start-command 0.36.0 → 0.37.1

package/test/regression-207.js

@@ -0,0 +1,249 @@
+const { it, expect } = require('bun:test');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { initialState, transitionLog } = require('../src/lib/cpu-penalty');
+const cpu = require('../src/lib/cpu-penalty-monitor');
+
+it('restarted monitors retain an observed base absent from launch flags', () => {
+  const saved = { ...initialState(4, 0), phase: 'penalized', limitCpus: 2 };
+  expect(initialState(null, 100, saved).baseCpus).toBe(4);
+});
+
+it('saved observing limits preserve the base after a daemon-clamped lift', () => {
+  const saved = { ...initialState(4, 0), limitCpus: 1 };
+  const { observeBase } = require('../src/lib/cpu-penalty');
+  expect(observeBase(initialState(null, 100, saved), 1, 100).baseCpus).toBe(4);
+});
+
+for (const mode of [
+  'nano',
+  'quota',
+  'restart',
+  'zombie',
+  'reused',
+  'supervise',
+  'publish-fault',
+  'graceful',
+  'override',
+]) {
+  it(`CPU monitor recovers external base and idle release: ${mode}`, () => {
+    if (
+      process.platform === 'win32' ||
+      (['zombie', 'reused'].includes(mode) && process.platform !== 'linux')
+    ) {
+      return;
+    }
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cpu-monitor-207-'));
+    try {
+      const logPath = path.join(dir, 'task.log');
+      fs.writeFileSync(logPath, '');
+      const record = {
+        logPath,
+        options: {
+          sessionName: 'cpu-task',
+          isolated: 'docker',
+          cpuPenaltyConfig: {
+            cpus: 2,
+            trigger: 95,
+            release: 65,
+            triggerWindowMs: 400,
+            releaseWindowMs: 400,
+          },
+          baseResourceLimits: [],
+        },
+      };
+      const command = [
+        process.execPath,
+        require.resolve('../src/lib/cpu-penalty-monitor'),
+        '',
+        'cpu-task',
+        '1',
+        JSON.stringify(record),
+      ];
+      if (mode === 'supervise') {
+        const script = `${cpu.startSnippet(null, 'cpu-task', 1, { ...record.options, logPath })}; read done; ${cpu.stopSnippet()}`;
+        command.splice(0, command.length, 'sh', '-c', script);
+      }
+      const result = spawnSync(
+        'python3',
+        [
+          path.resolve(__dirname, '../../experiments/issue-207-monitor.py'),
+          mode,
+          logPath,
+          ...command,
+        ],
+        { encoding: 'utf8' }
+      );
+      expect(result.status, result.stderr).toBe(0);
+      const state = cpu.readState(record);
+      const expected = mode === 'override' ? 3 : 4;
+      expect(state.baseCpus).toBe(expected);
+      expect(state.phase).toBe('observing');
+      expect(state.limitCpus).toBe(expected);
+      if (mode !== 'override') {
+        expect(fs.readFileSync(logPath, 'utf8')).toContain(
+          'CPU penalty lifted: 4'
+        );
+      }
+      const { ExecutionRecord } = require('../src/lib/execution-store');
+      const {
+        enrichDetachedStatus,
+        formatRecord,
+      } = require('../src/lib/status-formatter');
+      const statusRecord = new ExecutionRecord({
+        ...record,
+        options: { ...record.options, isolated: undefined },
+      });
+      const status = JSON.parse(
+        formatRecord(enrichDetachedStatus(statusRecord), 'json')
+      );
+      expect(status.cpuPenalty.baseCpus).toBe(expected);
+      expect(status.cpuPenalty.limitCpus).toBe(expected);
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  }, 15000);
+}
+
+for (const failure of ['inspect', 'stats', 'update', 'publish']) {
+  it(`an exception in ${failure} resets coverage and monitoring continues`, async () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cpu-tick-207-'));
+    const logPath = path.join(dir, 'task.log');
+    const record = {
+      logPath,
+      options: {
+        sessionName: 'cpu-task',
+        cpuPenaltyConfig: {
+          cpus: 2,
+          trigger: 95,
+          release: 65,
+          triggerWindowMs: 100,
+          releaseWindowMs: 100,
+        },
+      },
+    };
+    let ticks = 0;
