@link-assistant/hive-mind 2.15.2 → 2.17.0

package/src/github.lib.mjs

@@ -10,6 +10,10 @@ import { batchCheckPullRequestsForIssues as batchCheckPRs, batchCheckArchivedRep
 import { isSafeToken, isHexInSafeContext, getGitHubTokensFromFiles, getGitHubTokensFromCommand, sanitizeOutput, sanitizeLogContent, sanitizeForPublication, writeSanitizedPublicationFile } from './token-sanitization.lib.mjs';
 export { isSafeToken, isHexInSafeContext, getGitHubTokensFromFiles, getGitHubTokensFromCommand, sanitizeOutput, sanitizeLogContent, sanitizeForPublication, writeSanitizedPublicationFile }; // Re-export for backward compatibility
 import { uploadLogWithGhUploadLog } from './log-upload.lib.mjs';
+// Issue #2189: bracket the log-upload phase with resource samples. The incident
+// log's last sample was `after_agent`, ten minutes before the heap OOM, so the
+// phase that actually died left no telemetry at all.
+import { recordResourceSnapshot, RESOURCE_PHASE_LOG_UPLOAD_START, RESOURCE_PHASE_LOG_UPLOAD_END } from './solve.resource-diagnostics.lib.mjs';
 import { formatResetTimeWithRelative } from './usage-limit.lib.mjs'; // See: https://github.com/link-assistant/hive-mind/issues/1236
 // Import model info helpers (Issue #1225)
 import { getToolDisplayName, getModelInfoForComment } from './models/index.mjs';
@@ -26,6 +30,13 @@ export { buildGitHubPullRequestUrl, buildGitHubPullRequestUrlOrNull, isGitHubUrl
 import { SOLUTION_DRAFT_LOG_MARKER, SOLUTION_DRAFT_FAILED_MARKER, SOLUTION_DRAFT_FINISHED_WITH_ERRORS_MARKER, USAGE_LIMIT_REACHED_MARKER, NOW_WORKING_SESSION_IS_ENDED_MARKER, postTrackedComment, postTrackedCommentFromFile } from './tool-comments.lib.mjs';
 export const maskGitHubToken = maskToken; // Alias for backward compatibility
 export const escapeCodeBlocksInLog = logContent => logContent.replace(/```/g, '\\`\\`\\`'); // Escape ``` in logs
+// Issue #2189: the old "too large" message always rendered megabytes, so a 200 KB
+// log that still could not be inlined was reported as "0MB". Report the unit that
+// actually carries information.
+export const formatLogSizeForHumans = bytes => {
+  const size = Number(bytes) || 0;
+  return size >= 1024 * 1024 ? `${Math.round(size / 1024 / 1024)}MB` : `${Math.round(size / 1024)}KB`;
+};
 const buildIssueFailureActionSection = targetType => {
   if (targetType !== 'issue') return '';
   return `
@@ -317,6 +328,150 @@ const getLogUploadTerminalStatus = ({ errorMessage, errorDuringExecution, isUsag
   if (isUsageLimit) return { emoji: '📎', label: 'Usage-limit execution log' };
   return { emoji: '✅', label: 'Solution draft log' };
 };
+/**
+ * Build the inline `--attach-logs` comment body — the variant that embeds the
+ * whole transcript inside a `<details>` block.
+ *
+ * Issue #2189: extracted from attachLogToGitHub so that it is only ever called
+ * for a log small enough to inline. Previously the body was assembled
+ * unconditionally — including reading, sanitizing and escaping the log — and
+ * then discarded when the size check downstream routed the log to gh-upload-log
+ * anyway. On a 134 MB transcript that discarded pre-work alone exhausted V8's
+ * old space and killed the run.
+ *
+ * @param {object} params - Everything the four comment shapes interpolate
+ * @param {string} params.logContent - Already sanitized and markdown-escaped log
+ * @param {number} params.logSizeBytes - Size of the log on disk, for the summary line
+ * @returns {string} Markdown comment body
+ */
+function buildInlineLogComment({ logContent, logSizeBytes, targetType, customTitle, sessionType, sessionId, errorMessage, errorDuringExecution, isUsageLimit, limitResetTime, toolName, resumeCommand, isAutoResumeEnabled, autoResumeMode, modelInfoString, budgetStats, totalCostUSD, anthropicTotalCostUSD, pricingInfo, failureAction }) {
+  let logComment;
+  // Usage limit comments should be shown whenever isUsageLimit is true, regardless of whether a generic errorMessage is provided.
+  if (isUsageLimit) {
+    // Usage limit error format - separate from general failures
+    logComment = `## ⏳ ${USAGE_LIMIT_REACHED_MARKER}
+
+The automated solution draft was interrupted because the ${toolName} usage limit was reached.
