@link-assistant/hive-mind 2.12.2 → 2.12.4

package/src/locales/hi.lino

@@ -654,6 +654,7 @@ hi
         runner_also_failed "रनर भी विफल हुआ; जाँच के लिए उसका exit code सुरक्षित रखा गया है।"
         killed "कार्य सत्र रोका गया: {{reason}}{{exitSuffix}}"
         stopped "कार्य सत्र उपयोगकर्ता द्वारा रोका गया{{requestedBy}}{{exitSuffix}}"
+        not_launched "कार्य सत्र शुरू ही नहीं हुआ, इसलिए उसका कोई log नहीं है और वह `--list` में नहीं दिखता।"
     duration
       label "अवधि"
     session
@@ -670,6 +671,8 @@ hi
         resumed_attempt "🔄 इस समाप्ति से पुनर्प्राप्ति हेतु नया कार्य सत्र शुरू किया गया (प्रयास {{attempt}}): {{sessionId}}"
     isolation
       label "Isolation"
+    execution
+      label "निष्पादन"
     error
       executing
         command "❌ {{commandName}} command चलाने में त्रुटि"

package/src/locales/ru.lino

@@ -654,6 +654,7 @@ ru
         runner_also_failed "Средство запуска также завершилось с ошибкой; код выхода сохранён для расследования."
         killed "Рабочий сеанс остановлен: {{reason}}{{exitSuffix}}"
         stopped "Рабочий сеанс остановлен пользователем{{requestedBy}}{{exitSuffix}}"
+        not_launched "Рабочий сеанс не был запущен, поэтому у него нет журнала и он не отображается в `--list`."
     duration
       label "Длительность"
     session
@@ -670,6 +671,8 @@ ru
         resumed_attempt "🔄 Запущена новая рабочая сессия для восстановления после этого завершения (попытка {{attempt}}): {{sessionId}}"
     isolation
       label "Изоляция"
+    execution
+      label "Запуск"
     error
       executing
         command "❌ Ошибка выполнения команды {{commandName}}"

package/src/locales/zh.lino

@@ -654,6 +654,7 @@ zh
         runner_also_failed "运行器也失败了；其退出代码已保留以供调查。"
         killed "工作会话已终止：{{reason}}{{exitSuffix}}"
         stopped "工作会话已由用户停止{{requestedBy}}{{exitSuffix}}"
+        not_launched "工作会话未启动，因此没有日志，也不会出现在 `--list` 中。"
     duration
       label "耗时"
     session
@@ -670,6 +671,8 @@ zh
         resumed_attempt "🔄 已启动新的工作会话以从此次终止中恢复（第 {{attempt}} 次尝试）：{{sessionId}}"
     isolation
       label "隔离"
+    execution
+      label "执行"
     error
       executing
         command "❌ 执行 {{commandName}} 命令时出错"

package/src/session-kill-recovery.lib.mjs

@@ -24,6 +24,7 @@
 
 import { spawn } from 'child_process';
 import { describeChildExit } from './child-exit.lib.mjs';
+import { sanitizeForPublication } from './token-sanitization.lib.mjs'; // issue #2156: this body is published to a pull request
 import { KILL_CAUSE_DISK_FULL, KILL_CAUSE_FORCED_KILL, KILL_CAUSE_OUT_OF_MEMORY } from './session-kill-diagnostics.lib.mjs';
 import { ON_SESSION_KILL_RESUME } from './session-kill-policy.lib.mjs';
 
@@ -161,6 +162,13 @@ const defaultUnlink = async filePath => {
  * `--body-file` (not `--body`) is used deliberately: the notice contains
  * backticks and newlines that would otherwise have to survive shell quoting.
  *
+ * Issue #2156: the body is sanitized here rather than by the caller. It carries
+ * kill diagnostics and a resume command, both assembled from process and log
+ * data, so it is a publication boundary like any other and must fail closed.
+ * The array-argument `gh` invocation below is invisible to the
+ * `require-sanitized-output` ESLint rule, which is exactly how this path stayed
+ * unsanitized; the rule now understands this shape too.
+ *
  * @param {Object} options
  * @param {string} options.pullRequestUrl
  * @param {string} options.body
@@ -178,7 +186,7 @@ export async function postKillRecoveryNotice({ pullRequestUrl, body, runCommand
 
   const bodyFile = `${tempDir.replace(/\/$/, '')}/hive-mind-kill-notice-${fileSuffix}.md`;
   try {
-    await writeFile(bodyFile, body);
+    await writeFile(bodyFile, await sanitizeForPublication(body));
     const result = await runCommand('gh', ['pr', 'comment', pullRequestUrl, '--body-file', bodyFile]);
     if (result?.code === 0) {
       const url = String(result.stdout || '').trim() || null;