+    let injected = false,
+      limit = 4,
+      lifted = false;
+    const filesystem = Object.create(fs);
+    filesystem.renameSync = (from, to) => {
+      if (
+        failure === 'publish' &&
+        !injected &&
+        JSON.parse(fs.readFileSync(from)).phase === 'penalized'
+      ) {
+        injected = true;
+        throw new Error('injected ENOSPC');
+      }
+      fs.renameSync(from, to);
+    };
+    try {
+      await cpu.monitor('', 'cpu-task', 1, JSON.stringify(record), {
+        fs: filesystem,
+        run: (_command, args) => {
+          if (args[0] === failure && !injected) {
+            injected = true;
+            throw new Error(`injected ${failure}`);
+          }
+          const result = (stdout) => ({ success: true, stdout });
+          if (args[0] === 'inspect') {
+            if (!args[2].includes('HostConfig') && ++ticks > 60) {
+              lifted = false;
+              return result('false');
+            }
+            return result(
+              args[2].includes('HostConfig')
+                ? JSON.stringify({ NanoCpus: limit * 1e9 })
+                : String(!lifted)
+            );
+          }
+          if (args[0] === 'info') {
+            return result('{"NCPU":6}');
+          }
+          if (args[0] === 'stats') {
+            return result(
+              JSON.stringify({
+                Name: 'cpu-task',
+                CPUPerc: limit === 2 ? '20%' : '400%',
+              })
+            );
+          }
+          if (args[0] === 'update') {
+            limit = Number(args[2]);
+            lifted = limit === 4;
+            return result('');
+          }
+          throw new Error('unexpected command');
+        },
+      });
+      expect(injected).toBe(true);
+      expect(lifted).toBe(true);
+      expect(cpu.readState(record).baseCpus).toBe(4);
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  }, 5000);
+}
+
+it('stopped resume uses the observed base rather than the temporary quota', () => {
+  const { restoreBaseCpu } = require('../src/lib/resume-resources');
+  expect(
+    restoreBaseCpu(
+      ['--memory=512m', '--cpus=2'],
+      { cpuPenaltyConfig: {}, baseResourceLimits: [] },
+      { baseCpus: 4 }
+    )
+  ).toEqual(['--memory=512m', '--cpus=4']);
+});
+
+it('stopped resume preserves a later supervisor override instead of the stale cap', () => {
+  const { restoreBaseCpu } = require('../src/lib/resume-resources');
+  const options = { cpuPenaltyConfig: {}, baseResourceLimits: [] };
+  const saved = { phase: 'penalized', baseCpus: 4, limitCpus: 2 };
+  expect(restoreBaseCpu(['--cpus=2'], options, saved, true)).toEqual([
+    '--cpus=4',
+  ]);
+  expect(restoreBaseCpu(['--cpus=3'], options, saved, true)).toEqual([
+    '--cpus=3',
+  ]);
+});
+
+it('transition logs explain the window and phase denominator', () => {
+  const config = { cpus: 2, triggerWindowMs: 900000, releaseWindowMs: 400 };
+  expect(
+    transitionLog({ kind: 'apply', cpus: 2, capacity: 4, average: 100 }, config)
+  ).toContain('of 4 CPUs for 15m');
+  expect(
+    transitionLog({ kind: 'lift', cpus: 4, capacity: 4, average: 10 }, config)
+  ).toContain('of 2 CPUs for 400ms');
+});
+
+it('process birth identity reclaims reused PIDs without evicting a live lock', () => {
+  if (process.platform !== 'linux') {
+    return;
+  }
+  const { LockManager } = require('../src/lib/store-lock');
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cpu-lock-207-'));
+  const file = path.join(dir, 'lock');
+  const first = new LockManager(file);
+  const replacement = new LockManager(file);
+  try {
+    expect(first.acquire(100)).toBe(true);
+    const data = JSON.parse(fs.readFileSync(file));
+    expect(data.processStart).toBeTruthy();
+    expect(replacement.acquire(100)).toBe(false);
+    fs.writeFileSync(
+      file,
+      JSON.stringify({ ...data, processStart: 'different-birth' })
+    );
+    expect(replacement.acquire(100)).toBe(true);
+    first.release();
+    expect(fs.existsSync(file)).toBe(true);
+  } finally {
+    replacement.release();
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});