+
+### 📊 Limit Information
+- **Tool**: ${toolName}
+- **Limit Type**: Usage limit exceeded`;
+    if (limitResetTime) {
+      // Format reset time with relative time and UTC for better user understanding Shows "in 14m (Feb 6, 3:00 PM UTC)" instead of just "4:00 PM" See: https://github.com/link-assistant/hive-mind/issues/1236
+      const formattedResetTime = formatResetTimeWithRelative(limitResetTime, global.limitTimezone || null) || limitResetTime;
+      logComment += `\n- **Reset Time**: ${formattedResetTime}`;
+    }
+    if (sessionId) {
+      logComment += `\n- **Session ID**: ${sessionId}`;
+    }
+    logComment += '\n\n### 🔄 How to Continue\n';
+    // If auto-resume/auto-restart is enabled, show automatic continuation message instead of CLI commands See: https://github.com/link-assistant/hive-mind/issues/1152
+    if (isAutoResumeEnabled) {
+      const modeName = autoResumeMode === 'restart' ? 'restart' : 'resume';
+      const modeDescription = autoResumeMode === 'restart' ? 'The session will automatically restart (fresh start) when the limit resets.' : 'The session will automatically resume (with context preserved) when the limit resets.';
+      logComment += `**Auto-${modeName} is enabled.** ${modeDescription}`;
+    } else {
+      // Manual resume mode - show CLI commands
+      if (limitResetTime) {
+        logComment += `Once the limit resets at **${limitResetTime}**, `;
+      } else {
+        logComment += 'Once the limit resets, ';
+      }
+      if (resumeCommand) {
+        logComment += `you can resume this session by running:
+\`\`\`bash
+${resumeCommand}
+\`\`\``;
+      } else if (sessionId) {
+        logComment += `you can resume this session using session ID: \`${sessionId}\``;
+      } else {
+        logComment += 'you can retry the operation.';
+      }
+    }
+    const footerNote = isAutoResumeEnabled ? (autoResumeMode === 'restart' ? '*This session was interrupted due to usage limits. The session will automatically restart when the limit resets.*' : '*This session was interrupted due to usage limits. The session will automatically resume when the limit resets.*') : '*This session was interrupted due to usage limits. You can resume once the limit resets.*';
+    logComment += `${modelInfoString}
+
+<details>
+<summary>Click to expand execution log (${Math.round(logSizeBytes / 1024)}KB)</summary>
+
+\`\`\`
+${logContent}
+\`\`\`
+
+</details>
+
+---
+${footerNote}`;
+  } else if (errorMessage) {
+    // Failure log format (non-usage-limit errors)
+    logComment = `## 🚨 ${SOLUTION_DRAFT_FAILED_MARKER}
+The automated solution draft encountered an error:
+\`\`\`
+${errorMessage}
+\`\`\`${failureAction}${modelInfoString}
+
+<details>
+<summary>Click to expand failure log (${Math.round(logSizeBytes / 1024)}KB)</summary>
+
+\`\`\`
+${logContent}
+\`\`\`
+
+</details>
+
+---
+*${NOW_WORKING_SESSION_IS_ENDED_MARKER}, feel free to review and add any feedback on the solution draft.*`;
+  } else if (errorDuringExecution) {
+    // Issue #1088: "Finished with errors" format - work may have been completed but errors occurred
+    const costInfo = buildCostInfoString(totalCostUSD, anthropicTotalCostUSD, pricingInfo, { includeTokenUsage: !budgetStats });
+    logComment = `## ⚠️ ${SOLUTION_DRAFT_FINISHED_WITH_ERRORS_MARKER}
+This log file contains the complete execution trace of the AI ${targetType === 'pr' ? 'solution draft' : 'analysis'} process.${costInfo}${budgetStats}${modelInfoString}
+
+> **Note**: The session encountered errors during execution, but some work may have been completed. Please review the changes carefully.
+
+<details>
+<summary>Click to expand solution draft log (${Math.round(logSizeBytes / 1024)}KB)</summary>
+
+\`\`\`
+${logContent}
+\`\`\`
+
+</details>
+
+---
+*${NOW_WORKING_SESSION_IS_ENDED_MARKER}, feel free to review and add any feedback on the solution draft.*`;
+  } else {
+    const costInfo = buildCostInfoString(totalCostUSD, anthropicTotalCostUSD, pricingInfo, { includeTokenUsage: !budgetStats });
+    // Determine title based on session type (Issue #1152) Issue #1625: Every title variant embeds SOLUTION_DRAFT_LOG_MARKER so the filter in checkForAiCreatedComments matches every variant with a single substring check against the centralized marker constant.
