@link-assistant/hive-mind 2.13.1 → 2.13.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @link-assistant/hive-mind
 
+## 2.13.2
+
+### Patch Changes
+
+- 6b0435a: Make every Telegram message the bot sends visible. A single unpaired `_` in a repository name (`save_visiogetbb`) made `parse_mode: 'Markdown'` messages fail with `400: can't parse entities`, and because the plain-text fallback was installed on `bot.telegram` — while telegraf hands each handler a _different_ `Telegram` instance — the fallback never ran, so `/stop` cancelled the task but reported nothing. All sends now go through one funnel that validates the text against a port of TDLib's `parse_markdown()` before the call, logs every attempt/success/rejection, chunks at 4096 chars, and retries as plain text on any `400`; the funnel is re-installed on every per-update context, covers document captions, and a new `telegram-safety/no-unsafe-telegram-send` ESLint rule makes a raw `parse_mode` send a build error. Also: `/stop` and queue cards echo only the URL actually interpreted (no `#issuecomment-…` anchor), mentions no longer render a literal `\_`, and `/fix` rejects unsupported options (`--ci-de`) up front instead of silently spawning a wrong run.
+
 ## 2.13.1
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "2.13.1",
+  "version": "2.13.2",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",

package/src/buildUserMention.lib.mjs

@@ -1,3 +1,20 @@
+/**
+ * Make a display name safe to use as the label of a legacy-Markdown entity
+ * (`[label](url)`).
+ *
+ * Inside an entity TDLib copies bytes verbatim, so nothing needs escaping — but
+ * a literal `]` would terminate the entity early and turn the rest of the
+ * message into garbage. Those two delimiters are therefore dropped; `_` and `*`
+ * are deliberately left alone (issue #2166).
+ *
+ * @param {string} label - Raw display name.
+ * @returns {string} Label safe to embed between `[` and `]`.
+ */
+export function escapeMarkdownEntityLabel(label) {
+  if (!label || typeof label !== 'string') return label;
+  return label.replace(/[[\]]/g, '');
+}
+
 /**
  * Build a Telegram user mention link in various parse modes.
  *
@@ -42,9 +59,19 @@ export function buildUserMention({ user, id: idParam, username: usernameParam, f
   switch (parseMode) {
     case 'Markdown': {
       // Legacy Markdown: [text](url)
-      // Escape _ and * in display name to prevent "can't find end of entity" errors (issue #1460)
-      const escapedMarkdownName = displayName.replace(/_/g, '\\_').replace(/\*/g, '\\*');
-      return `[${escapedMarkdownName}](${link})`;
+      //
+      // Issue #2166: do NOT backslash-escape `_` / `*` here. TDLib's
+      // `parse_markdown()` only unescapes `\_ \* \` \[` at the *top level*; once it
+      // is inside an entity it copies bytes verbatim until the closing `]`:
+      //
+      //   while (i < size && text[i] != end_character) { … text[result_size++] = text[i++]; }
+      //
+      // So `[@my\_user](…)` renders the backslashes literally — that is the
+      // unpolished `\_` the issue reports. The label is already inside the entity,
+      // which is what actually prevents the "can't find end of entity" error from
+      // issue #1460; only the delimiters themselves are dangerous.
+      const labelName = escapeMarkdownEntityLabel(displayName);
+      return `[${labelName}](${link})`;
     }
     case 'MarkdownV2': {
       // MarkdownV2 requires escaping special characters

package/src/github-url-parser.lib.mjs

@@ -5,7 +5,8 @@ import { reportError } from './sentry.lib.mjs';
  * @param {string} url - The GitHub URL to parse
  * @returns {Object} Parsed URL information including:
  *   - valid: boolean indicating if the URL is valid
- *   - normalized: the normalized URL (https://github.com/...)
+ *   - normalized: the normalized URL (https://github.com/...), query/fragment kept
+ *   - canonical: the URL the bot actually interprets (no query string, no #fragment)
  *   - type: 'user', 'repo', 'issue', 'pull', 'gist', 'actions', etc.
  *   - owner: repository owner/organization
  *   - repo: repository name (if applicable)
@@ -96,6 +97,13 @@ export function parseGitHubUrl(url) {
   const result = {
     valid: true,
     normalized: normalizedUrl,
+    // Issue #2166: `normalized` keeps whatever query string or fragment the user
+    // pasted (`…/pull/18#issuecomment-5370631063`), but nothing downstream reads
+    // it — the bot resolves the target from owner/repo/number alone. Echoing the
+    // fragment back therefore claims an interpretation that never happened, so
+    // `canonical` is the URL the bot actually acted on and is what gets shown,
+    // queued and matched against.
+    canonical: `https://github.com${urlObj.pathname.replace(/\/+$/, '')}`,
     hostname: 'github.com',
     protocol: 'https',
     path: urlObj.pathname,
@@ -242,6 +250,23 @@ export function normalizeGitHubUrl(url) {
   return parsed.valid ? parsed.normalized : null;
 }
 
