@link-assistant/hive-mind 2.13.1 → 2.13.3

package/src/gemini.lib.mjs

@@ -22,7 +22,7 @@ import { defaultModels, geminiModels, isFormalAiModel } from './models/index.mjs
 import { isPrepareOnly, logPreparedToolCommand, resolveFormalAiToolExecution } from './formal-ai.lib.mjs';
 import { buildFormalAiPricingInfo } from './formal-ai-pricing.lib.mjs'; // Issue #2119
 import { checkPlaywrightMcpPackageAvailability } from './playwright-mcp.lib.mjs';
-import { classifyRetryableError, prepareRetryAfterError, waitWithCountdown } from './tool-retry.lib.mjs';
+import { classifyRetryableError, createTransientRetryBudget, prepareRetryAfterError, waitWithCountdown } from './tool-retry.lib.mjs';
 import { getCumulativeContextInputTokens, toTokenCount } from './context-fill.lib.mjs';
 import { ensureAiToolScratchIgnored, filterAiToolScratchFromStatus } from './ai-tool-scratch.lib.mjs';
 import { getTerminalEventCompletionHealth } from './tool-run-health.lib.mjs'; // Issue #1990
@@ -391,12 +391,15 @@ export const executeGeminiCommand = async params => {
   const { tempDir, workspaceTmpDir, branchName, prompt, systemPrompt, argv, log, formatAligned, getResourceSnapshot, forkedRepo, feedbackLines, geminiPath, $, waitForRetryDelay = waitWithCountdown } = params;
 
   let retryCount = 0;
+  // Issue #2169: retries are bounded by a wall-clock budget (12 h by default, configurable via
+  // HIVE_MIND_TRANSIENT_ERROR_RETRY_BUDGET_MS) instead of a low attempt count.
+  const transientRetryBudget = createTransientRetryBudget();
 
   const executeWithRetry = async () => {
     if (retryCount === 0) {
       await log(`\n${formatAligned('🤖', 'Executing Gemini:', argv.model.toUpperCase())}`);
     } else {
-      await log(`\n${formatAligned('🔄', 'Retry attempt:', `${retryCount}/${retryLimits.maxTransientErrorRetries}`)}`);
+      await log(`\n${formatAligned('🔄', 'Retry attempt:', `${retryCount} (${transientRetryBudget.describeProgress()})`)}`);
     }
 
     if (argv.verbose) {
@@ -515,7 +518,17 @@ export const executeGeminiCommand = async params => {
         if (retryableError.isRetryable) {
           const isRequestTimeoutRetry = retryableError.label === 'Request timeout';
           const maxRetries = isRequestTimeoutRetry ? retryLimits.maxRequestTimeoutRetries : retryLimits.maxTransientErrorRetries;
-          if (retryCount < maxRetries) {
+          // Issue #2169: the attempt count is only a runaway backstop — the 12-hour wall-clock budget
+          // (configurable) decides when to stop, and every wait honours the 3-minute minimum.
+          const retryDecision = transientRetryBudget.evaluate({
+            retryCount,
+            maxRetries,
+            initialDelayMs: isRequestTimeoutRetry ? retryLimits.initialRequestTimeoutDelayMs : retryLimits.initialTransientErrorDelayMs,
+            maxDelayMs: isRequestTimeoutRetry ? retryLimits.maxRequestTimeoutDelayMs : retryLimits.maxTransientErrorDelayMs,
+            minDelayMs: retryLimits.minTransientErrorDelayMs,
+          });
+          if (retryDecision.allowed) {
+            transientRetryBudget.grant();
             // Issue #2037: retry the same model on capacity errors before falling back;
             // after a capacity-driven model switch, retry quickly instead of waiting the
             // full transient backoff — the new model may be available now.
@@ -527,16 +540,17 @@ export const executeGeminiCommand = async params => {
               retryCount,
               initialDelayMs: isRequestTimeoutRetry ? retryLimits.initialRequestTimeoutDelayMs : retryLimits.initialTransientErrorDelayMs,
               maxDelayMs: isRequestTimeoutRetry ? retryLimits.maxRequestTimeoutDelayMs : retryLimits.maxTransientErrorDelayMs,
+              minDelayMs: retryLimits.minTransientErrorDelayMs,
             });
             const delay = retryPlan.delay;
             const delayLabel = delay >= 60000 ? `${Math.round(delay / 60000)} min` : `${Math.round(delay / 1000)}s`;
-            await log(`\n⚠️ ${retryableError.label} detected. Retry ${retryCount + 1}/${maxRetries} in ${delayLabel}${sessionId ? ' (session preserved)' : ''}...`, { level: 'warning' });
+            await log(`\n⚠️ ${retryableError.label} detected. Retry ${retryCount + 1} in ${delayLabel}${sessionId ? ' (session preserved)' : ''} (${transientRetryBudget.describeProgress()})...`, { level: 'warning' });
             await waitForRetryDelay(delay, log);
             await log('\n🔄 Retrying now...');
             retryCount++;
             return await executeWithRetry();
           }
-          await log(`\n\n❌ ${retryableError.label} persisted after ${maxRetries} retries`, { level: 'error' });
+          await log(`\n\n❌ ${retryableError.label} persisted: ${transientRetryBudget.describeExhaustion(retryDecision)}`, { level: 'error' });
         }
 