+    let title = customTitle;
+    let sessionNote = '';
+    if (sessionType === 'auto-resume') {
+      title = `🔄 ${SOLUTION_DRAFT_LOG_MARKER} (auto resume on limit reset)`;
+      sessionNote = '\n\n**Note**: This session was automatically resumed after a usage limit reset, with the previous context preserved.';
+    } else if (sessionType === 'auto-restart') {
+      title = `🔄 ${SOLUTION_DRAFT_LOG_MARKER} (auto restart on limit reset)`;
+      sessionNote = '\n\n**Note**: This session was automatically restarted after a usage limit reset (fresh start).';
+    } else if (sessionType === 'resume') {
+      title = `🔄 ${SOLUTION_DRAFT_LOG_MARKER} (Resumed)`;
+      sessionNote = '\n\n**Note**: This session was manually resumed using the --resume flag.';
+    }
+    logComment = `## ${title}
+This log file contains the complete execution trace of the AI ${targetType === 'pr' ? 'solution draft' : 'analysis'} process.${costInfo}${budgetStats}${modelInfoString}${sessionNote}
+
+<details>
+<summary>Click to expand solution draft log (${Math.round(logSizeBytes / 1024)}KB)</summary>
+
+\`\`\`
+${logContent}
+\`\`\`
+
+</details>
+
+---
+*${NOW_WORKING_SESSION_IS_ENDED_MARKER}, feel free to review and add any feedback on the solution draft.*`;
+  }
+  return logComment;
+}
 /** Attaches a log file to a GitHub PR or issue as a comment. Returns true if upload succeeded. */
 export async function attachLogToGitHub(options) {
   const fs = (await use('fs')).promises;
@@ -351,9 +506,11 @@ export async function attachLogToGitHub(options) {
     resultModelUsage = null, // Issue #1454
     budgetStatsData = null, // Issue #1491: budget stats for comment
     failureActionSection = null,
+    recordResources = recordResourceSnapshot, // Issue #2189: injectable for tests
   } = options;
   const budgetStats = budgetStatsData ? buildBudgetStatsString(budgetStatsData.tokenUsage, budgetStatsData.subAgentCalls) : '';
   const targetName = targetType === 'pr' ? 'Pull Request' : 'Issue';
+  let uploadPhaseEntered = false;
   try {
     // Issue #1212: Check disk space before attempting log upload (100MB minimum)
     try {
@@ -372,6 +529,12 @@ export async function attachLogToGitHub(options) {
       await log('  ⚠️  Log file is empty, skipping upload');
       return false;
     }
+    // Issue #2189: sample resources on the way in and on the way out of the
+    // upload, tagged with the log size, so a future post-mortem can see the V8
+    // heap climbing against its own limit instead of guessing from a machine
+    // that still had 10 GB of RAM free.
+    uploadPhaseEntered = true;
+    await recordResources({ phase: RESOURCE_PHASE_LOG_UPLOAD_START, log, label: `log upload start, ${formatLogSizeForHumans(logStats.size)} log` });
     // Issue #1173: gh-upload-log handles large files; skip inline comment for files > fileMaxSize
     const useLargeFileMode = logStats.size > githubLimits.fileMaxSize;
     if (useLargeFileMode && verbose) {
@@ -436,148 +599,37 @@ export async function attachLogToGitHub(options) {
         }
       }
     }
-    // Read and sanitize log content
-    const rawLogContent = await fs.readFile(logFile, 'utf8');
-    if (verbose) {
-      await log('  🔍 Sanitizing log content to mask GitHub tokens...', { verbose: true });
-    }
-    let logContent = await sanitizeForPublication(rawLogContent);
-    // Escape code blocks in the log content to prevent them from breaking markdown formatting
-    if (verbose) {
-      await log('  🔧 Escaping code blocks in log content for safe embedding...', { verbose: true });
-    }
-    logContent = escapeCodeBlocksInLog(logContent);
     const failureAction = normalizeFailureActionSection(failureActionSection ?? buildIssueFailureActionSection(targetType));
-    // Create formatted comment
-    let logComment;
-    // Usage limit comments should be shown whenever isUsageLimit is true, regardless of whether a generic errorMessage is provided.
-    if (isUsageLimit) {
-      // Usage limit error format - separate from general failures
-      logComment = `## ⏳ ${USAGE_LIMIT_REACHED_MARKER}
-
-The automated solution draft was interrupted because the ${toolName} usage limit was reached.
