@qelos/aidev 1.2.0 → 1.3.0

package/dist/commands/run.js

@@ -89,6 +89,14 @@ const activeTask_1 = require("../activeTask");
 const hooks_1 = require("../hooks");
 const sessions_1 = require("../sessions");
 const accepted_1 = require("./accepted");
+const safeMode_1 = require("../safeMode");
+function applySafeMode(task, context, config) {
+    if (!config.safeMode)
+        return { task, context };
+    const secrets = (0, safeMode_1.collectSecrets)();
+    const sanitized = (0, safeMode_1.sanitizeTaskForSafeMode)(task, context, secrets);
+    return { task: { ...task, ...sanitized.task }, context: sanitized.context };
+}
 const SKIP_STATUSES = new Set(['closed', 'done', 'cancelled', 'complete', 'resolved', 'completed']);
 const NO_PRIORITY = Number.MAX_SAFE_INTEGER;
 const SLEEPING_MARKER = 'machine appears to be asleep';
@@ -570,18 +578,18 @@ async function processTask(task, filter, config, provider, runners, screenAvaila
             logger_1.logger.info(`Trigger word "${config.triggerWord}" found — re-processing task`);
         }
         if (!screenAvailable) {
-            await notifySleeping(task, provider, config.commentPrefix);
+            await notifySleeping(task, provider, config, hooks, vm);
             return 'skipped';
         }
     }
     else {
         if (!screenAvailable) {
-            await notifySleeping(task, provider, config.commentPrefix);
+            await notifySleeping(task, provider, config, hooks, vm);
             return 'skipped';
         }
         const clarification = await checkNeedsClarification(task, config, provider, runners);
         if (clarification) {
-            await provider.postComment(task.id, `${config.commentPrefix} ${clarification}`);
+            await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} ${clarification}`, config, provider, hooks, vm);
             await provider.updateStatus(task.id, getPendingStatus(config));
             logger_1.logger.info(`Posted clarification question, set status to ${getPendingStatus(config)}`);
             return 'skipped';
@@ -647,7 +655,7 @@ function hasTriggerWord(comments, triggerWord) {
         return true;
     return false;
 }
-async function notifySleeping(task, provider, commentPrefix) {
+async function notifySleeping(task, provider, config, hooks, vm) {
     try {
         const comments = await provider.getComments(task.id);
         const lastComment = comments.length > 0 ? comments[comments.length - 1] : null;
@@ -660,8 +668,8 @@ async function notifySleeping(task, provider, commentPrefix) {
         // If we can't check comments, still attempt to post
     }
     try {
-        await provider.postComment(task.id, `${commentPrefix} Cannot work on this task — the ${SLEEPING_MARKER} or the screen is locked. ` +
-            'AI agents require an active display session to operate. Please wake the machine and unlock the screen so I can continue.');
+        await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Cannot work on this task — the ${SLEEPING_MARKER} or the screen is locked. ` +
+            'AI agents require an active display session to operate. Please wake the machine and unlock the screen so I can continue.', config, provider, hooks, vm);
         logger_1.logger.info(`[${task.id}] Posted sleep notification`);
     }
     catch (err) {
@@ -761,12 +769,13 @@ async function resolveConflictsWithAI(task, config, provider, runners, context,
     logger_1.logger.warn(`Branch has conflicts with ${config.githubBaseBranch} in ${check.conflictFiles.length} file(s): ` +
         check.conflictFiles.join(', '));
     try {
-        await provider.postComment(task.id, `${config.commentPrefix} Branch \`${branchName}\` has merge conflicts with \`${config.githubBaseBranch}\` ` +
-            `in ${check.conflictFiles.length} file(s). Attempting automatic resolution...`);
+        await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Branch \`${branchName}\` has merge conflicts with \`${config.githubBaseBranch}\` ` +
+            `in ${check.conflictFiles.length} file(s). Attempting automatic resolution...`, config, provider, hooks, vm);
     }
     catch { /* ignore */ }
     if (!git.mergeBaseBranch(config.gitRemote, config.githubBaseBranch)) {
-        let prompt = buildConflictResolutionPrompt(task, check.conflictFiles, context);