+/**
+ * Reduce a GitHub URL to the part the tooling actually interprets: no query
+ * string, no `#issuecomment-…` fragment, no trailing slash.
+ *
+ * Used wherever a URL is echoed back to a user, stored as a queue key, or
+ * compared against another URL, so that a link copied from a comment and the
+ * same link copied from the address bar name one and the same task (issue #2166).
+ *
+ * @param {string} url
+ * @returns {string} The canonical URL, or the trimmed input when it cannot be parsed.
+ */
+export function canonicalizeGitHubUrl(url) {
+  if (!url || typeof url !== 'string') return url;
+  const parsed = parseGitHubUrl(url);
+  return parsed.valid && parsed.canonical ? parsed.canonical : url.trim();
+}
+
 /** Build the canonical web URL for a pull request already identified by GitHub. */
 export function buildGitHubPullRequestUrl({ owner, repo, number } = {}) {
   if (!owner || !repo || !Number.isInteger(Number(number)) || Number(number) <= 0) {

package/src/session-monitor.lib.mjs

@@ -23,6 +23,7 @@ import fs from 'fs/promises';
 import { promisify } from 'util';
 import { formatSessionCompletionMessage, getSessionCompletionExitCode, classifySessionOutcome } from './work-session-formatting.lib.mjs';
 import { notifySubscribers, getSubscriberCount } from './telegram-subscribers.lib.mjs';
+import { safeSendMessage, safeEditMessageText } from './telegram-safe-reply.lib.mjs';
 import { classifyExitStatus, normalizeExitCode } from './session-status.lib.mjs';
 import { readLastSessionIdFromLog, buildResumeCommand, formatResumeSection } from './session-resume.lib.mjs';
 import { resolveFailedSessionPullRequestState } from './github-pr-state.lib.mjs';
@@ -942,11 +943,11 @@ export async function monitorSessions(bot, verbose = false, options = {}) {
         let notifyFromChatId = null;
         let notifyMessageId = null;
         if (sessionInfo.messageId) {
-          await bot.telegram.editMessageText(sessionInfo.chatId, sessionInfo.messageId, undefined, message, { parse_mode: 'Markdown' });
+          await safeEditMessageText(bot.telegram, sessionInfo.chatId, sessionInfo.messageId, undefined, message, { verbose });
           notifyFromChatId = sessionInfo.chatId;
           notifyMessageId = sessionInfo.messageId;
         } else {
-          const sent = await bot.telegram.sendMessage(sessionInfo.chatId, message, { parse_mode: 'Markdown' });
+          const sent = await safeSendMessage(bot.telegram, sessionInfo.chatId, message, { verbose });
           notifyFromChatId = sent?.chat?.id || sessionInfo.chatId;
           notifyMessageId = sent?.message_id || null;
         }

package/src/telegram-accept-invitations.lib.mjs

@@ -19,6 +19,7 @@
 import { promisify } from 'util';
 import { exec as execCallback } from 'child_process';
 import { ghWithRateLimitRetry } from './github-rate-limit.lib.mjs';
+import { safeReply, safeEditMessageText } from './telegram-safe-reply.lib.mjs';
 
 const execRaw = promisify(execCallback);
 // Issue #1726: rate-limit safe gh wrapper.
@@ -148,9 +149,10 @@ export function registerAcceptInvitesCommand(bot, options) {
       return await ctx.reply(errMsg, { reply_to_message_id: ctx.message.message_id });
     }
 
-    const fetchingMessage = await ctx.reply('🔄 Fetching pending GitHub invitations\\.\\.\\.', {
+    const fetchingMessage = await safeReply(ctx, '🔄 Fetching pending GitHub invitations\\.\\.\\.', {
       reply_to_message_id: ctx.message.message_id,
       parse_mode: 'MarkdownV2',
+      verbose: VERBOSE,
     });
 
