start-command 0.36.0 → 0.37.1

package/src/lib/docker-command-handoff.js

@@ -0,0 +1,75 @@
+/** Copy only a command script into a stopped container, never its writable layer. */
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { shellQuote } = require('./isolation-log-utils');
+
+function commandHandoffPath(sessionName) {
+  return `/.start-command-resume-${String(sessionName).replace(/[^A-Za-z0-9_.-]/g, '_')}`;
+}
+
+function buildCommandHandoffArgs(mainArgs, markerPath) {
+  return [
+    'sh',
+    '-c',
+    'p=$1; shift; if [ -f "$p" ]; then exec sh "$p"; fi; exec "$@"',
+    'start-command-handoff',
+    markerPath,
+    ...mainArgs,
+  ];
+}
+
+function buildCommandHandoffScript(command, options = {}) {
+  const {
+    isInteractiveShellCommand,
+    isShellInvocationWithArgs,
+    buildShellWithArgsCmdArgs,
+    toShellWords,
+  } = require('./shell-utils');
+  if (
+    !options.keepAlive &&
+    (isInteractiveShellCommand(command) || isShellInvocationWithArgs(command))
+  ) {
+    const args = isShellInvocationWithArgs(command)
+      ? buildShellWithArgsCmdArgs(command)
+      : toShellWords(command);
+    return `exec ${args.map(shellQuote).join(' ')}\n`;
+  }
+  if (!options.shell || options.shell === 'auto') {
+    const effective = options.keepAlive
+      ? `${command}; exec "$__START_COMMAND_HANDOFF_SHELL"`
+      : command;
+    return `__START_COMMAND_HANDOFF_SHELL=$(command -v bash || command -v zsh || command -v sh); export __START_COMMAND_HANDOFF_SHELL\ncase "$__START_COMMAND_HANDOFF_SHELL" in */bash|bash|*/zsh|zsh) exec "$__START_COMMAND_HANDOFF_SHELL" -i -c ${shellQuote(effective)};; *) exec "$__START_COMMAND_HANDOFF_SHELL" -c ${shellQuote(effective)};; esac\n`;
+  }
+  const shell = options.shell;
+  const interactive = /(?:^|\/)(?:bash|zsh)$/.test(shell) ? ' -i' : '';
+  const effective = options.keepAlive
+    ? `${command}; exec ${shellQuote(shell)}`
+    : command;
+  return `exec ${shellQuote(shell)}${interactive} -c ${shellQuote(effective)}\n`;
+}
+
+function writeCommandHandoff(containerName, command, runner, options = {}) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'start-handoff-'));
+  const file = path.join(dir, 'command');
+  try {
+    fs.writeFileSync(file, buildCommandHandoffScript(command, options), {
+      mode: 0o644,
+    });
+    fs.chmodSync(file, 0o644);
+    return runner(require('./docker-cleanup').getDockerCommand(), [
+      'cp',
+      file,
+      `${containerName}:${commandHandoffPath(containerName)}`,
+    ]);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+module.exports = {
+  commandHandoffPath,
+  buildCommandHandoffArgs,
+  buildCommandHandoffScript,
+  writeCommandHandoff,
+};

package/src/lib/docker-labels.js

@@ -0,0 +1,33 @@
+/** Docker attribution shared by initial launches and snapshot resumes (#199). */
+function validateLabel(label) {
+  if (typeof label !== 'string' || !/^[^=\s]+=[\s\S]*$/.test(label)) {
+    throw new Error('--label requires KEY=VALUE with a nonempty key');
+  }
+  if (label.startsWith('start-command.')) {
+    throw new Error(
+      'start-command.* labels are reserved for execution attribution'
+    );
+  }
+}
+
+function dockerLabels(options = {}) {
+  const labels = [...(options.labels || [])];
+  const session = options.containerName || options.session;
+  if (session) {
+    const inferredRoot =
+      Number(options.resumeCount) > 0
+        ? session.replace(/(?:-resume-\d+)+$/, '')
+        : session;
+    labels.push(`start-command.session=${session}`);
+    labels.push(
+      `start-command.root-session=${options.rootSession || inferredRoot}`
+    );
+    labels.push(`start-command.resume-count=${options.resumeCount || 0}`);
+  }
+  if (options.sessionId || options.uuid) {
+    labels.push(`start-command.uuid=${options.sessionId || options.uuid}`);
+  }
+  return labels;
+}
+
+module.exports = { validateLabel, dockerLabels };