package/test/regression-91.js

@@ -69,7 +69,7 @@ function buildAttachedCmdArgs(command, shellToUse = '/bin/bash') {
 describe('isShellInvocationWithArgs (issue #91)', () => {
   it('should return true for "bash -i -c nvm --version"', () => {
     assert.strictEqual(
-      isShellInvocationWithArgs('bash -i -c nvm --version'),
+      isShellInvocationWithArgs('bash -i -c "nvm --version"'),
       true
     );
   });
@@ -79,11 +79,14 @@ describe('isShellInvocationWithArgs (issue #91)', () => {
   });
 
   it('should return true for "bash -c echo hello"', () => {
-    assert.strictEqual(isShellInvocationWithArgs('bash -c echo hello'), true);
+    assert.strictEqual(isShellInvocationWithArgs('bash -c "echo hello"'), true);
   });
 
   it('should return true for "zsh -c nvm --version"', () => {
-    assert.strictEqual(isShellInvocationWithArgs('zsh -c nvm --version'), true);
+    assert.strictEqual(
+      isShellInvocationWithArgs('zsh -c "nvm --version"'),
+      true
+    );
   });
 
   it('should return true for "sh -c ls"', () => {
@@ -115,12 +118,12 @@ describe('isShellInvocationWithArgs (issue #91)', () => {
 
 describe('buildShellWithArgsCmdArgs (issue #91)', () => {
   it('should reconstruct "bash -i -c nvm --version" correctly', () => {
-    const result = buildShellWithArgsCmdArgs('bash -i -c nvm --version');
+    const result = buildShellWithArgsCmdArgs('bash -i -c "nvm --version"');
     assert.deepStrictEqual(result, ['bash', '-i', '-c', 'nvm --version']);
   });
 
   it('should reconstruct "bash -c echo hello" correctly', () => {
-    const result = buildShellWithArgsCmdArgs('bash -c echo hello');
+    const result = buildShellWithArgsCmdArgs('bash -c "echo hello"');
     assert.deepStrictEqual(result, ['bash', '-c', 'echo hello']);
   });
 
@@ -130,13 +133,13 @@ describe('buildShellWithArgsCmdArgs (issue #91)', () => {
   });
 
   it('should handle zsh with -c', () => {
-    const result = buildShellWithArgsCmdArgs('zsh -c nvm --version');
+    const result = buildShellWithArgsCmdArgs('zsh -c "nvm --version"');
     assert.deepStrictEqual(result, ['zsh', '-c', 'nvm --version']);
   });
 
   it('should handle /bin/bash -i -c with multi-word script', () => {
     const result = buildShellWithArgsCmdArgs(
-      '/bin/bash -i -c node -e process.version'
+      '/bin/bash -i -c "node -e process.version"'
     );
     assert.deepStrictEqual(result, [
       '/bin/bash',
@@ -147,7 +150,7 @@ describe('buildShellWithArgsCmdArgs (issue #91)', () => {
   });
 