     // State for tracking progress
@@ -169,7 +171,7 @@ export function registerAcceptInvitesCommand(bot, options) {
     const updateMessage = async () => {
       try {
         const message = buildProgressMessage(state);
-        await ctx.telegram.editMessageText(fetchingMessage.chat.id, fetchingMessage.message_id, undefined, message, { parse_mode: 'MarkdownV2' });
+        await safeEditMessageText(ctx.telegram, fetchingMessage.chat.id, fetchingMessage.message_id, undefined, message, { parse_mode: 'MarkdownV2', verbose: VERBOSE });
       } catch (err) {
         // Ignore "message not modified" errors
         if (!err.message?.includes('message is not modified')) {
@@ -238,7 +240,7 @@ export function registerAcceptInvitesCommand(bot, options) {
     } catch (error) {
       console.error('Error in /accept_invites:', error);
       const escapedError = escapeMarkdown(error.message);
-      await ctx.telegram.editMessageText(fetchingMessage.chat.id, fetchingMessage.message_id, undefined, `❌ Error fetching invitations: ${escapedError}\n\nMake sure \`gh\` CLI is installed and authenticated\\.`, { parse_mode: 'MarkdownV2' });
+      await safeEditMessageText(ctx.telegram, fetchingMessage.chat.id, fetchingMessage.message_id, undefined, `❌ Error fetching invitations: ${escapedError}\n\nMake sure \`gh\` CLI is installed and authenticated\\.`, { parse_mode: 'MarkdownV2', verbose: VERBOSE });
     }
   });
 }

package/src/telegram-bot.mjs

@@ -244,8 +244,8 @@ const { applySolveToolAlias, getFirstParsedPositionalArg, getSolveCommandNameFro
 const { executeStartScreen: executeStartScreenCommand, buildExecuteAndUpdateMessage } = await import('./telegram-command-execution.lib.mjs');
 const { isChatStopped, getChatStopInfo, getStoppedChatRejectMessage, DEFAULT_STOP_REASON } = await import('./telegram-start-stop-command.lib.mjs');
 const { isOldMessage: _isOldMessage, isGroupChat: _isGroupChat, isChatAuthorized: _isChatAuthorized, isForwarded: _isForwarded, isForwardedOrReply: _isForwardedOrReply, extractCommandFromText, extractGitHubUrl: _extractGitHubUrl } = await import('./telegram-message-filters.lib.mjs');
-const { installTelegramFormattingFallback, isTelegramFormattingError, isTelegramMessageTooLongError, safeEditMessageText, safeReply, TELEGRAM_TEXT_LIMIT } = await import('./telegram-safe-reply.lib.mjs');
-const { installTelegramRateLimitTracker } = await import('./telegram-rate-limit.lib.mjs');
+const { isTelegramFormattingError, isTelegramMessageTooLongError, safeEditMessageText, safeReply, safeSendMessage, TELEGRAM_TEXT_LIMIT } = await import('./telegram-safe-reply.lib.mjs');
+const { installTelegramContextSafety } = await import('./telegram-context-safety.lib.mjs');
 const { registerTerminalWatchCommand, startAutoTerminalWatchForSession } = await import('./telegram-terminal-watch-command.lib.mjs');
 const { launchBotWithRetry } = await import('./telegram-bot-launcher.lib.mjs');
 const { trackSession, untrackSession, startSessionMonitoring, hasActiveSessionForUrlAsync, findStoppableSessionByUrl, setSessionStore, setSessionLogger, resumeTrackedSessions, getActiveSessionCount } = await import('./session-monitor.lib.mjs');
@@ -271,8 +271,10 @@ const { Telegraf } = telegrafModule;
 const bot = new Telegraf(BOT_TOKEN, {
   handlerTimeout: Infinity, // Remove default 90s timeout; command handlers like /solve spawn long-running processes
 });
-installTelegramFormattingFallback(bot.telegram, { verbose: VERBOSE });
-installTelegramRateLimitTracker(bot.telegram, { verbose: VERBOSE });
+// Issue #2166: Telegraf hands every update a *new* `Telegram` client, so
+// instrumenting `bot.telegram` alone leaves `ctx.reply()` unprotected. Install
+// on the bot client (for background sends) and on each per-update context.
+installTelegramContextSafety(bot, { verbose: VERBOSE });
 // Track bot startup time (Unix seconds to match Telegram's message.date format)
 const BOT_START_TIME = Math.floor(Date.now() / 1000);
 