package/src/lib/docker-runtime-args.js

@@ -42,6 +42,9 @@ function buildDockerRuntimeArgs(options = {}) {
   for (const envVar of options.env || []) {
     args.push('-e', envVar);
   }
+  for (const label of require('./docker-labels').dockerLabels(options)) {
+    args.push('--label', label);
+  }
   for (const volume of options.volumes || []) {
     args.push('-v', volume);
   }
@@ -69,6 +72,9 @@ function buildDockerRuntimeArgs(options = {}) {
  */
 function buildDockerRuntimeStatusLines(options = {}) {
   const lines = [];
+  if (options.labels && options.labels.length > 0) {
+    lines.push(`[Isolation] Labels: ${options.labels.join(', ')}`);
+  }
   if (options.volumes && options.volumes.length > 0) {
     lines.push(`[Isolation] Volumes: ${options.volumes.join(', ')}`);
   }
@@ -129,6 +135,8 @@ function buildDockerRuntimeMetadata(options = {}) {
       options.volumes && options.volumes.length > 0 ? options.volumes : null,
     mounts: options.mounts && options.mounts.length > 0 ? options.mounts : null,
     env: options.env && options.env.length > 0 ? options.env : null,
+    labels: options.labels && options.labels.length > 0 ? options.labels : null,
+    commandHandoff: options.detached ? true : null,
     privileged: options.privileged || null,
     network: networks[0] || null,
     networks: networks.length > 0 ? networks : null,

