocation({
-      tool: 'gemini',
-      model: argv.model || defaultModels.gemini,
-      toolPath: geminiPath,
-    });
+    // Issue #2130: Formal AI runs the native CLI against a local Formal AI server (no argv wrapper).
+    const toolInvocation = await resolveFormalAiToolExecution({ tool: 'gemini', model: argv.model || defaultModels.gemini, toolPath: geminiPath, workdir: tempDir, log, verbose: argv.verbose, prepareOnly: isPrepareOnly(argv) });
+    const geminiEnv = { ...process.env, ...toolInvocation.env };
     const combinedPrompt = systemPrompt ? `${systemPrompt}\n\n${prompt}` : prompt;
 
     if (argv.resume) {
@@ -426,7 +424,6 @@ export const executeGeminiCommand = async params => {
     // Issue #1809: build args via shared helper so verbose/sandbox/include-dirs
     // toggles stay consistent between the logged command and the real invocation.
     const geminiArgList = buildGeminiArgs(argv, mappedModel, { tempDir, workspaceTmpDir });
-    const fullGeminiArgList = [...toolInvocation.args, ...geminiArgList];
     const fullCommand = `(cd ${shellQuote(tempDir)} && ${toolInvocation.displayCommand} ${geminiArgList.map(shellQuote).join(' ')} <<< <prompt>)`;
 
     const preparedResult = await logPreparedToolCommand({ argv, fullCommand, log, formatAligned });
@@ -449,7 +446,8 @@ export const executeGeminiCommand = async params => {
         cwd: tempDir,
         stdin: combinedPrompt,
         mirror: false,
-      })`${toolInvocation.command} ${fullGeminiArgList}`;
+        env: geminiEnv,
+      })`${toolInvocation.command} ${geminiArgList}`;
 
       await log(`${formatAligned('📋', 'Command details:', '')}`);
       await log(formatAligned('📂', 'Working directory:', tempDir, 2));

package/src/git.lib.mjs

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
 
 import { exec } from 'child_process';
+
+import { quietProbe } from './quiet-probe.lib.mjs'; // issue #2130: keep read-only probe payloads out of the attached log
 import { promisify } from 'util';
 
 const execAsync = promisify(exec);
@@ -86,7 +88,14 @@ export const getGitVersion = async (execFunc = execAsync, currentVersion) => {
 };
 
 // Helper function for async git operations with zx
-export const getGitVersionAsync = async ($, currentVersion) => {
+//
+// Issue #2130: every probe below is quiet. They answer questions the caller
+// asks about its own checkout ("is this a git repo?", "what is HEAD?"), and
+// their bare answers - a `.git` path, a tag, a short SHA - were mirrored into
+// the log attached to the pull request with nothing to explain them. The
+// version this function computes is logged in words by the caller.
+export const getGitVersionAsync = async (dollar, currentVersion) => {
+  const $ = quietProbe(dollar);
   // First check if we're in a git repository to avoid "fatal: not a git repository" errors
   // Redirect stderr to /dev/null at shell level to prevent error messages from appearing
   try {

package/src/github-error-reporter.lib.mjs

@@ -17,6 +17,7 @@ if (typeof globalThis.use === 'undefined') {
 const fs = (await use('fs')).promises;
 const { $: __rawDollar$ } = await use('command-stream');
 const { wrapDollarWithGhRetry } = await import('./github-rate-limit.lib.mjs');
+const { QUIET_PROBE } = await import('./quiet-probe.lib.mjs'); // issue #2130: keep read-only probe payloads out of the attached log
 const $ = wrapDollarWithGhRetry(__rawDollar$);
 const GITHUB_ISSUE_BODY_MAX_SIZE = 60000;
 const GITHUB_FILE_MAX_SIZE = 10 * 1024 * 1024;
@@ -53,7 +54,7 @@ export const promptUserForIssueCreation = async errorMessage => {
  */
 const getCurrentGitHubUser = async () => {
   try {
-    const result = await $`gh api user --jq .login`;
+    const result = await $(QUIET_PROBE)`gh api user --jq .login`;
     if (result.exitCode === 0) {
       const user = result.stdout.toString().trim();
       if (user) return user;

package/src/github-rate-limit.lib.mjs

@@ -449,6 +449,13 @@ export const execGhWithRetry = async (command, options = {}) => {
  *   const { $: rawDollar } = await use('command-stream');
  *   const $ = wrapDollarWithGhRetry(rawDollar);
  *
+ * The wrapper also forwards command-stream's options-call form, so the
+ * "do not mirror this probe" idiom (see src/quiet-probe.lib.mjs) keeps working
+ * on a wrapped `$` - issue #2130, where read-only probes dumped raw API
+ * payloads into the log that gets attached to the pull request:
+ *
+ *   await $(QUIET_PROBE)`gh api repos/${owner}/${repo}`;
+ *
  * @template T
  * @param {(strings: TemplateStringsArray, ...values: unknown[]) => Promise<T>} dollar
  * @param {object} [options] - forwarded to ghWithRateLimitRetry per call.
@@ -456,6 +463,12 @@ export const execGhWithRetry = async (command, options = {}) => {
  */
 export const wrapDollarWithGhRetry = (dollar, options = {}) => {
   const wrapped = (strings, ...values) => {
+    // Options-call form: `$({ mirror: false })` returns a new tag bound to
+    // those options. Template literals always arrive as an array of quasis, so
+    // a plain object here is unambiguous.
+    if (strings && !Array.isArray(strings) && typeof strings === 'object') {
+      return wrapDollarWithGhRetry(dollar(strings), options);
+    }
     // Reconstruct the literal command for inspection (sufficient — leading
     // `gh ` is what we care about).
     let preview = '';