+        const { task: safeTask, context: safeContext } = applySafeMode(task, context, config);
+        let prompt = buildConflictResolutionPrompt(safeTask, check.conflictFiles, safeContext);
         // beforeResolveConflicts hook
         if (vm) {
             const conflictCtx = { task, config, branchName, conflictFiles: check.conflictFiles, prompt };
@@ -811,7 +820,7 @@ async function resolveConflictsWithAI(task, config, provider, runners, context,
                 git.abortMerge();
             }
             try {
-                await provider.postComment(task.id, `${config.commentPrefix} Failed to automatically resolve merge conflicts. Manual intervention needed to rebase/merge the branch.`);
+                await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Failed to automatically resolve merge conflicts. Manual intervention needed to rebase/merge the branch.`, config, provider, hooks, vm);
             }
             catch { /* ignore */ }
             return false;
@@ -833,7 +842,7 @@ async function resolveConflictsWithAI(task, config, provider, runners, context,
             await (0, hooks_1.executeHook)(hooks, 'afterResolveConflicts', afterCtx, vm);
         }
         try {
-            await provider.postComment(task.id, `${config.commentPrefix} Merge conflicts resolved automatically.`);
+            await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Merge conflicts resolved automatically.`, config, provider, hooks, vm);
         }
         catch { /* ignore */ }
     }
@@ -887,7 +896,7 @@ async function implementTask(task, branchName, branchExists, config, provider, r
     try {
         await provider.updateStatus(task.id, 'in progress');
         const verb = branchExists ? 'Continuing' : 'Starting';
-        await provider.postComment(task.id, `${config.commentPrefix} ${verb} implementation on branch \`${branchName}\``);
+        await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} ${verb} implementation on branch \`${branchName}\``, config, provider, hooks, vm);
     }
     catch (err) {
         logger_1.logger.warn(`Could not update task status: ${err}`);
@@ -895,7 +904,7 @@ async function implementTask(task, branchName, branchExists, config, provider, r
     if (branchExists) {
         if (!git.fetchAndCheckoutBranch(config.gitRemote, branchName)) {
             logger_1.logger.error(`Failed to checkout existing branch ${branchName}`);
-            await provider.postComment(task.id, `${config.commentPrefix} Failed to checkout existing branch. Manual intervention needed.`);
+            await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Failed to checkout existing branch. Manual intervention needed.`, config, provider, hooks, vm);
             return;
         }
         logger_1.logger.info(`Continuing on existing branch: ${branchName}`);
@@ -903,7 +912,7 @@ async function implementTask(task, branchName, branchExists, config, provider, r
     else {
         if (!git.createBranchFromRemote(config.gitRemote, config.githubBaseBranch, branchName)) {
             logger_1.logger.error(`Failed to create branch ${branchName} from ${config.gitRemote}/${config.githubBaseBranch}`);
-            await provider.postComment(task.id, `${config.commentPrefix} Failed to prepare git branch. Manual intervention needed.`);
+            await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Failed to prepare git branch. Manual intervention needed.`, config, provider, hooks, vm);
             return;
         }
     }
@@ -930,10 +939,11 @@ async function implementTask(task, branchName, branchExists, config, provider, r
         logger_1.logger.info(`Found ${reviewThreads.length} unresolved review comment(s) to address`);
         context += formatReviewComments(reviewThreads);
     }
-    let implementPrompt = buildImplementPrompt(task, context);
+    const { task: safeTask, context: safeContext } = applySafeMode(task, context, config);
+    let implementPrompt = buildImplementPrompt(safeTask, safeContext);
     // beforeEachTask hook — may modify context (e.g. improve the prompt)
     if (vm) {
-        const taskCtx = { task, config, branchName, prompt: implementPrompt };
+        const taskCtx = { task: safeTask, config, branchName, prompt: implementPrompt };
         const modified = await (0, hooks_1.executeHook)(hooks, 'beforeEachTask', taskCtx, vm);
         implementPrompt = modified.prompt;
