@link-assistant/hive-mind 2.13.0 → 2.13.2

package/src/solve.restart-shared.lib.mjs

@@ -30,7 +30,10 @@ const fs = (await use('fs')).promises;
 
 // Import shared library functions
 const lib = await import('./lib.mjs');
-const { log, formatAligned, extractToolErrorCore } = lib;
+// Issue #2160: the real log-file accessors must be forwarded to every tool executor. Passing
+// no-op stubs (or omitting them entirely) broke session-log renaming in restart/watch iterations
+// ("⚠️ Could not rename log file: getLogFile is not a function").
+const { log, formatAligned, extractToolErrorCore, getLogFile, setLogFile } = lib;
 const { ensurePullRequestBaseBranch } = await import('./solve.pr-base-guard.lib.mjs');
 const { ensureAiToolScratchIgnored, filterAiToolScratchFromStatus } = await import('./ai-tool-scratch.lib.mjs');
 const { RESOURCE_PHASE_RESTART_AFTER, RESOURCE_PHASE_RESTART_BEFORE, recordResourceSnapshot } = await import('./solve.resource-diagnostics.lib.mjs');
@@ -240,8 +243,8 @@ export const executeToolIteration = async params => {
       log,
       formatAligned,
       getResourceSnapshot,
-      setLogFile: () => {},
-      getLogFile: () => '',
+      setLogFile,
+      getLogFile,
       $,
     });
   } else if (argv.tool === 'opencode') {
@@ -280,6 +283,8 @@ export const executeToolIteration = async params => {
       log,
       formatAligned,
       getResourceSnapshot,
+      setLogFile,
+      getLogFile,
       opencodePath,
       $,
     });
@@ -318,8 +323,8 @@ export const executeToolIteration = async params => {
       repo,
       argv,
       log,
-      setLogFile: () => {},
-      getLogFile: () => '',
+      setLogFile,
+      getLogFile,
       formatAligned,
       getResourceSnapshot,
       codexPath,
@@ -362,6 +367,8 @@ export const executeToolIteration = async params => {
       log,
       formatAligned,
       getResourceSnapshot,
+      setLogFile,
+      getLogFile,
       agentPath,
       $,
     });
@@ -400,8 +407,8 @@ export const executeToolIteration = async params => {
       repo,
       argv,
       log,
-      setLogFile: () => {},
-      getLogFile: () => '',
+      setLogFile,
+      getLogFile,
       formatAligned,
       getResourceSnapshot,
       geminiPath,
@@ -442,8 +449,8 @@ export const executeToolIteration = async params => {
       repo,
       argv,
       log,
-      setLogFile: () => {},
-      getLogFile: () => '',
+      setLogFile,
+      getLogFile,
       formatAligned,
       getResourceSnapshot,
       qwenPath,
@@ -488,6 +495,8 @@ export const executeToolIteration = async params => {
       log,
       formatAligned,
       getResourceSnapshot,
+      setLogFile,
+      getLogFile,
       claudePath,
       $,
     });

package/src/solve.results.lib.mjs

@@ -485,12 +485,15 @@ export const cleanupClaudeFile = async (tempDir, branchName, claudeCommitHash =
     const verifyResult = await $({ cwd: tempDir })`git ls-files ${fileName} 2>&1`;
     const fileStillExists = verifyResult.code === 0 && verifyResult.stdout && verifyResult.stdout.trim();
     if (fileStillExists) {
-      await log(`   ⚠️  WARNING: ${fileName} still exists after cleanup — attempting direct removal...`);
-      // Check if the file existed before the initial commit (parent)
+      // Issue #2160: the pre-existence check must come FIRST. A file that legitimately predates
+      // the session is not a cleanup failure, and warning about it produced a false positive
+      // ("⚠️ WARNING: .gitkeep still exists after cleanup" immediately followed by
+      // "ℹ️ .gitkeep existed before this session — keeping pre-existing file").
       const parentCommit = `${claudeCommitHash}~1`;
       const parentFileExists = await $({ cwd: tempDir })`git cat-file -e ${parentCommit}:${fileName} 2>&1`;
       if (parentFileExists.code !== 0) {
-        // File didn't exist before the session — force remove it
+        // File didn't exist before the session — this is a real leftover, force remove it
+        await log(`   ⚠️  WARNING: ${fileName} still exists after cleanup — attempting direct removal...`);
         await $({ cwd: tempDir })`git rm -f ${fileName} 2>&1`;
         const fallbackCommit = await $({ cwd: tempDir })`git commit -m "Remove leftover ${fileName} (post-cleanup fallback, Issue #1436)" 2>&1`;
         if (fallbackCommit.code === 0) {

package/src/solve.validation.lib.mjs

@@ -53,12 +53,6 @@ const { parseResetTime: parseResetTimeToDate } = usageLimitLib;
 
 const { validateClaudeConnection } = claudeLib;
 