   it('should not include -c argument inside script argument (no double -c)', () => {
-    const result = buildShellWithArgsCmdArgs('bash -i -c nvm --version');
+    const result = buildShellWithArgsCmdArgs('bash -i -c "nvm --version"');
     // The script arg must be 'nvm --version', not '-c nvm --version'
     assert.strictEqual(result[result.length - 1], 'nvm --version');
     assert.strictEqual(result.indexOf('-c'), 2);
@@ -159,13 +162,13 @@ describe('Regression: No Double-Wrapping for Shell With -c (issue #91)', () => {
   // Each test verifies that `bash -i -c "cmd"` style commands are NOT re-wrapped
   // in another outer shell -c invocation.
   //
-  // Before fix: buildAttachedCmdArgs('bash -i -c nvm --version')
-  //   → ['/bin/bash', '-i', '-c', 'bash -i -c nvm --version']   (WRONG: double-wrap)
-  // After fix:  buildAttachedCmdArgs('bash -i -c nvm --version')
+  // Before fix: buildAttachedCmdArgs('bash -i -c "nvm --version"')
+  //   → ['/bin/bash', '-i', '-c', 'bash -i -c "nvm --version"']   (WRONG: double-wrap)
+  // After fix:  buildAttachedCmdArgs('bash -i -c "nvm --version"')
   //   → ['bash', '-i', '-c', 'nvm --version']                   (CORRECT: direct pass)
 
   it('should pass "bash -i -c nvm --version" directly without outer shell wrapper', () => {
-    const args = buildAttachedCmdArgs('bash -i -c nvm --version');
+    const args = buildAttachedCmdArgs('bash -i -c "nvm --version"');
     // Must start with 'bash', not with '/bin/bash' (the outer shellToUse)
     assert.strictEqual(args[0], 'bash');
     // Must not wrap in outer bash -i -c
@@ -182,7 +185,7 @@ describe('Regression: No Double-Wrapping for Shell With -c (issue #91)', () => {
   });
 
   it('should pass "zsh -c nvm --version" directly without outer shell wrapper', () => {
-    const args = buildAttachedCmdArgs('zsh -c nvm --version', '/bin/zsh');
+    const args = buildAttachedCmdArgs('zsh -c "nvm --version"', '/bin/zsh');
     assert.deepStrictEqual(args, ['zsh', '-c', 'nvm --version']);
     assert.ok(
       args.filter((a) => a === '-c').length === 1,
@@ -191,12 +194,12 @@ describe('Regression: No Double-Wrapping for Shell With -c (issue #91)', () => {
   });
 
   it('should pass "bash -c echo hello" directly', () => {
-    const args = buildAttachedCmdArgs('bash -c echo hello');
+    const args = buildAttachedCmdArgs('bash -c "echo hello"');
     assert.deepStrictEqual(args, ['bash', '-c', 'echo hello']);
   });
 
   it('should not introduce a second bash layer (no shell-inside-shell)', () => {
-    const args = buildAttachedCmdArgs('bash -i -c nvm --version');
+    const args = buildAttachedCmdArgs('bash -i -c "nvm --version"');
     // The first element of the docker image command args must NOT be the outer shell
     // i.e., must not be ['/bin/bash', '-i', '-c', 'bash ...']
     assert.notStrictEqual(
@@ -206,7 +209,7 @@ describe('Regression: No Double-Wrapping for Shell With -c (issue #91)', () => {
     );
     // Must not contain the original full command string as an argument
     assert.ok(
-      !args.includes('bash -i -c nvm --version'),
+      !args.includes('bash -i -c "nvm --version"'),
       'Must not contain the full command string as a single argument (double-wrap)'
     );
   });
@@ -241,7 +244,7 @@ describe('isShellInvocationWithArgs is mutually exclusive with isInteractiveShel
     'bash',
     'bash -i',
     'bash --norc',
-    'bash -i -c nvm --version',
+    'bash -i -c "nvm --version"',
     'bash -c echo hi',
     'zsh -c ls',
     'nvm --version',
@@ -263,14 +266,14 @@ describe('isShellInvocationWithArgs is mutually exclusive with isInteractiveShel
 describe('buildDisplayCommand (issue #91 display fix)', () => {
   it('should quote the -c script argument when it contains spaces', () => {
     assert.strictEqual(
-      buildDisplayCommand('bash -i -c nvm --version'),
+      buildDisplayCommand('bash -i -c "nvm --version"'),
       'bash -i -c "nvm --version"'
     );
   });
 
   it('should quote the -c script argument for plain "bash -c echo hello"', () => {
     assert.strictEqual(
-      buildDisplayCommand('bash -c echo hello'),
+      buildDisplayCommand('bash -c "echo hello"'),
       'bash -c "echo hello"'
     );
   });
@@ -289,7 +292,7 @@ describe('buildDisplayCommand (issue #91 display fix)', () => {
 