     }
@@ -968,7 +978,7 @@ async function implementTask(task, branchName, branchExists, config, provider, r
     if (!implemented) {
         logger_1.logger.error('All AI runners failed or produced no changes');
         const diagnostics = (0, diagnostics_1.collectAndLogDiagnostics)();
-        await provider.postComment(task.id, `${config.commentPrefix} All AI runners failed. Manual implementation needed.\n\n${diagnostics}`);
+        await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} All AI runners failed. Manual implementation needed.\n\n${diagnostics}`, config, provider, hooks, vm);
         if (!branchExists) {
             git.deleteBranch(branchName);
         }
@@ -992,7 +1002,7 @@ async function implementTask(task, branchName, branchExists, config, provider, r
     try {
         const prUrl = tryCreatePR(config, branchName, task);
         const comment = buildCompletionComment(branchName, prUrl, config);
-        await provider.postComment(task.id, comment);
+        await (0, hooks_1.postCommentWithHooks)(task, comment, config, provider, hooks, vm);
         await provider.updateStatus(task.id, getInReviewStatus(config));
     }
     catch (err) {
@@ -1209,7 +1219,7 @@ async function implementThinkingTask(task, branchName, branchExists, config, pro
     try {
         await provider.updateStatus(task.id, 'in progress');
         const verb = branchExists ? 'Continuing' : 'Starting';
-        await provider.postComment(task.id, `${config.commentPrefix} ${verb} implementation on branch \`${branchName}\` (thinking mode — will analyze and break into sub-tasks)`);
+        await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} ${verb} implementation on branch \`${branchName}\` (thinking mode — will analyze and break into sub-tasks)`, config, provider, hooks, vm);
     }
     catch (err) {
         logger_1.logger.warn(`Could not update task status: ${err}`);
@@ -1217,7 +1227,7 @@ async function implementThinkingTask(task, branchName, branchExists, config, pro
     if (branchExists) {
         if (!git.fetchAndCheckoutBranch(config.gitRemote, branchName)) {
             logger_1.logger.error(`Failed to checkout existing branch ${branchName}`);
-            await provider.postComment(task.id, `${config.commentPrefix} Failed to checkout existing branch. Manual intervention needed.`);
+            await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Failed to checkout existing branch. Manual intervention needed.`, config, provider, hooks, vm);
             return;
         }
         logger_1.logger.info(`Continuing on existing branch: ${branchName}`);
@@ -1225,7 +1235,7 @@ async function implementThinkingTask(task, branchName, branchExists, config, pro
     else {
         if (!git.createBranchFromRemote(config.gitRemote, config.githubBaseBranch, branchName)) {
             logger_1.logger.error(`Failed to create branch ${branchName} from ${config.gitRemote}/${config.githubBaseBranch}`);
-            await provider.postComment(task.id, `${config.commentPrefix} Failed to prepare git branch. Manual intervention needed.`);
+            await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Failed to prepare git branch. Manual intervention needed.`, config, provider, hooks, vm);
             return;
         }
     }
@@ -1254,16 +1264,17 @@ async function implementThinkingTask(task, branchName, branchExists, config, pro
         logger_1.logger.info(`Found ${reviewThreads.length} unresolved review comment(s) to address`);
         context += reviewContext;
     }
+    const { task: safeTask, context: safeContext } = applySafeMode(task, context, config);
     // Check for an existing plan (resume scenario)
     let plan = readTaskPlan(task.id);
     if (plan) {
         logger_1.logger.info(`Found existing task plan with ${plan.subtasks.length} sub-tasks — resuming`);
     }
     else {
-        plan = await analyzeAndPlan(task, context, runners);
+        plan = await analyzeAndPlan(safeTask, safeContext, runners);
         if (!plan) {
             logger_1.logger.error('Failed to create implementation plan');
-            await provider.postComment(task.id, `${config.commentPrefix} Failed to analyze and break down the task. Manual implementation needed.`);
+            await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Failed to analyze and break down the task. Manual implementation needed.`, config, provider, hooks, vm);