         const limitInfo = detectUsageLimit(errorText);

package/src/github-url-parser.lib.mjs

@@ -5,7 +5,8 @@ import { reportError } from './sentry.lib.mjs';
  * @param {string} url - The GitHub URL to parse
  * @returns {Object} Parsed URL information including:
  *   - valid: boolean indicating if the URL is valid
- *   - normalized: the normalized URL (https://github.com/...)
+ *   - normalized: the normalized URL (https://github.com/...), query/fragment kept
+ *   - canonical: the URL the bot actually interprets (no query string, no #fragment)
  *   - type: 'user', 'repo', 'issue', 'pull', 'gist', 'actions', etc.
  *   - owner: repository owner/organization
  *   - repo: repository name (if applicable)
@@ -96,6 +97,13 @@ export function parseGitHubUrl(url) {
   const result = {
     valid: true,
     normalized: normalizedUrl,
+    // Issue #2166: `normalized` keeps whatever query string or fragment the user
+    // pasted (`…/pull/18#issuecomment-5370631063`), but nothing downstream reads
+    // it — the bot resolves the target from owner/repo/number alone. Echoing the
+    // fragment back therefore claims an interpretation that never happened, so
+    // `canonical` is the URL the bot actually acted on and is what gets shown,
+    // queued and matched against.
+    canonical: `https://github.com${urlObj.pathname.replace(/\/+$/, '')}`,
     hostname: 'github.com',
     protocol: 'https',
     path: urlObj.pathname,
@@ -242,6 +250,23 @@ export function normalizeGitHubUrl(url) {
   return parsed.valid ? parsed.normalized : null;
 }
 
+/**
+ * Reduce a GitHub URL to the part the tooling actually interprets: no query
+ * string, no `#issuecomment-…` fragment, no trailing slash.
+ *
+ * Used wherever a URL is echoed back to a user, stored as a queue key, or
+ * compared against another URL, so that a link copied from a comment and the
+ * same link copied from the address bar name one and the same task (issue #2166).
+ *
+ * @param {string} url
+ * @returns {string} The canonical URL, or the trimmed input when it cannot be parsed.
+ */
+export function canonicalizeGitHubUrl(url) {
+  if (!url || typeof url !== 'string') return url;
+  const parsed = parseGitHubUrl(url);
+  return parsed.valid && parsed.canonical ? parsed.canonical : url.trim();
+}
+
 /** Build the canonical web URL for a pull request already identified by GitHub. */
 export function buildGitHubPullRequestUrl({ owner, repo, number } = {}) {
   if (!owner || !repo || !Number.isInteger(Number(number)) || Number(number) <= 0) {

package/src/opencode.lib.mjs

@@ -25,7 +25,7 @@ import { checkPlaywrightMcpPackageAvailability, getOpenCodePlaywrightMcpDisableE
 import { createAgentTokenUsage, accumulateAgentStepFinishUsage, parseAgentTokenUsage as parseOpenCodeTokenUsage } from './agent-token-usage.lib.mjs';
 import { createJsonStreamScanner } from './json-stream.lib.mjs';
 import { calculateAgentPricing } from './agent.lib.mjs';
-import { classifyRetryableError, prepareRetryAfterError, waitWithCountdown } from './tool-retry.lib.mjs';
+import { classifyRetryableError, createTransientRetryBudget, prepareRetryAfterError, waitWithCountdown } from './tool-retry.lib.mjs';
 import { ensureAiToolScratchIgnored, filterAiToolScratchFromStatus } from './ai-tool-scratch.lib.mjs';
 
 export { parseOpenCodeTokenUsage };
@@ -193,13 +193,16 @@ export const executeOpenCodeCommand = async params => {
 
   // Retry configuration
   let retryCount = 0;
+  // Issue #2169: retries are bounded by a wall-clock budget (12 h by default, configurable via
+  // HIVE_MIND_TRANSIENT_ERROR_RETRY_BUDGET_MS) instead of a low attempt count.
+  const transientRetryBudget = createTransientRetryBudget();
 
   const executeWithRetry = async () => {
     // Execute opencode command from the cloned repository directory
     if (retryCount === 0) {
       await log(`\n${formatAligned('🤖', 'Executing OpenCode:', argv.model.toUpperCase())}`);
     } else {
-      await log(`\n${formatAligned('🔄', 'Retry attempt:', `${retryCount}/${retryLimits.maxTransientErrorRetries}`)}`);
+      await log(`\n${formatAligned('🔄', 'Retry attempt:', `${retryCount} (${transientRetryBudget.describeProgress()})`)}`);
     }
 