package/src/github-terminal-state.lib.mjs

@@ -21,7 +21,13 @@ const getDefaultCommandRunner = async () => {
   const use = globalThis.use;
   const { $: rawDollar } = await use('command-stream');
   const { wrapDollarWithGhRetry } = await import('./github-rate-limit.lib.mjs');
-  defaultCommandRunner = wrapDollarWithGhRetry(rawDollar);
+  const { QUIET_PROBE } = await import('./quiet-probe.lib.mjs');
+  // Issue #2130: these are existence probes. Their raw payloads (a ~33 KB pull
+  // request object, once per watch iteration) and their expected "gh: Not Found
+  // (HTTP 404)" answers were mirrored into the attached log, where a handled
+  // probe reads as an unexplained error. Every outcome is reported by the
+  // caller in words, so the raw output is captured but never mirrored.
+  defaultCommandRunner = wrapDollarWithGhRetry(rawDollar(QUIET_PROBE));
   return defaultCommandRunner;
 };
 

package/src/github.lib.mjs

@@ -19,6 +19,7 @@ import { buildCostInfoString } from './github-cost-info.lib.mjs';
 export { buildCostInfoString };
 // #1756: route gh exec calls through transient + rate-limit retry wrapper
 import { execGhWithRetry } from './github-rate-limit.lib.mjs';
+import { QUIET_PROBE } from './quiet-probe.lib.mjs'; // issue #2130: keep read-only probe payloads out of the attached log
 // Issue #1625: Named marker constants (single source of truth) + in-memory
 // tracking for tool-posted comments. See tool-comments.lib.mjs for design.
 import { SOLUTION_DRAFT_LOG_MARKER, SOLUTION_DRAFT_FAILED_MARKER, SOLUTION_DRAFT_FINISHED_WITH_ERRORS_MARKER, USAGE_LIMIT_REACHED_MARKER, NOW_WORKING_SESSION_IS_ENDED_MARKER, postTrackedComment, postTrackedCommentFromFile } from './tool-comments.lib.mjs';
@@ -43,8 +44,11 @@ export const checkFileInBranch = async (owner, repo, fileName, branchName) => {
   const { $ } = await use('command-stream');
 
   try {
-    // Use GitHub CLI to check if file exists in the branch
-    const result = await $`gh api repos/${owner}/${repo}/contents/${fileName}?ref=${branchName}`;
+    // Issue #2130: this is an existence probe, and "absent" is the answer the
+    // caller is usually looking for. Mirroring the command would print the whole
+    // contents payload on a hit and `gh: Not Found (HTTP 404)` on a miss, which
+    // reads as a failure in the log even though nothing went wrong.
+    const result = await $(QUIET_PROBE)`gh api repos/${owner}/${repo}/contents/${fileName}?ref=${branchName}`;
     return result.code === 0;
   } catch (error) {
     // File doesn't exist or access error - this is expected behavior
@@ -66,8 +70,10 @@ export const checkGitHubPermissions = async () => {
   const { $ } = await use('command-stream');
   try {
     await log('\n🔐 Checking GitHub authentication and permissions...');
-    // Get auth status including token scopes
-    const authStatusResult = await $`gh auth status 2>&1`;
+    // Get auth status including token scopes.
+    // Issue #2130: capture without mirroring - the parsed summary below is what
+    // belongs in the log, not gh's raw account/token/scope block.
+    const authStatusResult = await $(QUIET_PROBE)`gh auth status 2>&1`;
     const authOutput = authStatusResult.stdout.toString() + authStatusResult.stderr.toString();
     if (authStatusResult.code !== 0 || authOutput.includes('not logged into any GitHub hosts')) {
       await log('❌ GitHub authentication error: Not logged in', { level: 'error' });
@@ -183,7 +189,7 @@ export const checkRepositoryWritePermission = async (owner, repo, options = {})
     await log('');
     // Get current user to suggest their fork
     try {
-      const userResult = await $`gh api user --jq .login`;
+      const userResult = await $(QUIET_PROBE)`gh api user --jq .login`;
       if (userResult.code === 0) {
         const currentUser = userResult.stdout.toString().trim();
         await log('      Run this command:', { level: 'error' });
@@ -614,7 +620,7 @@ ${logContent}
         // Issue #1173: Use public upload for public repos, private for private repos
         let isPublicRepo = true;
         try {
-          const repoVisibilityResult = await $`gh api repos/${owner}/${repo} --jq .visibility`;
+          const repoVisibilityResult = await $(QUIET_PROBE)`gh api repos/${owner}/${repo} --jq .visibility`;
           if (repoVisibilityResult.code === 0) {
             const visibility = repoVisibilityResult.stdout.toString().trim();
             isPublicRepo = visibility === 'public';
@@ -972,7 +978,9 @@ export async function fetchProjectIssues(projectNumber, owner, statusFilter) {
     await log(`🔍 Fetching issues from GitHub Project #${projectNumber} (owner: ${owner}, status: ${statusFilter})`);
     // Check for project scope in GitHub CLI authentication
     try {
-      const authStatus = await $`gh auth status --show-token`;
+      // Issue #2130: --show-token prints the token in clear text; mirroring it
+      // would put a live credential on stdout and in the log file.
+      const authStatus = await $(QUIET_PROBE)`gh auth status --show-token`;
       if (!authStatus.stdout.includes('project')) {
         throw new Error('Missing project scope. Run: gh auth refresh -s project');
       }
@@ -1431,7 +1439,7 @@ export async function handlePRNotFoundError({ prNumber, owner, repo, argv, shoul
 export async function detectRepositoryVisibility(owner, repo) {
   try {
     // Issue #1536: retry on transient network errors
-    const visibilityResult = await ghCmdRetry(() => $`gh api repos/${owner}/${repo} --jq .visibility`, { label: `visibility ${owner}/${repo}` });
+    const visibilityResult = await ghCmdRetry(() => $(QUIET_PROBE)`gh api repos/${owner}/${repo} --jq .visibility`, { label: `visibility ${owner}/${repo}` });
     if (visibilityResult.code === 0) {
       const visibility = visibilityResult.stdout.toString().trim();
       const isPublic = visibility === 'public';