package/src/lib/docker-snapshot-safety.js

@@ -0,0 +1,164 @@
+/** Serialize costly snapshot resumes and check every image-store filesystem. */
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { LockManager } = require('./store-lock');
+
+const GiB = 1024 ** 3;
+const SNAPSHOT_RESERVE_BYTES = 10 * GiB;
+const SNAPSHOT_IMAGE_LABEL = 'start-command.snapshot-image';
+
+function acquireSnapshotLock(options = {}) {
+  const lockPath =
+    options.lockPath ||
+    process.env.START_SNAPSHOT_LOCK ||
+    path.join(
+      process.platform === 'win32' ? os.tmpdir() : '/tmp',
+      'start-command-docker-snapshot.lock'
+    );
+  const lock = new LockManager(lockPath);
+  // The ordinary store lock is held only for a brief write. A snapshot can
+  // legitimately take hours, so never reclaim this lock merely for its age.
+  lock.isLockStale = (data) => {
+    if (
+      !data ||
+      data.hostname !== os.hostname() ||
+      !Number.isInteger(data.pid) ||
+      data.pid <= 0
+    ) {
+      return false;
+    }
+    try {
+      process.kill(data.pid, 0);
+      return false;
+    } catch (error) {
+      return error.code === 'ESRCH';
+    }
+  };
+  if (!lock.acquire(1000)) {
+    throw new Error(
+      'A Docker snapshot resume is in progress on this host. Retry after it finishes.'
+    );
+  }
+  return lock;
+}
+
+function containerdRoot(config = '') {
+  // Only the root-level TOML key configures containerd's storage root.
+  const topLevel = config.split(/^\s*\[/m)[0];
+  return (
+    topLevel.match(/^\s*root\s*=\s*["']([^"']+)["']/m)?.[1] ||
+    '/var/lib/containerd'
+  );
+}
+
+function defaultContainerdRoot() {
+  if (process.env.START_CONTAINERD_ROOT) {
+    return process.env.START_CONTAINERD_ROOT;
+  }
+  try {
+    return containerdRoot(
+      fs.readFileSync('/etc/containerd/config.toml', 'utf8')
+    );
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      return containerdRoot();
+    }
+    throw error;
+  }
+}
+
+function readFreeBytes(root) {
+  const stats = fs.statfsSync(root, { bigint: true });
+  return Number(stats.bavail * stats.bsize);
+}
+
+function preflightSnapshot(containerName, runner, options = {}) {
+  const docker = require('./docker-cleanup').getDockerCommand();
+  const sizeResult = runner(docker, [
+    'inspect',
+    '--size',
+    '--format',
+    '{{.SizeRw}}',
+    containerName,
+  ]);
+  const size = Number(String(sizeResult.stdout || '').trim());
+  if (
+    !sizeResult.success ||
+    !/^\d+$/.test(String(sizeResult.stdout || '').trim()) ||
+    !Number.isSafeInteger(size) ||
+    size < 0
+  ) {
+    throw new Error(
+      'Cannot determine the writable layer size; refusing Docker snapshot resume.'
+    );
+  }
+  const infoResult = runner(docker, ['info', '--format', '{{json .}}']);
+  let info;
+  try {
+    info = JSON.parse(infoResult.stdout);
+  } catch {
+    /* Refuse unknown storage. */
+  }
+  if (!infoResult.success || !info?.DockerRootDir) {
+    throw new Error(
+      'Cannot determine Docker data root; refusing Docker snapshot resume.'
+    );
+  }
+  const roots = [info.DockerRootDir];
+  if (
+    JSON.stringify(info.DriverStatus || []).includes(
+      'io.containerd.snapshotter'
+    )
+  ) {
+    roots.push(options.containerdRoot || defaultContainerdRoot());
+  }
+  const required = 2 * size + (options.reserveBytes ?? SNAPSHOT_RESERVE_BYTES);
+  const free = options.freeBytes || readFreeBytes;
+  for (const root of [...new Set(roots)]) {
+    let available;
+    try {
+      available = free(root);
+    } catch (error) {
+      throw new Error(
+        `Cannot check free disk at ${root}: ${error.message}; refusing Docker snapshot resume.`,
+        { cause: error }
+      );
+    }
+    if (!Number.isFinite(available) || available < required) {
+      throw new Error(
+        `Insufficient disk at ${root}: need ${(required / GiB).toFixed(2)} GiB (2 × writable layer plus reserve), available ${(available / GiB).toFixed(2)} GiB. Docker snapshot resume refused.`
+      );
+    }
+  }
+  return {
+    size,
+    required,
+    roots,
+    message: `[Resume] snapshotting ${(size / GiB).toFixed(2)} GiB; disk preflight passed (${(required / GiB).toFixed(2)} GiB required).`,
+  };
+}
+
+function snapshotImageCleanupSnippet(
+  containerName,
+  redirection = '>/dev/null 2>&1'
+) {
+  const { shellQuote } = require('./isolation-log-utils');
+  const name = shellQuote(containerName);
+  const format = shellQuote(
+    `{{index .Config.Labels "${SNAPSHOT_IMAGE_LABEL}"}}`
+  );
+  return {
+    capture: `__start_snapshot_image=$(docker inspect -f ${format} ${name} 2>/dev/null || true)`,
+    remove: `case "$__start_snapshot_image" in start-command-resume/*) docker rmi "$__start_snapshot_image" ${redirection} || true;; esac`,
+  };
+}
+
+module.exports = {
+  acquireSnapshotLock,
+  containerdRoot,
+  preflightSnapshot,
+  SNAPSHOT_RESERVE_BYTES,
+  SNAPSHOT_IMAGE_LABEL,
+  snapshotImageCleanupSnippet,
+};

package/src/lib/execution-recovery.js

@@ -357,7 +357,14 @@ function recoverKilledExecution(params = {}) {
   if (opts.recoveryCommand) {
     let copied;
     try {
-      copied = writeRecoveryMarker(containerName, attempt, runner);
+      copied = opts.commandHandoff
+        ? require('./docker-command-handoff').writeCommandHandoff(
+            containerName,
+            `export ${RECOVERY_ATTEMPT_ENV}=${attempt}; ${opts.recoveryCommand}`,
+            runner,
+            opts
+          )
+        : writeRecoveryMarker(containerName, attempt, runner);
     } catch (err) {
       copied = { success: false, error: err.message };
     }