   it('should handle zsh -c with spaces', () => {
     assert.strictEqual(
-      buildDisplayCommand('zsh -c echo hello world'),
+      buildDisplayCommand('zsh -c "echo hello world"'),
       'zsh -c "echo hello world"'
     );
   });

package/test/shared-golden.js

@@ -0,0 +1,77 @@
+const { describe, it } = require('node:test');
+const assert = require('node:assert/strict');
+const { readFileSync } = require('node:fs');
+const { resolve } = require('node:path');
+const { parseArgs } = require('../src/lib/args-parser');
+const { buildDockerRuntimeArgs } = require('../src/lib/docker-runtime-args');
+const { ExecutionRecord } = require('../src/lib/execution-store');
+const { formatRecord } = require('../src/lib/status-formatter');
+const fixtures = JSON.parse(
+  readFileSync(resolve(__dirname, '../../parity/fixtures/contracts.json'))
+);
+
+describe('shared JavaScript and Rust golden contracts', () => {
+  for (const fixture of fixtures['cli-parsing']) {
+    it(`CLI parsing: ${fixture.name}`, () => {
+      if (fixture.error) {
+        assert.throws(() => parseArgs(fixture.argv), new RegExp(fixture.error));
+        return;
+      }
+      const parsed = parseArgs(fixture.argv);
+      assert.equal(parsed.command, fixture.command);
+      assert.deepEqual(parsed.rawCommand, fixture.rawCommand);
+      for (const [key, value] of Object.entries(fixture.options)) {
+        assert.deepEqual(parsed.wrapperOptions[key], value, key);
+      }
+    });
+  }
+  for (const fixture of fixtures['isolation-arguments']) {
+    it(`isolation argv: ${fixture.name}`, () => {
+      assert.deepEqual(buildDockerRuntimeArgs(fixture.options), fixture.argv);
+    });
+  }
+  it('uses the same JSON and text status output', () => {
+    const fixture = fixtures['status-output'];
+    const record = new ExecutionRecord(fixture.record);
+    assert.deepEqual(JSON.parse(formatRecord(record, 'json')), fixture.json);
+    assert.equal(formatRecord(record, 'text'), fixture.text);
+  });
+  for (const fixture of fixtures['execution-record-format']) {
+    it(`preserves the complete execution record format (exit ${fixture.exitCode})`, () => {
+      assert.deepEqual(ExecutionRecord.fromObject(fixture).toObject(), fixture);
+    });
+  }
+  it('executes the JavaScript source of the generated Rust parity policy', async () => {
+    const { minimumRustTestCount } =
+      await import('../../scripts/parity-threshold.mjs');
+    for (const fixture of fixtures['parity-threshold']) {
+      assert.equal(
+        minimumRustTestCount(fixture.javascript),
+        fixture.minimumRust
+      );
+    }
+  });
+  for (const fixture of fixtures['cpu-penalty-state']) {
+    it(`CPU state: ${fixture.name}`, () => {
+      const {
+        initialState,
+        observeBase,
+        evaluate,
+      } = require('../src/lib/cpu-penalty');
+      let state = initialState(fixture.baseCpus, 0, fixture.saved);
+      for (const step of fixture.steps) {
+        state = observeBase(state, step.baseCpus, step.now);
+        const decision = evaluate(
+          state,
+          { now: step.now, cores: step.cores, daemonCpus: 6, maxGapMs: 50 },
+          fixture.config
+        );
+        assert.equal(decision.action?.kind || null, step.action);
+        state = decision.state;
+      }
+      for (const [key, value] of Object.entries(fixture.expected)) {
+        assert.deepEqual(state[key], value, key);
+      }
+    });
+  }
+});

package/test/status-query.js

@@ -53,19 +53,35 @@ function createExecutable(filePath, content) {
   fs.chmodSync(filePath, 0o755);
 }
 