     if (argv.verbose) {
@@ -483,7 +486,17 @@ export const executeOpenCodeCommand = async params => {
         if (retryableError.isRetryable) {
           const isRequestTimeoutRetry = retryableError.label === 'Request timeout';
           const maxRetries = isRequestTimeoutRetry ? retryLimits.maxRequestTimeoutRetries : retryLimits.maxTransientErrorRetries;
-          if (retryCount < maxRetries) {
+          // Issue #2169: the attempt count is only a runaway backstop — the 12-hour wall-clock budget
+          // (configurable) decides when to stop, and every wait honours the 3-minute minimum.
+          const retryDecision = transientRetryBudget.evaluate({
+            retryCount,
+            maxRetries,
+            initialDelayMs: isRequestTimeoutRetry ? retryLimits.initialRequestTimeoutDelayMs : retryLimits.initialTransientErrorDelayMs,
+            maxDelayMs: isRequestTimeoutRetry ? retryLimits.maxRequestTimeoutDelayMs : retryLimits.maxTransientErrorDelayMs,
+            minDelayMs: retryLimits.minTransientErrorDelayMs,
+          });
+          if (retryDecision.allowed) {
+            transientRetryBudget.grant();
             if (sessionId && !argv.resume) argv.resume = sessionId;
             // Issue #2037: retry the same model on capacity errors before falling back;
             // after a capacity-driven model switch, retry quickly instead of waiting the
@@ -496,16 +509,17 @@ export const executeOpenCodeCommand = async params => {
               retryCount,
               initialDelayMs: isRequestTimeoutRetry ? retryLimits.initialRequestTimeoutDelayMs : retryLimits.initialTransientErrorDelayMs,
               maxDelayMs: isRequestTimeoutRetry ? retryLimits.maxRequestTimeoutDelayMs : retryLimits.maxTransientErrorDelayMs,
+              minDelayMs: retryLimits.minTransientErrorDelayMs,
             });
             const delay = retryPlan.delay;
             const delayLabel = delay >= 60000 ? `${Math.round(delay / 60000)} min` : `${Math.round(delay / 1000)}s`;
-            await log(`\n⚠️ ${retryableError.label} detected. Retry ${retryCount + 1}/${maxRetries} in ${delayLabel}${sessionId ? ' (session preserved)' : ''}...`, { level: 'warning' });
+            await log(`\n⚠️ ${retryableError.label} detected. Retry ${retryCount + 1} in ${delayLabel}${sessionId ? ' (session preserved)' : ''} (${transientRetryBudget.describeProgress()})...`, { level: 'warning' });
             await waitForRetryDelay(delay, log);
             await log('\n🔄 Retrying now...');
             retryCount++;
             return await executeWithRetry();
           }
-          await log(`\n\n❌ ${retryableError.label} persisted after ${maxRetries} retries`, { level: 'error' });
+          await log(`\n\n❌ ${retryableError.label} persisted: ${transientRetryBudget.describeExhaustion(retryDecision)}`, { level: 'error' });
         }
 
         // Check for usage limit errors first (more specific)

package/src/qwen.lib.mjs

@@ -22,7 +22,7 @@ import { qwenModels, defaultModels, isFormalAiModel } from './models/index.mjs';
 import { buildFormalAiEnvExports, isPrepareOnly, logPreparedToolCommand, resolveFormalAiToolExecution } from './formal-ai.lib.mjs';
 import { buildFormalAiPricingInfo } from './formal-ai-pricing.lib.mjs'; // Issue #2119
 import { checkPlaywrightMcpPackageAvailability } from './playwright-mcp.lib.mjs';
-import { classifyRetryableError, prepareRetryAfterError, waitWithCountdown } from './tool-retry.lib.mjs';
+import { classifyRetryableError, createTransientRetryBudget, prepareRetryAfterError, waitWithCountdown } from './tool-retry.lib.mjs';
 import { getCumulativeContextInputTokens, getRestoredContextInputTokens, toTokenCount } from './context-fill.lib.mjs';
 import { ensureAiToolScratchIgnored, filterAiToolScratchFromStatus } from './ai-tool-scratch.lib.mjs';
 import { getTerminalEventCompletionHealth } from './tool-run-health.lib.mjs'; // Issue #1990
@@ -489,6 +489,9 @@ export const executeQwenCommand = async params => {
   const { tempDir, branchName, prompt, systemPrompt, argv, log, formatAligned = (_icon, label, value = '') => `${label} ${value}`.trim(), getResourceSnapshot = async () => ({ memory: '\nunknown', load: 'unknown' }), forkedRepo, feedbackLines, qwenPath = 'qwen', $: dollar = $, waitForRetryDelay = waitWithCountdown } = params;
 
   let retryCount = 0;
+  // Issue #2169: retries are bounded by a wall-clock budget (12 h by default, configurable via
+  // HIVE_MIND_TRANSIENT_ERROR_RETRY_BUDGET_MS) instead of a low attempt count.
+  const transientRetryBudget = createTransientRetryBudget();
   const promptFile = path.join(os.tmpdir(), `qwen_prompt_${Date.now()}_${process.pid}.txt`);
   const systemPromptFile = path.join(os.tmpdir(), `qwen_system_prompt_${Date.now()}_${process.pid}.txt`);
 