             cleanupThinkingFiles(task.id);
             if (!branchExists)
                 git.deleteBranch(branchName);
@@ -1271,7 +1282,7 @@ async function implementThinkingTask(task, branchName, branchExists, config, pro
         }
         logger_1.logger.info(`Task broken into ${plan.subtasks.length} sub-tasks`);
         try {
-            await provider.postComment(task.id, `${config.commentPrefix} Task analyzed and broken into ${plan.subtasks.length} sub-tasks:\n\n${formatSubtaskList(plan)}`);
+            await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Task analyzed and broken into ${plan.subtasks.length} sub-tasks:\n\n${formatSubtaskList(plan)}`, config, provider, hooks, vm);
         }
         catch (err) {
             logger_1.logger.warn(`Failed to post breakdown comment: ${err}`);
@@ -1280,7 +1291,7 @@ async function implementThinkingTask(task, branchName, branchExists, config, pro
     // beforeThinkingTask hook — may adjust subtask titles/descriptions before execution
     if (vm) {
         const thinkCtx = {
-            task,
+            task: safeTask,
             config,
             branchName,
             subtasks: plan.subtasks.map((s) => ({
@@ -1328,7 +1339,7 @@ async function implementThinkingTask(task, branchName, branchExists, config, pro
                     const newIds = newSubtasks.map((s) => s.id).join(', ');
                     logger_1.logger.info(`  Step ${failedId} was split into ${newIds}`);
                     try {
-                        await provider.postComment(task.id, `${config.commentPrefix} Step ${failedId} was split into ${newIds}:\n\n${formatSubtaskList(plan)}`);
+                        await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Step ${failedId} was split into ${newIds}:\n\n${formatSubtaskList(plan)}`, config, provider, hooks, vm);
                     }
                     catch { /* ignore */ }
                     i--; // re-process this index — it now points at the first new sub-task
@@ -1336,14 +1347,14 @@ async function implementThinkingTask(task, branchName, branchExists, config, pro
                 }
                 logger_1.logger.warn(`  Could not split failed step ${failedId} — falling back to plain retry`);
                 try {
-                    await provider.postComment(task.id, `${config.commentPrefix} Failed to automatically split step ${failedId}. Retrying as-is.`);
+                    await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Failed to automatically split step ${failedId}. Retrying as-is.`, config, provider, hooks, vm);
                 }
                 catch { /* ignore */ }
             }
             else if (!isGitFailure && attempts >= 2 && depth >= 2) {
                 logger_1.logger.warn(`  Step ${subtask.id} has reached the split-depth cap — manual intervention may be needed`);
                 try {
-                    await provider.postComment(task.id, `${config.commentPrefix} Step ${subtask.id} has already been split twice and is still failing. Retrying as-is — please consider manual intervention.`);
+                    await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Step ${subtask.id} has already been split twice and is still failing. Retrying as-is — please consider manual intervention.`, config, provider, hooks, vm);
                 }
                 catch { /* ignore */ }
             }
@@ -1353,7 +1364,7 @@ async function implementThinkingTask(task, branchName, branchExists, config, pro
         subtask.attempts = (subtask.attempts ?? 0) + 1;
         writeTaskPlan(plan);
         logger_1.logger.info(`  Starting step ${subtask.id}: ${subtask.title} (attempt ${subtask.attempts})`);
-        const success = await executeSubTask(subtask, task, plan, config, runners, reviewContext, previousError, ticketConversationContext.trim().length > 0);
+        const success = await executeSubTask(subtask, safeTask, plan, config, runners, reviewContext, previousError, ticketConversationContext.trim().length > 0);
         if (!success) {
             const diagnostics = (0, diagnostics_1.collectAndLogDiagnostics)();
             subtask.status = 'failed';
@@ -1362,7 +1373,7 @@ async function implementThinkingTask(task, branchName, branchExists, config, pro