+function fakeUploaderScript(fakeBin, outputPrefix) {
+  const fixturePath = path.join(fakeBin, 'capture-upload.js');
+  fs.writeFileSync(
+    fixturePath,
+    [
+      "const fs = require('fs');",
+      'const args = process.argv.slice(2);',
+      'fs.writeFileSync(process.env.UPLOAD_CAPTURE, JSON.stringify({',
+      '  args, content: fs.readFileSync(args[0], "utf8"),',
+      '  mode: fs.statSync(args[0]).mode & 0o777,',
+      '}));',
+      `console.log(${JSON.stringify(outputPrefix)} + ': ' + args[0]);`,
+      '',
+    ].join('\n')
+  );
+  if (process.platform === 'win32') {
+    return `@echo off\r\n"${process.execPath}" "${fixturePath}" %*\r\n`;
+  }
+  return `#!/bin/sh\n"${process.execPath}" "${fixturePath}" "$@"\n`;
+}
+
 function createFakeUploader(fakeBin, outputPrefix) {
+  const content = fakeUploaderScript(fakeBin, outputPrefix);
   if (process.platform === 'win32') {
-    createExecutable(
-      path.join(fakeBin, 'gh-upload-log.cmd'),
-      `@echo off\r\necho ${outputPrefix}: %1\r\n`
-    );
+    createExecutable(path.join(fakeBin, 'gh-upload-log.cmd'), content);
     return;
   }
 
-  createExecutable(
-    path.join(fakeBin, 'gh-upload-log'),
-    `#!/bin/sh\necho "${outputPrefix}: $1"\n`
-  );
+  createExecutable(path.join(fakeBin, 'gh-upload-log'), content);
 }
 
 describe('--status query functionality', () => {
@@ -262,10 +278,14 @@ describe('--status query functionality', () => {
   });
 
   describe('--upload-log functionality', () => {
-    it('should run gh-upload-log with the stored execution log path', () => {
+    it('should upload a private sanitized copy and preserve the stored log', () => {
       const fakeBin = fs.mkdtempSync(path.join(os.tmpdir(), 'upload-log-bin-'));
       const logPath = path.join(TEST_APP_FOLDER, 'command.log');
-      fs.writeFileSync(logPath, 'captured command output\n', 'utf8');
+      const capturePath = path.join(fakeBin, 'capture.json');
+      const token = ['gh', 'p_', 'a'.repeat(36)].join('');
+      const customSecret = 'fake-custom-credential';
+      const original = `captured command output\n${token}\n${customSecret}\n`;
+      fs.writeFileSync(logPath, original, 'utf8');
       createFakeUploader(fakeBin, 'fake uploader received');
 
       testRecord.logPath = logPath;
@@ -274,11 +294,28 @@ describe('--status query functionality', () => {
       const result = runCli(['--upload-log', testRecord.uuid], {
         PATH: fakeBin,
         HOME: fakeBin,
+        UPLOAD_CAPTURE: capturePath,
+        EXAMPLE_API_KEY: customSecret,
+        GH_UPLOAD_PUBLIC: 'true',
       });
 
       expect(result.exitCode).toBe(0);
-      expect(result.stdout).toContain(`fake uploader received: ${logPath}`);
+      const captured = JSON.parse(fs.readFileSync(capturePath, 'utf8'));
+      expect(captured.args[0]).not.toBe(logPath);
+      expect(captured.args[1]).toBe('--private');
+      expect(captured.content).toContain('captured command output');
+      expect(captured.content).toContain('[REDACTED]');
+      expect(captured.content).not.toContain(token);
+      expect(captured.content).not.toContain(customSecret);
+      if (process.platform !== 'win32') {
+        expect(captured.mode).toBe(0o600);
+      }
+      expect(result.stdout).toContain(
+        `fake uploader received: ${captured.args[0]}`
+      );
       expect(result.stderr).toBe('');
+      expect(fs.readFileSync(logPath, 'utf8')).toBe(original);
+      expect(fs.existsSync(captured.args[0])).toBe(false);
 