-
-### 📊 Limit Information
-- **Tool**: ${toolName}
-- **Limit Type**: Usage limit exceeded`;
-      if (limitResetTime) {
-        // Format reset time with relative time and UTC for better user understanding Shows "in 14m (Feb 6, 3:00 PM UTC)" instead of just "4:00 PM" See: https://github.com/link-assistant/hive-mind/issues/1236
-        const formattedResetTime = formatResetTimeWithRelative(limitResetTime, global.limitTimezone || null) || limitResetTime;
-        logComment += `\n- **Reset Time**: ${formattedResetTime}`;
-      }
-      if (sessionId) {
-        logComment += `\n- **Session ID**: ${sessionId}`;
+    // Issue #2189: choose the publication route from the file size BEFORE touching
+    // the bytes. The old order read the log, sanitized it and escaped it — three
+    // full-size strings — and only then discovered the comment was far over
+    // GitHub's limit and had to be uploaded instead. On a 134 MB transcript that
+    // wasted pre-work alone exhausted V8's ~2 GB old space and killed the run
+    // ("FATAL ERROR: Reached heap limit"). A log that cannot possibly fit in a
+    // comment is now never read into memory at all: it streams straight to
+    // gh-upload-log, which sanitizes it block by block.
+    const canBuildInlineComment = !useLargeFileMode && logStats.size <= githubLimits.commentMaxSize;
+    let logComment = '';
+    if (canBuildInlineComment) {
+      // Read and sanitize log content
+      const rawLogContent = await fs.readFile(logFile, 'utf8');
+      if (verbose) {
+        await log('  🔍 Sanitizing log content to mask GitHub tokens...', { verbose: true });
       }
-      logComment += '\n\n### 🔄 How to Continue\n';
-      // If auto-resume/auto-restart is enabled, show automatic continuation message instead of CLI commands See: https://github.com/link-assistant/hive-mind/issues/1152
-      if (isAutoResumeEnabled) {
-        const modeName = autoResumeMode === 'restart' ? 'restart' : 'resume';
-        const modeDescription = autoResumeMode === 'restart' ? 'The session will automatically restart (fresh start) when the limit resets.' : 'The session will automatically resume (with context preserved) when the limit resets.';
-        logComment += `**Auto-${modeName} is enabled.** ${modeDescription}`;
-      } else {
-        // Manual resume mode - show CLI commands
-        if (limitResetTime) {
-          logComment += `Once the limit resets at **${limitResetTime}**, `;
-        } else {
-          logComment += 'Once the limit resets, ';
-        }
-        if (resumeCommand) {
-          logComment += `you can resume this session by running:
-\`\`\`bash
-${resumeCommand}
-\`\`\``;
-        } else if (sessionId) {
-          logComment += `you can resume this session using session ID: \`${sessionId}\``;
-        } else {
-          logComment += 'you can retry the operation.';
-        }
+      let logContent = await sanitizeForPublication(rawLogContent);
+      // Escape code blocks in the log content to prevent them from breaking markdown formatting
+      if (verbose) {
+        await log('  🔧 Escaping code blocks in log content for safe embedding...', { verbose: true });
       }
-      const footerNote = isAutoResumeEnabled ? (autoResumeMode === 'restart' ? '*This session was interrupted due to usage limits. The session will automatically restart when the limit resets.*' : '*This session was interrupted due to usage limits. The session will automatically resume when the limit resets.*') : '*This session was interrupted due to usage limits. You can resume once the limit resets.*';
-      logComment += `${modelInfoString}
-
-<details>
-<summary>Click to expand execution log (${Math.round(logStats.size / 1024)}KB)</summary>
-
-\`\`\`
-${logContent}
-\`\`\`
-
-</details>
-
----
-${footerNote}`;
-    } else if (errorMessage) {
-      // Failure log format (non-usage-limit errors)
-      logComment = `## 🚨 ${SOLUTION_DRAFT_FAILED_MARKER}
-The automated solution draft encountered an error:
-\`\`\`
-${errorMessage}
-\`\`\`${failureAction}${modelInfoString}
-
-<details>
-<summary>Click to expand failure log (${Math.round(logStats.size / 1024)}KB)</summary>
-
-\`\`\`
-${logContent}
-\`\`\`
-
-</details>
-
----
-*${NOW_WORKING_SESSION_IS_ENDED_MARKER}, feel free to review and add any feedback on the solution draft.*`;
-    } else if (errorDuringExecution) {
-      // Issue #1088: "Finished with errors" format - work may have been completed but errors occurred
-      const costInfo = buildCostInfoString(totalCostUSD, anthropicTotalCostUSD, pricingInfo, { includeTokenUsage: !budgetStats });
-      logComment = `## ⚠️ ${SOLUTION_DRAFT_FINISHED_WITH_ERRORS_MARKER}
-This log file contains the complete execution trace of the AI ${targetType === 'pr' ? 'solution draft' : 'analysis'} process.${costInfo}${budgetStats}${modelInfoString}
-
-> **Note**: The session encountered errors during execution, but some work may have been completed. Please review the changes carefully.
