@link-assistant/hive-mind 2.11.5 → 2.11.7

package/src/solve.feedback.lib.mjs

@@ -7,6 +7,7 @@
 import { reportError } from './sentry.lib.mjs';
 
 import { wrapDollarWithGhRetry as _wrapDollarWithGhRetry } from './github-rate-limit.lib.mjs'; // rate-limit marker (#1726): gh API calls flow through $ wrapped by caller
+import { QUIET_PROBE, quietProbe } from './quiet-probe.lib.mjs'; // issue #2130: keep read-only probe payloads out of the attached log
 // Issue #1827: tool-generated comments (markers + in-memory tracked IDs) must
 // not count as feedback in watch/continue mode, mirroring checkForNonBotComments.
 import { isToolGeneratedComment, isToolTrackedCommentId } from './tool-comments.lib.mjs';
@@ -22,7 +23,7 @@ export const detectAndCountFeedback = async params => {
 
   // Get current GitHub user to filter out own comments
   try {
-    const userResult = await $`gh api user --jq .login`;
+    const userResult = await quietProbe($)`gh api user --jq .login`;
     if (userResult.code === 0) {
       currentUser = userResult.stdout.toString().trim();
       await log(formatAligned('👤', 'Current user:', currentUser, 2));
@@ -63,7 +64,11 @@ export const detectAndCountFeedback = async params => {
 
       // Get the last commit timestamp from the PR branch
       let lastCommitTime = null;
-      const git$ = repositoryPath ? $({ cwd: repositoryPath }) : $;
+      // Issue #2130: quiet. These probes answer "when was the last commit?", and
+      // the answer is logged in words below; mirroring them put bare ISO dates
+      // and `git log`'s "unknown revision" complaint - the expected outcome for
+      // a branch that has never been pushed - into the attached log.
+      const git$ = repositoryPath ? $({ cwd: repositoryPath, ...QUIET_PROBE }) : quietProbe($);
       let lastCommitResult = await git$`git log -1 --format="%aI" origin/${branchName}`;
       if (lastCommitResult.code !== 0) {
         // Fallback to local branch if remote doesn't exist
@@ -76,7 +81,7 @@ export const detectAndCountFeedback = async params => {
       } else {
         // Fallback: Get last commit time from GitHub API
         try {
-          const prCommitsResult = await $`gh api repos/${owner}/${repo}/pulls/${prNumber}/commits --paginate --jq 'last.commit.author.date'`;
+          const prCommitsResult = await quietProbe($)`gh api repos/${owner}/${repo}/pulls/${prNumber}/commits --paginate --jq 'last.commit.author.date'`;
           if (prCommitsResult.code === 0 && prCommitsResult.stdout) {
             lastCommitTime = new Date(prCommitsResult.stdout.toString().trim());
             await log(formatAligned('📅', 'Last commit time (from API):', lastCommitTime.toISOString(), 2));
@@ -109,14 +114,14 @@ export const detectAndCountFeedback = async params => {
         let prConversationComments = [];
 
         // Get PR code review comments (use --paginate to get all comments, not just first page)
-        const prReviewCommentsResult = await $`gh api repos/${owner}/${repo}/pulls/${prNumber}/comments --paginate`;
+        const prReviewCommentsResult = await quietProbe($)`gh api repos/${owner}/${repo}/pulls/${prNumber}/comments --paginate`;
         if (prReviewCommentsResult.code === 0) {
           prReviewComments = JSON.parse(prReviewCommentsResult.stdout.toString());
         }
 
         // Get PR conversation comments (PR is also an issue)
         // Use --paginate to get all comments - GitHub API returns max 30 per page by default
-        const prConversationCommentsResult = await $`gh api repos/${owner}/${repo}/issues/${prNumber}/comments --paginate`;
+        const prConversationCommentsResult = await quietProbe($)`gh api repos/${owner}/${repo}/issues/${prNumber}/comments --paginate`;
         if (prConversationCommentsResult.code === 0) {
           prConversationComments = JSON.parse(prConversationCommentsResult.stdout.toString());
         }
@@ -156,7 +161,7 @@ export const detectAndCountFeedback = async params => {
 