package/src/session-monitor.lib.mjs

@@ -164,6 +164,9 @@ export function trackSession(sessionName, sessionInfo, verbose = false) {
     url: sessionInfo.url || null,
     command: sessionInfo.command || null,
     sessionId: sessionInfo.sessionId || null,
+    // Issue #2154: `$ --list` prints start-command's execution UUID, not the
+    // session name. Logging both is what makes the two views joinable.
+    executionUuid: sessionInfo.executionUuid || null,
     startTime: sessionInfo.startTime instanceof Date ? sessionInfo.startTime.toISOString() : sessionInfo.startTime || null,
   });
 }
@@ -230,24 +233,40 @@ export function markSessionStopRequested(sessionId, { requestedBy = null, verbos
  * map and the durable store without emitting a `session_completed` audit event —
  * the session never ran, so it has no exit code to record (issue #1946).
  *
+ * Issue #2154: the durable structured log recorded only
+ * `session_untracked {"sessionName":…}`. Why the session disappeared a second
+ * after it was announced lived on untimestamped console lines, so an incident
+ * could not be reconstructed from the timestamped log alone. Callers now pass
+ * the reason and it is recorded with the event.
+ *
  * @param {string} sessionName - Name/UUID of the session to drop
  * @param {boolean} verbose - Whether to log verbose output
+ * @param {object} [details] - Extra context recorded with the `session_untracked` event
+ * @param {string} [details.reason] - Why the session was dropped (e.g. the launch error)
  */
-export function untrackSession(sessionName, verbose = false) {
+export function untrackSession(sessionName, verbose = false, details = {}) {
   if (!sessionName) return;
   const sessionInfo = activeSessions.get(sessionName) || null;
   const existed = activeSessions.delete(sessionName);
+  const reason = typeof details?.reason === 'string' && details.reason.trim() ? details.reason.trim() : null;
   if (verbose && existed) {
-    console.log(`[VERBOSE] Session ${sessionName} untracked (launch failed before it started)`);
+    console.log(`[VERBOSE] Session ${sessionName} untracked (launch failed before it started)${reason ? `: ${reason}` : ''}`);
   }
   if (sessionStore && isPersistableSession(sessionInfo)) {
     try {
-      sessionStore.remove(sessionName, { status: 'launch-failed', exitCode: null });
+      sessionStore.remove(sessionName, { status: 'launch-failed', exitCode: null, reason });
     } catch (error) {
       console.error(`[session-monitor] Could not remove untracked session ${sessionName}: ${error.message}`);
     }
   }
-  logEvent('session_untracked', { sessionName });
+  logEvent('session_untracked', {
+    sessionName,
+    reason,
+    url: sessionInfo?.url || null,
+    command: sessionInfo?.command || null,
+    tool: sessionInfo?.tool || null,
+    isolationBackend: sessionInfo?.isolationBackend || null,
+  });
 }
 /**
  * Get the number of active sessions being tracked
@@ -646,6 +665,18 @@ export async function monitorSessions(bot, verbose = false, options = {}) {
         sessionInfo.logPath = statusResult.logPath;
         persistSessionSnapshot(sessionName, sessionInfo);
       }
+      // Issue #2154: the same status record carries start-command's *execution*
+      // UUID — the only identifier `$ --list` prints. A session launched before
+      // this fix (or by a start-command whose banner we could not parse) has
+      // none, so backfill it here; otherwise that session stays impossible to
+      // find in the session list for its whole lifetime.
+      if (statusResult?.uuid && sessionInfo.executionUuid !== statusResult.uuid) {
+        if (verbose) {
+          console.log(`[VERBOSE] Session ${sessionName}: recorded start-command execution UUID ${statusResult.uuid} (this is what '$ --list' shows)`);
+        }
+        sessionInfo.executionUuid = statusResult.uuid;
+        persistSessionSnapshot(sessionName, sessionInfo);
+      }
     } else {
       // Issue #1586: Non-isolation screen sessions cannot reliably detect
       // completion because start-screen keeps the screen alive via `exec bash`.

package/src/session-store.lib.mjs

@@ -35,7 +35,10 @@ import path from 'node:path';
 // with its exact original invocation plus `--resume <lastSessionId>`.
 // `commandAlias` (#2109) preserves the Telegram spelling (`solve`, `codex`,
 // `claude`, etc.) so a bot notification never suggests a terminal-only command.
-const PERSISTABLE_FIELDS = ['chatId', 'messageId', 'startTime', 'url', 'command', 'commandAlias', 'isolationBackend', 'sessionId', 'containerFilesystemStartBytes', 'containerFilesystemLastBytes', 'containerFilesystemLastObservedAt', 'tool', 'infoBlock', 'urlContext', 'requesterUserId', 'showLimits', 'locale', 'logPath', 'args'];
+// `executionUuid` (#2154) is start-command's own identifier for the execution —
+// the one `$ --list` prints. It differs from `sessionId`, so persisting it is
+// what lets a restarted bot still correlate its sessions with the session list.
+const PERSISTABLE_FIELDS = ['chatId', 'messageId', 'startTime', 'url', 'command', 'commandAlias', 'isolationBackend', 'sessionId', 'executionUuid', 'containerFilesystemStartBytes', 'containerFilesystemLastBytes', 'containerFilesystemLastObservedAt', 'tool', 'infoBlock', 'urlContext', 'requesterUserId', 'showLimits', 'locale', 'logPath', 'args'];
 