package/src/lib/execution-resume.js

@@ -7,13 +7,13 @@
  * addressing one logical session across restarts.
  *
  * Three strategies, chosen from the probed session state:
- * - DOCKER_START:    the container still exists and the stored command is
- *                    re-run by `docker start` (its original entrypoint).
- * - DOCKER_SNAPSHOT: the container still exists but a new command was given,
- *                    so its filesystem is committed to an image and a derived
- *                    container runs the new command. This avoids
- *                    `docker start -ai`, which would re-run the original
- *                    entrypoint from scratch.
+ * - DOCKER_START:    the container still exists. Newly managed containers
+ *                    accept replacement commands through a small handoff
+ *                    script, then restart in place without a snapshot.
+ * - DOCKER_SNAPSHOT: a legacy container needs a replacement command, or
+ *                    immutable labels need changing. After disk preflight,
+ *                    its filesystem is committed under a host-wide lock and
+ *                    a derived container runs the command.
  * - RELAUNCH:        nothing is left of the session, so the command is
  *                    launched again through the stored isolation options.
  */
@@ -44,6 +44,16 @@ const {
 } = require('./launch-persistence');
 const { SessionState, probeSession } = require('./session-probe');
 const { getDockerNetworks } = require('./docker-network-lifecycle');
+const {
+  writeCommandHandoff,
+  buildCommandHandoffArgs,
+  commandHandoffPath,
+} = require('./docker-command-handoff');
+const {
+  acquireSnapshotLock,
+  preflightSnapshot,
+  SNAPSHOT_IMAGE_LABEL,
+} = require('./docker-snapshot-safety');
 const {
   ResumeAllAction,
   resumeAllExecutions,
@@ -94,6 +104,11 @@ function buildLaunchOptions(record) {
   const opts = record.options || {};
   return {
     ...opts,
+    labels: opts.labels || [],
+    sessionId: record.uuid,
+    rootSession:
+      opts.rootSession || opts.sessionNameHistory?.[0] || opts.sessionName,
+    resumeCount: (Number(opts.resumeCount) || 0) + 1,
     image: opts.image || null,
     session: opts.sessionName,
     detached: true,
@@ -214,12 +229,13 @@ function buildResumePlan(
   const attempt = (Number(opts.resumeCount) || 0) + 1;
 
   if (backend === 'docker' && probe.state === SessionState.STOPPED) {
-    if (!newCommand) {
+    if (!opts.forceSnapshot && (!newCommand || opts.commandHandoff)) {
       return {
         mode: ResumeMode.DOCKER_START,
         backend,
         sessionName,
         command,
+        ...(newCommand ? { handoffCommand: command } : {}),
         attempt,
         steps: [
           {
@@ -228,7 +244,9 @@ function buildResumePlan(
             description: `Start stopped container ${sessionName}`,
           },
         ],
-        message: `Resumed detached docker container: ${sessionName}`,
+        message: newCommand
+          ? `Resumed new command in the same detached docker container: ${sessionName} (no filesystem snapshot)`
+          : `Resumed detached docker container: ${sessionName}`,
       };
     }
 