-// Wrapper function for disk space check using imported module
-const checkDiskSpace = async (minSpaceMB = 10240) => {
-  const result = await memoryCheck.checkDiskSpace(minSpaceMB, { log });
-  return result.success;
-};
-
 // Wrapper function for memory check using imported module
 const checkMemory = async (minMemoryMB = 256) => {
   const result = await memoryCheck.checkMemory(minMemoryMB, { log });
@@ -217,9 +211,13 @@ export const validateContinueOnlyOnFeedback = async (argv, isPrUrl, isIssueUrl)
 // Note: skipToolConnection only skips the connection check, not model validation
 // Model validation should be done separately before calling this function
 export const performSystemChecks = async (minDiskSpace = 10240, skipToolConnection = false, model = 'sonnet', argv = {}) => {
-  // Check disk space before proceeding
-  const hasEnoughSpace = await checkDiskSpace(minDiskSpace);
-  if (!hasEnoughSpace) {
+  // Check disk space before proceeding.
+  // Issue #2160: record *which* check failed on argv. A full disk says nothing about the issue
+  // being solved, so the caller exits with a retry-later code and skips the "Solution Draft
+  // Failed" comment instead of blaming the task (hive counted 4 such exits as task failures).
+  const diskSpace = await memoryCheck.checkDiskSpace(minDiskSpace, { log });
+  if (!diskSpace.success) {
+    argv.systemCheckFailure = { check: 'disk-space', availableMB: diskSpace.availableMB, requiredMB: minDiskSpace };
     return false;
   }
 

package/src/telegram-accept-invitations.lib.mjs

@@ -19,6 +19,7 @@
 import { promisify } from 'util';
 import { exec as execCallback } from 'child_process';
 import { ghWithRateLimitRetry } from './github-rate-limit.lib.mjs';
+import { safeReply, safeEditMessageText } from './telegram-safe-reply.lib.mjs';
 
 const execRaw = promisify(execCallback);
 // Issue #1726: rate-limit safe gh wrapper.
@@ -148,9 +149,10 @@ export function registerAcceptInvitesCommand(bot, options) {
       return await ctx.reply(errMsg, { reply_to_message_id: ctx.message.message_id });
     }
 
-    const fetchingMessage = await ctx.reply('🔄 Fetching pending GitHub invitations\\.\\.\\.', {
+    const fetchingMessage = await safeReply(ctx, '🔄 Fetching pending GitHub invitations\\.\\.\\.', {
       reply_to_message_id: ctx.message.message_id,
       parse_mode: 'MarkdownV2',
+      verbose: VERBOSE,
     });
 
     // State for tracking progress
@@ -169,7 +171,7 @@ export function registerAcceptInvitesCommand(bot, options) {
     const updateMessage = async () => {
       try {
         const message = buildProgressMessage(state);
-        await ctx.telegram.editMessageText(fetchingMessage.chat.id, fetchingMessage.message_id, undefined, message, { parse_mode: 'MarkdownV2' });
+        await safeEditMessageText(ctx.telegram, fetchingMessage.chat.id, fetchingMessage.message_id, undefined, message, { parse_mode: 'MarkdownV2', verbose: VERBOSE });
       } catch (err) {
         // Ignore "message not modified" errors
         if (!err.message?.includes('message is not modified')) {
@@ -238,7 +240,7 @@ export function registerAcceptInvitesCommand(bot, options) {
     } catch (error) {
       console.error('Error in /accept_invites:', error);
       const escapedError = escapeMarkdown(error.message);
-      await ctx.telegram.editMessageText(fetchingMessage.chat.id, fetchingMessage.message_id, undefined, `❌ Error fetching invitations: ${escapedError}\n\nMake sure \`gh\` CLI is installed and authenticated\\.`, { parse_mode: 'MarkdownV2' });
+      await safeEditMessageText(ctx.telegram, fetchingMessage.chat.id, fetchingMessage.message_id, undefined, `❌ Error fetching invitations: ${escapedError}\n\nMake sure \`gh\` CLI is installed and authenticated\\.`, { parse_mode: 'MarkdownV2', verbose: VERBOSE });
     }
   });
 }