@@ -499,7 +502,7 @@ export const executeQwenCommand = async params => {
     if (retryCount === 0) {
       await log(`\n${formatAligned('🤖', 'Executing Qwen Code:', argv.model.toUpperCase())}`);
     } else {
-      await log(`\n${formatAligned('🔄', 'Retry attempt:', `${retryCount}/${retryLimits.maxTransientErrorRetries}`)}`);
+      await log(`\n${formatAligned('🔄', 'Retry attempt:', `${retryCount} (${transientRetryBudget.describeProgress()})`)}`);
     }
 
     if (argv.verbose) {
@@ -625,7 +628,17 @@ export const executeQwenCommand = async params => {
           if (retryableError.isRetryable) {
             const isRequestTimeoutRetry = retryableError.label === 'Request timeout';
             const maxRetries = isRequestTimeoutRetry ? retryLimits.maxRequestTimeoutRetries : retryLimits.maxTransientErrorRetries;
-            if (retryCount < maxRetries) {
+            // Issue #2169: the attempt count is only a runaway backstop — the 12-hour wall-clock budget
+            // (configurable) decides when to stop, and every wait honours the 3-minute minimum.
+            const retryDecision = transientRetryBudget.evaluate({
+              retryCount,
+              maxRetries,
+              initialDelayMs: isRequestTimeoutRetry ? retryLimits.initialRequestTimeoutDelayMs : retryLimits.initialTransientErrorDelayMs,
+              maxDelayMs: isRequestTimeoutRetry ? retryLimits.maxRequestTimeoutDelayMs : retryLimits.maxTransientErrorDelayMs,
+              minDelayMs: retryLimits.minTransientErrorDelayMs,
+            });
+            if (retryDecision.allowed) {
+              transientRetryBudget.grant();
               if (sessionId && !argv.resume) argv.resume = sessionId;
               // Issue #2037: retry the same model on capacity errors before falling back;
               // after a capacity-driven model switch, retry quickly instead of waiting the
@@ -638,16 +651,17 @@ export const executeQwenCommand = async params => {
                 retryCount,
                 initialDelayMs: isRequestTimeoutRetry ? retryLimits.initialRequestTimeoutDelayMs : retryLimits.initialTransientErrorDelayMs,
                 maxDelayMs: isRequestTimeoutRetry ? retryLimits.maxRequestTimeoutDelayMs : retryLimits.maxTransientErrorDelayMs,
+                minDelayMs: retryLimits.minTransientErrorDelayMs,
               });
               const delay = retryPlan.delay;
               const delayLabel = delay >= 60000 ? `${Math.round(delay / 60000)} min` : `${Math.round(delay / 1000)}s`;
-              await log(`\n⚠️ ${retryableError.label} detected. Retry ${retryCount + 1}/${maxRetries} in ${delayLabel}${sessionId ? ' (session preserved)' : ''}...`, { level: 'warning' });
+              await log(`\n⚠️ ${retryableError.label} detected. Retry ${retryCount + 1} in ${delayLabel}${sessionId ? ' (session preserved)' : ''} (${transientRetryBudget.describeProgress()})...`, { level: 'warning' });
               await waitForRetryDelay(delay, log);
               await log('\n🔄 Retrying now...');
               retryCount++;
               return await executeWithRetry();
             }
-            await log(`\n\n❌ ${retryableError.label} persisted after ${maxRetries} retries`, { level: 'error' });
+            await log(`\n\n❌ ${retryableError.label} persisted: ${transientRetryBudget.describeExhaustion(retryDecision)}`, { level: 'error' });
           } else if (exitCode === 130) {
             await log('\n\n⚠️ Qwen Code command interrupted (CTRL+C)');
           } else {

package/src/session-monitor.lib.mjs

@@ -23,6 +23,7 @@ import fs from 'fs/promises';
 import { promisify } from 'util';
 import { formatSessionCompletionMessage, getSessionCompletionExitCode, classifySessionOutcome } from './work-session-formatting.lib.mjs';
 import { notifySubscribers, getSubscriberCount } from './telegram-subscribers.lib.mjs';
+import { safeSendMessage, safeEditMessageText } from './telegram-safe-reply.lib.mjs';
 import { classifyExitStatus, normalizeExitCode } from './session-status.lib.mjs';
 import { readLastSessionIdFromLog, buildResumeCommand, formatResumeSection } from './session-resume.lib.mjs';
 import { resolveFailedSessionPullRequestState } from './github-pr-state.lib.mjs';
@@ -942,11 +943,11 @@ export async function monitorSessions(bot, verbose = false, options = {}) {
         let notifyFromChatId = null;
         let notifyMessageId = null;
         if (sessionInfo.messageId) {
-          await bot.telegram.editMessageText(sessionInfo.chatId, sessionInfo.messageId, undefined, message, { parse_mode: 'Markdown' });
+          await safeEditMessageText(bot.telegram, sessionInfo.chatId, sessionInfo.messageId, undefined, message, { verbose });
           notifyFromChatId = sessionInfo.chatId;
           notifyMessageId = sessionInfo.messageId;
         } else {
-          const sent = await bot.telegram.sendMessage(sessionInfo.chatId, message, { parse_mode: 'Markdown' });
+          const sent = await safeSendMessage(bot.telegram, sessionInfo.chatId, message, { verbose });
           notifyFromChatId = sent?.chat?.id || sessionInfo.chatId;
           notifyMessageId = sent?.message_id || null;
         }

package/src/telegram-accept-invitations.lib.mjs

@@ -19,6 +19,7 @@
 import { promisify } from 'util';
 import { exec as execCallback } from 'child_process';
 import { ghWithRateLimitRetry } from './github-rate-limit.lib.mjs';
+import { safeReply, safeEditMessageText } from './telegram-safe-reply.lib.mjs';
 
 const execRaw = promisify(execCallback);
 // Issue #1726: rate-limit safe gh wrapper.
@@ -148,9 +149,10 @@ export function registerAcceptInvitesCommand(bot, options) {
       return await ctx.reply(errMsg, { reply_to_message_id: ctx.message.message_id });
     }
 