@@ -522,7 +524,9 @@ bot.command('version', async ctx => {
 const { registerLanguageCommand } = await import('./telegram-language-command.lib.mjs');
 registerLanguageCommand(bot, { VERBOSE, isOldMessage, isForwardedOrReply });
 const { registerAcceptInvitesCommand } = await import('./telegram-accept-invitations.lib.mjs');
-const sharedCommandOpts = { VERBOSE, isOldMessage, isForwarded, isForwardedOrReply, isGroupChat: _isGroupChat, isChatAuthorized, isTopicAuthorized, buildAuthErrorMessage, addBreadcrumb, isChatStopped, getStoppedChatRejectMessage };
+// Issue #2166 (R7): every command module gets the same send helpers, so no
+// command can drift back to a raw, unvalidated, unlogged `ctx.reply`.
+const sharedCommandOpts = { VERBOSE, isOldMessage, isForwarded, isForwardedOrReply, isGroupChat: _isGroupChat, isChatAuthorized, isTopicAuthorized, buildAuthErrorMessage, addBreadcrumb, isChatStopped, getStoppedChatRejectMessage, safeReply, safeEditMessageText };
 registerAcceptInvitesCommand(bot, sharedCommandOpts);
 const { registerMergeCommand } = await import('./telegram-merge-command.lib.mjs');
 registerMergeCommand(bot, sharedCommandOpts);
@@ -673,6 +677,9 @@ async function handleSolveCommand(ctx) {
     return;
   }
   userArgs = moveArgumentToFront(userArgs, validation.normalizedUrl, cleanNonPrintableChars);
+  // Issue #2166: hand the spawned session the same canonical URL that is shown
+  // in the chat, so the echo and the actual work can never disagree.
+  if (validation.parsed?.canonical && userArgs[0] && cleanNonPrintableChars(userArgs[0]) === validation.normalizedUrl) userArgs[0] = validation.parsed.canonical;
   const { backend: solvePerCommandIsolation, filteredArgs: userArgsWithoutIsolation } = extractIsolationFromArgs(userArgs); // issue #1534
   if (solvePerCommandIsolation && !isValidPerCommandIsolation(solvePerCommandIsolation)) {
     await safeReply(ctx, t('telegram.invalid_isolation', { value: escapeMarkdown(solvePerCommandIsolation) }, { locale: solveLocale }), { reply_to_message_id: ctx.message.message_id });
@@ -739,8 +746,10 @@ async function handleSolveCommand(ctx) {
     await safeReply(ctx, `❌ ${escapeMarkdown(entityCheck.error)}`, { reply_to_message_id: ctx.message.message_id });
     return;
   }
-  // Use normalized URL from validation to ensure consistent duplicate detection (issue #1080)
-  const normalizedUrl = validation.parsed.normalized;
+  // Use the canonical URL from validation to ensure consistent duplicate
+  // detection (issue #1080) and to echo back only what the bot interpreted —
+  // a `#issuecomment-…` fragment is never used to resolve the target (#2166).
+  const normalizedUrl = validation.parsed.canonical || validation.parsed.normalized;
 
   const requester = buildUserMention({ user: ctx.from, parseMode: 'Markdown' });
   // #1228: only user options; #1460: escape; #1688: 'Issue:' / 'Pull request:' label so completion can append PR link.
@@ -777,7 +786,7 @@ async function handleSolveCommand(ctx) {
   }
 
   // Issue #1688: parsed URL context lets the completion message look up linked PRs.
-  const solveUrlContext = validation.parsed ? { owner: validation.parsed.owner, repo: validation.parsed.repo, number: validation.parsed.number, type: validation.parsed.type, normalized: validation.parsed.normalized || normalizedUrl } : null;
+  const solveUrlContext = validation.parsed ? { owner: validation.parsed.owner, repo: validation.parsed.repo, number: validation.parsed.number, type: validation.parsed.type, normalized: normalizedUrl } : null;
   const toolQueuedCount = queueStats.queuedByTool[solveTool] || 0; // tool-specific queue count (#1551)
   // Issue #378: propagate user's effective Telegram locale to the spawned solve session.
   const argsWithLocale = injectLanguageIfMissing(args, solveLocale);
@@ -998,7 +1007,7 @@ registerLeakNotifier(async ({ owner, repo, prNumber, tokenHits = [] }) => {
         if (creator && creator.user?.id) ownerUserId = creator.user.id;
       }
       if (ownerUserId) {
-        await bot.telegram.sendMessage(ownerUserId, text, { parse_mode: 'Markdown' }).catch(err => {
+        await safeSendMessage(bot.telegram, ownerUserId, text, { verbose: VERBOSE }).catch(err => {
           console.warn(`[telegram-leak-notifier] DM to user ${ownerUserId} (chat ${chatId}) failed: ${err.message}`);
         });
       }

package/src/telegram-command-execution.lib.mjs

@@ -3,6 +3,7 @@ import { describeChildExit } from './child-exit.lib.mjs';
 import { promisify } from 'util';
 import { exec as execCallback } from 'child_process';
 import { formatFailedLaunchMessage as defaultFormatFailedLaunchMessage } from './work-session-formatting.lib.mjs';
+import { safeEditMessageText } from './telegram-safe-reply.lib.mjs';
 
 const exec = promisify(execCallback);
 