         // Count new issue comments after last commit
         // Use --paginate to get all comments - GitHub API returns max 30 per page by default
-        const issueCommentsResult = await $`gh api repos/${owner}/${repo}/issues/${issueNumber}/comments --paginate`;
+        const issueCommentsResult = await quietProbe($)`gh api repos/${owner}/${repo}/issues/${issueNumber}/comments --paginate`;
         if (issueCommentsResult.code === 0) {
           const issueComments = JSON.parse(issueCommentsResult.stdout.toString());
           const filteredIssueComments = issueComments.filter(comment => {
@@ -242,7 +247,7 @@ export const detectAndCountFeedback = async params => {
           // started) should be considered feedback.
           try {
             // Check PR description edit time
-            const prDetailsResult = await $`gh api repos/${owner}/${repo}/pulls/${prNumber}`;
+            const prDetailsResult = await quietProbe($)`gh api repos/${owner}/${repo}/pulls/${prNumber}`;
             if (prDetailsResult.code === 0) {
               const prDetails = JSON.parse(prDetailsResult.stdout.toString());
               const prUpdatedAt = new Date(prDetails.updated_at);
@@ -265,7 +270,7 @@ export const detectAndCountFeedback = async params => {
 
             // Check issue description edit time if we have an issue
             if (issueNumber) {
-              const issueDetailsResult = await $`gh api repos/${owner}/${repo}/issues/${issueNumber}`;
+              const issueDetailsResult = await quietProbe($)`gh api repos/${owner}/${repo}/issues/${issueNumber}`;
               if (issueDetailsResult.code === 0) {
                 const issueDetails = JSON.parse(issueDetailsResult.stdout.toString());
                 const issueUpdatedAt = new Date(issueDetails.updated_at);
@@ -300,12 +305,12 @@ export const detectAndCountFeedback = async params => {
 
           // 3. Check for new commits on default branch
           try {
-            const defaultBranchResult = await $`gh api repos/${owner}/${repo}`;
+            const defaultBranchResult = await quietProbe($)`gh api repos/${owner}/${repo}`;
             if (defaultBranchResult.code === 0) {
               const repoData = JSON.parse(defaultBranchResult.stdout.toString());
               const defaultBranch = repoData.default_branch;
 
-              const commitsResult = await $`gh api repos/${owner}/${repo}/commits --paginate --field sha=${defaultBranch} --field since=${lastCommitTime.toISOString()}`;
+              const commitsResult = await quietProbe($)`gh api repos/${owner}/${repo}/commits --paginate --field sha=${defaultBranch} --field since=${lastCommitTime.toISOString()}`;
               if (commitsResult.code === 0) {
                 const commits = JSON.parse(commitsResult.stdout.toString());
                 if (commits.length > 0) {
@@ -353,10 +358,10 @@ export const detectAndCountFeedback = async params => {
 
           // 6. Check for failed PR checks
           try {
-            const prHeadResult = await $`gh api repos/${owner}/${repo}/pulls/${prNumber} --jq '.head.sha'`;
+            const prHeadResult = await quietProbe($)`gh api repos/${owner}/${repo}/pulls/${prNumber} --jq '.head.sha'`;
             if (prHeadResult.code === 0) {
               const prHeadSha = prHeadResult.stdout.toString().trim();
-              const checksResult = await $`gh api repos/${owner}/${repo}/commits/${prHeadSha}/check-runs --paginate --slurp`;
+              const checksResult = await quietProbe($)`gh api repos/${owner}/${repo}/commits/${prHeadSha}/check-runs --paginate --slurp`;
               const checkRuns = checksResult.code === 0 ? JSON.parse(checksResult.stdout.toString() || '[]').flatMap(page => page.check_runs || []) : [];
               const failedChecks = checkRuns.filter(check => check.conclusion === 'failure' && new Date(check.completed_at) > lastCommitTime);
 