-    const fetchingMessage = await ctx.reply('🔄 Fetching pending GitHub invitations\\.\\.\\.', {
+    const fetchingMessage = await safeReply(ctx, '🔄 Fetching pending GitHub invitations\\.\\.\\.', {
       reply_to_message_id: ctx.message.message_id,
       parse_mode: 'MarkdownV2',
+      verbose: VERBOSE,
     });
 
     // State for tracking progress
@@ -169,7 +171,7 @@ export function registerAcceptInvitesCommand(bot, options) {
     const updateMessage = async () => {
       try {
         const message = buildProgressMessage(state);
-        await ctx.telegram.editMessageText(fetchingMessage.chat.id, fetchingMessage.message_id, undefined, message, { parse_mode: 'MarkdownV2' });
+        await safeEditMessageText(ctx.telegram, fetchingMessage.chat.id, fetchingMessage.message_id, undefined, message, { parse_mode: 'MarkdownV2', verbose: VERBOSE });
       } catch (err) {
         // Ignore "message not modified" errors
         if (!err.message?.includes('message is not modified')) {
@@ -238,7 +240,7 @@ export function registerAcceptInvitesCommand(bot, options) {
     } catch (error) {
       console.error('Error in /accept_invites:', error);
       const escapedError = escapeMarkdown(error.message);
-      await ctx.telegram.editMessageText(fetchingMessage.chat.id, fetchingMessage.message_id, undefined, `❌ Error fetching invitations: ${escapedError}\n\nMake sure \`gh\` CLI is installed and authenticated\\.`, { parse_mode: 'MarkdownV2' });
+      await safeEditMessageText(ctx.telegram, fetchingMessage.chat.id, fetchingMessage.message_id, undefined, `❌ Error fetching invitations: ${escapedError}\n\nMake sure \`gh\` CLI is installed and authenticated\\.`, { parse_mode: 'MarkdownV2', verbose: VERBOSE });
     }
   });
 }

package/src/telegram-bot.mjs

@@ -244,8 +244,8 @@ const { applySolveToolAlias, getFirstParsedPositionalArg, getSolveCommandNameFro
 const { executeStartScreen: executeStartScreenCommand, buildExecuteAndUpdateMessage } = await import('./telegram-command-execution.lib.mjs');
 const { isChatStopped, getChatStopInfo, getStoppedChatRejectMessage, DEFAULT_STOP_REASON } = await import('./telegram-start-stop-command.lib.mjs');
 const { isOldMessage: _isOldMessage, isGroupChat: _isGroupChat, isChatAuthorized: _isChatAuthorized, isForwarded: _isForwarded, isForwardedOrReply: _isForwardedOrReply, extractCommandFromText, extractGitHubUrl: _extractGitHubUrl } = await import('./telegram-message-filters.lib.mjs');
-const { installTelegramFormattingFallback, isTelegramFormattingError, isTelegramMessageTooLongError, safeEditMessageText, safeReply, TELEGRAM_TEXT_LIMIT } = await import('./telegram-safe-reply.lib.mjs');
-const { installTelegramRateLimitTracker } = await import('./telegram-rate-limit.lib.mjs');
+const { isTelegramFormattingError, isTelegramMessageTooLongError, safeEditMessageText, safeReply, safeSendMessage, TELEGRAM_TEXT_LIMIT } = await import('./telegram-safe-reply.lib.mjs');
+const { installTelegramContextSafety } = await import('./telegram-context-safety.lib.mjs');
 const { registerTerminalWatchCommand, startAutoTerminalWatchForSession } = await import('./telegram-terminal-watch-command.lib.mjs');
 const { launchBotWithRetry } = await import('./telegram-bot-launcher.lib.mjs');
 const { trackSession, untrackSession, startSessionMonitoring, hasActiveSessionForUrlAsync, findStoppableSessionByUrl, setSessionStore, setSessionLogger, resumeTrackedSessions, getActiveSessionCount } = await import('./session-monitor.lib.mjs');
@@ -271,8 +271,10 @@ const { Telegraf } = telegrafModule;
 const bot = new Telegraf(BOT_TOKEN, {
   handlerTimeout: Infinity, // Remove default 90s timeout; command handlers like /solve spawn long-running processes
 });
-installTelegramFormattingFallback(bot.telegram, { verbose: VERBOSE });
-installTelegramRateLimitTracker(bot.telegram, { verbose: VERBOSE });
+// Issue #2166: Telegraf hands every update a *new* `Telegram` client, so
+// instrumenting `bot.telegram` alone leaves `ctx.reply()` unprotected. Install
+// on the bot client (for background sends) and on each per-update context.
+installTelegramContextSafety(bot, { verbose: VERBOSE });
 // Track bot startup time (Unix seconds to match Telegram's message.date format)
 const BOT_START_TIME = Math.floor(Date.now() / 1000);
 
