@link-assistant/hive-mind 2.15.2 → 2.17.0

package/src/development-log.lib.mjs

@@ -2,6 +2,8 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { sanitizeForPublication } from './token-sanitization.lib.mjs';
+import { findResidualCredentialBlock } from './log-sanitize-stream.lib.mjs';
+import { sanitizeLogFileToFileBounded } from './log-sanitize-worker.lib.mjs';
 
 const sanitizePathSegment = (value, fallback) => {
   const raw = value === null || value === undefined || value === '' ? fallback : String(value);
@@ -94,13 +96,25 @@ const writePrivatePublicationFile = async (destinationPath, content) => {
   await fs.chmod(destinationPath, 0o600);
 };
 
+// Issue #2189: `sanitizeLogFileToFileBounded` creates its destination exclusively
+// (`wx`) so a pre-planted symlink cannot be followed. Collection may run more
+// than once for the same session directory, so drop a previous artifact first —
+// unlink-then-O_EXCL keeps the symlink guarantee that a plain truncate loses.
+const sanitizeIntoPublicationFile = async ({ sourcePath, destinationPath, startByte = 0, endByte = null }) => {
+  await fs.rm(destinationPath, { force: true });
+  return sanitizeLogFileToFileBounded({ sourcePath, destPath: destinationPath, startByte, endByte });
+};
+
 const copyIfExists = async ({ sourcePath, destinationPath }) => {
   if (!(await fileExists(sourcePath))) return false;
   // Raw local audit sources remain available to the operator but must not be
   // group/world-readable. Only the sanitized copy enters the repository.
   await fs.chmod(sourcePath, 0o600);
-  const content = await fs.readFile(sourcePath, 'utf8');
-  await writePrivatePublicationFile(destinationPath, content);
+  // Issue #2189: transcripts are as large as the run that produced them (the
+  // captured incident had a 134 MB one). Sanitize source → destination block by
+  // block instead of holding the file, its sanitized twin and the sanitizer's
+  // own working copy in the heap at once.
+  await sanitizeIntoPublicationFile({ sourcePath, destinationPath });
   return true;
 };
 
@@ -140,8 +154,7 @@ const copyLogSlice = async ({ logFile, destinationPath, logStartByte = 0 }) => {
     await writePrivatePublicationFile(destinationPath, '');
     return { logStartByte: start, logEndByte: stat.size };
   }
-  const bytes = await fs.readFile(logFile);
-  await writePrivatePublicationFile(destinationPath, bytes.subarray(start, stat.size).toString('utf8'));
+  await sanitizeIntoPublicationFile({ sourcePath: logFile, destinationPath, startByte: start, endByte: stat.size });
   return { logStartByte: start, logEndByte: stat.size };
 };
 
@@ -279,9 +292,11 @@ const verifyDevelopmentLogDirectory = async directoryPath => {
     if (!entry.isFile()) continue;
     const parentPath = entry.parentPath || entry.path;
     const filePath = path.join(parentPath, entry.name);
-    const exactBytes = await fs.readFile(filePath, 'utf8');
-    const rescanned = await sanitizeForPublication(exactBytes);
-    if (rescanned !== exactBytes) {
+    // Issue #2189: rescan block by block. Reading each artifact back whole made
+    // the verification cost as much heap as the artifact — on top of the copy
+    // that had just been written.
+    const residual = await findResidualCredentialBlock(filePath);
+    if (residual) {
       throw new Error('Development-log publication rescan found residual credential material.');
     }
     await fs.chmod(filePath, 0o600);

package/src/disk-guard.lib.mjs

@@ -27,6 +27,8 @@ import path from 'node:path';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 
+import { DEFAULT_AGENT_SNAPSHOT_MIN_IDLE_MS, getAgentDataHome, reclaimAgentSnapshotStores } from './agent-snapshot-store.lib.mjs';
+
 const execFileAsync = promisify(execFile);
 
