@link-assistant/hive-mind 2.11.4 → 2.11.6

package/src/solve.fork-sync.lib.mjs

@@ -14,6 +14,7 @@ const use = globalThis.use;
 
 // Use command-stream for consistent $ behavior; wrap with rate-limit retry (#1726)
 const { wrapDollarWithGhRetry } = await import('./github-rate-limit.lib.mjs');
+const { QUIET_PROBE } = await import('./quiet-probe.lib.mjs'); // issue #2130: keep read-only probe payloads out of the attached log
 const $ = wrapDollarWithGhRetry((await use('command-stream')).$);
 
 // Import shared library functions
@@ -179,7 +180,7 @@ export const setupUpstreamAndSync = async (tempDir, forkedRepo, upstreamRemote,
               // branch. Attempting the push there is guaranteed to be rejected
               // with "permission denied" and is unnecessary, so we skip it and
               // keep working on the PR branch.
-              const currentUserResult = await $`gh api user --jq .login`;
+              const currentUserResult = await $(QUIET_PROBE)`gh api user --jq .login`;
               const currentUser = currentUserResult.code === 0 ? currentUserResult.stdout.toString().trim() : null;
               const pushDecision = shouldPushDefaultBranchToFork({ currentUser, forkedRepo });
 

package/src/solve.repo-setup.lib.mjs

@@ -6,6 +6,7 @@
 // Issue #1625: centralized markers + tracked posting for the "empty repo"
 // issue comment so it's excluded from --auto-attach-solution-summary's check.
 import { REPOSITORY_INITIALIZATION_REQUIRED_MARKER, postTrackedComment } from './tool-comments.lib.mjs';
+import { QUIET_PROBE } from './quiet-probe.lib.mjs'; // issue #2130: keep read-only probe payloads out of the attached log
 
 export async function setupRepositoryAndClone({ argv, owner, repo, forkOwner, forkRepoName, tempDir, isContinueMode, issueUrl, log, $, needsClone = true }) {
   // Set up repository and handle forking
@@ -28,14 +29,49 @@ export async function setupRepositoryAndClone({ argv, owner, repo, forkOwner, fo
   const prForkRemote = await setupPrForkRemote(tempDir, argv, prForkOwner, repo, isContinueMode, owner);
 
   // Set up git authentication using gh
-  const authSetupResult = await $({ cwd: tempDir })`gh auth setup-git 2>&1`;
-  if (authSetupResult.code !== 0) {
-    await log('Note: gh auth setup-git had issues, continuing anyway\n');
-  }
+  await setupGitCredentialHelper({ tempDir, log, $ });
 
   return { repoToClone, forkedRepo, upstreamRemote, prForkRemote, prForkOwner };
 }
 
+/**
+ * Point git at `gh` for GitHub credentials.
+ *
+ * Issue #2130: `gh auth setup-git` only ever writes the *global* gitconfig. In
+ * a container where `~/.gitconfig` is bind-mounted, git cannot replace it and
+ * gh reports `failed to set up git credential helper: failed to run git: error:
+ * could not write config file /home/box/.gitconfig: Device or resource busy`.
+ * Hive Mind used to mirror that line raw and continue with no credential helper
+ * at all, so the real failure only surfaced later as a push error.
+ *
+ * The clone-local config is equivalent for our purposes and is never
+ * bind-mounted, so it is used as the fallback. The empty `helper` entry first
+ * clears any inherited helper, exactly as `gh auth setup-git` does.
+ */
+export async function setupGitCredentialHelper({ tempDir, log, $, hosts = ['github.com'] }) {
+  const authSetupResult = await $({ cwd: tempDir, ...QUIET_PROBE })`gh auth setup-git 2>&1`;
+  if (authSetupResult.code === 0) return { scope: 'global', hosts };
+
+  const reason = (authSetupResult.stdout?.toString() || authSetupResult.stderr?.toString() || '').trim();
+  await log(`ℹ️  gh auth setup-git could not write the global gitconfig${reason ? `: ${reason.split('\n')[0]}` : ''}`, { verbose: true });
+
+  const failures = [];
+  for (const host of hosts) {
+    const key = `credential.https://${host}.helper`;
+    const cleared = await $({ cwd: tempDir, ...QUIET_PROBE })`git config --local --replace-all ${key} ""`;
+    const configured = await $({ cwd: tempDir, ...QUIET_PROBE })`git config --local --add ${key} ${'!gh auth git-credential'}`;
+    if (cleared.code !== 0 || configured.code !== 0) failures.push(host);
+  }
+
+  if (failures.length) {
+    await log(`⚠️  Could not configure a git credential helper for ${failures.join(', ')} - pushes may require credentials in the remote URL`, { level: 'warning' });
+    return { scope: 'none', hosts: failures };
+  }
+
+  await log('🔑 Configured the gh credential helper for this clone (the global gitconfig is not writable)', { verbose: true });
+  return { scope: 'local', hosts };
+}
+
 async function setupRepository(argv, owner, repo, forkOwner, issueUrl, forkRepoName) {
   const repository = await import('./solve.repository.lib.mjs');
   const { setupRepository: setupRepoFn } = repository;