@@ -379,7 +384,7 @@ export const detectAndCountFeedback = async params => {
 
           // 7. Check for review requests with changes requested
           try {
-            const reviewsResult = await $`gh api repos/${owner}/${repo}/pulls/${prNumber}/reviews --paginate`;
+            const reviewsResult = await quietProbe($)`gh api repos/${owner}/${repo}/pulls/${prNumber}/reviews --paginate`;
             if (reviewsResult.code === 0) {
               const reviews = JSON.parse(reviewsResult.stdout.toString());
               const changesRequestedReviews = reviews.filter(review => review.state === 'CHANGES_REQUESTED' && new Date(review.submitted_at) > lastCommitTime);

package/src/solve.fork-sync.lib.mjs

@@ -14,6 +14,7 @@ const use = globalThis.use;
 
 // Use command-stream for consistent $ behavior; wrap with rate-limit retry (#1726)
 const { wrapDollarWithGhRetry } = await import('./github-rate-limit.lib.mjs');
+const { QUIET_PROBE } = await import('./quiet-probe.lib.mjs'); // issue #2130: keep read-only probe payloads out of the attached log
 const $ = wrapDollarWithGhRetry((await use('command-stream')).$);
 
 // Import shared library functions
@@ -179,7 +180,7 @@ export const setupUpstreamAndSync = async (tempDir, forkedRepo, upstreamRemote,
               // branch. Attempting the push there is guaranteed to be rejected
               // with "permission denied" and is unnecessary, so we skip it and
               // keep working on the PR branch.
-              const currentUserResult = await $`gh api user --jq .login`;
+              const currentUserResult = await $(QUIET_PROBE)`gh api user --jq .login`;
               const currentUser = currentUserResult.code === 0 ? currentUserResult.stdout.toString().trim() : null;
               const pushDecision = shouldPushDefaultBranchToFork({ currentUser, forkedRepo });
 

package/src/solve.mjs

@@ -1238,8 +1238,6 @@ try {
     prNumber,
     issueNumber,
     success,
-    publicPricingEstimate,
-    anthropicTotalCostUSD,
     pricingInfo,
     sessionUsage: { sessionId, tempDir, resultModelUsage, streamTokenUsage, subAgentCalls },
   });

package/src/solve.repo-setup.lib.mjs

@@ -6,6 +6,7 @@
 // Issue #1625: centralized markers + tracked posting for the "empty repo"
 // issue comment so it's excluded from --auto-attach-solution-summary's check.
 import { REPOSITORY_INITIALIZATION_REQUIRED_MARKER, postTrackedComment } from './tool-comments.lib.mjs';
+import { QUIET_PROBE } from './quiet-probe.lib.mjs'; // issue #2130: keep read-only probe payloads out of the attached log
 
 export async function setupRepositoryAndClone({ argv, owner, repo, forkOwner, forkRepoName, tempDir, isContinueMode, issueUrl, log, $, needsClone = true }) {
   // Set up repository and handle forking
@@ -28,14 +29,49 @@ export async function setupRepositoryAndClone({ argv, owner, repo, forkOwner, fo
   const prForkRemote = await setupPrForkRemote(tempDir, argv, prForkOwner, repo, isContinueMode, owner);
 
   // Set up git authentication using gh
-  const authSetupResult = await $({ cwd: tempDir })`gh auth setup-git 2>&1`;
-  if (authSetupResult.code !== 0) {
-    await log('Note: gh auth setup-git had issues, continuing anyway\n');
-  }
+  await setupGitCredentialHelper({ tempDir, log, $ });
 
   return { repoToClone, forkedRepo, upstreamRemote, prForkRemote, prForkOwner };
 }
 