@@ -522,7 +524,9 @@ bot.command('version', async ctx => {
 const { registerLanguageCommand } = await import('./telegram-language-command.lib.mjs');
 registerLanguageCommand(bot, { VERBOSE, isOldMessage, isForwardedOrReply });
 const { registerAcceptInvitesCommand } = await import('./telegram-accept-invitations.lib.mjs');
-const sharedCommandOpts = { VERBOSE, isOldMessage, isForwarded, isForwardedOrReply, isGroupChat: _isGroupChat, isChatAuthorized, isTopicAuthorized, buildAuthErrorMessage, addBreadcrumb, isChatStopped, getStoppedChatRejectMessage };
+// Issue #2166 (R7): every command module gets the same send helpers, so no
+// command can drift back to a raw, unvalidated, unlogged `ctx.reply`.
+const sharedCommandOpts = { VERBOSE, isOldMessage, isForwarded, isForwardedOrReply, isGroupChat: _isGroupChat, isChatAuthorized, isTopicAuthorized, buildAuthErrorMessage, addBreadcrumb, isChatStopped, getStoppedChatRejectMessage, safeReply, safeEditMessageText };
 registerAcceptInvitesCommand(bot, sharedCommandOpts);
 const { registerMergeCommand } = await import('./telegram-merge-command.lib.mjs');
 registerMergeCommand(bot, sharedCommandOpts);
@@ -673,6 +677,9 @@ async function handleSolveCommand(ctx) {
     return;
   }
   userArgs = moveArgumentToFront(userArgs, validation.normalizedUrl, cleanNonPrintableChars);
+  // Issue #2166: hand the spawned session the same canonical URL that is shown
+  // in the chat, so the echo and the actual work can never disagree.
+  if (validation.parsed?.canonical && userArgs[0] && cleanNonPrintableChars(userArgs[0]) === validation.normalizedUrl) userArgs[0] = validation.parsed.canonical;
   const { backend: solvePerCommandIsolation, filteredArgs: userArgsWithoutIsolation } = extractIsolationFromArgs(userArgs); // issue #1534
   if (solvePerCommandIsolation && !isValidPerCommandIsolation(solvePerCommandIsolation)) {
     await safeReply(ctx, t('telegram.invalid_isolation', { value: escapeMarkdown(solvePerCommandIsolation) }, { locale: solveLocale }), { reply_to_message_id: ctx.message.message_id });
@@ -739,8 +746,10 @@ async function handleSolveCommand(ctx) {
     await safeReply(ctx, `❌ ${escapeMarkdown(entityCheck.error)}`, { reply_to_message_id: ctx.message.message_id });
     return;
   }
-  // Use normalized URL from validation to ensure consistent duplicate detection (issue #1080)
-  const normalizedUrl = validation.parsed.normalized;
+  // Use the canonical URL from validation to ensure consistent duplicate
+  // detection (issue #1080) and to echo back only what the bot interpreted —
+  // a `#issuecomment-…` fragment is never used to resolve the target (#2166).
+  const normalizedUrl = validation.parsed.canonical || validation.parsed.normalized;
 
   const requester = buildUserMention({ user: ctx.from, parseMode: 'Markdown' });
   // #1228: only user options; #1460: escape; #1688: 'Issue:' / 'Pull request:' label so completion can append PR link.
@@ -777,7 +786,7 @@ async function handleSolveCommand(ctx) {
   }
 
   // Issue #1688: parsed URL context lets the completion message look up linked PRs.
-  const solveUrlContext = validation.parsed ? { owner: validation.parsed.owner, repo: validation.parsed.repo, number: validation.parsed.number, type: validation.parsed.type, normalized: validation.parsed.normalized || normalizedUrl } : null;
+  const solveUrlContext = validation.parsed ? { owner: validation.parsed.owner, repo: validation.parsed.repo, number: validation.parsed.number, type: validation.parsed.type, normalized: normalizedUrl } : null;
   const toolQueuedCount = queueStats.queuedByTool[solveTool] || 0; // tool-specific queue count (#1551)
   // Issue #378: propagate user's effective Telegram locale to the spawned solve session.
   const argsWithLocale = injectLanguageIfMissing(args, solveLocale);
@@ -998,7 +1007,7 @@ registerLeakNotifier(async ({ owner, repo, prNumber, tokenHits = [] }) => {
         if (creator && creator.user?.id) ownerUserId = creator.user.id;
       }
       if (ownerUserId) {
-        await bot.telegram.sendMessage(ownerUserId, text, { parse_mode: 'Markdown' }).catch(err => {
+        await safeSendMessage(bot.telegram, ownerUserId, text, { verbose: VERBOSE }).catch(err => {
           console.warn(`[telegram-leak-notifier] DM to user ${ownerUserId} (chat ${chatId}) failed: ${err.message}`);
         });
       }

package/src/telegram-command-execution.lib.mjs

@@ -3,6 +3,7 @@ import { describeChildExit } from './child-exit.lib.mjs';
 import { promisify } from 'util';
 import { exec as execCallback } from 'child_process';
 import { formatFailedLaunchMessage as defaultFormatFailedLaunchMessage } from './work-session-formatting.lib.mjs';
+import { safeEditMessageText } from './telegram-safe-reply.lib.mjs';
 
 const exec = promisify(execCallback);
 