package/src/solve.repository.lib.mjs

@@ -14,6 +14,7 @@ const use = globalThis.use;
 
 // Use command-stream for consistent $ behavior; wrap with rate-limit retry (#1726)
 const { wrapDollarWithGhRetry } = await import('./github-rate-limit.lib.mjs');
+const { QUIET_PROBE } = await import('./quiet-probe.lib.mjs'); // issue #2130: keep read-only probe payloads out of the attached log
 const $ = wrapDollarWithGhRetry((await use('command-stream')).$);
 const os = (await use('os')).default;
 const path = (await use('path')).default;
@@ -57,7 +58,7 @@ export const getRootRepository = async (owner, repo) => {
 // Check if current user has a fork of the given root repository
 export const checkExistingForkOfRoot = async rootRepo => {
   try {
-    const userResult = await lib.ghCmdRetry(() => $`gh api user --jq .login`, { label: 'get user (fork check)' });
+    const userResult = await lib.ghCmdRetry(() => $(QUIET_PROBE)`gh api user --jq .login`, { label: 'get user (fork check)' });
     if (userResult.code !== 0) return null;
     const currentUser = userResult.stdout.toString().trim();
     // Issue #2119: build the jq expression in JS. Its double quotes belong to jq,
@@ -378,7 +379,7 @@ export const setupRepository = async (argv, owner, repo, forkOwner = null, issue
     await log(`${formatAligned('', 'Checking fork status...', '')}\n`);
 
     // Get current user (issue #1536: retry on transient network errors)
-    const userResult = await lib.ghCmdRetry(() => $`gh api user --jq .login`, { label: 'get current user' });
+    const userResult = await lib.ghCmdRetry(() => $(QUIET_PROBE)`gh api user --jq .login`, { label: 'get current user' });
     if (userResult.code !== 0) {
       await log(`${formatAligned('❌', 'Error:', 'Failed to get current user')}`);
       await safeExit(1, 'Repository setup failed');
@@ -1191,7 +1192,7 @@ export const setupPrForkRemote = async (tempDir, argv, prForkOwner, repo, isCont
 
   // Get current user to check if it's someone else's fork
   await log(`\n${formatAligned('🔍', 'Checking PR fork:', 'Determining if branch is in another fork...')}`);
-  const userResult = await $`gh api user --jq .login`;
+  const userResult = await $(QUIET_PROBE)`gh api user --jq .login`;
   if (userResult.code !== 0) {
     await log(`${formatAligned('⚠️', 'Warning:', 'Failed to get current user, cannot set up pr-fork remote')}`);
     return null;

package/src/solve.results.lib.mjs

@@ -15,6 +15,7 @@ const use = globalThis.use;
 // Use command-stream for consistent $ behavior across runtimes
 const { $: __rawDollar$ } = await use('command-stream');
 const { wrapDollarWithGhRetry } = await import('./github-rate-limit.lib.mjs');
+const { QUIET_PROBE } = await import('./quiet-probe.lib.mjs'); // issue #2130: keep read-only probe payloads out of the attached log
 const $ = wrapDollarWithGhRetry(__rawDollar$);
 const path = (await use('path')).default;
 