       fs.rmSync(fakeBin, { recursive: true, force: true });
     });
@@ -293,8 +330,15 @@ describe('--status query functionality', () => {
         path.join(os.tmpdir(), 'upload-log-install-bin-')
       );
       const installMarker = path.join(fakeBin, 'install.log');
+      const capturePath = path.join(fakeBin, 'capture.json');
       const logPath = path.join(TEST_APP_FOLDER, 'install-command.log');
-      fs.writeFileSync(logPath, 'captured command output\n', 'utf8');
+      const token = ['gh', 'p_', 'b'.repeat(36)].join('');
+      const original = `captured command output\n${token}\n`;
+      fs.writeFileSync(logPath, original, 'utf8');
+      const uploaderScript = fakeUploaderScript(
+        fakeBin,
+        'installed uploader received'
+      );
 
       createExecutable(
         path.join(fakeBin, 'bun'),
@@ -302,8 +346,7 @@ describe('--status query functionality', () => {
           '#!/bin/sh',
           `echo "$@" > "${installMarker}"`,
           `cat > "${path.join(fakeBin, 'gh-upload-log')}" <<'SCRIPT'`,
-          '#!/bin/sh',
-          'echo "installed uploader received: $1"',
+          uploaderScript,
           'SCRIPT',
           `chmod +x "${path.join(fakeBin, 'gh-upload-log')}"`,
           'exit 0',
@@ -317,6 +360,7 @@ describe('--status query functionality', () => {
       const result = runCli(['--upload-log', testRecord.uuid], {
         PATH: `${fakeBin}${path.delimiter}/usr/bin${path.delimiter}/bin`,
         HOME: fakeBin,
+        UPLOAD_CAPTURE: capturePath,
       });
 
       expect(result.exitCode).toBe(0);
@@ -324,10 +368,48 @@ describe('--status query functionality', () => {
         'install -g gh-upload-log'
       );
       expect(result.stdout).toContain('gh-upload-log not found');
+      const captured = JSON.parse(fs.readFileSync(capturePath, 'utf8'));
+      expect(captured.args[0]).not.toBe(logPath);
+      expect(captured.args[1]).toBe('--private');
+      expect(captured.content).toContain('captured command output');
+      expect(captured.content).toContain('[REDACTED]');
+      expect(captured.content).not.toContain(token);
+      expect(captured.mode).toBe(0o600);
       expect(result.stdout).toContain(
-        `installed uploader received: ${logPath}`
+        `installed uploader received: ${captured.args[0]}`
+      );
+      expect(fs.readFileSync(logPath, 'utf8')).toBe(original);
+      expect(fs.existsSync(captured.args[0])).toBe(false);
+
+      fs.rmSync(fakeBin, { recursive: true, force: true });
+    });
+
+    it('should upload the original privately only with explicit --no-sanitize', () => {
+      const fakeBin = fs.mkdtempSync(path.join(os.tmpdir(), 'upload-raw-bin-'));
+      const capturePath = path.join(fakeBin, 'capture.json');
+      const logPath = path.join(TEST_APP_FOLDER, 'raw-command.log');
+      const token = ['gh', 'p_', 'c'.repeat(36)].join('');
+      const original = `captured command output\n${token}\n`;
+      fs.writeFileSync(logPath, original, 'utf8');
+      createFakeUploader(fakeBin, 'raw uploader received');
+      testRecord.logPath = logPath;
+      store.save(testRecord);
+
+      const result = runCli(
+        ['--upload-log', testRecord.uuid, '--no-sanitize'],
+        {
+          PATH: fakeBin,
+          HOME: fakeBin,
+          UPLOAD_CAPTURE: capturePath,
+          GH_UPLOAD_PUBLIC: 'true',
+        }
       );
 
+      expect(result.exitCode).toBe(0);
+      const captured = JSON.parse(fs.readFileSync(capturePath, 'utf8'));
+      expect(captured.args).toEqual([logPath, '--private']);
+      expect(captured.content).toBe(original);
+      expect(fs.readFileSync(logPath, 'utf8')).toBe(original);
       fs.rmSync(fakeBin, { recursive: true, force: true });
     });