@@ -106,7 +107,7 @@ export function buildExecuteAndUpdateMessage(deps) {
     const { chat, message_id: msgId } = startingMessage;
     const safeEdit = async text => {
       try {
-        await ctx.telegram.editMessageText(chat.id, msgId, undefined, text, { parse_mode: 'Markdown' });
+        await safeEditMessageText(ctx.telegram, chat.id, msgId, undefined, text, { verbose: VERBOSE });
       } catch (e) {
         console.error(`[telegram-bot] Failed to update message for ${commandName}: ${e.message}`);
       }

package/src/telegram-context-safety.lib.mjs

@@ -0,0 +1,70 @@
+/**
+ * Per-update Telegram instrumentation (issue #2166).
+ *
+ * Telegraf does **not** reuse `bot.telegram` when handling an update. Every
+ * update gets a brand new `Telegram` client so that `webhookReply` can answer on
+ * the open HTTP response:
+ *
+ * ```js
+ * // telegraf/lib/telegraf.js — handleUpdate()
+ * const tg = new telegram_1.default(this.token, this.telegram.options, webhookResponse);
+ * const ctx = new TelegrafContext(update, tg, this.botInfo);
+ * ```
+ *
+ * Consequently `ctx.telegram !== bot.telegram`, and anything installed on
+ * `bot.telegram` (the plain-text formatting fallback, the rate-limit tracker) is
+ * invisible to `ctx.reply()`, `ctx.telegram.sendMessage()` and
+ * `ctx.telegram.editMessageText()` — which is how *every* command handler talks
+ * to Telegram. That is why the `/stop` confirmation in issue #2166 died with an
+ * unhandled `Can't find end of the entity starting at byte offset 65` instead of
+ * degrading to plain text.
+ *
+ * This module re-installs the instrumentation on each freshly created context,
+ * so a single send path — `installTelegramFormattingFallback` — covers the whole
+ * bot regardless of which object a handler happens to call.
+ *
+ * @module telegram-context-safety.lib
+ * @see https://github.com/link-assistant/hive-mind/issues/2166
+ */
+
+import { installTelegramFormattingFallback } from './telegram-safe-reply.lib.mjs';
+import { installTelegramRateLimitTracker } from './telegram-rate-limit.lib.mjs';
+
+/**
+ * Install the formatting fallback and rate-limit tracker on one Telegram client.
+ * Both installers are idempotent (guarded by a symbol), so calling this on an
+ * already-protected client is a no-op.
+ *
+ * @param {object} telegram - A Telegraf `Telegram` client instance.
+ * @param {{verbose?: boolean, fallbackLocale?: string|null, tracker?: object}} [options]
+ * @returns {object|null} The same client, or `null` when there is nothing to protect.
+ */
+export function protectTelegramClient(telegram, options = {}) {
+  if (!telegram) return null;
+  const { verbose = false, fallbackLocale = null, tracker } = options;
+  installTelegramFormattingFallback(telegram, { verbose, fallbackLocale });
+  installTelegramRateLimitTracker(telegram, tracker ? { verbose, tracker } : { verbose });
+  return telegram;
+}
+
+/**
+ * Register the per-update protection as the very first middleware of a bot.
+ *
+ * Must run before any command handler so that handlers which call `ctx.reply()`
+ * directly still get the plain-text fallback and the send audit log.
+ *
+ * @param {object} bot - A Telegraf bot instance.
+ * @param {{verbose?: boolean, fallbackLocale?: string|null, tracker?: object}} [options]
+ * @returns {object} The bot, for chaining.
+ */
+export function installTelegramContextSafety(bot, options = {}) {
+  if (!bot) return bot;
+  protectTelegramClient(bot.telegram, options);
+  if (typeof bot.use === 'function') {
+    bot.use((ctx, next) => {
+      protectTelegramClient(ctx?.telegram, options);
+      return next();
+    });
+  }
+  return bot;
+}

package/src/telegram-fix-command.lib.mjs

@@ -8,6 +8,10 @@
  */
 
 import { buildUserMention } from './buildUserMention.lib.mjs';
+import { calculateLevenshteinDistance } from './option-suggestions.lib.mjs';
+import { getLinoYargsFactory } from './cli-arguments.lib.mjs';
+import { createYargsConfig as createSolveYargsConfig, detectMalformedFlags } from './solve.config.lib.mjs';
+import { parseArgsWithYargs } from './telegram-solve-command.lib.mjs';
 import { validateModelName } from './models/index.mjs';
 import { parseFixRepository } from './fix.ci-cd.lib.mjs';
 import { getModelFromArgs } from './model-args.lib.mjs';
@@ -15,6 +19,8 @@ import { escapeMarkdown } from './telegram-markdown.lib.mjs';
 import { extractIsolationFromArgs, isValidPerCommandIsolation } from './telegram-isolation.lib.mjs';
 import { mergeArgsWithOverrides } from './args-overrides.lib.mjs';
 import { moveArgumentToFront, parseCommandArgs } from './telegram-solve-command.lib.mjs';
+import { safeReply as defaultSafeReply } from './telegram-safe-reply.lib.mjs';
+import { partitionFixArgs } from './fix.ci-cd.lib.mjs';
 import { formatStartingWorkSessionMessage } from './work-session-formatting.lib.mjs';
 
 export const FIX_COMMAND_NAMES = Object.freeze(['fix']);
@@ -68,6 +74,54 @@ export function buildFixCommandArgs(text) {
   };
 }
 