package/src/telegram-bot.mjs

@@ -244,8 +244,8 @@ const { applySolveToolAlias, getFirstParsedPositionalArg, getSolveCommandNameFro
 const { executeStartScreen: executeStartScreenCommand, buildExecuteAndUpdateMessage } = await import('./telegram-command-execution.lib.mjs');
 const { isChatStopped, getChatStopInfo, getStoppedChatRejectMessage, DEFAULT_STOP_REASON } = await import('./telegram-start-stop-command.lib.mjs');
 const { isOldMessage: _isOldMessage, isGroupChat: _isGroupChat, isChatAuthorized: _isChatAuthorized, isForwarded: _isForwarded, isForwardedOrReply: _isForwardedOrReply, extractCommandFromText, extractGitHubUrl: _extractGitHubUrl } = await import('./telegram-message-filters.lib.mjs');
-const { installTelegramFormattingFallback, isTelegramFormattingError, isTelegramMessageTooLongError, safeEditMessageText, safeReply, TELEGRAM_TEXT_LIMIT } = await import('./telegram-safe-reply.lib.mjs');
-const { installTelegramRateLimitTracker } = await import('./telegram-rate-limit.lib.mjs');
+const { isTelegramFormattingError, isTelegramMessageTooLongError, safeEditMessageText, safeReply, safeSendMessage, TELEGRAM_TEXT_LIMIT } = await import('./telegram-safe-reply.lib.mjs');
+const { installTelegramContextSafety } = await import('./telegram-context-safety.lib.mjs');
 const { registerTerminalWatchCommand, startAutoTerminalWatchForSession } = await import('./telegram-terminal-watch-command.lib.mjs');
 const { launchBotWithRetry } = await import('./telegram-bot-launcher.lib.mjs');
 const { trackSession, untrackSession, startSessionMonitoring, hasActiveSessionForUrlAsync, findStoppableSessionByUrl, setSessionStore, setSessionLogger, resumeTrackedSessions, getActiveSessionCount } = await import('./session-monitor.lib.mjs');
@@ -271,8 +271,10 @@ const { Telegraf } = telegrafModule;
 const bot = new Telegraf(BOT_TOKEN, {
   handlerTimeout: Infinity, // Remove default 90s timeout; command handlers like /solve spawn long-running processes
 });
-installTelegramFormattingFallback(bot.telegram, { verbose: VERBOSE });
-installTelegramRateLimitTracker(bot.telegram, { verbose: VERBOSE });
+// Issue #2166: Telegraf hands every update a *new* `Telegram` client, so
+// instrumenting `bot.telegram` alone leaves `ctx.reply()` unprotected. Install
+// on the bot client (for background sends) and on each per-update context.
+installTelegramContextSafety(bot, { verbose: VERBOSE });
 // Track bot startup time (Unix seconds to match Telegram's message.date format)
 const BOT_START_TIME = Math.floor(Date.now() / 1000);
 
@@ -522,7 +524,9 @@ bot.command('version', async ctx => {
 const { registerLanguageCommand } = await import('./telegram-language-command.lib.mjs');
 registerLanguageCommand(bot, { VERBOSE, isOldMessage, isForwardedOrReply });
 const { registerAcceptInvitesCommand } = await import('./telegram-accept-invitations.lib.mjs');
-const sharedCommandOpts = { VERBOSE, isOldMessage, isForwarded, isForwardedOrReply, isGroupChat: _isGroupChat, isChatAuthorized, isTopicAuthorized, buildAuthErrorMessage, addBreadcrumb, isChatStopped, getStoppedChatRejectMessage };
+// Issue #2166 (R7): every command module gets the same send helpers, so no
+// command can drift back to a raw, unvalidated, unlogged `ctx.reply`.
+const sharedCommandOpts = { VERBOSE, isOldMessage, isForwarded, isForwardedOrReply, isGroupChat: _isGroupChat, isChatAuthorized, isTopicAuthorized, buildAuthErrorMessage, addBreadcrumb, isChatStopped, getStoppedChatRejectMessage, safeReply, safeEditMessageText };
 registerAcceptInvitesCommand(bot, sharedCommandOpts);
 const { registerMergeCommand } = await import('./telegram-merge-command.lib.mjs');
 registerMergeCommand(bot, sharedCommandOpts);
@@ -673,6 +677,9 @@ async function handleSolveCommand(ctx) {
     return;
   }
   userArgs = moveArgumentToFront(userArgs, validation.normalizedUrl, cleanNonPrintableChars);
+  // Issue #2166: hand the spawned session the same canonical URL that is shown
+  // in the chat, so the echo and the actual work can never disagree.
+  if (validation.parsed?.canonical && userArgs[0] && cleanNonPrintableChars(userArgs[0]) === validation.normalizedUrl) userArgs[0] = validation.parsed.canonical;
   const { backend: solvePerCommandIsolation, filteredArgs: userArgsWithoutIsolation } = extractIsolationFromArgs(userArgs); // issue #1534
   if (solvePerCommandIsolation && !isValidPerCommandIsolation(solvePerCommandIsolation)) {
     await safeReply(ctx, t('telegram.invalid_isolation', { value: escapeMarkdown(solvePerCommandIsolation) }, { locale: solveLocale }), { reply_to_message_id: ctx.message.message_id });
@@ -739,8 +746,10 @@ async function handleSolveCommand(ctx) {
     await safeReply(ctx, `❌ ${escapeMarkdown(entityCheck.error)}`, { reply_to_message_id: ctx.message.message_id });
     return;
   }
-  // Use normalized URL from validation to ensure consistent duplicate detection (issue #1080)
-  const normalizedUrl = validation.parsed.normalized;
+  // Use the canonical URL from validation to ensure consistent duplicate
+  // detection (issue #1080) and to echo back only what the bot interpreted —
+  // a `#issuecomment-…` fragment is never used to resolve the target (#2166).
+  const normalizedUrl = validation.parsed.canonical || validation.parsed.normalized;
 