-
-<details>
-<summary>Click to expand solution draft log (${Math.round(logStats.size / 1024)}KB)</summary>
-
-\`\`\`
-${logContent}
-\`\`\`
-
-</details>
-
----
-*${NOW_WORKING_SESSION_IS_ENDED_MARKER}, feel free to review and add any feedback on the solution draft.*`;
-    } else {
-      const costInfo = buildCostInfoString(totalCostUSD, anthropicTotalCostUSD, pricingInfo, { includeTokenUsage: !budgetStats });
-      // Determine title based on session type (Issue #1152) Issue #1625: Every title variant embeds SOLUTION_DRAFT_LOG_MARKER so the filter in checkForAiCreatedComments matches every variant with a single substring check against the centralized marker constant.
-      let title = customTitle;
-      let sessionNote = '';
-      if (sessionType === 'auto-resume') {
-        title = `🔄 ${SOLUTION_DRAFT_LOG_MARKER} (auto resume on limit reset)`;
-        sessionNote = '\n\n**Note**: This session was automatically resumed after a usage limit reset, with the previous context preserved.';
-      } else if (sessionType === 'auto-restart') {
-        title = `🔄 ${SOLUTION_DRAFT_LOG_MARKER} (auto restart on limit reset)`;
-        sessionNote = '\n\n**Note**: This session was automatically restarted after a usage limit reset (fresh start).';
-      } else if (sessionType === 'resume') {
-        title = `🔄 ${SOLUTION_DRAFT_LOG_MARKER} (Resumed)`;
-        sessionNote = '\n\n**Note**: This session was manually resumed using the --resume flag.';
-      }
-      logComment = `## ${title}
-This log file contains the complete execution trace of the AI ${targetType === 'pr' ? 'solution draft' : 'analysis'} process.${costInfo}${budgetStats}${modelInfoString}${sessionNote}
-
-<details>
-<summary>Click to expand solution draft log (${Math.round(logStats.size / 1024)}KB)</summary>
-
-\`\`\`
-${logContent}
-\`\`\`
-
-</details>
-
----
-*${NOW_WORKING_SESSION_IS_ENDED_MARKER}, feel free to review and add any feedback on the solution draft.*`;
+      logContent = escapeCodeBlocksInLog(logContent);
+      logComment = buildInlineLogComment({ logContent, logSizeBytes: logStats.size, targetType, customTitle, sessionType, sessionId, errorMessage, errorDuringExecution, isUsageLimit, limitResetTime, toolName, resumeCommand, isAutoResumeEnabled, autoResumeMode, modelInfoString, budgetStats, totalCostUSD, anthropicTotalCostUSD, pricingInfo, failureAction });
+    } else if (verbose) {
+      await log(`  ⏭️  Log is ${formatLogSizeForHumans(logStats.size)} — skipping inline comment construction, the log goes straight to gh-upload-log`, { verbose: true });
     }
     // Check GitHub comment size limit or large file mode Issue #1173: Also use gh-upload-log for large files, not just long comments
-    if (useLargeFileMode || logComment.length > githubLimits.commentMaxSize) {
-      if (useLargeFileMode) {
-        await log(`  📁 Log file too large for inline comment (${Math.round(logStats.size / 1024 / 1024)}MB), using gh-upload-log`);
+    if (!canBuildInlineComment || logComment.length > githubLimits.commentMaxSize) {
+      if (!canBuildInlineComment) {
+        await log(`  📁 Log file too large for inline comment (${formatLogSizeForHumans(logStats.size)}), using gh-upload-log`);
       } else {
         // Issue #2160: this is the expected route for a long log, not a problem — the upload
         // below handles it. Reporting it as a warning made every normal run look degraded.
@@ -607,23 +659,20 @@ ${logContent}
           isPublicRepo = false;
           await log('  ⚠️  Could not determine repository visibility, defaulting to private for safety');
         }
-        // Create temp log file with sanitized content (no compression, just gh-upload-log)
-        const tempLogFile = `/tmp/solution-draft-log-${targetType}-${Date.now()}.txt`;
-        // Use the original sanitized content for upload since it's a plain text file
-        await writeSanitizedPublicationFile(tempLogFile, rawLogContent);
+        // Issue #2189: hand the raw log path to the uploader and let it stream the
+        // sanitize into its own private temp file. This used to read the whole log
+        // a second time and write a sanitized copy here, after which
+        // uploadLogWithGhUploadLog read and sanitized that copy a *third* time —
+        // which is why the incident log shows "🔒 Sanitized 591 secrets" twice.