@@ -106,7 +107,7 @@ export function buildExecuteAndUpdateMessage(deps) {
     const { chat, message_id: msgId } = startingMessage;
     const safeEdit = async text => {
       try {
-        await ctx.telegram.editMessageText(chat.id, msgId, undefined, text, { parse_mode: 'Markdown' });
+        await safeEditMessageText(ctx.telegram, chat.id, msgId, undefined, text, { verbose: VERBOSE });
       } catch (e) {
         console.error(`[telegram-bot] Failed to update message for ${commandName}: ${e.message}`);
       }

package/src/telegram-context-safety.lib.mjs

@@ -0,0 +1,70 @@
+/**
+ * Per-update Telegram instrumentation (issue #2166).
+ *
+ * Telegraf does **not** reuse `bot.telegram` when handling an update. Every
+ * update gets a brand new `Telegram` client so that `webhookReply` can answer on
+ * the open HTTP response:
+ *
+ * ```js
+ * // telegraf/lib/telegraf.js — handleUpdate()
+ * const tg = new telegram_1.default(this.token, this.telegram.options, webhookResponse);
+ * const ctx = new TelegrafContext(update, tg, this.botInfo);
+ * ```
+ *
+ * Consequently `ctx.telegram !== bot.telegram`, and anything installed on
+ * `bot.telegram` (the plain-text formatting fallback, the rate-limit tracker) is
+ * invisible to `ctx.reply()`, `ctx.telegram.sendMessage()` and
+ * `ctx.telegram.editMessageText()` — which is how *every* command handler talks
+ * to Telegram. That is why the `/stop` confirmation in issue #2166 died with an
+ * unhandled `Can't find end of the entity starting at byte offset 65` instead of
+ * degrading to plain text.
+ *
+ * This module re-installs the instrumentation on each freshly created context,
+ * so a single send path — `installTelegramFormattingFallback` — covers the whole
+ * bot regardless of which object a handler happens to call.
+ *
+ * @module telegram-context-safety.lib
+ * @see https://github.com/link-assistant/hive-mind/issues/2166
+ */
+
+import { installTelegramFormattingFallback } from './telegram-safe-reply.lib.mjs';
+import { installTelegramRateLimitTracker } from './telegram-rate-limit.lib.mjs';
+
+/**
+ * Install the formatting fallback and rate-limit tracker on one Telegram client.
+ * Both installers are idempotent (guarded by a symbol), so calling this on an
+ * already-protected client is a no-op.
+ *
+ * @param {object} telegram - A Telegraf `Telegram` client instance.
+ * @param {{verbose?: boolean, fallbackLocale?: string|null, tracker?: object}} [options]
+ * @returns {object|null} The same client, or `null` when there is nothing to protect.
+ */
+export function protectTelegramClient(telegram, options = {}) {
+  if (!telegram) return null;
+  const { verbose = false, fallbackLocale = null, tracker } = options;
+  installTelegramFormattingFallback(telegram, { verbose, fallbackLocale });
+  installTelegramRateLimitTracker(telegram, tracker ? { verbose, tracker } : { verbose });
+  return telegram;
+}
+
+/**
+ * Register the per-update protection as the very first middleware of a bot.
+ *
+ * Must run before any command handler so that handlers which call `ctx.reply()`
+ * directly still get the plain-text fallback and the send audit log.
+ *
+ * @param {object} bot - A Telegraf bot instance.
+ * @param {{verbose?: boolean, fallbackLocale?: string|null, tracker?: object}} [options]
+ * @returns {object} The bot, for chaining.
+ */
+export function installTelegramContextSafety(bot, options = {}) {
+  if (!bot) return bot;
+  protectTelegramClient(bot.telegram, options);
+  if (typeof bot.use === 'function') {
+    bot.use((ctx, next) => {
+      protectTelegramClient(ctx?.telegram, options);
+      return next();
+    });
+  }
+  return bot;
+}

package/src/telegram-fix-command.lib.mjs

@@ -8,6 +8,10 @@
  */
 
 import { buildUserMention } from './buildUserMention.lib.mjs';
+import { calculateLevenshteinDistance } from './option-suggestions.lib.mjs';
+import { getLinoYargsFactory } from './cli-arguments.lib.mjs';
+import { createYargsConfig as createSolveYargsConfig, detectMalformedFlags } from './solve.config.lib.mjs';
+import { parseArgsWithYargs } from './telegram-solve-command.lib.mjs';
 import { validateModelName } from './models/index.mjs';
 import { parseFixRepository } from './fix.ci-cd.lib.mjs';
 import { getModelFromArgs } from './model-args.lib.mjs';
@@ -15,6 +19,8 @@ import { escapeMarkdown } from './telegram-markdown.lib.mjs';
 import { extractIsolationFromArgs, isValidPerCommandIsolation } from './telegram-isolation.lib.mjs';
 import { mergeArgsWithOverrides } from './args-overrides.lib.mjs';
 import { moveArgumentToFront, parseCommandArgs } from './telegram-solve-command.lib.mjs';
+import { safeReply as defaultSafeReply } from './telegram-safe-reply.lib.mjs';
+import { partitionFixArgs } from './fix.ci-cd.lib.mjs';
 import { formatStartingWorkSessionMessage } from './work-session-formatting.lib.mjs';
 
 export const FIX_COMMAND_NAMES = Object.freeze(['fix']);
@@ -68,6 +74,54 @@ export function buildFixCommandArgs(text) {
   };
 }
 