   const requester = buildUserMention({ user: ctx.from, parseMode: 'Markdown' });
   // #1228: only user options; #1460: escape; #1688: 'Issue:' / 'Pull request:' label so completion can append PR link.
@@ -777,7 +786,7 @@ async function handleSolveCommand(ctx) {
   }
 
   // Issue #1688: parsed URL context lets the completion message look up linked PRs.
-  const solveUrlContext = validation.parsed ? { owner: validation.parsed.owner, repo: validation.parsed.repo, number: validation.parsed.number, type: validation.parsed.type, normalized: validation.parsed.normalized || normalizedUrl } : null;
+  const solveUrlContext = validation.parsed ? { owner: validation.parsed.owner, repo: validation.parsed.repo, number: validation.parsed.number, type: validation.parsed.type, normalized: normalizedUrl } : null;
   const toolQueuedCount = queueStats.queuedByTool[solveTool] || 0; // tool-specific queue count (#1551)
   // Issue #378: propagate user's effective Telegram locale to the spawned solve session.
   const argsWithLocale = injectLanguageIfMissing(args, solveLocale);
@@ -998,7 +1007,7 @@ registerLeakNotifier(async ({ owner, repo, prNumber, tokenHits = [] }) => {
         if (creator && creator.user?.id) ownerUserId = creator.user.id;
       }
       if (ownerUserId) {
-        await bot.telegram.sendMessage(ownerUserId, text, { parse_mode: 'Markdown' }).catch(err => {
+        await safeSendMessage(bot.telegram, ownerUserId, text, { verbose: VERBOSE }).catch(err => {
           console.warn(`[telegram-leak-notifier] DM to user ${ownerUserId} (chat ${chatId}) failed: ${err.message}`);
         });
       }

package/src/telegram-command-execution.lib.mjs

@@ -3,6 +3,7 @@ import { describeChildExit } from './child-exit.lib.mjs';
 import { promisify } from 'util';
 import { exec as execCallback } from 'child_process';
 import { formatFailedLaunchMessage as defaultFormatFailedLaunchMessage } from './work-session-formatting.lib.mjs';
+import { safeEditMessageText } from './telegram-safe-reply.lib.mjs';
 
 const exec = promisify(execCallback);
 
@@ -106,7 +107,7 @@ export function buildExecuteAndUpdateMessage(deps) {
     const { chat, message_id: msgId } = startingMessage;
     const safeEdit = async text => {
       try {
-        await ctx.telegram.editMessageText(chat.id, msgId, undefined, text, { parse_mode: 'Markdown' });
+        await safeEditMessageText(ctx.telegram, chat.id, msgId, undefined, text, { verbose: VERBOSE });
       } catch (e) {
         console.error(`[telegram-bot] Failed to update message for ${commandName}: ${e.message}`);
       }