+        // There is now exactly one sanitize pass, and it never buffers the file.
         // Use gh-upload-log default auto mode and shared repository fallback.
         const uploadDescription = `Solution draft log for https://github.com/${owner}/${repo}/${targetType === 'pr' ? 'pull' : 'issues'}/${targetNumber}`;
-        let uploadResult;
-        try {
-          uploadResult = await uploadLogWithGhUploadLog({
-            logFile: tempLogFile,
-            isPublic: isPublicRepo,
-            description: uploadDescription,
-            verbose,
-          });
-        } finally {
-          await fs.unlink(tempLogFile).catch(() => {});
-        }
+        const uploadResult = await uploadLogWithGhUploadLog({
+          logFile,
+          isPublic: isPublicRepo,
+          description: uploadDescription,
+          verbose,
+        });
         if (uploadResult.success) {
           // Use rawUrl for direct file access (single chunk) or url for repository (multiple chunks) Requirements: 1 chunk = direct raw link, >1 chunks = repo link Private repository raw URLs can contain short-lived tokens, so keep private uploads on the stable repository/tree page URL.
           const logUrl = selectLogUploadUrl({ uploadResult, isPublicRepo });
@@ -789,6 +838,17 @@ ${sessionNote}
     const msg = isENOSPC(uploadError) ? 'ENOSPC: No space left on device during log upload. Free disk space and retry.' : `Error uploading log file: ${uploadError.message}`;
     await log(`  ❌ ${msg}`);
     return false;
+  } finally {
+    // Issue #2189: the closing sample must run on every exit path, including the
+    // failure ones — an upload that died half way through is exactly the case
+    // whose memory profile we need.
+    if (uploadPhaseEntered) {
+      try {
+        await recordResources({ phase: RESOURCE_PHASE_LOG_UPLOAD_END, log, label: 'log upload end' });
+      } catch {
+        /* telemetry must never change the outcome of the upload */
+      }
+    }
   }
 }
 /**

package/src/instrument.mjs

@@ -1,17 +1,6 @@
 // Lazy-load config only when needed to avoid loading use-m at module initialization
 // This prevents network fetches that can hang during --help or --version
-import { sanitizeCredentialText } from './credential-sanitization-core.lib.mjs';
-
-const sanitizeEventValue = (value, seen = new WeakSet()) => {
-  if (typeof value === 'string') return sanitizeCredentialText(value);
-  if (!value || typeof value !== 'object') return value;
-  if (seen.has(value)) return value;
-  seen.add(value);
-  for (const [key, item] of Object.entries(value)) {
-    value[key] = sanitizeEventValue(item, seen);
-  }
-  return value;
-};
+import { sanitizeSentryLog, sanitizeSentryValue } from './instrument.sanitize.lib.mjs';
 
 // Check if Sentry should be disabled
 const shouldDisableSentry = () => {
@@ -78,7 +67,9 @@ if (!shouldDisableSentry()) {
       environment: process.env.NODE_ENV || 'production',
       release: `hive-mind@${process.env.npm_package_version || version.default}`,
 
-      // Send structured logs to Sentry
+      // Send structured logs to Sentry. Stated explicitly even though Sentry
+      // 10.71 made it the default, so the setting stays a decision rather than
+      // whatever the SDK happens to default to next.
       enableLogs: true,
 
       // Tracing
@@ -98,7 +89,7 @@ if (!shouldDisableSentry()) {
 
       // Before send hook to filter out sensitive data
       beforeSend(event) {
-        sanitizeEventValue(event);
+        sanitizeSentryValue(event);
 
         // Filter out sensitive environment variables
         if (event.contexts && event.contexts.runtime && event.contexts.runtime.env) {
@@ -123,6 +114,13 @@ if (!shouldDisableSentry()) {
         return event;
       },
 
+      // Structured logs never pass through beforeSend, so they get the same
+      // masking here — otherwise a token printed by `Sentry.logger.*` would
+      // leave the process verbatim.
+      beforeSendLog(log) {
+        return sanitizeSentryLog(log);
+      },
+
       // Integration specific options
       ignoreErrors: [
         // Ignore specific errors that are expected or not relevant

package/src/instrument.sanitize.lib.mjs

@@ -0,0 +1,52 @@
+/**
+ * Credential sanitization for everything Hive Mind hands to Sentry.
+ *
+ * `src/instrument.mjs` has always masked credentials in *events* (`beforeSend`).