@@ -719,7 +720,7 @@ export const verifyResults = async (owner, repo, branchName, issueNumber, prNumb
 
   try {
     // Get the current user's GitHub username
-    const userResult = await $`gh api user --jq .login`;
+    const userResult = await $(QUIET_PROBE)`gh api user --jq .login`;
 
     if (userResult.code !== 0) {
       throw new Error(`Failed to get current user: ${userResult.stderr ? userResult.stderr.toString() : 'Unknown error'}`);
@@ -1139,7 +1140,7 @@ export const { TOOL_GENERATED_COMMENT_MARKERS, isToolGeneratedComment, trackTool
 export const checkForAiCreatedComments = async (sessionStartTime, owner, repo, prNumber, issueNumber) => {
   try {
     // Get the current user's GitHub username
-    const userResult = await $`gh api user --jq .login`;
+    const userResult = await $(QUIET_PROBE)`gh api user --jq .login`;
     if (userResult.code !== 0) {
       return false; // Cannot determine, default to not attaching
     }

package/src/solve.validation.lib.mjs

@@ -308,13 +308,20 @@ export const performSystemChecks = async (minDiskSpace = 10240, skipToolConnecti
       const { validateFormalAiToolConnection } = await import('./formal-ai.lib.mjs');
       const formalAiValidation = await validateFormalAiToolConnection(argv.tool || 'claude');
       isToolConnected = formalAiValidation.valid;
+      // Record the wrapper version on both paths: the wrapper builds the tool's
+      // argv, so its version is the first thing needed to explain a failure
+      // (issue #2130's logs recorded neither, which left the round-2 claude
+      // failure unattributable).
+      const formalAiVersionLine = `📦 Formal AI wrapper version: ${formalAiValidation.formalAiVersion || 'unknown'}`;
       if (isToolConnected) {
         await log(`✅ Formal AI wrapper and ${argv.tool || 'claude'} CLI are available`);
+        await log(formalAiVersionLine);
         if (formalAiValidation.version) {
           await log(`📦 ${argv.tool || 'claude'} CLI version: ${formalAiValidation.version}`);
         }
       } else {
         await log(`❌ Formal AI dispatch validation failed: ${formalAiValidation.error}`, { level: 'error' });
+        await log(`   ${formalAiVersionLine}`, { level: 'error' });
         await log('   Install or update the wrapper with: cargo install formal-ai', { level: 'error' });
         return false;
       }

package/src/token-sanitization.lib.mjs

@@ -24,6 +24,7 @@ import { reportError } from './sentry.lib.mjs';
 export { createCredentialStreamSanitizer };
 
 import { wrapDollarWithGhRetry as _wrapDollarWithGhRetry } from './github-rate-limit.lib.mjs'; // rate-limit marker (#1726): gh API calls flow through $ wrapped by caller
+import { QUIET_PROBE } from './quiet-probe.lib.mjs'; // issue #2130: never mirror the call that discovers which secrets must be masked
 // Dynamic imports for runtime dependencies
 const getOsModule = async () => (await import('os')).default;
 const getPathModule = async () => (await import('path')).default;
@@ -255,8 +256,12 @@ export const getGitHubTokensFromCommand = async () => {
   const tokens = [];
 
   try {
-    // Run gh auth status to get token info
-    const authResult = await $`gh auth status 2>&1`.catch(() => ({ stdout: '', stderr: '' }));
+    // Run gh auth status to get token info.
+    // Issue #2130: never mirror this. The whole point of the call is to learn
+    // which secrets have to be masked, so its output is the one thing that is
+    // guaranteed to be unmasked at this moment - and it was being echoed into
+    // the log that later gets attached to the pull request.
+    const authResult = await $(QUIET_PROBE)`gh auth status 2>&1`.catch(() => ({ stdout: '', stderr: '' }));
     const authOutput = authResult.stdout?.toString() + authResult.stderr?.toString() || '';
 
     // Look for token patterns in the output