+/**
+ * Options `/fix` consumes itself; everything else is forwarded to `/solve` and
+ * must therefore be a valid `solve` option.
+ */
+export const FIX_OWN_OPTIONS = Object.freeze(['--ci-cd', '--isolation', '--dry-run', '--no-solve', '--no-auto-solve', '--solve', '--help', '-h', '--version']);
+
+/**
+ * Reject a `/fix` request that contains any option `fix` or `solve` cannot act on.
+ *
+ * Issue #2166: a typo such as `--ci-de` used to be silently forwarded to
+ * `solve.mjs` inside the spawned work session, where the failure was invisible
+ * in the chat. `/fix` now fails immediately, in the same chat message, using the
+ * very same checks `/solve` runs (`detectMalformedFlags` + solve's strict yargs
+ * config), so no typo can slip through.
+ *
+ * @param {string[]} args - Arguments as produced by `buildFixCommandArgs().args`.
+ * @returns {Promise<string|null>} Error message to show the user, or `null` when valid.
+ */
+export async function validateFixCommandOptions(args) {
+  const list = Array.isArray(args) ? args : [];
+
+  const { malformed, errors } = detectMalformedFlags(list);
+  if (malformed.length > 0) return errors.join('\n');
+
+  // `--ci-de` is closer to `/fix`'s own `--ci-cd` than to anything solve knows,
+  // so check fix's own vocabulary first — otherwise the generic suggester points
+  // at unrelated solve options.
+  const partitioned = partitionFixArgs(list);
+  for (const arg of partitioned.passthrough) {
+    if (!arg.startsWith('-')) continue;
+    const name = arg.split('=')[0];
+    const closest = FIX_OWN_OPTIONS.map(option => ({ option, distance: calculateLevenshteinDistance(name, option) }))
+      .filter(candidate => candidate.distance > 0 && candidate.distance <= 2)
+      .sort((a, b) => a.distance - b.distance)[0];
+    if (closest) return `Unknown option "${name}". Did you mean "${closest.option}"?`;
+  }
+
+  // solve requires a positional issue URL; a placeholder keeps the parser happy
+  // so that only the *options* are judged here.
+  const probeArgs = ['https://github.com/owner/repo/issues/1', ...partitioned.passthrough];
+  try {
+    await parseArgsWithYargs(probeArgs, getLinoYargsFactory(), createSolveYargsConfig);
+  } catch (error) {
+    return error?.message || String(error);
+  }
+  return null;
+}
+
 // Issue #378: inject --language LOCALE into spawn args if no language flag is
 // already present, so spawned fix sessions inherit the user's effective locale.
 function injectLanguageIfMissing(args, locale) {
@@ -81,7 +135,7 @@ function injectLanguageIfMissing(args, locale) {
 }
 
 export function registerFixCommand(bot, options) {
-  const { VERBOSE, fixEnabled, addBreadcrumb, isOldMessage, isForwardedOrReply, isGroupChat, isTopicAuthorized, buildAuthErrorMessage, isChatStopped, getStoppedChatRejectMessage, safeReply, executeAndUpdateMessage, resolveLocale = null, solveOverrides = [] } = options;
+  const { VERBOSE, fixEnabled, addBreadcrumb, isOldMessage, isForwardedOrReply, isGroupChat, isTopicAuthorized, buildAuthErrorMessage, isChatStopped, getStoppedChatRejectMessage, safeReply = defaultSafeReply, executeAndUpdateMessage, resolveLocale = null, solveOverrides = [] } = options;
 
   async function handleFixCommand(ctx) {
     const commandDisplay = '/fix';
@@ -95,7 +149,7 @@ export function registerFixCommand(bot, options) {
     });
 