+ * Structured logs are a second, separate pipeline: `enableLogs` sends
+ * `Sentry.logger.*` records straight to the transport, and `beforeSend` is never
+ * called for them. Sentry 10.71 made `enableLogs` the default, so any consumer
+ * that has not opted out now ships that pipeline whether it meant to or not —
+ * which is why the same masking is applied through `beforeSendLog` here.
+ *
+ * Both hooks share one walker so a token can never be masked in one surface and
+ * printed verbatim in the other.
+ *
+ * @see https://github.com/link-assistant/hive-mind/issues/2189
+ */
+
+import { sanitizeCredentialText } from './credential-sanitization-core.lib.mjs';
+
+/**
+ * Recursively mask credentials in a Sentry payload, in place.
+ *
+ * Mutates rather than clones on purpose: Sentry hands us the object it is about
+ * to serialize, and a copy would leave the original untouched. Cycles are
+ * tracked so a self-referencing payload cannot spin forever — the same class of
+ * unbounded work this issue is about.
+ *
+ * @param {*} value - Any part of a Sentry event or log record
+ * @param {WeakSet} [seen] - Cycle guard, supplied by the recursion
+ * @returns {*} The same value with every string masked
+ */
+export const sanitizeSentryValue = (value, seen = new WeakSet()) => {
+  if (typeof value === 'string') return sanitizeCredentialText(value);
+  if (!value || typeof value !== 'object') return value;
+  if (seen.has(value)) return value;
+  seen.add(value);
+  for (const [key, item] of Object.entries(value)) {
+    value[key] = sanitizeSentryValue(item, seen);
+  }
+  return value;
+};
+
+/**
+ * `beforeSendLog` hook: mask credentials in a structured log record.
+ *
+ * Returns the record (never `null`) so sanitization only ever changes the
+ * content of a log, never whether it is delivered — dropping logs silently
+ * would recreate the blind spot described in Finding F5.
+ *
+ * @param {Object} log - The log record Sentry is about to send
+ * @returns {Object} The same record, masked
+ */
+export const sanitizeSentryLog = log => sanitizeSentryValue(log);

package/src/isolation-runner.lib.mjs

@@ -1,4 +1,3 @@
-import { ensureUseM } from './use-m-bootstrap.lib.mjs';
 /**
  * Isolation Runner for Telegram bot
  *
@@ -30,30 +29,22 @@ import { buildRouterGitConfigEntries, buildRouterTaskEnv, getRouterSuppressedCre
 import { acquireRouterForTask, attachRouterTaskContainer, registerFormalAiWithRouter, releaseRouterForTask } from './router-task-isolation.lib.mjs';
 import { buildGitConfigEnv, GIT_PUSH_GUARD_CONTAINER_DIR, GIT_PUSH_GUARD_ESCAPE_ENV, hasForcePushOptIn, installGitPushGuard } from './git-push-guard.lib.mjs';
 export { getDockerIsolationImage, resolveDockerIsolationImageTag } from './hive-mind-image.lib.mjs';
-let commandStreamDollarPromise = null;
-async function getCommandStreamDollar() {
-  if (!commandStreamDollarPromise) {
-    commandStreamDollarPromise = (async () => {
-      if (typeof globalThis.use === 'undefined') {
-        await ensureUseM();
-      }
-      const { $ } = await globalThis.use('command-stream');
-      return $;
-    })();
-  }
-  try {
-    return await commandStreamDollarPromise;
-  } catch (error) {
-    commandStreamDollarPromise = null;
-    throw error;
-  }
-}
 // Re-export the shared status predicates so existing callers that reach them via the isolation-runner module (e.g. session-monitor's `runner.isExecutingSessionStatus`) keep working. The canonical definitions live in session-status.lib.mjs so the killed/terminated/oom vocabulary stays consistent everywhere (issue #1927).
 export { isExecutingSessionStatus, isTerminalSessionStatus, isKilledSessionStatus } from './session-status.lib.mjs';
 // Issue #2175: the `$` output parsers live in their own module to keep this file
 // under the 1350-line warning threshold. Re-exported so importers are unaffected.
 import { isUnknownDockerExitCode, parseSessionExitFooter, parseSessionListOutput, parseSessionStatusOutput, parseStartCommandExecutionUuid, readSessionExitFromLog, shouldFallbackToScreenStatus } from './isolation-runner.parsers.lib.mjs';
 export { isUnknownDockerExitCode, parseSessionExitFooter, parseSessionListOutput, parseSessionStatusOutput, parseStartCommandExecutionUuid, readSessionExitFromLog, shouldFallbackToScreenStatus };
+// Issue #2189: the `$` loader and PATH lookup live in their own module so the
+// resume/attach wrappers can use them without importing this runner (a cycle).