 /**
@@ -224,8 +226,12 @@ export const reclaimSolverWorkspaces = async ({ requiredMB = 0, tmpRoot = DEFAUL
  *
  * An unreadable `df` never blocks work: the guard is an optimisation over solve's own pre-flight
  * check, not a replacement for it.
+ *
+ * Issue #2186 added a second source of reclaimable space: orphaned
+ * `@link-assistant/agent` snapshot stores in the home directory, which no `/tmp`-scoped check
+ * could see. Pass `agentDataHome: null` to opt out.
  */
-export const ensureDiskSpaceForWorker = async ({ requiredMB = 10240, tmpRoot = DEFAULT_TMP_ROOT, protectedPaths = new Set(), minIdleMs = DEFAULT_MIN_IDLE_MS, maxWaitMs = 0, pollIntervalMs = 30000, log = async () => {}, now = Date.now, sleep = defaultSleep, getFreeMB = getFreeDiskSpaceMB, fileSystem = fsPromises, procRoot = '/proc', remove = defaultRemove } = {}) => {
+export const ensureDiskSpaceForWorker = async ({ requiredMB = 10240, tmpRoot = DEFAULT_TMP_ROOT, protectedPaths = new Set(), minIdleMs = DEFAULT_MIN_IDLE_MS, maxWaitMs = 0, pollIntervalMs = 30000, log = async () => {}, now = Date.now, sleep = defaultSleep, getFreeMB = getFreeDiskSpaceMB, fileSystem = fsPromises, procRoot = '/proc', remove = defaultRemove, agentDataHome = getAgentDataHome(), agentSnapshotMinIdleMs = DEFAULT_AGENT_SNAPSHOT_MIN_IDLE_MS } = {}) => {
   const startedAt = now();
   const reclaimed = [];
   let freeMB = await getFreeMB(tmpRoot);
@@ -239,6 +245,20 @@ export const ensureDiskSpaceForWorker = async ({ requiredMB = 10240, tmpRoot = D
   }
   await log(`   💾 Low disk space: ${freeMB}MB free, ${requiredMB}MB required — reclaiming idle solver workspaces before starting work`, { level: 'warning' });
   for (;;) {
+    // Issue #2186: orphaned agent snapshot stores are pure garbage — their
+    // worktree is gone, so nothing can be restored from them — while a solver
+    // workspace may still be wanted for debugging. Reclaim them first, and note
+    // that they live in the home directory, which every check here used to be
+    // blind to.
+    if (agentDataHome) {
+      const agentResult = await reclaimAgentSnapshotStores({ dataHome: agentDataHome, minIdleMs: agentSnapshotMinIdleMs, stopWhenFreeMB: requiredMB, getFreeMB: () => getFreeMB(tmpRoot), now, log, fileSystem, remove });
+      reclaimed.push(...agentResult.removed);
+      if (agentResult.freeMB !== null && agentResult.freeMB !== undefined) freeMB = agentResult.freeMB;
+      if (freeMB >= requiredMB) {
+        await log(`   ✅ Disk space recovered: ${freeMB}MB free after reclaiming ${agentResult.removed.length} orphaned agent snapshot store(s)`);
+        return { ok: true, freeMB, reason: 'reclaimed', reclaimed, waitedMs: now() - startedAt };
+      }
+    }
     const result = await reclaimSolverWorkspaces({ requiredMB, tmpRoot, protectedPaths, minIdleMs, now, log, fileSystem, procRoot, getFreeMB, remove });
     reclaimed.push(...result.removed);
     if (result.freeMB !== null && result.freeMB !== undefined) freeMB = result.freeMB;

package/src/formal-ai-version.lib.mjs

@@ -29,13 +29,17 @@ export const FORMAL_AI_MEMORY_CONTRACT_MINIMUM_VERSION = '0.336.0';
  * PR #2147 this is the *initial* pin only: once the container is running,
  * `src/formal-ai-updater.lib.mjs` replaces it with the newest published image
  * while no Formal AI task holds a lease. 0.339.0 restored `cargo install
- * formal-ai --locked` on stock Rust images (formal-ai#988) and 0.339.1 routes
- * command execution through the published command-stream component; the
- * memory-contract sources (`src/cli_memory.rs`, `src/server.rs`,
- * `src/shared_memory.rs`) are byte-identical to 0.337.0 and
- * `src/memory/upgrade.rs` only adds an explicit advisory-lock release.
+ * formal-ai --locked` on stock Rust images (formal-ai#988) and 0.339.1 routed
+ * command execution through the published command-stream component. 0.345.0 is
+ * the current release and is a safe bootstrap for the same reason 0.339.1 was:
+ * its Cargo.lock still carries no `openssl-sys`, so the builder stage keeps
+ * building on a stock `rust:slim` image, and the four memory-contract sources
+ * (`src/cli_memory.rs`, `src/server.rs`, `src/shared_memory.rs`,
+ * `src/memory/upgrade.rs`) are byte-identical to 0.339.1 — 0.340.0-0.345.0 only
+ * change reasoning data, benchmarks and unrelated handlers. Verified by
+ * diffing the published crates; see docs/case-studies/issue-2186.
  */
-export const FORMAL_AI_BOOTSTRAP_VERSION = '0.339.1';
+export const FORMAL_AI_BOOTSTRAP_VERSION = '0.345.0';
 