@@ -261,12 +279,24 @@ function buildResumePlan(
           containerArgs: [
             '--name',
             newSessionName,
+            '--label',
+            `${SNAPSHOT_IMAGE_LABEL}=${snapshotImage}`,
             ...(opts.user ? ['--user', opts.user] : []),
-            ...buildDockerRuntimeArgs({ ...opts, resourceLimits }),
+            ...buildDockerRuntimeArgs({
+              ...opts,
+              resourceLimits,
+              session: newSessionName,
+              containerName: newSessionName,
+              sessionId: record.uuid,
+              rootSession:
+                opts.rootSession || opts.sessionNameHistory?.[0] || sessionName,
+              resumeCount: attempt,
+            }),
             snapshotImage,
-            'sh',
-            '-c',
-            command,
+            ...buildCommandHandoffArgs(
+              ['sh', '-c', command],
+              commandHandoffPath(newSessionName)
+            ),
           ],
           extraNetworks: getDockerNetworks(opts).slice(1),
           newSessionName,
@@ -360,6 +390,10 @@ function applyResumeToRecord(
   archiveAttempt(record);
   record.attempt = attempt;
   const options = { ...(record.options || {}) };
+  options.rootSession =
+    options.rootSession ||
+    options.sessionNameHistory?.[0] ||
+    options.sessionName;
   options.resumeCount = plan.attempt;
   options.resumedAt = attempt.startedAt;
   // A resume is a new deliberate start: launch-time recovery applies again.
@@ -378,6 +412,12 @@ function applyResumeToRecord(
   }
   if (plan.snapshotImage) {
     options.image = plan.snapshotImage;
+    options.snapshotImage = plan.snapshotImage;
+    // Every new detached container, including a snapshot successor, supports handoff.
+    options.commandHandoff = true;
+  }
+  if (plan.mode === ResumeMode.RELAUNCH && plan.backend === 'docker') {
+    options.commandHandoff = true;
   }
   if (containerId) {
     options.containerId = containerId;
@@ -445,12 +485,34 @@ async function resumeExecution(store, identifier, deps = {}) {
   } catch (error) {
     return { success: false, error: error.message };
   }
-  const planningRecord = resources
-    ? {
-        ...record,
-        options: { ...opts, resourceLimits: resources.resourceLimits },
-      }
-    : record;
+  const requestedLabels = deps.resourceOptions?.labels || [];
+  const labels = [...(opts.labels || [])];
+  for (const label of requestedLabels) {
+    const key = label.split('=')[0];
+    const existing = labels.findIndex((value) => value.split('=')[0] === key);
+    if (existing >= 0) {
+      labels[existing] = label;
+    } else {
+      labels.push(label);
+    }
+  }
+  if (requestedLabels.length && opts.isolated !== 'docker') {
+    return {
+      success: false,
+      error: 'Docker labels require a Docker execution when resuming.',
+    };
+  }
+  const labelsChanged =
+    JSON.stringify(labels) !== JSON.stringify(opts.labels || []);
+  const planningRecord = {
+    ...record,
+    options: {
+      ...opts,
+      ...(resources ? { resourceLimits: resources.resourceLimits } : {}),
+      ...(requestedLabels.length ? { labels } : {}),
+      ...(labelsChanged ? { forceSnapshot: true } : {}),
+    },
+  };
   const plan = buildResumePlan(
     planningRecord,
     deps.command || null,
@@ -485,6 +547,9 @@ async function resumeExecution(store, identifier, deps = {}) {
   };
   appendLifecycle(lifecycleRecord, 'resume-started');
   const updated = applyResumeToRecord(record, plan, null, attempt);
+  if (requestedLabels.length) {
+    updated.options.labels = labels;
+  }
   if (resources) {
     updated.options.resolvedLimits = resources.resolvedLimits;
     updated.options.resourceLimitSpecs = resources.resourceLimitSpecs;
@@ -540,26 +605,108 @@ async function resumeExecution(store, identifier, deps = {}) {
     }
     containerId = launchResult.containerId || null;
   } else {
-    for (const step of plan.steps) {
-      let result;
-      try {
-        result = runner(step.command, step.args);
-      } catch (error) {
-        result = { success: false, error: error.message };
+    let snapshotLock;
+    let snapshotCreated = false;
+    let derivedCreated = false;
+    try {
+      if (plan.mode === ResumeMode.DOCKER_SNAPSHOT) {
+        snapshotLock = acquireSnapshotLock(deps.snapshotOptions);
+        const preflight = preflightSnapshot(
+          plan.sessionName,
+          runner,
+          deps.snapshotOptions
+        );
+        plan.message += `\n${preflight.message}`;
+        if (record.logPath) {
+          appendLogFile(record.logPath, `${preflight.message}\n`);
+        }
       }
-      if (!result.success) {
-        rollbackLaunch(store, previous);
-        const detail =
-          (result.stderr || '').trim() ||
-          result.error ||
-          `exit code ${result.status}`;
-        appendLifecycle(lifecycleRecord, 'launch-failed', { error: detail });
-        return {
-          success: false,
-          error: `Failed to resume ${plan.backend} session "${plan.sessionName}": ${detail}`,
-        };
+      if (plan.handoffCommand) {
+        const copied = writeCommandHandoff(
+          plan.sessionName,
+          plan.handoffCommand,
+          runner,
+          opts
+        );
+        if (!copied.success) {
+          throw new Error(
+            (copied.stderr || '').trim() ||
+              copied.error ||
+              'Could not copy replacement command into the stopped container'
+          );
+        }
       }
-      containerId = (result.stdout || '').trim() || containerId;
+      for (const step of plan.steps) {
+        let result;
+        try {
+          result = runner(step.command, step.args);
+        } catch (error) {
+          result = { success: false, error: error.message };
+        }
+        if (!result.success) {
+          const detail =
+            (result.stderr || '').trim() ||
+            result.error ||
+            `exit code ${result.status}`;
+          throw new Error(detail);
+        }
+        if (step.args[0] === 'commit') {
+          snapshotCreated = true;
+        }
+        if (step.args[0] === 'create') {
+          derivedCreated = true;
+        }
+        // commit returns an image ID; cp/update/network commands are not IDs.
+        if (['run', 'create'].includes(step.args[0])) {
+          containerId = (result.stdout || '').trim() || containerId;
+        }
+      }
+      if (plan.mode === ResumeMode.DOCKER_SNAPSHOT && deps.removeOriginal) {
+        const running = runner(getDockerCommand(), [
+          'inspect',
+          '-f',
+          '{{.State.Running}}',
+          plan.newSessionName,
+        ]);
+        if (running.success && String(running.stdout).trim() === 'true') {
+          const removed = runner(getDockerCommand(), ['rm', plan.sessionName]);
+          const note = removed.success
+            ? `Stopped original container removed: ${plan.sessionName}`
+            : `Original container retained: ${(removed.stderr || removed.error || 'docker rm failed').trim()}`;
+          plan.message += `\n${note}`;
+          if (record.logPath) {
+            appendLogFile(record.logPath, `${note}\n`);
+          }
+        } else {
+          plan.message +=
+            '\nOriginal container retained: the snapshot container is not running.';
+        }
+      }
+    } catch (error) {
+      if (derivedCreated) {
+        runner(getDockerCommand(), ['rm', plan.newSessionName]);
+      }
+      if (snapshotCreated) {
+        runner(getDockerCommand(), ['rmi', plan.snapshotImage]);
+      }
+      if (plan.handoffCommand) {
+        // A failed start must not leave a replacement hidden behind the old record.
+        try {
+          writeCommandHandoff(plan.sessionName, previous.command, runner, opts);
+        } catch {
+          /* Next explicit command can still repair the handoff. */
+        }
+      }
+      rollbackLaunch(store, previous);
+      appendLifecycle(lifecycleRecord, 'launch-failed', {
+        error: error.message,
+      });
+      return {
+        success: false,
+        error: `Failed to resume ${plan.backend} session "${plan.sessionName}": ${error.message}`,
+      };
+    } finally {
+      snapshotLock?.release();
     }
 