 /**
  * Resolve the directory durable bot state is written to. Honors
@@ -213,7 +216,9 @@ export function createSessionStore(options = {}) {
         delete sessions[sessionName];
         writeSnapshotMap(sessions);
       }
-      appendEvent('complete', sessionName, { status: meta.status ?? null, exitCode: meta.exitCode ?? null });
+      // Issue #2154: carry the reason (when the caller knows it) so the durable
+      // event log says why a session ended, not just that it did.
+      appendEvent('complete', sessionName, { status: meta.status ?? null, exitCode: meta.exitCode ?? null, reason: meta.reason ?? null });
       log('debug', `Removed session ${sessionName} from snapshot`, meta);
     },
 

package/src/telegram-command-execution.lib.mjs

@@ -2,7 +2,7 @@ import { spawn } from 'child_process';
 import { describeChildExit } from './child-exit.lib.mjs';
 import { promisify } from 'util';
 import { exec as execCallback } from 'child_process';
-import { t } from './i18n.lib.mjs';
+import { formatFailedLaunchMessage as defaultFormatFailedLaunchMessage } from './work-session-formatting.lib.mjs';
 
 const exec = promisify(execCallback);
 
@@ -101,7 +101,7 @@ function executeWithCommand(startScreenCmd, command, args, verbose = false) {
  * @returns {Function} executeAndUpdateMessage(ctx, startingMessage, commandName, args, infoBlock, perCommandIsolation, tool, urlContext, sessionExtras)
  */
 export function buildExecuteAndUpdateMessage(deps) {
-  const { resolveIsolation, ISOLATION_BACKEND, isolationRunner, VERBOSE, executeStartScreen, trackSession, untrackSession, AUTO_WATCH_MESSAGE, startAutoTerminalWatchForSession, bot, formatExecutingWorkSessionMessage, formatStartingWorkSessionMessage } = deps;
+  const { resolveIsolation, ISOLATION_BACKEND, isolationRunner, VERBOSE, executeStartScreen, trackSession, untrackSession, AUTO_WATCH_MESSAGE, startAutoTerminalWatchForSession, bot, formatExecutingWorkSessionMessage, formatStartingWorkSessionMessage, formatFailedLaunchMessage = defaultFormatFailedLaunchMessage } = deps;
   return async function executeAndUpdateMessage(ctx, startingMessage, commandName, args, infoBlock, perCommandIsolation = null, tool = 'claude', urlContext = null, { showLimits = false, limitsAtStart = null, locale = null, commandAlias = null } = {}) {
     const { chat, message_id: msgId } = startingMessage;
     const safeEdit = async text => {
@@ -130,14 +130,27 @@ export function buildExecuteAndUpdateMessage(deps) {
       trackSession(session, sessionInfo, VERBOSE);
       await safeEdit(formatStartingWorkSessionMessage({ sessionName: session, isolationBackend: iso.backend, infoBlock, locale }));
       result = await iso.runner.executeWithIsolation(commandName, args, { backend: iso.backend, sessionId: session, tool, verbose: VERBOSE });
-      if (result.success && sessionInfo && Number.isFinite(result.containerFilesystemStartBytes)) {
-        sessionInfo.containerFilesystemStartBytes = result.containerFilesystemStartBytes;
+      if (result.success && sessionInfo && (Number.isFinite(result.containerFilesystemStartBytes) || result.executionUuid)) {
+        if (Number.isFinite(result.containerFilesystemStartBytes)) sessionInfo.containerFilesystemStartBytes = result.containerFilesystemStartBytes;
+        // Issue #2154: `$ --list` identifies executions by start-command's own
+        // UUID, not by the session name the bot shows. Keep both on the session
+        // so the two views can be joined — in the reply, in the structured log
+        // and in the durable snapshot after a restart.
+        if (result.executionUuid) sessionInfo.executionUuid = result.executionUuid;
         trackSession(session, sessionInfo, VERBOSE);
       }
       if (!result.success) {
         // The launch never produced a live container — drop the optimistic
         // tracking so a phantom session is not monitored or resumed.
-        if (typeof untrackSession === 'function') untrackSession(session, VERBOSE);
+        // Issue #2154: the untracking used to be the *only* trace of the
+        // failure anywhere outside Telegram. Record the UUID, the backend and
+        // the reason first, so the bot log explains why a session that was
+        // announced a second ago is gone and absent from `--list`.
+        const launchError = result.error || result.output || 'unknown error';
+        console.error(`[telegram-bot] ${commandName} session ${session} was not launched (isolation=${iso.backend}, tool=${tool}): ${launchError}`);
+        // The reason also goes into the structured `session_untracked` event, so
+        // the timestamped log explains the disappearance on its own.
+        if (typeof untrackSession === 'function') untrackSession(session, VERBOSE, { reason: launchError });
         sessionInfo = undefined;
       }
     } else {
@@ -152,9 +165,15 @@ export function buildExecuteAndUpdateMessage(deps) {
     }
     if (result.warning) return safeEdit(`⚠️  ${result.warning}`);
     if (result.success) {
-      await safeEdit(formatExecutingWorkSessionMessage({ sessionName: session, isolationBackend: iso?.backend || null, infoBlock, locale }));
+      await safeEdit(formatExecutingWorkSessionMessage({ sessionName: session, executionUuid: result.executionUuid || null, isolationBackend: iso?.backend || null, infoBlock, locale }));
       if (AUTO_WATCH_MESSAGE && commandName === 'solve' && sessionInfo?.isolationBackend) await startAutoTerminalWatchForSession({ bot, ctx, sessionId: session, sessionInfo, verbose: VERBOSE });
-    } else await safeEdit(`${t('telegram.error_executing_command', { commandName }, { locale })}:\n\n\`\`\`\n${result.error || result.output}\n\`\`\`\n\n${infoBlock}`);
+    } else {
+      // Issue #2154: keep the session UUID in the failure reply. It is the only
+      // handle the operator has on the attempt, and this edit replaces the
+      // "🔄 Starting..." message that used to carry it.
+      if (!iso) console.error(`[telegram-bot] ${commandName} command failed to start (no isolation, tool=${tool}): ${result.error || result.output || 'unknown error'}`);
+      await safeEdit(formatFailedLaunchMessage({ commandName, sessionName: iso ? session : null, isolationBackend: iso?.backend || null, infoBlock, error: result.error || result.output, locale }));
+    }
   };
 }
 