package/src/opencode.lib.mjs

@@ -20,7 +20,7 @@ import { timeouts, retryLimits } from './config.lib.mjs';
 import { detectUsageLimit, formatUsageLimitMessage } from './usage-limit.lib.mjs';
 import { sanitizeObjectStrings } from './unicode-sanitization.lib.mjs';
 import { opencodeModels, defaultModels } from './models/index.mjs';
-import { logPreparedToolCommand, resolveFormalAiToolInvocation } from './formal-ai.lib.mjs';
+import { isPrepareOnly, logPreparedToolCommand, resolveFormalAiToolExecution } from './formal-ai.lib.mjs';
 import { checkPlaywrightMcpPackageAvailability, getOpenCodePlaywrightMcpDisableEnv } from './playwright-mcp.lib.mjs';
 import { createAgentTokenUsage, accumulateAgentStepFinishUsage, parseAgentTokenUsage as parseOpenCodeTokenUsage } from './agent-token-usage.lib.mjs';
 import { createJsonStreamScanner } from './json-stream.lib.mjs';
@@ -234,11 +234,9 @@ export const executeOpenCodeCommand = async params => {
 
     // Map model alias to full ID
     const mappedModel = mapModelToId(argv.model);
-    const toolInvocation = resolveFormalAiToolInvocation({
-      tool: 'opencode',
-      model: argv.model,
-      toolPath: opencodePath,
-    });
+    // Issue #2130: Formal AI runs the native CLI against a local Formal AI server (no argv wrapper).
+    const toolInvocation = await resolveFormalAiToolExecution({ tool: 'opencode', model: argv.model, toolPath: opencodePath, workdir: tempDir, log, verbose: argv.verbose, prepareOnly: isPrepareOnly(argv), env: opencodeEnv });
+    Object.assign(opencodeEnv, toolInvocation.env);
     const streamingTokenUsage = createAgentTokenUsage();
 
     // Build opencode command arguments
@@ -310,14 +308,14 @@ export const executeOpenCodeCommand = async params => {
           mirror: false,
           env: opencodeEnv,
         });
-        execCommand = toolInvocation.formalAi ? commandRunner`cat ${promptFile} | ${toolInvocation.command} ${toolInvocation.args} run --format json --session ${argv.resume} --model ${mappedModel}` : commandRunner`cat ${promptFile} | ${toolInvocation.command} run --format json --session ${argv.resume} --model ${mappedModel}`;
+        execCommand = commandRunner`cat ${promptFile} | ${toolInvocation.command} run --format json --session ${argv.resume} --model ${mappedModel}`;
       } else {
         const commandRunner = $({
           cwd: tempDir,
           mirror: false,
           env: opencodeEnv,
         });
-        execCommand = toolInvocation.formalAi ? commandRunner`cat ${promptFile} | ${toolInvocation.command} ${toolInvocation.args} run --format json --model ${mappedModel}` : commandRunner`cat ${promptFile} | ${toolInvocation.command} run --format json --model ${mappedModel}`;
+        execCommand = commandRunner`cat ${promptFile} | ${toolInvocation.command} run --format json --model ${mappedModel}`;
       }
 
       await log(`${formatAligned('📋', 'Command details:', '')}`);
@@ -355,8 +353,11 @@ export const executeOpenCodeCommand = async params => {
           accumulateAgentStepFinishUsage(streamingTokenUsage, data);
           // Track text content for result summary
           // OpenCode outputs text via 'text', 'assistant', 'message', or 'result' type events
-          if (data.type === 'text' && data.text) {
-            lastTextContent = data.text;
+          // Issue #2130: OpenCode-derived CLIs nest assistant text under `part`
+          // (`{"type":"text","part":{"type":"text","text":"…"}}`) with no
+          // top-level `data.text`, which left `resultSummary` null.
+          if (data.type === 'text' && (data.text || data.part?.text)) {
+            lastTextContent = data.text || data.part.text;
           } else if (data.type === 'assistant' && data.message?.content) {
             const content = Array.isArray(data.message.content) ? data.message.content : [data.message.content];
             for (const item of content) {