package/src/telegram-context-safety.lib.mjs

@@ -0,0 +1,70 @@
+/**
+ * Per-update Telegram instrumentation (issue #2166).
+ *
+ * Telegraf does **not** reuse `bot.telegram` when handling an update. Every
+ * update gets a brand new `Telegram` client so that `webhookReply` can answer on
+ * the open HTTP response:
+ *
+ * ```js
+ * // telegraf/lib/telegraf.js — handleUpdate()
+ * const tg = new telegram_1.default(this.token, this.telegram.options, webhookResponse);
+ * const ctx = new TelegrafContext(update, tg, this.botInfo);
+ * ```
+ *
+ * Consequently `ctx.telegram !== bot.telegram`, and anything installed on
+ * `bot.telegram` (the plain-text formatting fallback, the rate-limit tracker) is
+ * invisible to `ctx.reply()`, `ctx.telegram.sendMessage()` and
+ * `ctx.telegram.editMessageText()` — which is how *every* command handler talks
+ * to Telegram. That is why the `/stop` confirmation in issue #2166 died with an
+ * unhandled `Can't find end of the entity starting at byte offset 65` instead of
+ * degrading to plain text.
+ *
+ * This module re-installs the instrumentation on each freshly created context,
+ * so a single send path — `installTelegramFormattingFallback` — covers the whole
+ * bot regardless of which object a handler happens to call.
+ *
+ * @module telegram-context-safety.lib
+ * @see https://github.com/link-assistant/hive-mind/issues/2166
+ */
+
+import { installTelegramFormattingFallback } from './telegram-safe-reply.lib.mjs';
+import { installTelegramRateLimitTracker } from './telegram-rate-limit.lib.mjs';
+
+/**
+ * Install the formatting fallback and rate-limit tracker on one Telegram client.
+ * Both installers are idempotent (guarded by a symbol), so calling this on an
+ * already-protected client is a no-op.
+ *
+ * @param {object} telegram - A Telegraf `Telegram` client instance.
+ * @param {{verbose?: boolean, fallbackLocale?: string|null, tracker?: object}} [options]
+ * @returns {object|null} The same client, or `null` when there is nothing to protect.
+ */
+export function protectTelegramClient(telegram, options = {}) {
+  if (!telegram) return null;
+  const { verbose = false, fallbackLocale = null, tracker } = options;
+  installTelegramFormattingFallback(telegram, { verbose, fallbackLocale });
+  installTelegramRateLimitTracker(telegram, tracker ? { verbose, tracker } : { verbose });
+  return telegram;
+}
+
+/**
+ * Register the per-update protection as the very first middleware of a bot.
+ *
+ * Must run before any command handler so that handlers which call `ctx.reply()`
+ * directly still get the plain-text fallback and the send audit log.
+ *
+ * @param {object} bot - A Telegraf bot instance.
+ * @param {{verbose?: boolean, fallbackLocale?: string|null, tracker?: object}} [options]
+ * @returns {object} The bot, for chaining.
+ */
+export function installTelegramContextSafety(bot, options = {}) {
+  if (!bot) return bot;
+  protectTelegramClient(bot.telegram, options);
+  if (typeof bot.use === 'function') {
+    bot.use((ctx, next) => {
+      protectTelegramClient(ctx?.telegram, options);
+      return next();
+    });
+  }
+  return bot;
+}

package/src/telegram-fix-command.lib.mjs

@@ -8,6 +8,10 @@
  */
 
 import { buildUserMention } from './buildUserMention.lib.mjs';
+import { calculateLevenshteinDistance } from './option-suggestions.lib.mjs';
+import { getLinoYargsFactory } from './cli-arguments.lib.mjs';
+import { createYargsConfig as createSolveYargsConfig, detectMalformedFlags } from './solve.config.lib.mjs';
+import { parseArgsWithYargs } from './telegram-solve-command.lib.mjs';
 import { validateModelName } from './models/index.mjs';
 import { parseFixRepository } from './fix.ci-cd.lib.mjs';
 import { getModelFromArgs } from './model-args.lib.mjs';
@@ -15,6 +19,8 @@ import { escapeMarkdown } from './telegram-markdown.lib.mjs';
 import { extractIsolationFromArgs, isValidPerCommandIsolation } from './telegram-isolation.lib.mjs';
 import { mergeArgsWithOverrides } from './args-overrides.lib.mjs';
 import { moveArgumentToFront, parseCommandArgs } from './telegram-solve-command.lib.mjs';
+import { safeReply as defaultSafeReply } from './telegram-safe-reply.lib.mjs';
+import { partitionFixArgs } from './fix.ci-cd.lib.mjs';
 import { formatStartingWorkSessionMessage } from './work-session-formatting.lib.mjs';
 
 export const FIX_COMMAND_NAMES = Object.freeze(['fix']);
@@ -68,6 +74,54 @@ export function buildFixCommandArgs(text) {
   };
 }
 