+/**
+ * Point git at `gh` for GitHub credentials.
+ *
+ * Issue #2130: `gh auth setup-git` only ever writes the *global* gitconfig. In
+ * a container where `~/.gitconfig` is bind-mounted, git cannot replace it and
+ * gh reports `failed to set up git credential helper: failed to run git: error:
+ * could not write config file /home/box/.gitconfig: Device or resource busy`.
+ * Hive Mind used to mirror that line raw and continue with no credential helper
+ * at all, so the real failure only surfaced later as a push error.
+ *
+ * The clone-local config is equivalent for our purposes and is never
+ * bind-mounted, so it is used as the fallback. The empty `helper` entry first
+ * clears any inherited helper, exactly as `gh auth setup-git` does.
+ */
+export async function setupGitCredentialHelper({ tempDir, log, $, hosts = ['github.com'] }) {
+  const authSetupResult = await $({ cwd: tempDir, ...QUIET_PROBE })`gh auth setup-git 2>&1`;
+  if (authSetupResult.code === 0) return { scope: 'global', hosts };
+
+  const reason = (authSetupResult.stdout?.toString() || authSetupResult.stderr?.toString() || '').trim();
+  await log(`ℹ️  gh auth setup-git could not write the global gitconfig${reason ? `: ${reason.split('\n')[0]}` : ''}`, { verbose: true });
+
+  const failures = [];
+  for (const host of hosts) {
+    const key = `credential.https://${host}.helper`;
+    const cleared = await $({ cwd: tempDir, ...QUIET_PROBE })`git config --local --replace-all ${key} ""`;
+    const configured = await $({ cwd: tempDir, ...QUIET_PROBE })`git config --local --add ${key} ${'!gh auth git-credential'}`;
+    if (cleared.code !== 0 || configured.code !== 0) failures.push(host);
+  }
+
+  if (failures.length) {
+    await log(`⚠️  Could not configure a git credential helper for ${failures.join(', ')} - pushes may require credentials in the remote URL`, { level: 'warning' });
+    return { scope: 'none', hosts: failures };
+  }
+
+  await log('🔑 Configured the gh credential helper for this clone (the global gitconfig is not writable)', { verbose: true });
+  return { scope: 'local', hosts };
+}
+
 async function setupRepository(argv, owner, repo, forkOwner, issueUrl, forkRepoName) {
   const repository = await import('./solve.repository.lib.mjs');
   const { setupRepository: setupRepoFn } = repository;

package/src/solve.repository.lib.mjs

@@ -14,6 +14,7 @@ const use = globalThis.use;
 
 // Use command-stream for consistent $ behavior; wrap with rate-limit retry (#1726)
 const { wrapDollarWithGhRetry } = await import('./github-rate-limit.lib.mjs');
+const { QUIET_PROBE } = await import('./quiet-probe.lib.mjs'); // issue #2130: keep read-only probe payloads out of the attached log
 const $ = wrapDollarWithGhRetry((await use('command-stream')).$);
 const os = (await use('os')).default;
 const path = (await use('path')).default;
@@ -57,7 +58,7 @@ export const getRootRepository = async (owner, repo) => {
 // Check if current user has a fork of the given root repository
 export const checkExistingForkOfRoot = async rootRepo => {
   try {
-    const userResult = await lib.ghCmdRetry(() => $`gh api user --jq .login`, { label: 'get user (fork check)' });
+    const userResult = await lib.ghCmdRetry(() => $(QUIET_PROBE)`gh api user --jq .login`, { label: 'get user (fork check)' });
     if (userResult.code !== 0) return null;
     const currentUser = userResult.stdout.toString().trim();
     // Issue #2119: build the jq expression in JS. Its double quotes belong to jq,
@@ -378,7 +379,7 @@ export const setupRepository = async (argv, owner, repo, forkOwner = null, issue
     await log(`${formatAligned('', 'Checking fork status...', '')}\n`);
 