package/src/telegram-solve-queue.lib.mjs

@@ -15,7 +15,7 @@ import { collectExecutingItems, formatDuration, formatQueueToolSection, formatWa
 export { QUEUE_CONFIG, THRESHOLD_STRATEGIES } from './queue-config.lib.mjs';
 import { QUEUE_CONFIG } from './queue-config.lib.mjs';
 import { reserveStartSlotForQueue } from './queue-start-reservation.lib.mjs';
-import { formatExecutingWorkSessionMessage, formatStartingWorkSessionMessage } from './work-session-formatting.lib.mjs';
+import { formatExecutingWorkSessionMessage, formatFailedLaunchMessage, formatStartingWorkSessionMessage } from './work-session-formatting.lib.mjs';
 import { t } from './i18n.lib.mjs';
 import { lt } from './limits-i18n.lib.mjs';
 export const QueueItemStatus = {
@@ -1070,9 +1070,24 @@ export class SolveQueue {
         // This was a bug where the final message update never happened because messageInfo was null
         // See: https://github.com/link-assistant/hive-mind/issues/1062
         const savedMessageInfo = item.messageInfo;
-        // Update to Started status (terminal - forgets message tracking)
-        item.setStarted(sessionName);
-        this.stats.totalCompleted++;
+        // Issue #2154: a launch that never produced a container was still marked
+        // STARTED, counted in `totalCompleted`, pushed onto `completed` and
+        // logged as `Finished: […] (started)`. Three Formal AI tasks that never
+        // ran therefore appear in the bot log as successful starts — a false
+        // positive that hid the incident and contradicted `$ --list`, which had
+        // no such sessions. A refused launch is a failure of the queue item.
+        const launchFailed = Boolean(result) && result.success === false;
+        if (launchFailed) {
+          item.setFailed(result.error || result.output || 'the launch was refused before the container started');
+          item.sessionName = sessionName;
+          item.messageInfo = null; // terminal status — stop tracking the message
+          this.stats.totalFailed++;
+          console.error(`[solve_queue] Item ${item.id} was not launched (session ${sessionName}): ${item.error}`);
+        } else {
+          // Update to Started status (terminal - forgets message tracking)
+          item.setStarted(sessionName);
+          this.stats.totalCompleted++;
+        }
         // Final message update using saved messageInfo
         if (item.ctx && result && savedMessageInfo) {
           const { chatId, messageId } = savedMessageInfo;
@@ -1089,7 +1104,17 @@ export class SolveQueue {
                 });
                 await item.ctx.telegram.editMessageText(chatId, messageId, undefined, response, { parse_mode: 'Markdown' });
               } else {
-                const response = `${t('telegram.error_executing_command', { commandName: 'solve' }, { locale: item.locale })}:\n\n\`\`\`\n${result.error || result.output}\n\`\`\`\n\n${item.infoBlock}`;
+                // Issue #2154: a queued /solve that fails to launch reports the
+                // same way as a direct one — with its session UUID and a note
+                // that nothing was started, instead of a bare error dump.
+                const response = formatFailedLaunchMessage({
+                  commandName: 'solve',
+                  sessionName: sessionName === 'unknown' ? null : sessionName,
+                  isolationBackend: result.isolationBackend || null,
+                  infoBlock: item.infoBlock,
+                  error: result.error || result.output,
+                  locale: item.locale,
+                });
                 await item.ctx.telegram.editMessageText(chatId, messageId, undefined, response, { parse_mode: 'Markdown' });
               }
             } catch (error) {