             allSucceeded = false;
             logger_1.logger.error(`  Step ${subtask.id} failed: ${subtask.title}`);
             try {
-                await provider.postComment(task.id, `${config.commentPrefix} Step ${subtask.id} failed: ${subtask.title}\n\n${formatSubtaskList(plan)}\n\n${diagnostics}`);
+                await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Step ${subtask.id} failed: ${subtask.title}\n\n${formatSubtaskList(plan)}\n\n${diagnostics}`, config, provider, hooks, vm);
             }
             catch { /* ignore */ }
             break;
@@ -1387,7 +1398,7 @@ async function implementThinkingTask(task, branchName, branchExists, config, pro
         writeTaskPlan(plan);
         logger_1.logger.success(`  Step ${subtask.id} complete: ${subtask.title}`);
         try {
-            await provider.postComment(task.id, `${config.commentPrefix} Step ${subtask.id} complete: ${subtask.title}\n\n${formatSubtaskList(plan)}`);
+            await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Step ${subtask.id} complete: ${subtask.title}\n\n${formatSubtaskList(plan)}`, config, provider, hooks, vm);
         }
         catch { /* ignore */ }
     }
@@ -1395,7 +1406,7 @@ async function implementThinkingTask(task, branchName, branchExists, config, pro
         logger_1.logger.error('Thinking task did not complete all sub-tasks');
         try {
             const diagnostics = (0, diagnostics_1.collectAndLogDiagnostics)();
-            await provider.postComment(task.id, `${config.commentPrefix} Thinking task did not complete all sub-tasks. Manual intervention needed.\n\n${diagnostics}`);
+            await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Thinking task did not complete all sub-tasks. Manual intervention needed.\n\n${diagnostics}`, config, provider, hooks, vm);
         }
         catch { /* ignore */ }
         return;
@@ -1407,7 +1418,7 @@ async function implementThinkingTask(task, branchName, branchExists, config, pro
     try {
         const prUrl = tryCreatePR(config, branchName, task);
         const comment = buildCompletionComment(branchName, prUrl, config);
-        await provider.postComment(task.id, comment);
+        await (0, hooks_1.postCommentWithHooks)(task, comment, config, provider, hooks, vm);
         await provider.updateStatus(task.id, getInReviewStatus(config));
         if (config.thinkingTag && provider.removeTag) {
             try {
@@ -1430,11 +1441,11 @@ async function implementThinkingTask(task, branchName, branchExists, config, pro
     }
     logger_1.logger.success(`Thinking task implemented: branch ${branchName} pushed`);
 }
-async function implementPlanningTask(task, config, provider, runners, _hooks = {}, _vm) {
+async function implementPlanningTask(task, config, provider, runners, hooks = {}, vm) {
     logger_1.logger.info(`Implementing planning task: ${task.name}`);
     try {
         await provider.updateStatus(task.id, 'in progress');
-        await provider.postComment(task.id, `${config.commentPrefix} Starting planning mode — analyzing task and drafting sub-tickets`);
+        await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Starting planning mode — analyzing task and drafting sub-tickets`, config, provider, hooks, vm);
     }
     catch (err) {
         logger_1.logger.warn(`Could not update task status: ${err}`);
@@ -1447,7 +1458,8 @@ async function implementPlanningTask(task, config, provider, runners, _hooks = {
     catch {
         // ignore
     }
-    const prompt = buildPlanningAnalysisPrompt(task, context);
+    const { task: safeTask, context: safeContext } = applySafeMode(task, context, config);
+    const prompt = buildPlanningAnalysisPrompt(safeTask, safeContext);
     let parsed = null;
     let previousNotes = '';
     for (const runner of runners) {
@@ -1469,14 +1481,14 @@ async function implementPlanningTask(task, config, provider, runners, _hooks = {
     if (!parsed) {
         logger_1.logger.error('Planning produced no sub-tasks');
         try {
-            await provider.postComment(task.id, `${config.commentPrefix} Planning produced no sub-tasks`);
+            await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Planning produced no sub-tasks`, config, provider, hooks, vm);
         }
         catch { /* ignore */ }
         return;
     }
     if (parsed.clarification) {