+/**
+ * Options `/fix` consumes itself; everything else is forwarded to `/solve` and
+ * must therefore be a valid `solve` option.
+ */
+export const FIX_OWN_OPTIONS = Object.freeze(['--ci-cd', '--isolation', '--dry-run', '--no-solve', '--no-auto-solve', '--solve', '--help', '-h', '--version']);
+
+/**
+ * Reject a `/fix` request that contains any option `fix` or `solve` cannot act on.
+ *
+ * Issue #2166: a typo such as `--ci-de` used to be silently forwarded to
+ * `solve.mjs` inside the spawned work session, where the failure was invisible
+ * in the chat. `/fix` now fails immediately, in the same chat message, using the
+ * very same checks `/solve` runs (`detectMalformedFlags` + solve's strict yargs
+ * config), so no typo can slip through.
+ *
+ * @param {string[]} args - Arguments as produced by `buildFixCommandArgs().args`.
+ * @returns {Promise<string|null>} Error message to show the user, or `null` when valid.
+ */
+export async function validateFixCommandOptions(args) {
+  const list = Array.isArray(args) ? args : [];
+
+  const { malformed, errors } = detectMalformedFlags(list);
+  if (malformed.length > 0) return errors.join('\n');
+
+  // `--ci-de` is closer to `/fix`'s own `--ci-cd` than to anything solve knows,
+  // so check fix's own vocabulary first — otherwise the generic suggester points
+  // at unrelated solve options.
+  const partitioned = partitionFixArgs(list);
+  for (const arg of partitioned.passthrough) {
+    if (!arg.startsWith('-')) continue;
+    const name = arg.split('=')[0];
+    const closest = FIX_OWN_OPTIONS.map(option => ({ option, distance: calculateLevenshteinDistance(name, option) }))
+      .filter(candidate => candidate.distance > 0 && candidate.distance <= 2)
+      .sort((a, b) => a.distance - b.distance)[0];
+    if (closest) return `Unknown option "${name}". Did you mean "${closest.option}"?`;
+  }
+
+  // solve requires a positional issue URL; a placeholder keeps the parser happy
+  // so that only the *options* are judged here.
+  const probeArgs = ['https://github.com/owner/repo/issues/1', ...partitioned.passthrough];
+  try {
+    await parseArgsWithYargs(probeArgs, getLinoYargsFactory(), createSolveYargsConfig);
+  } catch (error) {
+    return error?.message || String(error);
+  }
+  return null;
+}
+
 // Issue #378: inject --language LOCALE into spawn args if no language flag is
 // already present, so spawned fix sessions inherit the user's effective locale.
 function injectLanguageIfMissing(args, locale) {
@@ -81,7 +135,7 @@ function injectLanguageIfMissing(args, locale) {
 }
 
 export function registerFixCommand(bot, options) {
-  const { VERBOSE, fixEnabled, addBreadcrumb, isOldMessage, isForwardedOrReply, isGroupChat, isTopicAuthorized, buildAuthErrorMessage, isChatStopped, getStoppedChatRejectMessage, safeReply, executeAndUpdateMessage, resolveLocale = null, solveOverrides = [] } = options;
+  const { VERBOSE, fixEnabled, addBreadcrumb, isOldMessage, isForwardedOrReply, isGroupChat, isTopicAuthorized, buildAuthErrorMessage, isChatStopped, getStoppedChatRejectMessage, safeReply = defaultSafeReply, executeAndUpdateMessage, resolveLocale = null, solveOverrides = [] } = options;
 
   async function handleFixCommand(ctx) {
     const commandDisplay = '/fix';
@@ -95,7 +149,7 @@ export function registerFixCommand(bot, options) {
     });
 
     if (!fixEnabled) {
-      await ctx.reply('❌ The fix command is disabled on this bot instance.');
+      await safeReply(ctx, '❌ The fix command is disabled on this bot instance.');
       return;
     }
     if (isOldMessage(ctx)) return;
@@ -107,11 +161,11 @@ export function registerFixCommand(bot, options) {
       return;
     }
     if (!isGroupChat(ctx)) {
-      await ctx.reply(`❌ The ${commandDisplay} command only works in group chats. Please add this bot to a group and make it an admin.`, { reply_to_message_id: ctx.message.message_id });
+      await safeReply(ctx, `❌ The ${commandDisplay} command only works in group chats. Please add this bot to a group and make it an admin.`, { reply_to_message_id: ctx.message.message_id });
       return;
     }
     if (!isTopicAuthorized(ctx)) {
-      await ctx.reply(buildAuthErrorMessage(ctx), { reply_to_message_id: ctx.message.message_id });
+      await safeReply(ctx, buildAuthErrorMessage(ctx), { reply_to_message_id: ctx.message.message_id });
       return;
     }
     if (isChatStopped(ctx.chat.id)) {
@@ -131,6 +185,16 @@ export function registerFixCommand(bot, options) {
       return;
     }
 