package/src/token-sanitization.lib.mjs

@@ -19,6 +19,7 @@ import { ensureUseM } from './use-m-bootstrap.lib.mjs';
 // lib.mjs, so it must not depend on this asynchronous Secretlint layer.
 import { log, isENOSPC } from './lib.mjs';
 import { CREDENTIAL_SANITIZATION_ERROR_CODE, CREDENTIAL_SANITIZATION_FAILURE_MESSAGE, createCredentialStreamSanitizer, findCredentialResiduals, maskToken, sanitizeCredentialText } from './credential-sanitization-core.lib.mjs';
+import { findDecodableRuns, findEncodedKnownTokenRuns, sanitizeEncodedCredentials } from './encoded-credential-detection.lib.mjs'; // issue #2156: credentials that only appear re-encoded
 import { reportError } from './sentry.lib.mjs';
 
 export { createCredentialStreamSanitizer };
@@ -518,6 +519,130 @@ const sanitizeCredentialTextPreservingExclusions = (input, excludedSet) => {
   return output;
 };
 
+// ---------------------------------------------------------------------------
+// Issue #2156 — known-local tokens that only appear in an encoded form
+// ---------------------------------------------------------------------------
+// The leak in this issue was a `gho_` token that the GHCR token endpoint echoed
+// back base64-encoded inside a JSON body. Every masking layer we had compared
+// bytes literally, so the encoded copy walked straight through. These helpers
+// mask the *encoded* occurrences of tokens we already hold locally.
+// ---------------------------------------------------------------------------
+
+/** Encoded-scan recursion limit: base64-of-base64-of-base64 and no deeper. */
+const MAX_ENCODED_KNOWN_TOKEN_DEPTH = 2;
+
+/**
+ * Replace every verbatim occurrence of the supplied token values.
+ *
+ * @param {string} text
+ * @param {Array<string>} values already filtered and de-duplicated
+ * @returns {string}
+ */
+const maskKnownTokenValues = (text, values) => {
+  let output = text;
+  for (const value of values) {
+    if (output.includes(value)) output = output.split(value).join(maskToken(value));
+  }
+  return output;
+};
+
+/**
+ * Narrow a raw token list to the values worth searching for.
+ *
+ * @param {Array<string|{value: string}>} tokens
+ * @param {Set<string>} [excludedSet] issue #1745 user-content carve-out
+ * @returns {Array<string>}
+ */
+const usableTokenValues = (tokens, excludedSet) => [...new Set((tokens || []).map(t => (typeof t === 'string' ? t : t?.value)).filter(value => typeof value === 'string' && value.length >= 12))].filter(value => !excludedSet?.has(value));
+
+/**
+ * Mask encoded occurrences of known-local tokens.
+ *
+ * Decoded payloads are rebuilt rather than dropped: a base64 blob that merely
+ * *contains* the token keeps its other fields and stays parseable, and the
+ * masked token retains its first/last characters for debugging — the same
+ * contract plaintext masking has always offered.
+ *
+ * @param {string} text
+ * @param {Array<string>} values from {@link usableTokenValues}
+ * @param {number} [depth] internal recursion counter
+ * @returns {string}
+ */
+const maskEncodedKnownTokens = (text, values, depth = 0) => {
+  if (values.length === 0) return text;
+  return sanitizeEncodedCredentials(text, {
+    knownTokens: values,
+    sanitizePlaintext: decoded => {
+      const masked = maskKnownTokenValues(decoded, values);
+      // Peel nested encodings so base64-of-base64 is covered too.
+      return depth >= MAX_ENCODED_KNOWN_TOKEN_DEPTH ? masked : maskEncodedKnownTokens(masked, values, depth + 1);
+    },
+  });
+};
+
+/**
+ * Mask encoded runs whose *decoded* payload Secretlint recognises.
+ *
+ * This is the redundancy the issue asks for, aimed at where it actually helps.
+ * Secretlint is blind to encoding: its GitHub rule flags a bare `gho_…` but
+ * reports nothing for the same token base64-encoded, and neither does any other
+ * pattern scanner, because a pattern scanner matches the bytes it is given.
+ * Adding a third scanner alongside the first two would therefore have changed
+ * nothing about this incident. Decoding first and *then* asking both detectors
+ * is what closes the gap, so the external rule set is applied to the decoded
+ * payload exactly as the maintained core already is.
+ *
+ * The two detectors stay independent: this runs whether or not the core found
+ * anything, so a credential format Secretlint knows and we do not is still
+ * caught once it is decoded.
+ *
+ * @param {string} text
+ * @param {Set<string>} [excludedSet] issue #1745 user-content carve-out
+ * @returns {Promise<{text: string, masked: number, ruleIds: Array<string>}>}
+ */
+const maskEncodedSecretsWithSecretlint = async (text, excludedSet) => {
+  const runs = findDecodableRuns(text);
+  if (runs.length === 0) return { text, masked: 0, ruleIds: [] };
+
+  // Each payload is scanned on its own rather than as one joined document: a
+  // rule that matched across a join boundary would blame a run that is
+  // innocent, and masking an innocent run destroys log content.
+  const verdicts = await Promise.all(runs.map(run => detectSecretsWithSecretlint(run.decoded)));
+
+  // Keyed by decoded content, because that is what the sync layer hands back
+  // when it re-walks the same runs below. Two runs that decode identically are
+  // masked identically, which is what we want.
+  const maskedPayloads = new Map();
+  const ruleIds = new Set();
+  for (const [index, findings] of verdicts.entries()) {
+    const usable = findings.filter(finding => !excludedSet?.has(finding.token));
+    if (usable.length === 0) continue;
+    const { decoded } = runs[index];
+
+    // Mask inside the decoded payload so the surrounding structure survives.
+    // Ranges are spliced from the end so earlier offsets stay valid.
+    let payload = decoded;
+    for (const finding of [...usable].sort((a, b) => b.start - a.start)) {
+      if (payload.substring(finding.start, finding.end) !== finding.token) continue;
+      payload = payload.substring(0, finding.start) + maskToken(finding.token) + payload.substring(finding.end);
+      ruleIds.add(finding.ruleId);
+    }
+    if (payload === decoded) continue;
+    maskedPayloads.set(decoded, payload);
+  }
+
+  if (maskedPayloads.size === 0) return { text, masked: 0, ruleIds: [] };
+
+  // Re-encoding, round-trip verification and overlap merging are the sync
+  // layer's job. Driving it with a lookup of payloads we have already masked
+  // means the two paths cannot disagree about what a masked run looks like.
+  const output = sanitizeEncodedCredentials(text, {
+    sanitizePlaintext: decoded => maskedPayloads.get(decoded) ?? decoded,
+  });
+
+  return { text: output, masked: maskedPayloads.size, ruleIds: [...ruleIds] };
+};
+
 /**
  * Sanitize arbitrary outbound output by masking sensitive tokens while avoiding false positives
  * Uses DUAL APPROACH: Both secretlint AND custom patterns run independently
@@ -543,6 +668,8 @@ export const sanitizeOutput = async (output, options = {}) => {
   const stats = {
     knownTokens: 0,
     secretlintDetections: 0,
+    encodedSecretlintDetections: 0,
+    encodedSecretlintRuleIds: [],
     customDetections: 0,
     secretlintOnlyWarnings: [],
     customOnlyDetections: [],
@@ -571,6 +698,17 @@ export const sanitizeOutput = async (output, options = {}) => {
           }
         }
       }
+
+      // Issue #2156: the same tokens, base64/hex/percent-encoded. Byte-for-byte
+      // comparison above cannot see those copies.
+      const encodableTokens = usableTokenValues(allKnownTokens, excludedSet);
+      const beforeEncoded = sanitized;
+      sanitized = maskEncodedKnownTokens(sanitized, encodableTokens);
+      if (sanitized !== beforeEncoded) {
+        stats.knownTokens++;
+        sanitizationStats.knownTokenMasks++;
+        sanitizationStats.totalMasked++;
+      }
     }
 