package/src/post-finish-sanitization-sweep.lib.mjs

@@ -23,6 +23,7 @@
 
 import { sanitizeForPublication, getSanitizationStats } from './token-sanitization.lib.mjs';
 import { wrapDollarWithGhRetry as _wrapDollarWithGhRetry } from './github-rate-limit.lib.mjs'; // rate-limit marker (#1726): caller passes $ already wrapped through wrapDollarWithGhRetry
+import { quietProbe } from './quiet-probe.lib.mjs'; // issue #2130: keep read-only probe payloads out of the attached log
 
 /**
  * Determine the bot's gh login name. The function returns null on any error
@@ -33,7 +34,7 @@ import { wrapDollarWithGhRetry as _wrapDollarWithGhRetry } from './github-rate-l
  */
 const detectBotLogin = async $ => {
   try {
-    const result = await $`gh api user --jq .login`;
+    const result = await quietProbe($)`gh api user --jq .login`;
     if (result && result.code === 0 && result.stdout) {
       const login = result.stdout.toString().trim();
       return login || null;
@@ -61,7 +62,7 @@ export const sweepPrConversationComments = async ({ $, owner, repo, prNumber, bo
   const stats = { scanned: 0, edited: 0, errors: 0 };
   let response;
   try {
-    response = await $`gh api repos/${owner}/${repo}/issues/${prNumber}/comments --paginate`;
+    response = await quietProbe($)`gh api repos/${owner}/${repo}/issues/${prNumber}/comments --paginate`;
   } catch (err) {
     await log(`⚠️ post-finish sweep: failed to list comments: ${err.message || err}`);
     stats.errors++;
@@ -120,7 +121,7 @@ export const sweepPrDescription = async ({ $, owner, repo, prNumber, log = async
   const stats = { scanned: 0, edited: 0, errors: 0 };
   let response;
   try {
-    response = await $`gh api repos/${owner}/${repo}/pulls/${prNumber}`;
+    response = await quietProbe($)`gh api repos/${owner}/${repo}/pulls/${prNumber}`;
   } catch (err) {
     await log(`⚠️ post-finish sweep: failed to fetch PR ${prNumber}: ${err.message || err}`);
     stats.errors++;

package/src/quiet-probe.lib.mjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+/**
+ * Read-only probes that must not be mirrored into the attached log.
+ *
+ * Issue #2130 — the solver mirrors every child process's output to stdout, and
+ * `src/lib.mjs` copies stdout into the log file that is later attached to the
+ * pull request. That is the right default for the AI tool's own output, but it
+ * also dumped the raw answers of the solver's internal probes between its own
+ * sentences, where they read as unexplained output or as errors:
+ *
+ *   - `gh api repos/OWNER/REPO/pulls/N` — a ~33 KB JSON object, once per watch
+ *     iteration (12 copies in the log captured for this issue);
+ *   - `gh api .../comments --paginate` — up to 46 KB per restart;
+ *   - `gh auth status --show-token` — a live credential in clear text;
+ *   - bare one-word answers such as a login, `public`, `I_kwDO...`, or a commit
+ *     SHA, with nothing around them to say what asked the question.
+ *
+ * Every one of those call sites already reports what it learned in words, so
+ * the raw output is captured for the caller but never mirrored.
+ *
+ * @module quiet-probe
+ */
+
+/**
+ * command-stream options for a probe whose raw output stays out of the log.
+ * `capture: true` keeps `result.stdout` available to the caller.
+ *
+ *   const result = await $(QUIET_PROBE)`gh api user --jq .login`;
+ */
+export const QUIET_PROBE = Object.freeze({ mirror: false, capture: true });
+
+const quietProbeCache = new WeakMap();
+
+/**
+ * Bind {@link QUIET_PROBE} to a `$` that arrived as a function argument,
+ * degrading to the tag itself when that `$` does not implement command-stream's
+ * options-call form.
+ *
+ * Many helpers take `$` as an injected parameter, and the doubles supplied by
+ * callers (tests, in particular) are plain tagged templates that throw on
+ * `$({ ... })`. Suppressing mirrored output is a readability improvement, never
+ * a correctness requirement, so a `$` that cannot be configured is used as-is
+ * rather than turned into a crash.
+ *
+ *   const result = await quietProbe($)`gh api user --jq .login`;
+ *
+ * @param {Function} dollar - a command-stream `$` or a tagged-template double.
+ * @returns {Function} `dollar` bound to the quiet options, or `dollar` itself.
+ */
+export const quietProbe = dollar => {
+  if (typeof dollar !== 'function') return dollar;
+  const cached = quietProbeCache.get(dollar);
+  if (cached) return cached;
+  let bound = dollar;
+  try {
+    const candidate = dollar(QUIET_PROBE);
+    // A tag that ignores the options call may return a promise for a command it
+    // never should have run; swallow it so it cannot surface as an unhandled
+    // rejection, and keep the original tag.
+    if (typeof candidate?.catch === 'function') candidate.catch(() => {});
+    if (typeof candidate === 'function') bound = candidate;
+  } catch {
+    /* not option-callable - use the tag unchanged */
+  }
+  quietProbeCache.set(dollar, bound);
+  return bound;
+};
+
+export default {
+  QUIET_PROBE,
+  quietProbe,
+};