     if (!fixEnabled) {
-      await ctx.reply('❌ The fix command is disabled on this bot instance.');
+      await safeReply(ctx, '❌ The fix command is disabled on this bot instance.');
       return;
     }
     if (isOldMessage(ctx)) return;
@@ -107,11 +161,11 @@ export function registerFixCommand(bot, options) {
       return;
     }
     if (!isGroupChat(ctx)) {
-      await ctx.reply(`❌ The ${commandDisplay} command only works in group chats. Please add this bot to a group and make it an admin.`, { reply_to_message_id: ctx.message.message_id });
+      await safeReply(ctx, `❌ The ${commandDisplay} command only works in group chats. Please add this bot to a group and make it an admin.`, { reply_to_message_id: ctx.message.message_id });
       return;
     }
     if (!isTopicAuthorized(ctx)) {
-      await ctx.reply(buildAuthErrorMessage(ctx), { reply_to_message_id: ctx.message.message_id });
+      await safeReply(ctx, buildAuthErrorMessage(ctx), { reply_to_message_id: ctx.message.message_id });
       return;
     }
     if (isChatStopped(ctx.chat.id)) {
@@ -131,6 +185,16 @@ export function registerFixCommand(bot, options) {
       return;
     }
 
+    // Issue #2166: fail immediately on any unsupported option, before a work
+    // session is spawned, so a typo can never turn into a silent no-op. Runs
+    // after --isolation extraction because that flag is consumed by /fix itself
+    // and is not part of the solve vocabulary the probe parser validates.
+    const optionsError = await validateFixCommandOptions(filteredArgs);
+    if (optionsError) {
+      await safeReply(ctx, `❌ Invalid options: ${escapeMarkdown(optionsError)}\n\nUse /help to see available options`, { reply_to_message_id: ctx.message.message_id });
+      return;
+    }
+
     // Issue #2085: /fix hands the generated issue off to /solve, so it must
     // apply the operator's solve overrides (TELEGRAM_SOLVE_OVERRIDES) exactly
     // like the /solve handler does — otherwise the solve started by /fix runs

package/src/telegram-language-command.lib.mjs

@@ -11,6 +11,7 @@
  */
 
 import { t, getSupportedLocales, normalizeLocale, setUserLocale, clearUserLocale, resolveLocaleFromTelegramCtx } from './i18n.lib.mjs';
+import { safeReply } from './telegram-safe-reply.lib.mjs';
 
 export function registerLanguageCommand(bot, options = {}) {
   const { VERBOSE = false, isOldMessage, isForwardedOrReply } = options;
@@ -27,14 +28,14 @@ export function registerLanguageCommand(bot, options = {}) {
     const arg = parts.length > 1 ? parts[1] : null;
     if (!arg) {
       const langName = t(`language.${locale}`, {}, { locale });
-      await ctx.reply(t('telegram.language_current', { language: langName, supported: supportedList }, { locale }), { parse_mode: 'Markdown', reply_to_message_id: ctx.message.message_id });
+      await safeReply(ctx, t('telegram.language_current', { language: langName, supported: supportedList }, { locale }), { reply_to_message_id: ctx.message.message_id });
       return;
     }
     if (['default', 'reset', 'clear'].includes(arg.toLowerCase())) {
       clearUserLocale(userId);
       const newLocale = resolveLocaleFromTelegramCtx(ctx);
       const langName = t(`language.${newLocale}`, {}, { locale: newLocale });
-      await ctx.reply(t('telegram.language_set', { language: langName }, { locale: newLocale }), { parse_mode: 'Markdown', reply_to_message_id: ctx.message.message_id });
+      await safeReply(ctx, t('telegram.language_set', { language: langName }, { locale: newLocale }), { reply_to_message_id: ctx.message.message_id });
       return;
     }
     const target = normalizeLocale(arg);
@@ -44,6 +45,6 @@ export function registerLanguageCommand(bot, options = {}) {
     }
     setUserLocale(userId, target);
     const langName = t(`language.${target}`, {}, { locale: target });
-    await ctx.reply(t('telegram.language_set', { language: langName }, { locale: target }), { parse_mode: 'Markdown', reply_to_message_id: ctx.message.message_id });
+    await safeReply(ctx, t('telegram.language_set', { language: langName }, { locale: target }), { reply_to_message_id: ctx.message.message_id });
   });
 }

package/src/telegram-log-command.lib.mjs

@@ -25,6 +25,7 @@ import os from 'os';
 import fs from 'fs/promises';
 import { constants as fsConstants } from 'fs';
 import { sanitizeForPublication, writeSanitizedPublicationFile } from './token-sanitization.lib.mjs';
+import { safeReply, safeReplyWithDocument, safeSendDocument } from './telegram-safe-reply.lib.mjs';
 
 const UUID_RE = /\b([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b/i;
 const ISOLATION_BACKENDS = new Set(['screen', 'tmux', 'docker']);
@@ -212,9 +213,9 @@ export async function registerLogCommand(bot, options) {
     const sessionId = directSessionId || replySessionId;
 