         try {
-            await provider.postComment(task.id, `${config.commentPrefix} ${parsed.clarification}`);
+            await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} ${parsed.clarification}`, config, provider, hooks, vm);
             await provider.updateStatus(task.id, getPendingStatus(config));
             logger_1.logger.info(`Posted planning clarification, set status to ${getPendingStatus(config)}`);
         }
@@ -1488,7 +1500,7 @@ async function implementPlanningTask(task, config, provider, runners, _hooks = {
     if (parsed.subtasks.length === 0) {
         logger_1.logger.error('Planning produced no sub-tasks');
         try {
-            await provider.postComment(task.id, `${config.commentPrefix} Planning produced no sub-tasks`);
+            await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Planning produced no sub-tasks`, config, provider, hooks, vm);
         }
         catch { /* ignore */ }
         return;
@@ -1533,7 +1545,7 @@ async function implementPlanningTask(task, config, provider, runners, _hooks = {
         }
     }
     try {
-        await provider.postComment(task.id, summaryLines.join('\n'));
+        await (0, hooks_1.postCommentWithHooks)(task, summaryLines.join('\n'), config, provider, hooks, vm);
     }
     catch (err) {
         logger_1.logger.warn(`Failed to post planning summary: ${err instanceof Error ? err.message : err}`);
@@ -1711,18 +1723,18 @@ async function processNonCodeTask(task, filter, config, provider, runners, scree
                 : 'Human follow-up comment found — processing non-code task');
         }
         if (!screenAvailable) {
-            await notifySleeping(task, provider, config.commentPrefix);
+            await notifySleeping(task, provider, config, hooks, vm);
             return 'skipped';
         }
     }
     else {
         if (!screenAvailable) {
-            await notifySleeping(task, provider, config.commentPrefix);
+            await notifySleeping(task, provider, config, hooks, vm);
             return 'skipped';
         }
         const clarification = await checkNeedsClarification(task, config, provider, runners);
         if (clarification) {
-            await provider.postComment(task.id, `${config.commentPrefix} ${clarification}`);
+            await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} ${clarification}`, config, provider, hooks, vm);
             await provider.updateStatus(task.id, getPendingStatus(config));
             logger_1.logger.info(`Posted clarification question, set status to ${getPendingStatus(config)}`);
             return 'skipped';
@@ -1749,7 +1761,7 @@ async function implementNonCodeTask(task, config, provider, runners, hooks = {},
     logger_1.logger.info(`Implementing non-code task: ${task.name}`);
     try {
         await provider.updateStatus(task.id, 'in progress');
-        await provider.postComment(task.id, `${config.commentPrefix} Starting non-code task execution`);
+        await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Starting non-code task execution`, config, provider, hooks, vm);
     }
     catch (err) {
         logger_1.logger.warn(`Could not update task status: ${err}`);
@@ -1762,10 +1774,11 @@ async function implementNonCodeTask(task, config, provider, runners, hooks = {},
     catch {
         // ignore
     }
-    let nonCodePrompt = buildNonCodePrompt(task, context);
+    const { task: safeTask, context: safeContext } = applySafeMode(task, context, config);
+    let nonCodePrompt = buildNonCodePrompt(safeTask, safeContext);
     // beforeNonCodeTask hook
     if (vm) {
-        const ncCtx = { task, config, prompt: nonCodePrompt };
+        const ncCtx = { task: safeTask, config, prompt: nonCodePrompt };
         const modified = await (0, hooks_1.executeHook)(hooks, 'beforeNonCodeTask', ncCtx, vm);
         nonCodePrompt = modified.prompt;
     }
@@ -1790,12 +1803,12 @@ async function implementNonCodeTask(task, config, provider, runners, hooks = {},
     if (!implemented) {
         logger_1.logger.error('All AI runners failed');
         const diagnostics = (0, diagnostics_1.collectAndLogDiagnostics)();
-        await provider.postComment(task.id, `${config.commentPrefix} All AI runners failed. Manual intervention needed.\n\n${diagnostics}`);