     // Get current user (issue #1536: retry on transient network errors)
-    const userResult = await lib.ghCmdRetry(() => $`gh api user --jq .login`, { label: 'get current user' });
+    const userResult = await lib.ghCmdRetry(() => $(QUIET_PROBE)`gh api user --jq .login`, { label: 'get current user' });
     if (userResult.code !== 0) {
       await log(`${formatAligned('❌', 'Error:', 'Failed to get current user')}`);
       await safeExit(1, 'Repository setup failed');
@@ -1191,7 +1192,7 @@ export const setupPrForkRemote = async (tempDir, argv, prForkOwner, repo, isCont
 
   // Get current user to check if it's someone else's fork
   await log(`\n${formatAligned('🔍', 'Checking PR fork:', 'Determining if branch is in another fork...')}`);
-  const userResult = await $`gh api user --jq .login`;
+  const userResult = await $(QUIET_PROBE)`gh api user --jq .login`;
   if (userResult.code !== 0) {
     await log(`${formatAligned('⚠️', 'Warning:', 'Failed to get current user, cannot set up pr-fork remote')}`);
     return null;

package/src/solve.results.lib.mjs

@@ -15,6 +15,7 @@ const use = globalThis.use;
 // Use command-stream for consistent $ behavior across runtimes
 const { $: __rawDollar$ } = await use('command-stream');
 const { wrapDollarWithGhRetry } = await import('./github-rate-limit.lib.mjs');
+const { QUIET_PROBE } = await import('./quiet-probe.lib.mjs'); // issue #2130: keep read-only probe payloads out of the attached log
 const $ = wrapDollarWithGhRetry(__rawDollar$);
 const path = (await use('path')).default;
 
@@ -28,8 +29,6 @@ import { safeExit } from './exit-handler.lib.mjs';
 // Import GitHub-related functions
 const githubLib = await import('./github.lib.mjs');
 const { sanitizeLogContent, attachLogToGitHub } = githubLib;
-const { buildCostInfoString } = await import('./github-cost-info.lib.mjs');
-const { buildBudgetStatsString } = await import('./claude.budget-stats.lib.mjs');
 
 // Issue #1745: process-wide sanitization counters used to print a one-line
 // "we masked N secrets" summary at the end of each run.
@@ -673,7 +672,18 @@ export const showSessionSummary = async (sessionId, limitReached, argv, issueUrl
 // same observed facts (working-session summary and attached log alike).
 export const buildSessionBudgetStatsData = async ({ argv, sessionId = null, tempDir = null, resultModelUsage = null, streamTokenUsage = null, subAgentCalls = null, pricingInfo = null }) => {
   let budgetStatsData = null;
-  if (argv.tokensBudgetStats && sessionId && tempDir) {
+  // Issue #2132: budget stats are a property of the working session **log**.
+  // With `--attach-logs` disabled there is no log comment, so they must not be
+  // computed or published anywhere.
+  const { shouldPublishBudgetStats, isAttachLogsEnabled, isTokensBudgetStatsEnabled } = await import('./budget-stats-policy.lib.mjs');
+  if (!shouldPublishBudgetStats(argv)) {
+    if (argv?.verbose) {
+      const reason = !isTokensBudgetStatsEnabled(argv) ? '--no-tokens-budget-stats' : !isAttachLogsEnabled(argv) ? '--attach-logs is disabled' : 'unknown';
+      await log(`  ℹ️  Skipping context/cost budget stats publication (${reason})`, { verbose: true });
+    }
+    return null;
+  }
+  if (sessionId && tempDir) {
     try {
       const { calculateSessionTokens } = await import('./claude.lib.mjs');
       const tokenUsage = await calculateSessionTokens(sessionId, tempDir, resultModelUsage);
@@ -685,7 +695,7 @@ export const buildSessionBudgetStatsData = async ({ argv, sessionId = null, temp
     }
   }
   // Issue #1526: Build budget stats from Agent CLI token/context data when no JSONL session available
-  if (!budgetStatsData && argv.tokensBudgetStats && pricingInfo?.tokenUsage) {
+  if (!budgetStatsData && pricingInfo?.tokenUsage) {
     try {
       const { buildAgentBudgetStats } = await import('./claude.budget-stats.lib.mjs');
       const agentBudgetData = buildAgentBudgetStats(pricingInfo.tokenUsage, pricingInfo);
@@ -719,7 +729,7 @@ export const verifyResults = async (owner, repo, branchName, issueNumber, prNumb
 