+    // Issue #2166: fail immediately on any unsupported option, before a work
+    // session is spawned, so a typo can never turn into a silent no-op. Runs
+    // after --isolation extraction because that flag is consumed by /fix itself
+    // and is not part of the solve vocabulary the probe parser validates.
+    const optionsError = await validateFixCommandOptions(filteredArgs);
+    if (optionsError) {
+      await safeReply(ctx, `❌ Invalid options: ${escapeMarkdown(optionsError)}\n\nUse /help to see available options`, { reply_to_message_id: ctx.message.message_id });
+      return;
+    }
+
     // Issue #2085: /fix hands the generated issue off to /solve, so it must
     // apply the operator's solve overrides (TELEGRAM_SOLVE_OVERRIDES) exactly
     // like the /solve handler does — otherwise the solve started by /fix runs

package/src/telegram-language-command.lib.mjs

@@ -11,6 +11,7 @@
  */
 
 import { t, getSupportedLocales, normalizeLocale, setUserLocale, clearUserLocale, resolveLocaleFromTelegramCtx } from './i18n.lib.mjs';
+import { safeReply } from './telegram-safe-reply.lib.mjs';
 
 export function registerLanguageCommand(bot, options = {}) {
   const { VERBOSE = false, isOldMessage, isForwardedOrReply } = options;
@@ -27,14 +28,14 @@ export function registerLanguageCommand(bot, options = {}) {
     const arg = parts.length > 1 ? parts[1] : null;
     if (!arg) {
       const langName = t(`language.${locale}`, {}, { locale });
-      await ctx.reply(t('telegram.language_current', { language: langName, supported: supportedList }, { locale }), { parse_mode: 'Markdown', reply_to_message_id: ctx.message.message_id });
+      await safeReply(ctx, t('telegram.language_current', { language: langName, supported: supportedList }, { locale }), { reply_to_message_id: ctx.message.message_id });
       return;
     }
     if (['default', 'reset', 'clear'].includes(arg.toLowerCase())) {
       clearUserLocale(userId);
       const newLocale = resolveLocaleFromTelegramCtx(ctx);
       const langName = t(`language.${newLocale}`, {}, { locale: newLocale });
-      await ctx.reply(t('telegram.language_set', { language: langName }, { locale: newLocale }), { parse_mode: 'Markdown', reply_to_message_id: ctx.message.message_id });
+      await safeReply(ctx, t('telegram.language_set', { language: langName }, { locale: newLocale }), { reply_to_message_id: ctx.message.message_id });
       return;
     }
     const target = normalizeLocale(arg);
@@ -44,6 +45,6 @@ export function registerLanguageCommand(bot, options = {}) {
     }
     setUserLocale(userId, target);
     const langName = t(`language.${target}`, {}, { locale: target });
-    await ctx.reply(t('telegram.language_set', { language: langName }, { locale: target }), { parse_mode: 'Markdown', reply_to_message_id: ctx.message.message_id });
+    await safeReply(ctx, t('telegram.language_set', { language: langName }, { locale: target }), { reply_to_message_id: ctx.message.message_id });
   });
 }

package/src/telegram-log-command.lib.mjs

@@ -25,6 +25,7 @@ import os from 'os';
 import fs from 'fs/promises';
 import { constants as fsConstants } from 'fs';
 import { sanitizeForPublication, writeSanitizedPublicationFile } from './token-sanitization.lib.mjs';
+import { safeReply, safeReplyWithDocument, safeSendDocument } from './telegram-safe-reply.lib.mjs';
 
 const UUID_RE = /\b([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b/i;
 const ISOLATION_BACKENDS = new Set(['screen', 'tmux', 'docker']);
@@ -212,9 +213,9 @@ export async function registerLogCommand(bot, options) {
     const sessionId = directSessionId || replySessionId;
 