+        await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} All AI runners failed. Manual intervention needed.\n\n${diagnostics}`, config, provider, hooks, vm);
         return;
     }
     try {
         const comment = buildNonCodeCompletionComment(config, agentOutput);
-        await provider.postComment(task.id, comment);
+        await (0, hooks_1.postCommentWithHooks)(task, comment, config, provider, hooks, vm);
         await provider.updateStatus(task.id, getInReviewStatus(config));
     }
     catch (err) {
@@ -1804,7 +1817,7 @@ async function implementNonCodeTask(task, config, provider, runners, hooks = {},
     // afterNonCodeTask hook
     if (vm) {
         const afterCtx = {
-            task, config, prompt: nonCodePrompt, success: true, output: agentOutput,
+            task: safeTask, config, prompt: nonCodePrompt, success: true, output: agentOutput,
         };
         await (0, hooks_1.executeHook)(hooks, 'afterNonCodeTask', afterCtx, vm);
     }
@@ -1920,7 +1933,7 @@ async function implementNonCodeThinkingTask(task, config, provider, runners, hoo
     logger_1.logger.info(`Implementing non-code thinking task: ${task.name}`);
     try {
         await provider.updateStatus(task.id, 'in progress');
-        await provider.postComment(task.id, `${config.commentPrefix} Starting non-code task execution (thinking mode — will analyze and break into sub-tasks)`);
+        await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Starting non-code task execution (thinking mode — will analyze and break into sub-tasks)`, config, provider, hooks, vm);
     }
     catch (err) {
         logger_1.logger.warn(`Could not update task status: ${err}`);
@@ -1933,15 +1946,16 @@ async function implementNonCodeThinkingTask(task, config, provider, runners, hoo
     catch {
         // ignore
     }
-    const plan = await analyzeAndPlanNonCode(task, context, runners);
+    const { task: safeTask, context: safeContext } = applySafeMode(task, context, config);
+    const plan = await analyzeAndPlanNonCode(safeTask, safeContext, runners);
     if (!plan) {
         logger_1.logger.error('Failed to create non-code task plan');
-        await provider.postComment(task.id, `${config.commentPrefix} Failed to analyze and break down the non-code task. Manual intervention needed.`);
+        await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Failed to analyze and break down the non-code task. Manual intervention needed.`, config, provider, hooks, vm);
         return;
     }
     logger_1.logger.info(`Non-code task broken into ${plan.subtasks.length} sub-tasks`);
     try {
-        await provider.postComment(task.id, `${config.commentPrefix} Task analyzed and broken into ${plan.subtasks.length} sub-tasks:\n\n${formatSubtaskList(plan)}`);
+        await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Task analyzed and broken into ${plan.subtasks.length} sub-tasks:\n\n${formatSubtaskList(plan)}`, config, provider, hooks, vm);
     }
     catch (err) {
         logger_1.logger.warn(`Failed to post non-code breakdown comment: ${err}`);
@@ -1950,7 +1964,7 @@ async function implementNonCodeThinkingTask(task, config, provider, runners, hoo
     // branchName is empty because non-code tasks don't create a branch.
     if (vm) {
         const thinkCtx = {
-            task,
+            task: safeTask,
             config,
             branchName: '',
             subtasks: plan.subtasks.map((s) => ({
@@ -2009,7 +2023,7 @@ async function implementNonCodeThinkingTask(task, config, provider, runners, hoo
             allSucceeded = false;
             logger_1.logger.error(`  Non-code step ${formatSubtaskId(subtask.id)} failed: ${subtask.title}`);
             try {
-                await provider.postComment(task.id, `${config.commentPrefix} Step ${formatSubtaskId(subtask.id)} failed: ${subtask.title}\n\n${formatSubtaskList(plan)}`);
+                await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Step ${formatSubtaskId(subtask.id)} failed: ${subtask.title}\n\n${formatSubtaskList(plan)}`, config, provider, hooks, vm);
             }
             catch { /* ignore */ }
             break;
@@ -2017,7 +2031,7 @@ async function implementNonCodeThinkingTask(task, config, provider, runners, hoo
         // Post the sub-task summary BEFORE marking it done — per the task spec, the
         // comment is posted, then the sub-task is announced as complete.