   try {
     // Get the current user's GitHub username
-    const userResult = await $`gh api user --jq .login`;
+    const userResult = await $(QUIET_PROBE)`gh api user --jq .login`;
 
     if (userResult.code !== 0) {
       throw new Error(`Failed to get current user: ${userResult.stderr ? userResult.stderr.toString() : 'Unknown error'}`);
@@ -1139,7 +1149,7 @@ export const { TOOL_GENERATED_COMMENT_MARKERS, isToolGeneratedComment, trackTool
 export const checkForAiCreatedComments = async (sessionStartTime, owner, repo, prNumber, issueNumber) => {
   try {
     // Get the current user's GitHub username
-    const userResult = await $`gh api user --jq .login`;
+    const userResult = await $(QUIET_PROBE)`gh api user --jq .login`;
     if (userResult.code !== 0) {
       return false; // Cannot determine, default to not attaching
     }
@@ -1263,15 +1273,19 @@ export const checkForAiCreatedComments = async (sessionStartTime, owner, repo, p
  * @param {string} options.repo - Repository name
  * @returns {Promise<boolean>} - True if comment was posted successfully
  */
-export const buildWorkingSessionSummaryDetails = ({ publicPricingEstimate = null, anthropicTotalCostUSD = null, pricingInfo = null, budgetStatsData = null } = {}) => {
-  const costInfo = buildCostInfoString(publicPricingEstimate, anthropicTotalCostUSD, pricingInfo, {
-    includeTokenUsage: false,
-  });
-  const budgetStats = budgetStatsData ? buildBudgetStatsString(budgetStatsData.tokenUsage, budgetStatsData.subAgentCalls) : '';
-  return `${costInfo}${budgetStats}`.trim();
-};
+/**
+ * Issue #2132: the working session summary must describe *what the AI did* and
+ * nothing else. Cost estimation and context/token budget statistics belong to
+ * the working session log comment (`--attach-logs`), where they are already
+ * published once per working session. Rendering them in the summary as well
+ * duplicated the very same block in two consecutive comments.
+ *
+ * Kept as an exported function returning an empty string so the invariant is
+ * directly testable and any future caller cannot silently re-add the block.
+ */
+export const buildWorkingSessionSummaryDetails = () => '';
 
-export const attachSolutionSummary = async ({ resultSummary, prNumber, issueNumber, owner, repo, publicPricingEstimate = null, anthropicTotalCostUSD = null, pricingInfo = null, budgetStatsData = null, changeStats = null }) => {
+export const attachSolutionSummary = async ({ resultSummary, prNumber, issueNumber, owner, repo, changeStats = null }) => {
   if (!resultSummary || typeof resultSummary !== 'string') {
     await log('⚠️  No working session summary available to attach', { verbose: true });
     return false;
@@ -1286,12 +1300,6 @@ export const attachSolutionSummary = async ({ resultSummary, prNumber, issueNumb
   }
 
   try {
-    const usageDetails = buildWorkingSessionSummaryDetails({
-      publicPricingEstimate,
-      anthropicTotalCostUSD,
-      pricingInfo,
-      budgetStatsData,
-    });
     // Issue #2119: publish what the session actually produced. The reported
     // summary said "The `pwd` command completed" and printed the solver's own
     // /tmp workspace, on a pull request that was still empty.
@@ -1301,7 +1309,7 @@ export const attachSolutionSummary = async ({ resultSummary, prNumber, issueNumb
     const comment = `${toolComments.WORKING_SESSION_SUMMARY_AUTOMATION_MARKER}
 ## ${toolComments.WORKING_SESSION_SUMMARY_MARKER}
 