     const limitsLine = buildResourceLimitsStatusLine(plan.resourceLimits);

package/src/lib/failure-handler.js

@@ -9,6 +9,7 @@ const os = require('os');
 const fs = require('fs');
 const path = require('path');
 const { getTimestamp } = require('./isolation');
+const { sanitizeLogToTemp, StreamingSanitizer } = require('./log-sanitizer');
 
 /**
  * Handle command failure - detect repository, upload log, create issue
@@ -55,7 +56,7 @@ function handleFailure(config, cmdName, fullCommand, exitCode, logPath) {
       console.log('Log upload disabled via START_DISABLE_LOG_UPLOAD');
     }
   } else if (isGhUploadLogAvailable()) {
-    logUrl = uploadLog(logPath);
+    logUrl = uploadLog(logPath, { verbose: config.verbose });
     if (logUrl) {
       console.log(`Log uploaded: ${logUrl}`);
     }
@@ -273,9 +274,11 @@ function isGhUploadLogAvailable() {
  * @param {string} logPath - Path to the log file
  * @returns {string|null} URL of the uploaded log or null
  */
-function uploadLog(logPath) {
+function uploadLog(logPath, options = {}) {
+  let prepared;
   try {
-    const result = execFileSync('gh-upload-log', [logPath, '--public'], {
+    prepared = sanitizeLogToTemp(logPath, { verbose: options.verbose });
+    const result = execFileSync('gh-upload-log', [prepared.path, '--private'], {
       encoding: 'utf8',
       stdio: ['pipe', 'pipe', 'pipe'],
     });
@@ -293,9 +296,13 @@ function uploadLog(logPath) {
     }
 
     return null;
-  } catch (err) {
-    console.log(`Warning: Log upload failed - ${err.message}`);
+  } catch {
+    console.log('Warning: Log preparation or upload failed; upload blocked.');
     return null;
+  } finally {
+    if (prepared) {
+      prepared.cleanup();
+    }
   }
 }
 
@@ -327,6 +334,9 @@ function canCreateIssue(owner, repo) {
  */
 function createIssue(repoInfo, fullCommand, exitCode, logUrl) {
   try {
+    fullCommand = new StreamingSanitizer()
+      .push(Buffer.from(fullCommand), true)
+      .toString();
     const title = `Command failed with exit code ${exitCode}: ${fullCommand.substring(0, 50)}${fullCommand.length > 50 ? '...' : ''}`;
 
     // Get runtime information