     if (skipOutputSanitization) {
@@ -663,6 +801,21 @@ export const sanitizeOutput = async (output, options = {}) => {
       }
     }
 
+    // Step 3b (issue #2156): everything above compares against the *surface*
+    // text, so a credential that only ever appears encoded is invisible to it —
+    // that is exactly how the leaked token survived. The maintained core
+    // already reads decoded payloads; run the external rule set over them too,
+    // so the two layers cover the same ground and either one can be the catch.
+    const beforeEncodedScan = sanitized;
+    const encodedScan = await maskEncodedSecretsWithSecretlint(sanitized, excludedSet);
+    if (encodedScan.text !== beforeEncodedScan) {
+      sanitized = encodedScan.text;
+      stats.encodedSecretlintDetections += encodedScan.masked;
+      stats.encodedSecretlintRuleIds = encodedScan.ruleIds;
+      sanitizationStats.patternMasks += encodedScan.masked;
+      sanitizationStats.totalMasked += encodedScan.masked;
+    }
+
     // Step 4: Handle 40-char hex tokens specially - only mask if NOT in safe context
     // These could be GitHub tokens OR git commit hashes/gist IDs
     const hexPattern = /(?:^|[\s:=])([a-f0-9]{40})(?=[\s\n]|$)/gm;
@@ -701,11 +854,14 @@ export const sanitizeOutput = async (output, options = {}) => {
     }
 