-${summaryBody}${noChangesNotice ? `\n\n${noChangesNotice}` : ''}${usageDetails ? `\n\n${usageDetails}` : ''}
+${summaryBody}${noChangesNotice ? `\n\n${noChangesNotice}` : ''}
 
 ---
 *${toolComments.WORKING_SESSION_SUMMARY_AUTOMATED_FOOTER}*`;
@@ -1358,7 +1366,7 @@ ${summaryBody}${noChangesNotice ? `\n\n${noChangesNotice}` : ''}${usageDetails ?
  * @param {boolean} [options.success=true] - skip attachment for failed iterations
  * @returns {Promise<{attached: boolean, reason: string}>}
  */
-export const maybeAttachWorkingSessionSummary = async ({ argv, resultSummary, workStartTime, owner, repo, prNumber, issueNumber, success = true, publicPricingEstimate = null, anthropicTotalCostUSD = null, pricingInfo = null, budgetStatsData = null, sessionUsage = null }) => {
+export const maybeAttachWorkingSessionSummary = async ({ argv, resultSummary, workStartTime, owner, repo, prNumber, issueNumber, success = true, pricingInfo = null, budgetStatsData = null, sessionUsage = null }) => {
   if (!success) {
     return { attached: false, reason: 'iteration_failed' };
   }
@@ -1407,16 +1415,14 @@ export const maybeAttachWorkingSessionSummary = async ({ argv, resultSummary, wo
   // say so, instead of reading as a report of completed work.
   const changeStats = prNumber ? await getPullRequestChangeStats({ owner, repo, prNumber, $ }) : null;
 
+  // Issue #2132: the summary carries no cost/budget block. `resolvedBudgetStatsData`
+  // is computed only so the caller can reuse it for this session's log comment.
   const ok = await attachSolutionSummary({
     resultSummary,
     prNumber,
     issueNumber,
     owner,
     repo,
-    publicPricingEstimate,
-    anthropicTotalCostUSD,
-    pricingInfo,
-    budgetStatsData: resolvedBudgetStatsData,
     changeStats,
   });
   return { attached: !!ok, reason: ok ? 'attached' : 'post_failed', budgetStatsData: resolvedBudgetStatsData };

package/src/solve.validation.lib.mjs

@@ -308,13 +308,20 @@ export const performSystemChecks = async (minDiskSpace = 10240, skipToolConnecti
       const { validateFormalAiToolConnection } = await import('./formal-ai.lib.mjs');
       const formalAiValidation = await validateFormalAiToolConnection(argv.tool || 'claude');
       isToolConnected = formalAiValidation.valid;
+      // Record the wrapper version on both paths: the wrapper builds the tool's
+      // argv, so its version is the first thing needed to explain a failure
+      // (issue #2130's logs recorded neither, which left the round-2 claude
+      // failure unattributable).
+      const formalAiVersionLine = `📦 Formal AI wrapper version: ${formalAiValidation.formalAiVersion || 'unknown'}`;
       if (isToolConnected) {
         await log(`✅ Formal AI wrapper and ${argv.tool || 'claude'} CLI are available`);
+        await log(formalAiVersionLine);
         if (formalAiValidation.version) {
           await log(`📦 ${argv.tool || 'claude'} CLI version: ${formalAiValidation.version}`);
         }
       } else {
         await log(`❌ Formal AI dispatch validation failed: ${formalAiValidation.error}`, { level: 'error' });
+        await log(`   ${formalAiVersionLine}`, { level: 'error' });
         await log('   Install or update the wrapper with: cargo install formal-ai', { level: 'error' });
         return false;
       }

package/src/solve.watch.lib.mjs

@@ -567,19 +567,21 @@ export const watchForFeedback = async params => {
             latestResultModelUsage = toolResult.resultModelUsage;
           }
 