package/src/qwen.lib.mjs

@@ -19,7 +19,7 @@ import { timeouts, retryLimits } from './config.lib.mjs';
 import { detectUsageLimit, formatUsageLimitMessage } from './usage-limit.lib.mjs';
 import { sanitizeObjectStrings } from './unicode-sanitization.lib.mjs';
 import { qwenModels, defaultModels, isFormalAiModel } from './models/index.mjs';
-import { logPreparedToolCommand, resolveFormalAiToolInvocation } from './formal-ai.lib.mjs';
+import { buildFormalAiEnvExports, isPrepareOnly, logPreparedToolCommand, resolveFormalAiToolExecution } from './formal-ai.lib.mjs';
 import { buildFormalAiPricingInfo } from './formal-ai-pricing.lib.mjs'; // Issue #2119
 import { checkPlaywrightMcpPackageAvailability } from './playwright-mcp.lib.mjs';
 import { classifyRetryableError, prepareRetryAfterError, waitWithCountdown } from './tool-retry.lib.mjs';
@@ -503,15 +503,15 @@ export const executeQwenCommand = async params => {
     await log(`   Load: ${resourcesBefore.load}`, { verbose: true });
 
     const mappedModel = mapModelToId(argv.model || defaultModels.qwen);
-    const toolInvocation = resolveFormalAiToolInvocation({
-      tool: 'qwen',
-      model: argv.model || defaultModels.qwen,
-      toolPath: qwenPath,
-    });
+    // Issue #2130: Formal AI runs the native CLI against a local Formal AI server (no argv wrapper).
+    const toolInvocation = await resolveFormalAiToolExecution({ tool: 'qwen', model: argv.model || defaultModels.qwen, toolPath: qwenPath, workdir: tempDir, log, verbose: argv.verbose, prepareOnly: isPrepareOnly(argv) });
+    const qwenEnv = { ...process.env, ...toolInvocation.env };
     const resumeSession = argv.resume || null;
     const resumeArgs = resumeSession ? ` --resume ${shellQuote(resumeSession)}` : '';
     const appendSystemPromptArg = systemPrompt ? ` --append-system-prompt "$(cat ${shellQuote(systemPromptFile)})"` : '';
-    const commandScript = `cd ${shellQuote(tempDir)} && ${toolInvocation.displayCommand} --model ${shellQuote(mappedModel)} --output-format stream-json --yolo${resumeArgs}${appendSystemPromptArg} --prompt "$(cat ${shellQuote(promptFile)})"`;
+    // Issue #2130: re-export the Formal AI environment inside the `sh -lc` script so a
+    // stale `formal-ai with --global` block in the operator profile cannot override it.
+    const commandScript = `${buildFormalAiEnvExports(toolInvocation.env)}cd ${shellQuote(tempDir)} && ${toolInvocation.displayCommand} --model ${shellQuote(mappedModel)} --output-format stream-json --yolo${resumeArgs}${appendSystemPromptArg} --prompt "$(cat ${shellQuote(promptFile)})"`;
     const fullCommand = `(cd "${tempDir}" && ${toolInvocation.displayCommand} --model "${mappedModel}" --output-format stream-json --yolo${resumeSession ? ` --resume "${resumeSession}"` : ''}${systemPrompt ? ` --append-system-prompt "$(cat "${systemPromptFile}")"` : ''} --prompt "$(cat "${promptFile}")")`;
 
     const preparedResult = await logPreparedToolCommand({ argv, fullCommand, log, formatAligned });
@@ -521,6 +521,7 @@ export const executeQwenCommand = async params => {
       const execCommand = dollar({
         cwd: tempDir,
         mirror: false,
+        env: qwenEnv,
       })`sh -lc ${commandScript}`;
 
       await log(`${formatAligned('📋', 'Command details:', '')}`);

package/src/solve.auto-continue.lib.mjs

@@ -16,6 +16,7 @@ const use = globalThis.use;
 // Use command-stream for consistent $ behavior across runtimes
 const { $: __rawDollar$ } = await use('command-stream');
 const { wrapDollarWithGhRetry } = await import('./github-rate-limit.lib.mjs');
+const { QUIET_PROBE } = await import('./quiet-probe.lib.mjs'); // issue #2130: keep read-only probe payloads out of the attached log
 const $ = wrapDollarWithGhRetry(__rawDollar$);
 // Import shared library functions
 const lib = await import('./lib.mjs');
@@ -522,7 +523,7 @@ export const processAutoContinueForIssue = async (argv, isIssueUrl, urlNumber, o
     // When in fork mode, check for existing branches in the fork
     try {
       // Get current user to determine fork name
-      const userResult = await $`gh api user --jq .login`;
+      const userResult = await $(QUIET_PROBE)`gh api user --jq .login`;
       if (userResult.code === 0) {
         const currentUser = userResult.stdout.toString().trim();
         // Determine fork name based on --prefix-fork-name-with-owner-name option

package/src/solve.auto-pr.lib.mjs

@@ -10,6 +10,7 @@ import { emitForkAwareDiagnostic } from './solve.auto-pr-fork-diagnostic.lib.mjs
 import { handleCompareApiNotReady } from './solve.auto-pr-compare-readiness.lib.mjs'; // Issue #1829: decides whether a failed compare-API readiness poll is fatal (fork mismatch / 0 commits) or a transient diff-render failure to degrade past.
 