     // Summary logging
-    const totalMasked = allSecrets.size + hexReplacements.length + stats.knownTokens;
+    const totalMasked = allSecrets.size + hexReplacements.length + stats.knownTokens + stats.encodedSecretlintDetections;
     if (global.verboseMode && totalMasked > 0) {
       await log(`  🔒 Sanitized ${totalMasked} secrets using dual approach:`, { verbose: true });
       await log(`      • Known tokens: ${stats.knownTokens}`, { verbose: true });
       await log(`      • Secretlint: ${stats.secretlintDetections} detections`, { verbose: true });
+      if (stats.encodedSecretlintDetections > 0) {
+        await log(`      • Secretlint (encoded payloads): ${stats.encodedSecretlintDetections} run(s) [${stats.encodedSecretlintRuleIds.join(', ')}]`, { verbose: true });
+      }
       await log(`      • Custom patterns: ${stats.customDetections} detections`, { verbose: true });
       await log(`      • Hex tokens: ${hexReplacements.length}`, { verbose: true });
       if (stats.secretlintOnlyWarnings.length > 0) {
@@ -929,16 +1085,29 @@ export const getAllKnownLocalTokens = async () => {
  * @param {Array<{value: string, name?: string, source?: string}>} [tokens]
  *   Pre-fetched token list (if you already called getAllKnownLocalTokens).
  *   Pass an explicit list to avoid re-running `gh auth status` per check.
- * @returns {Promise<Array<{name: string, source: string}>>} list of token
- *   identifiers that were found in the text (NOT the values themselves).
+ * Issue #2156: a token that appears only base64/hex/percent-encoded is a leak
+ * just the same — GitHub's own secret scanning decodes before matching, which
+ * is exactly how the revocation in that issue was triggered. Encoded hits are
+ * reported with the encoding that matched so operators can tell the two cases
+ * apart in the fail-closed publication error path.
+ *
+ * @returns {Promise<Array<{name: string, source: string, encoding: string}>>}
+ *   list of token identifiers that were found in the text (NOT the values
+ *   themselves).
  */
 export const containsKnownToken = async (text, tokens) => {
   if (typeof text !== 'string' || text.length === 0) return [];
   const list = tokens || (await getAllKnownLocalTokens());
   const hits = [];
   for (const t of list) {
-    if (t.value && text.includes(t.value)) {
-      hits.push({ name: t.name, source: t.source });
+    if (!t.value) continue;
+    if (text.includes(t.value)) {
+      hits.push({ name: t.name, source: t.source, encoding: 'plaintext' });
+      continue;
+    }
+    const encodedRuns = findEncodedKnownTokenRuns(text, [t.value]);
+    if (encodedRuns.length > 0) {
+      hits.push({ name: t.name, source: t.source, encoding: encodedRuns[0].encoding });
     }
   }
   return hits;
@@ -979,6 +1148,14 @@ export const sanitizeCommentBody = async (body, options = {}) => {
         sanitizationStats.totalMasked++;
       }
     }
+
+    // Issue #2156: the same tokens, re-encoded (base64/hex/percent/escapes).
+    const beforeEncoded = sanitized;
+    sanitized = maskEncodedKnownTokens(sanitized, usableTokenValues(knownTokens, excludedSet));
+    if (sanitized !== beforeEncoded) {
+      sanitizationStats.knownTokenMasks++;
+      sanitizationStats.totalMasked++;
+    }
   }
 
   // Pass 2: regex + secretlint sweep for anything else.

package/src/work-session-formatting.lib.mjs

@@ -80,12 +80,58 @@ export function formatStartingWorkSessionMessage({ sessionName = null, isolation
   return `${header}\n\n📊 ${sessionLabel}: \`${sessionName}\`${isolationInfo}${details}`;
 }
 