 export const parseFormalAiVersion = stdout => {
   const line = String(stdout || '')

package/src/github-error-reporter.lib.mjs

@@ -9,6 +9,8 @@ import { createInterface } from 'readline';
 import { log, cleanErrorMessage, getAbsoluteLogPath } from './lib.mjs';
 import { reportError, isSentryEnabled } from './sentry.lib.mjs';
 import { sanitizeForPublication, writeSanitizedPublicationFile } from './token-sanitization.lib.mjs';
+import { sanitizeLogFileToFileBounded } from './log-sanitize-worker.lib.mjs';
+import { readLogTailText } from './log-bounded-read.lib.mjs';
 
 if (typeof globalThis.use === 'undefined') {
   await ensureUseM();
@@ -107,8 +109,87 @@ const createSecretGist = async (logContent, filename) => {
   return null;
 };
 
+/**
+ * Upload a log FILE as a secret gist without ever holding it in memory.
+ *
+ * Issue #2189: the error reporter runs when the process is already in trouble —
+ * frequently because it just exhausted its heap. Reading the log to sanitize it
+ * (`readFile` + `sanitizeForPublication` + write = three full copies) is the one
+ * thing that must not happen there.
+ *
+ * @param {string} logFilePath - Log to upload
+ * @param {string} filename - Name for the gist file
+ * @returns {Promise<string|null>} Gist URL, or null when the upload failed
+ */
+const createSecretGistFromFile = async (logFilePath, filename) => {
+  const tempFile = `/tmp/${filename}`;
+  try {
+    await sanitizeLogFileToFileBounded({ sourcePath: logFilePath, destPath: tempFile });
+    const result = await $`gh gist create ${tempFile} --secret --desc "Error log for hive-mind"`;
+    if (result.exitCode === 0) {
+      return result.stdout.toString().trim();
+    }
+  } catch (error) {
+    reportError(error, {
+      context: 'create_secret_gist',
+      operation: 'gh_gist_create',
+    });
+  } finally {
+    await fs.unlink(tempFile).catch(() => {});
+  }
+  return null;
+};
+
+/**
+ * Format a log FILE for an issue body, choosing the attachment method from the
+ * file's size before reading any of it (issue #2189).
+ *
+ * Only the inline branch — by definition below GitHub's 60 kB issue-body limit —
+ * ever reads log content, and the truncated fallback reads a bounded tail.
+ *
+ * @param {string} logFilePath - Path to the log file
+ * @returns {Promise<{method: string, content: string}>}
+ */
+export const formatLogFileForIssue = async logFilePath => {
+  const { size } = await fs.stat(logFilePath);
+
+  if (size < GITHUB_ISSUE_BODY_MAX_SIZE) {
+    const logContent = await fs.readFile(logFilePath, 'utf8');
+    return {
+      method: 'inline',
+      content: `\`\`\`\n${logContent}\n\`\`\``,
+    };
+  }
+
+  if (size < GITHUB_FILE_MAX_SIZE) {
+    return {
+      method: 'file',
+      content: `Log file is too large to include inline. Please see the attached log file.\n\nLog file path: \`${logFilePath}\``,
+    };
+  }
+
+  const gistUrl = await createSecretGistFromFile(logFilePath, `hive-mind-error-${Date.now()}.log`);
+  if (gistUrl) {
+    return {
+      method: 'gist',
+      content: `Log file is too large for inline attachment.\n\n📄 View full log: ${gistUrl}`,
+    };
+  }
+
+  const tail = await readLogTailText(logFilePath, { maxBytes: 5000 });
+  return {
+    method: 'truncated',
+    content: `Log file is too large. Showing last 5000 characters:\n\n\`\`\`\n${tail}\n\`\`\``,
+  };
+};
+
 /**
  * Format log content for issue body
+ *
+ * Prefer {@link formatLogFileForIssue} when the log is a file on disk: this
+ * variant needs the whole log as a string, which is exactly what issue #2189
+ * removed from the publication path.
+ *
  * @param {string} logContent - Log file content
  * @param {string} logFilePath - Path to log file
  * @returns {Promise<Object>} Object with formatted content and attachment method
@@ -202,8 +283,9 @@ export const createIssueForError = async options => {
 
     if (logFile) {
       try {
-        const logContent = await fs.readFile(logFile, 'utf8');
-        const { method, content } = await formatLogForIssue(logContent, logFile);
+        // Issue #2189: pick the attachment method from the file size first; a
+        // log too large for the issue body is never read into memory here.
+        const { method, content } = await formatLogFileForIssue(logFile);
 
         issueBody += `### Log File\n\n${content}\n\n`;
         await log(`📄 Log attached via: ${method}`);