-          // Issue #1508: Compute budget stats for auto-restart log comment
-          let autoRestartBudgetStatsData = null;
-          if (argv.tokensBudgetStats && latestSessionId && tempDir) {
-            try {
-              const { calculateSessionTokens } = await import('./claude.lib.mjs');
-              const tokenUsage = await calculateSessionTokens(latestSessionId, tempDir, toolResult.resultModelUsage);
-              if (tokenUsage) {
-                autoRestartBudgetStatsData = { tokenUsage, streamTokenUsage: toolResult.streamTokenUsage || null, subAgentCalls: toolResult.subAgentCalls || null };
-              }
-            } catch (budgetError) {
-              if (argv.verbose) await log(`  ⚠️  Could not calculate budget stats: ${budgetError.message}`, { verbose: true });
-            }
-          }
+          // Issue #1508: Compute budget stats for auto-restart log comment.
+          // Issue #2132: shared with the top-level run and the
+          // auto-restart-until-mergeable loop via buildSessionBudgetStatsData,
+          // so every working session derives its own stats the same way (and
+          // skips them entirely when `--attach-logs` is disabled).
+          const { buildSessionBudgetStatsData } = await import('./solve.results.lib.mjs');
+          const autoRestartBudgetStatsData = await buildSessionBudgetStatsData({
+            argv,
+            sessionId: latestSessionId,
+            tempDir,
+            resultModelUsage: toolResult.resultModelUsage,
+            streamTokenUsage: toolResult.streamTokenUsage || null,
+            subAgentCalls: toolResult.subAgentCalls || null,
+            pricingInfo: toolResult.pricingInfo || null,
+          });
 
           // Issue #1761: Post the working session **summary** BEFORE uploading
           // the working session **log** so the summary always appears above
@@ -604,8 +606,6 @@ export const watchForFeedback = async params => {
               prNumber,
               issueNumber,
               success: true,
-              publicPricingEstimate: toolResult.publicPricingEstimate,
-              anthropicTotalCostUSD: latestAnthropicCost,
               pricingInfo: toolResult.pricingInfo,
               budgetStatsData: autoRestartBudgetStatsData,
             });

package/src/token-sanitization.lib.mjs

@@ -24,6 +24,7 @@ import { reportError } from './sentry.lib.mjs';
 export { createCredentialStreamSanitizer };
 
 import { wrapDollarWithGhRetry as _wrapDollarWithGhRetry } from './github-rate-limit.lib.mjs'; // rate-limit marker (#1726): gh API calls flow through $ wrapped by caller
+import { QUIET_PROBE } from './quiet-probe.lib.mjs'; // issue #2130: never mirror the call that discovers which secrets must be masked
 // Dynamic imports for runtime dependencies
 const getOsModule = async () => (await import('os')).default;
 const getPathModule = async () => (await import('path')).default;
@@ -255,8 +256,12 @@ export const getGitHubTokensFromCommand = async () => {
   const tokens = [];
 
   try {
-    // Run gh auth status to get token info
-    const authResult = await $`gh auth status 2>&1`.catch(() => ({ stdout: '', stderr: '' }));
+    // Run gh auth status to get token info.
+    // Issue #2130: never mirror this. The whole point of the call is to learn
+    // which secrets have to be masked, so its output is the one thing that is
+    // guaranteed to be unmasked at this moment - and it was being echoed into
+    // the log that later gets attached to the pull request.
+    const authResult = await $(QUIET_PROBE)`gh auth status 2>&1`.catch(() => ({ stdout: '', stderr: '' }));
     const authOutput = authResult.stdout?.toString() + authResult.stderr?.toString() || '';
 
     // Look for token patterns in the output