-export function formatExecutingWorkSessionMessage({ sessionName = 'unknown', isolationBackend = null, infoBlock = '', locale = null } = {}) {
+export function formatExecutingWorkSessionMessage({ sessionName = 'unknown', executionUuid = null, isolationBackend = null, infoBlock = '', locale = null } = {}) {
   const sessionLabel = text(locale, 'telegram.session_label', 'Session');
   const isolationLabel = text(locale, 'telegram.isolation_label', 'Isolation');
   const isolationInfo = isolationBackend ? `\n🔒 ${isolationLabel}: \`${isolationBackend}\`` : '';
   const details = infoBlock ? `\n\n${infoBlock}` : '';
-  return `${text(locale, 'telegram.work_session_executing', '⏳ Executing...')}\n\n📊 ${sessionLabel}: \`${sessionName}\`${isolationInfo}${details}`;
+  // Issue #2154: `$ --list` identifies an execution by start-command's own UUID,
+  // which is *not* the session name shown above it. Printing only one of the two
+  // left the operator unable to match a running task to the session list. The
+  // line is omitted entirely when start-command reported no UUID, so a session
+  // never carries an empty label.
+  const executionLabel = text(locale, 'telegram.execution_label', 'Execution');
+  const executionInfo = executionUuid ? `\n🆔 ${executionLabel}: \`${executionUuid}\`` : '';
+  return `${text(locale, 'telegram.work_session_executing', '⏳ Executing...')}\n\n📊 ${sessionLabel}: \`${sessionName}\`${executionInfo}${isolationInfo}${details}`;
+}
+
+/**
+ * Render the reply for a work session that never started (issue #2154).
+ *
+ * The previous reply was the raw runner error in a code fence and nothing else.
+ * Two things were missing, and both were reported as separate symptoms of the
+ * same incident:
+ *
+ *   - **The session UUID.** It was generated before the launch and shown in the
+ *     "🔄 Starting..." message, but the failure reply *overwrote* that message,
+ *     so the only identifier the task ever had was destroyed by its own error
+ *     report. Nothing then connected the Telegram thread to the bot log lines,
+ *     to the session store, or to a `--log <uuid>` lookup.
+ *   - **Why the task is missing from `--list`.** A failed launch produces no
+ *     container, so the session is untracked and never appears in the listing.
+ *     Without saying so, the reply reads as if the task were running somewhere.
+ *
+ * @param {Object} params
+ * @param {string} [params.commandName] - Command the user invoked (`solve`, `hive`, …)
+ * @param {string|null} [params.sessionName] - Session UUID, when one was generated
+ * @param {string|null} [params.isolationBackend]
+ * @param {string} [params.infoBlock]
+ * @param {string} [params.error] - Runner error text
+ * @param {string|null} [params.locale]
+ * @returns {string} Markdown reply
+ *
+ * @see https://github.com/link-assistant/hive-mind/issues/2154
+ */
+export function formatFailedLaunchMessage({ commandName = 'command', sessionName = null, isolationBackend = null, infoBlock = '', error = '', locale = null } = {}) {
+  const header = text(locale, 'telegram.error_executing_command', `❌ Error executing ${commandName} command`, { commandName });
+  const sessionLabel = text(locale, 'telegram.session_label', 'Session');
+  const isolationLabel = text(locale, 'telegram.isolation_label', 'Isolation');
+  const sessionLine = sessionName ? `\n📊 ${sessionLabel}: \`${sessionName}\`` : '';
+  const isolationLine = isolationBackend ? `\n🔒 ${isolationLabel}: \`${isolationBackend}\`` : '';
+  const body = String(error ?? '').trim() || 'unknown error';
+  const notLaunched = sessionName ? `\n\n${text(locale, 'telegram.work_session_not_launched', 'The work session was not launched, so it has no log and is not listed by `--list`.')}` : '';
+  const details = infoBlock ? `\n\n${infoBlock}` : '';
+  return `${header}:${sessionLine}${isolationLine}\n\n\`\`\`\n${body}\n\`\`\`${notLaunched}${details}`;
 }
 
 /**
@@ -176,6 +222,13 @@ export function formatSessionCompletionMessage({ sessionName, sessionInfo, statu
   const sessionLabel = text(messageLocale, 'telegram.session_label', 'Session');
   const isolationLabel = text(messageLocale, 'telegram.isolation_label', 'Isolation');
   const isolationInfo = sessionInfo?.isolationBackend ? `\n🔒 ${isolationLabel}: \`${sessionInfo.isolationBackend}\`` : '';
+  // Issue #2154: the completion reply is the last word the Telegram thread has
+  // on a task, and the handle an operator uses afterwards to fetch its log. Keep
+  // start-command's execution UUID (the one `$ --list` prints) next to the
+  // session UUID, so the finished task can still be found in the session list.
+  const executionLabel = text(messageLocale, 'telegram.execution_label', 'Execution');
+  const executionUuid = sessionInfo?.executionUuid || statusResult?.uuid || null;
+  const executionInfo = executionUuid ? `\n🆔 ${executionLabel}: \`${executionUuid}\`` : '';
   const startTime = parseDateValue(statusResult?.startTime) || parseDateValue(sessionInfo?.startTime) || observedEndTime;
   const endTime = parseDateValue(statusResult?.endTime) || observedEndTime;
   const durationSeconds = Math.max(0, (endTime.getTime() - startTime.getTime()) / 1000);
@@ -188,7 +241,7 @@ export function formatSessionCompletionMessage({ sessionName, sessionInfo, statu
   const statusEmoji = statusEmojiOverride || (failed ? '❌' : '✅');
   let message = `${statusEmoji} *${statusText}*\n\n`;
   message += `⏱️ ${durationLabel}: ${formatSessionDurationSeconds(durationSeconds)}\n`;
-  message += `📊 ${sessionLabel}: \`${sessionName || 'unknown'}\`${isolationInfo}${details}`;
+  message += `📊 ${sessionLabel}: \`${sessionName || 'unknown'}\`${executionInfo}${isolationInfo}${details}`;
 
   // Issue #594: --show-limits virtual option appends snapshot/delta sections
   // (Markdown code blocks) below the standard completion details.