 import { wrapDollarWithGhRetry as _wrapDollarWithGhRetry, execGhWithRetry, isTransientCompareApiError } from './github-rate-limit.lib.mjs'; // rate-limit marker (#1726): gh API calls flow through $ wrapped by caller. Issue #1756: execGhWithRetry retries on transient 5xx (504) too. Issue #1829: isTransientCompareApiError lets the compare-API readiness gate degrade gracefully on transient diff-render failures.
+import { quietProbe } from './quiet-probe.lib.mjs'; // issue #2130: keep read-only probe payloads out of the attached log
 import { stagePlaceholderFileOrExplain, explainNothingStagedAndThrow } from './solve.auto-pr-placeholder.lib.mjs'; // Issue #1825: handles the seed placeholder when the target repo gitignores it.
 import { sanitizeForPublication, writeSanitizedPublicationFile } from './token-sanitization.lib.mjs';
 
@@ -432,7 +433,7 @@ Proceed.
           // Determine fork name based on --prefix-fork-name-with-owner-name option
           const forkRepoName = argv.prefixForkNameWithOwnerName ? `${owner}-${repo}` : repo;
           try {
-            const userResult = await $`gh api user --jq .login`;
+            const userResult = await quietProbe($)`gh api user --jq .login`;
             if (userResult.code === 0) {
               currentUser = userResult.stdout.toString().trim();
               const userForkName = `${currentUser}/${forkRepoName}`;
@@ -1131,9 +1132,14 @@ ${prBody}`,
                 // the queries are assembled in JS and passed as one argument.
                 const repositorySelector = `repository(owner: ${JSON.stringify(owner)}, name: ${JSON.stringify(repo)})`;
 
-                // First, get the node IDs for both the issue and the PR
+                // First, get the node IDs for both the issue and the PR.
+                // Issue #2130: these three reads are quiet. Their bare answers
+                // ("I_kwDO...", "PR_kwDO...", "1") were mirrored into the
+                // attached log with nothing around them; the node IDs are
+                // re-logged below under --verbose and the link result is
+                // reported in words either way.
                 const issueNodeQuery = `query { ${repositorySelector} { issue(number: ${issueNumber}) { id } } }`;
-                const issueNodeResult = await $`gh api graphql -f query=${issueNodeQuery} --jq .data.repository.issue.id`;
+                const issueNodeResult = await quietProbe($)`gh api graphql -f query=${issueNodeQuery} --jq .data.repository.issue.id`;
 
                 if (issueNodeResult.code !== 0) {
                   throw new Error(`Failed to get issue node ID: ${issueNodeResult.stderr}`);
@@ -1143,7 +1149,7 @@ ${prBody}`,
                 await log(`   Issue node ID: ${issueNodeId}`, { verbose: true });
 
                 const prNodeQuery = `query { ${repositorySelector} { pullRequest(number: ${localPrNumber}) { id } } }`;
-                const prNodeResult = await $`gh api graphql -f query=${prNodeQuery} --jq .data.repository.pullRequest.id`;
+                const prNodeResult = await quietProbe($)`gh api graphql -f query=${prNodeQuery} --jq .data.repository.pullRequest.id`;
 
                 if (prNodeResult.code !== 0) {
                   throw new Error(`Failed to get PR node ID: ${prNodeResult.stderr}`);
@@ -1160,7 +1166,7 @@ ${prBody}`,
 
                 // Let's verify the link was created
                 const linkCheckQuery = `query { ${repositorySelector} { pullRequest(number: ${localPrNumber}) { closingIssuesReferences(first: 10) { nodes { number } } } } }`;
-                const linkCheckResult = await $`gh api graphql -f query=${linkCheckQuery} --jq '.data.repository.pullRequest.closingIssuesReferences.nodes[].number'`;
+                const linkCheckResult = await quietProbe($)`gh api graphql -f query=${linkCheckQuery} --jq '.data.repository.pullRequest.closingIssuesReferences.nodes[].number'`;
 
                 if (linkCheckResult.code === 0) {
                   const linkedIssues = parseClosingIssueNumbers(linkCheckResult.stdout);

package/src/solve.branch-errors.lib.mjs

@@ -10,6 +10,7 @@
 import { reportError } from './sentry.lib.mjs';
 
 import { wrapDollarWithGhRetry as _wrapDollarWithGhRetry } from './github-rate-limit.lib.mjs'; // rate-limit marker (#1726): gh API calls flow through $ wrapped by caller
+import { quietProbe } from './quiet-probe.lib.mjs'; // issue #2130: keep read-only probe payloads out of the attached log
 export async function handleBranchCheckoutError({ branchName, prNumber, errorOutput, issueUrl, owner, repo, tempDir, argv, formatAligned, log, $ }) {
   // Check if this is a PR from a fork
   let isForkPR = false;
@@ -67,7 +68,7 @@ export async function handleBranchCheckoutError({ branchName, prNumber, errorOut
 