     if (!sessionId) {
-      await ctx.reply('❌ /log requires a session id.\n\nUsage:\n• `/log <UUID>` — fetch a specific session log\n• Reply to a session message with `/log` — fetch the session referenced in that message', {
-        parse_mode: 'Markdown',
+      await safeReply(ctx, '❌ /log requires a session id.\n\nUsage:\n• `/log <UUID>` — fetch a specific session log\n• Reply to a session message with `/log` — fetch the session referenced in that message', {
         reply_to_message_id: message.message_id,
+        verbose: VERBOSE,
       });
       return;
     }
@@ -261,9 +262,9 @@ export async function registerLogCommand(bot, options) {
     }
 
     if (!statusResult || !statusResult.exists) {
-      await ctx.reply(`❌ Session \`${sessionId}\` is not known to start-command.\n\nUse the session id from a \`📊 Session: <uuid>\` line in one of the bot's status messages.`, {
-        parse_mode: 'Markdown',
+      await safeReply(ctx, `❌ Session \`${sessionId}\` is not known to start-command.\n\nUse the session id from a \`📊 Session: <uuid>\` line in one of the bot's status messages.`, {
         reply_to_message_id: message.message_id,
+        verbose: VERBOSE,
       });
       return;
     }
@@ -305,17 +306,17 @@ export async function registerLogCommand(bot, options) {
       return;
     }
     if (!(await fileExists(logPath))) {
-      await ctx.reply(`❌ Log file does not exist on disk:\n\`${logPath}\`\n\nThe session may have been cleaned up by the host or the isolation backend.`, {
-        parse_mode: 'Markdown',
+      await safeReply(ctx, `❌ Log file does not exist on disk:\n\`${logPath}\`\n\nThe session may have been cleaned up by the host or the isolation backend.`, {
         reply_to_message_id: message.message_id,
+        verbose: VERBOSE,
       });
       return;
     }
     const size = await fileSize(logPath);
     if (size !== null && size > TELEGRAM_DOCUMENT_MAX_BYTES) {
-      await ctx.reply(`❌ Log file is ${(size / (1024 * 1024)).toFixed(1)} MB which exceeds Telegram's 50 MB document upload limit.\n\nFile path on host: \`${logPath}\``, {
-        parse_mode: 'Markdown',
+      await safeReply(ctx, `❌ Log file is ${(size / (1024 * 1024)).toFixed(1)} MB which exceeds Telegram's 50 MB document upload limit.\n\nFile path on host: \`${logPath}\``, {
         reply_to_message_id: message.message_id,
+        verbose: VERBOSE,
       });
       return;
     }
@@ -333,7 +334,7 @@ export async function registerLogCommand(bot, options) {
       let upload;
       try {
         upload = await prepareSanitizedLogUpload(logPath, caption);
-        await ctx.replyWithDocument({ source: upload.path, filename }, { reply_to_message_id: message.message_id, caption: upload.caption, parse_mode: 'Markdown' });
+        await safeReplyWithDocument(ctx, { source: upload.path, filename }, { reply_to_message_id: message.message_id, caption: upload.caption, parse_mode: 'Markdown', verbose: VERBOSE });
       } catch (error) {
         console.error('[ERROR] /log: replyWithDocument failed:', error);
         await ctx.reply('❌ Failed to sanitize or upload the log.', { reply_to_message_id: message.message_id });
@@ -382,7 +383,8 @@ export async function registerLogCommand(bot, options) {
       upload = await prepareSanitizedLogUpload(logPath, caption);
       const replyOpts = forwardedMessageId ? { reply_to_message_id: forwardedMessageId, caption, parse_mode: 'Markdown' } : { caption, parse_mode: 'Markdown' };
       replyOpts.caption = upload.caption;
-      await ctx.telegram.sendDocument(userId, { source: upload.path, filename }, replyOpts);
+      replyOpts.verbose = VERBOSE;
+      await safeSendDocument(ctx.telegram, userId, { source: upload.path, filename }, replyOpts);
     } catch (error) {
       console.error('[ERROR] /log: sendDocument to DM failed:', error);
       // Tell the user, in their original chat, that DM delivery failed
@@ -397,9 +399,9 @@ export async function registerLogCommand(bot, options) {
     // Acknowledge in the original chat (only if it wasn't already a DM).
     if (chatType !== 'private') {
       try {
-        await ctx.reply(`📬 Sent the log for \`${sessionId}\` to your direct messages (private repository).`, {
-          parse_mode: 'Markdown',
+        await safeReply(ctx, `📬 Sent the log for \`${sessionId}\` to your direct messages (private repository).`, {
           reply_to_message_id: message.message_id,
+          verbose: VERBOSE,
         });
       } catch (error) {
         console.error('[ERROR] /log: failed to acknowledge in chat:', error);