     if (!sessionId) {
-      await ctx.reply('❌ /log requires a session id.\n\nUsage:\n• `/log <UUID>` — fetch a specific session log\n• Reply to a session message with `/log` — fetch the session referenced in that message', {
-        parse_mode: 'Markdown',
+      await safeReply(ctx, '❌ /log requires a session id.\n\nUsage:\n• `/log <UUID>` — fetch a specific session log\n• Reply to a session message with `/log` — fetch the session referenced in that message', {
         reply_to_message_id: message.message_id,
+        verbose: VERBOSE,
       });
       return;
     }
@@ -261,9 +262,9 @@ export async function registerLogCommand(bot, options) {
     }
 
     if (!statusResult || !statusResult.exists) {
-      await ctx.reply(`❌ Session \`${sessionId}\` is not known to start-command.\n\nUse the session id from a \`📊 Session: <uuid>\` line in one of the bot's status messages.`, {
-        parse_mode: 'Markdown',
+      await safeReply(ctx, `❌ Session \`${sessionId}\` is not known to start-command.\n\nUse the session id from a \`📊 Session: <uuid>\` line in one of the bot's status messages.`, {
         reply_to_message_id: message.message_id,
+        verbose: VERBOSE,
       });
       return;
     }
@@ -305,17 +306,17 @@ export async function registerLogCommand(bot, options) {
       return;
     }
     if (!(await fileExists(logPath))) {
-      await ctx.reply(`❌ Log file does not exist on disk:\n\`${logPath}\`\n\nThe session may have been cleaned up by the host or the isolation backend.`, {
-        parse_mode: 'Markdown',
+      await safeReply(ctx, `❌ Log file does not exist on disk:\n\`${logPath}\`\n\nThe session may have been cleaned up by the host or the isolation backend.`, {
         reply_to_message_id: message.message_id,
+        verbose: VERBOSE,
       });
       return;
     }
     const size = await fileSize(logPath);
     if (size !== null && size > TELEGRAM_DOCUMENT_MAX_BYTES) {
-      await ctx.reply(`❌ Log file is ${(size / (1024 * 1024)).toFixed(1)} MB which exceeds Telegram's 50 MB document upload limit.\n\nFile path on host: \`${logPath}\``, {
-        parse_mode: 'Markdown',
+      await safeReply(ctx, `❌ Log file is ${(size / (1024 * 1024)).toFixed(1)} MB which exceeds Telegram's 50 MB document upload limit.\n\nFile path on host: \`${logPath}\``, {
         reply_to_message_id: message.message_id,
+        verbose: VERBOSE,
       });
       return;
     }
@@ -333,7 +334,7 @@ export async function registerLogCommand(bot, options) {
       let upload;
       try {
         upload = await prepareSanitizedLogUpload(logPath, caption);
-        await ctx.replyWithDocument({ source: upload.path, filename }, { reply_to_message_id: message.message_id, caption: upload.caption, parse_mode: 'Markdown' });
+        await safeReplyWithDocument(ctx, { source: upload.path, filename }, { reply_to_message_id: message.message_id, caption: upload.caption, parse_mode: 'Markdown', verbose: VERBOSE });
       } catch (error) {
         console.error('[ERROR] /log: replyWithDocument failed:', error);
         await ctx.reply('❌ Failed to sanitize or upload the log.', { reply_to_message_id: message.message_id });
@@ -382,7 +383,8 @@ export async function registerLogCommand(bot, options) {
       upload = await prepareSanitizedLogUpload(logPath, caption);
       const replyOpts = forwardedMessageId ? { reply_to_message_id: forwardedMessageId, caption, parse_mode: 'Markdown' } : { caption, parse_mode: 'Markdown' };
       replyOpts.caption = upload.caption;
-      await ctx.telegram.sendDocument(userId, { source: upload.path, filename }, replyOpts);
+      replyOpts.verbose = VERBOSE;
+      await safeSendDocument(ctx.telegram, userId, { source: upload.path, filename }, replyOpts);
     } catch (error) {
       console.error('[ERROR] /log: sendDocument to DM failed:', error);
       // Tell the user, in their original chat, that DM delivery failed
@@ -397,9 +399,9 @@ export async function registerLogCommand(bot, options) {
     // Acknowledge in the original chat (only if it wasn't already a DM).
     if (chatType !== 'private') {
       try {
-        await ctx.reply(`📬 Sent the log for \`${sessionId}\` to your direct messages (private repository).`, {
-          parse_mode: 'Markdown',
+        await safeReply(ctx, `📬 Sent the log for \`${sessionId}\` to your direct messages (private repository).`, {
           reply_to_message_id: message.message_id,
+          verbose: VERBOSE,
         });
       } catch (error) {
         console.error('[ERROR] /log: failed to acknowledge in chat:', error);