     // Check if the current user has a fork of this repository
     try {
-      const userResult = await $`gh api user --jq .login`;
+      const userResult = await quietProbe($)`gh api user --jq .login`;
       if (userResult.code === 0) {
         const currentUser = userResult.stdout.toString().trim();
         // Determine fork name based on --prefix-fork-name-with-owner-name option

package/src/solve.execution.lib.mjs

@@ -15,6 +15,7 @@ const use = globalThis.use;
 // Use command-stream for consistent $ behavior across runtimes
 const { $: __rawDollar$ } = await use('command-stream');
 const { wrapDollarWithGhRetry } = await import('./github-rate-limit.lib.mjs');
+const { QUIET_PROBE } = await import('./quiet-probe.lib.mjs'); // issue #2130: keep read-only probe payloads out of the attached log
 const $ = wrapDollarWithGhRetry(__rawDollar$);
 const os = (await use('os')).default;
 const path = (await use('path')).default;
@@ -86,7 +87,7 @@ export const setupRepository = async (argv, owner, repo) => {
     await log(`${formatAligned('', 'Checking fork status...', '')}\n`);
 
     // Get current user
-    const userResult = await $`gh api user --jq .login`;
+    const userResult = await $(QUIET_PROBE)`gh api user --jq .login`;
     if (userResult.code !== 0) {
       await log(`${formatAligned('❌', 'Error:', 'Failed to get current user')}`);
       process.exit(1);

package/src/solve.feedback.lib.mjs

@@ -7,6 +7,7 @@
 import { reportError } from './sentry.lib.mjs';
 
 import { wrapDollarWithGhRetry as _wrapDollarWithGhRetry } from './github-rate-limit.lib.mjs'; // rate-limit marker (#1726): gh API calls flow through $ wrapped by caller
+import { QUIET_PROBE, quietProbe } from './quiet-probe.lib.mjs'; // issue #2130: keep read-only probe payloads out of the attached log
 // Issue #1827: tool-generated comments (markers + in-memory tracked IDs) must
 // not count as feedback in watch/continue mode, mirroring checkForNonBotComments.
 import { isToolGeneratedComment, isToolTrackedCommentId } from './tool-comments.lib.mjs';
@@ -22,7 +23,7 @@ export const detectAndCountFeedback = async params => {
 
   // Get current GitHub user to filter out own comments
   try {
-    const userResult = await $`gh api user --jq .login`;
+    const userResult = await quietProbe($)`gh api user --jq .login`;
     if (userResult.code === 0) {
       currentUser = userResult.stdout.toString().trim();
       await log(formatAligned('👤', 'Current user:', currentUser, 2));
@@ -63,7 +64,11 @@ export const detectAndCountFeedback = async params => {
 
       // Get the last commit timestamp from the PR branch
       let lastCommitTime = null;
-      const git$ = repositoryPath ? $({ cwd: repositoryPath }) : $;
+      // Issue #2130: quiet. These probes answer "when was the last commit?", and
+      // the answer is logged in words below; mirroring them put bare ISO dates
+      // and `git log`'s "unknown revision" complaint - the expected outcome for
+      // a branch that has never been pushed - into the attached log.
+      const git$ = repositoryPath ? $({ cwd: repositoryPath, ...QUIET_PROBE }) : quietProbe($);
       let lastCommitResult = await git$`git log -1 --format="%aI" origin/${branchName}`;
       if (lastCommitResult.code !== 0) {
         // Fallback to local branch if remote doesn't exist
@@ -76,7 +81,7 @@ export const detectAndCountFeedback = async params => {
       } else {
         // Fallback: Get last commit time from GitHub API
         try {
-          const prCommitsResult = await $`gh api repos/${owner}/${repo}/pulls/${prNumber}/commits --paginate --jq 'last.commit.author.date'`;
+          const prCommitsResult = await quietProbe($)`gh api repos/${owner}/${repo}/pulls/${prNumber}/commits --paginate --jq 'last.commit.author.date'`;
           if (prCommitsResult.code === 0 && prCommitsResult.stdout) {
             lastCommitTime = new Date(prCommitsResult.stdout.toString().trim());
             await log(formatAligned('📅', 'Last commit time (from API):', lastCommitTime.toISOString(), 2));
@@ -109,14 +114,14 @@ export const detectAndCountFeedback = async params => {
         let prConversationComments = [];
 
         // Get PR code review comments (use --paginate to get all comments, not just first page)
-        const prReviewCommentsResult = await $`gh api repos/${owner}/${repo}/pulls/${prNumber}/comments --paginate`;
+        const prReviewCommentsResult = await quietProbe($)`gh api repos/${owner}/${repo}/pulls/${prNumber}/comments --paginate`;
         if (prReviewCommentsResult.code === 0) {
           prReviewComments = JSON.parse(prReviewCommentsResult.stdout.toString());
         }
 