         try {
-            await provider.postComment(task.id, `${config.commentPrefix} Step ${formatSubtaskId(subtask.id)}: ${subtask.title}\n\n---\n\n${summary}`);
+            await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Step ${formatSubtaskId(subtask.id)}: ${subtask.title}\n\n---\n\n${summary}`, config, provider, hooks, vm);
         }
         catch (err) {
             logger_1.logger.warn(`Failed to post summary for step ${formatSubtaskId(subtask.id)}: ${err}`);
@@ -2026,20 +2040,20 @@ async function implementNonCodeThinkingTask(task, config, provider, runners, hoo
         subtask.status = 'done';
         logger_1.logger.success(`  Non-code step ${formatSubtaskId(subtask.id)} complete: ${subtask.title}`);
         try {
-            await provider.postComment(task.id, `${config.commentPrefix} Step ${formatSubtaskId(subtask.id)} complete: ${subtask.title}\n\n${formatSubtaskList(plan)}`);
+            await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Step ${formatSubtaskId(subtask.id)} complete: ${subtask.title}\n\n${formatSubtaskList(plan)}`, config, provider, hooks, vm);
         }
         catch { /* ignore */ }
     }
     if (!allSucceeded) {
         logger_1.logger.error('Non-code thinking task did not complete all sub-tasks');
         try {
-            await provider.postComment(task.id, `${config.commentPrefix} Non-code thinking task did not complete all sub-tasks. Manual intervention needed.`);
+            await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Non-code thinking task did not complete all sub-tasks. Manual intervention needed.`, config, provider, hooks, vm);
         }
         catch { /* ignore */ }
         return;
     }
     try {
-        await provider.postComment(task.id, buildNonCodeThinkingCompletionComment(config));
+        await (0, hooks_1.postCommentWithHooks)(task, buildNonCodeThinkingCompletionComment(config), config, provider, hooks, vm);
         await provider.updateStatus(task.id, getInReviewStatus(config));
         if (config.thinkingTag && provider.removeTag) {
             try {
@@ -2109,7 +2123,7 @@ async function processReviewTask(task, config, provider, runners, screenAvailabl
         return 'skipped';
     }
     if (!screenAvailable) {
-        await notifySleeping(task, provider, config.commentPrefix);
+        await notifySleeping(task, provider, config, hooks, vm);
         return 'skipped';
     }
     logger_1.logger.info(`[${task.id}] Found ${actionableThreads.length} actionable review thread(s) — resolving`);
@@ -2122,7 +2136,8 @@ async function implementReviewTask(task, branchName, config, provider, runners,
         logger_1.logger.error(`[${task.id}] Failed to checkout branch ${branchName}`);
         return;
     }
-    let reviewPrompt = buildReviewPrompt(task, threads);
+    const { task: safeTask } = applySafeMode(task, '', config);
+    let reviewPrompt = buildReviewPrompt(safeTask, threads);
     // beforeReviewTask hook
     if (vm) {
         const reviewCtx = { task, config, branchName, threads, prompt: reviewPrompt };
@@ -2149,7 +2164,7 @@ async function implementReviewTask(task, branchName, config, provider, runners,
         logger_1.logger.error(`[${task.id}] All AI runners failed to address review comments`);
         const diagnostics = (0, diagnostics_1.collectAndLogDiagnostics)();
         try {
-            await provider.postComment(task.id, `${config.commentPrefix} Failed to address code review comments automatically.\n\n${diagnostics}`);
+            await (0, hooks_1.postCommentWithHooks)(task, `${config.commentPrefix} Failed to address code review comments automatically.\n\n${diagnostics}`, config, provider, hooks, vm);
         }
         catch { /* ignore */ }
         // afterReviewTask hook — failure
@@ -2195,7 +2210,7 @@ async function implementReviewTask(task, branchName, config, provider, runners,
     if (resolvedCount > 0 || repliedCount > 0) {
         try {
             const comment = buildReviewCompletionComment(config, resolvedCount, repliedCount);
-            await provider.postComment(task.id, comment);
+            await (0, hooks_1.postCommentWithHooks)(task, comment, config, provider, hooks, vm);
         }
         catch { /* ignore */ }
     }