+import { findStartCommandBinary, getCommandStreamDollar } from './start-command-cli.lib.mjs';
+export { findStartCommandBinary };
+// Issue #2189: `$ --resume` / `$ --resume-all`, added in start-command 0.33.0
+// (link-foundation/start#162). Re-exported so callers keep reaching every
+// isolation verb through this module.
+import { resumeAllIsolationSessions, resumeIsolatedSession } from './isolation-runner.resume.lib.mjs';
+export { resumeAllIsolationSessions, resumeIsolatedSession };
+export { parseExecutionResumeAllOutput, parseExecutionResumeOutput, RESUME_ALL_ACTIONS, RESUME_MODES } from './isolation-runner.resume.lib.mjs';
 // Valid isolation backends
 const VALID_ISOLATION_BACKENDS = ['screen', 'tmux', 'docker'];
 const DOCKER_CONTAINER_HOME = '/home/box';
@@ -311,20 +302,6 @@ async function runStartCommand(binPath, startCommandArgs) {
 export function generateSessionId() {
   return crypto.randomUUID();
 }
-/**
- * Find the `$` CLI binary path
- * @returns {Promise<string|null>} Path to `$` binary or null
- */
-async function findStartCommandBinary() {
-  try {
-    const $ = await getCommandStreamDollar();
-    const result = await $({ mirror: false })`which $`;
-    const path = result.stdout?.toString().trim() || '';
-    return path || null;
-  } catch {
-    return null;
-  }
-}
 /**
  * Verbose post-launch diagnostics for a native docker-isolated session.
  *
@@ -611,6 +588,21 @@ export async function stopIsolatedSession(sessionId, verbose = false) {
         console.log(`[VERBOSE] isolation-runner: $ --stop ${sessionId} stderr: ${stderr.substring(0, 300)}`);
       }
     }
+    // Issue #2189: `command-stream`'s `$` resolves — it does not throw — when the
+    // child exits non-zero, so the catch below never sees a refusal. `$ --stop`
+    // answers `Error: No execution found with UUID or session name: …` on stderr
+    // with exit code 1; without this check every such refusal was reported to the
+    // operator as a successful stop, and a session nobody stopped looked handled.
+    const code = Number.isFinite(result.code) ? result.code : 0;
+    if (code !== 0) {
+      // describeChildExit rather than an interpolated code: issue #2135 made it
+      // the single vocabulary for "how a child ended", so a `$` that was
+      // signalled reads the same way here as everywhere else. command-stream
+      // normalizes a signalled exit to 128+signum before we see it
+      // (node_modules/command-stream/src/$.process-runner-stream-kill.mjs:194),
+      // so there is no separate signal to pass.
+      return { success: false, output: stdout, error: stderr.trim() || describeChildExit({ command: '`$ --stop`', code }) };
+    }
     return { success: true, output: stdout || stderr, error: null };
   } catch (error) {
     const stderr = error?.stderr?.toString?.() || '';
@@ -679,6 +671,37 @@ export async function checkDockerContainerRunning(containerName, verbose = false
     return false;
   }
 }
+/**
+ * Check whether the Docker container backing a session still exists at all —
+ * running or stopped.
+ *
+ * Issue #2189 requirement R2: a killed session should be re-entered rather than
+ * restarted from scratch, and `$ --resume` can only do that while the container
+ * is still there. `checkDockerContainerRunning` answers a different question (a
+ * stopped container is "not running" but is exactly the one worth resuming), so
+ * the state is read instead of the running flag.
+ *
+ * @param {string} containerName - Container name (the session UUID)
+ * @param {boolean} [verbose] - Enable verbose logging
+ * @returns {Promise<boolean>} True when `docker inspect` finds the container
+ */
+export async function checkDockerContainerExists(containerName, verbose = false) {
+  if (!containerName) return false;
+  try {
+    const $ = await getCommandStreamDollar();
+    const result = await $({ mirror: false })`docker inspect -f ${'{{.State.Status}}'} ${containerName}`;
+    const code = Number.isFinite(result.code) ? result.code : 0;
+    const state = (result.stdout?.toString() || '').trim();
+    const exists = code === 0 && state !== '';
+    if (verbose) {
+      console.log(`[VERBOSE] isolation-runner: docker inspect state for '${containerName}': ${exists ? state : 'no such container'}`);
+    }
+    return exists;
+  } catch {
+    // `docker inspect` exits non-zero when no such container exists.
+    return false;
+  }
+}
 export function parseDockerContainerWritableLayerSizeOutput(output) {
   const text = String(output || '').trim();
   if (!text) return null;