         // Get PR conversation comments (PR is also an issue)
         // Use --paginate to get all comments - GitHub API returns max 30 per page by default
-        const prConversationCommentsResult = await $`gh api repos/${owner}/${repo}/issues/${prNumber}/comments --paginate`;
+        const prConversationCommentsResult = await quietProbe($)`gh api repos/${owner}/${repo}/issues/${prNumber}/comments --paginate`;
         if (prConversationCommentsResult.code === 0) {
           prConversationComments = JSON.parse(prConversationCommentsResult.stdout.toString());
         }
@@ -156,7 +161,7 @@ export const detectAndCountFeedback = async params => {
 
         // Count new issue comments after last commit
         // Use --paginate to get all comments - GitHub API returns max 30 per page by default
-        const issueCommentsResult = await $`gh api repos/${owner}/${repo}/issues/${issueNumber}/comments --paginate`;
+        const issueCommentsResult = await quietProbe($)`gh api repos/${owner}/${repo}/issues/${issueNumber}/comments --paginate`;
         if (issueCommentsResult.code === 0) {
           const issueComments = JSON.parse(issueCommentsResult.stdout.toString());
           const filteredIssueComments = issueComments.filter(comment => {
@@ -242,7 +247,7 @@ export const detectAndCountFeedback = async params => {
           // started) should be considered feedback.
           try {
             // Check PR description edit time
-            const prDetailsResult = await $`gh api repos/${owner}/${repo}/pulls/${prNumber}`;
+            const prDetailsResult = await quietProbe($)`gh api repos/${owner}/${repo}/pulls/${prNumber}`;
             if (prDetailsResult.code === 0) {
               const prDetails = JSON.parse(prDetailsResult.stdout.toString());
               const prUpdatedAt = new Date(prDetails.updated_at);
@@ -265,7 +270,7 @@ export const detectAndCountFeedback = async params => {
 
             // Check issue description edit time if we have an issue
             if (issueNumber) {
-              const issueDetailsResult = await $`gh api repos/${owner}/${repo}/issues/${issueNumber}`;
+              const issueDetailsResult = await quietProbe($)`gh api repos/${owner}/${repo}/issues/${issueNumber}`;
               if (issueDetailsResult.code === 0) {
                 const issueDetails = JSON.parse(issueDetailsResult.stdout.toString());
                 const issueUpdatedAt = new Date(issueDetails.updated_at);
@@ -300,12 +305,12 @@ export const detectAndCountFeedback = async params => {
 
           // 3. Check for new commits on default branch
           try {
-            const defaultBranchResult = await $`gh api repos/${owner}/${repo}`;
+            const defaultBranchResult = await quietProbe($)`gh api repos/${owner}/${repo}`;
             if (defaultBranchResult.code === 0) {
               const repoData = JSON.parse(defaultBranchResult.stdout.toString());
               const defaultBranch = repoData.default_branch;
 
-              const commitsResult = await $`gh api repos/${owner}/${repo}/commits --paginate --field sha=${defaultBranch} --field since=${lastCommitTime.toISOString()}`;
+              const commitsResult = await quietProbe($)`gh api repos/${owner}/${repo}/commits --paginate --field sha=${defaultBranch} --field since=${lastCommitTime.toISOString()}`;
               if (commitsResult.code === 0) {
                 const commits = JSON.parse(commitsResult.stdout.toString());
                 if (commits.length > 0) {
@@ -353,10 +358,10 @@ export const detectAndCountFeedback = async params => {
 
           // 6. Check for failed PR checks
           try {
-            const prHeadResult = await $`gh api repos/${owner}/${repo}/pulls/${prNumber} --jq '.head.sha'`;
+            const prHeadResult = await quietProbe($)`gh api repos/${owner}/${repo}/pulls/${prNumber} --jq '.head.sha'`;
             if (prHeadResult.code === 0) {
               const prHeadSha = prHeadResult.stdout.toString().trim();
-              const checksResult = await $`gh api repos/${owner}/${repo}/commits/${prHeadSha}/check-runs --paginate --slurp`;
+              const checksResult = await quietProbe($)`gh api repos/${owner}/${repo}/commits/${prHeadSha}/check-runs --paginate --slurp`;
               const checkRuns = checksResult.code === 0 ? JSON.parse(checksResult.stdout.toString() || '[]').flatMap(page => page.check_runs || []) : [];
               const failedChecks = checkRuns.filter(check => check.conclusion === 'failure' && new Date(check.completed_at) > lastCommitTime);
 
@@ -379,7 +384,7 @@ export const detectAndCountFeedback = async params => {
 
           // 7. Check for review requests with changes requested
           try {
-            const reviewsResult = await $`gh api repos/${owner}/${repo}/pulls/${prNumber}/reviews --paginate`;
+            const reviewsResult = await quietProbe($)`gh api repos/${owner}/${repo}/pulls/${prNumber}/reviews --paginate`;
             if (reviewsResult.code === 0) {
               const reviews = JSON.parse(reviewsResult.stdout.toString());
               const changesRequestedReviews = reviews.filter(review => review.state === 'CHANGES_REQUESTED' && new Date(review.submitted_at) > lastCommitTime);