+/**
+ * Options `/fix` consumes itself; everything else is forwarded to `/solve` and
+ * must therefore be a valid `solve` option.
+ */
+export const FIX_OWN_OPTIONS = Object.freeze(['--ci-cd', '--isolation', '--dry-run', '--no-solve', '--no-auto-solve', '--solve', '--help', '-h', '--version']);
+
+/**
+ * Reject a `/fix` request that contains any option `fix` or `solve` cannot act on.
+ *
+ * Issue #2166: a typo such as `--ci-de` used to be silently forwarded to
+ * `solve.mjs` inside the spawned work session, where the failure was invisible
+ * in the chat. `/fix` now fails immediately, in the same chat message, using the
+ * very same checks `/solve` runs (`detectMalformedFlags` + solve's strict yargs
+ * config), so no typo can slip through.
+ *
+ * @param {string[]} args - Arguments as produced by `buildFixCommandArgs().args`.
+ * @returns {Promise<string|null>} Error message to show the user, or `null` when valid.
+ */
+export async function validateFixCommandOptions(args) {
+  const list = Array.isArray(args) ? args : [];
+
+  const { malformed, errors } = detectMalformedFlags(list);
+  if (malformed.length > 0) return errors.join('\n');
+
+  // `--ci-de` is closer to `/fix`'s own `--ci-cd` than to anything solve knows,
+  // so check fix's own vocabulary first — otherwise the generic suggester points
+  // at unrelated solve options.
+  const partitioned = partitionFixArgs(list);
+  for (const arg of partitioned.passthrough) {
+    if (!arg.startsWith('-')) continue;
+    const name = arg.split('=')[0];
+    const closest = FIX_OWN_OPTIONS.map(option => ({ option, distance: calculateLevenshteinDistance(name, option) }))
+      .filter(candidate => candidate.distance > 0 && candidate.distance <= 2)
+      .sort((a, b) => a.distance - b.distance)[0];
+    if (closest) return `Unknown option "${name}". Did you mean "${closest.option}"?`;
+  }
+
+  // solve requires a positional issue URL; a placeholder keeps the parser happy
+  // so that only the *options* are judged here.
+  const probeArgs = ['https://github.com/owner/repo/issues/1', ...partitioned.passthrough];
+  try {
+    await parseArgsWithYargs(probeArgs, getLinoYargsFactory(), createSolveYargsConfig);
+  } catch (error) {
+    return error?.message || String(error);
+  }
+  return null;
+}
+
 // Issue #378: inject --language LOCALE into spawn args if no language flag is
 // already present, so spawned fix sessions inherit the user's effective locale.
 function injectLanguageIfMissing(args, locale) {
@@ -81,7 +135,7 @@ function injectLanguageIfMissing(args, locale) {
 }
 
 export function registerFixCommand(bot, options) {
-  const { VERBOSE, fixEnabled, addBreadcrumb, isOldMessage, isForwardedOrReply, isGroupChat, isTopicAuthorized, buildAuthErrorMessage, isChatStopped, getStoppedChatRejectMessage, safeReply, executeAndUpdateMessage, resolveLocale = null, solveOverrides = [] } = options;
+  const { VERBOSE, fixEnabled, addBreadcrumb, isOldMessage, isForwardedOrReply, isGroupChat, isTopicAuthorized, buildAuthErrorMessage, isChatStopped, getStoppedChatRejectMessage, safeReply = defaultSafeReply, executeAndUpdateMessage, resolveLocale = null, solveOverrides = [] } = options;
 
   async function handleFixCommand(ctx) {
     const commandDisplay = '/fix';
@@ -95,7 +149,7 @@ export function registerFixCommand(bot, options) {
     });
 
     if (!fixEnabled) {
-      await ctx.reply('❌ The fix command is disabled on this bot instance.');
+      await safeReply(ctx, '❌ The fix command is disabled on this bot instance.');
       return;
     }
     if (isOldMessage(ctx)) return;
@@ -107,11 +161,11 @@ export function registerFixCommand(bot, options) {
       return;
     }
     if (!isGroupChat(ctx)) {
-      await ctx.reply(`❌ The ${commandDisplay} command only works in group chats. Please add this bot to a group and make it an admin.`, { reply_to_message_id: ctx.message.message_id });
+      await safeReply(ctx, `❌ The ${commandDisplay} command only works in group chats. Please add this bot to a group and make it an admin.`, { reply_to_message_id: ctx.message.message_id });
       return;
     }
     if (!isTopicAuthorized(ctx)) {
-      await ctx.reply(buildAuthErrorMessage(ctx), { reply_to_message_id: ctx.message.message_id });
+      await safeReply(ctx, buildAuthErrorMessage(ctx), { reply_to_message_id: ctx.message.message_id });
       return;
     }
     if (isChatStopped(ctx.chat.id)) {
@@ -131,6 +185,16 @@ export function registerFixCommand(bot, options) {
       return;
     }
 
+    // Issue #2166: fail immediately on any unsupported option, before a work
+    // session is spawned, so a typo can never turn into a silent no-op. Runs
+    // after --isolation extraction because that flag is consumed by /fix itself
+    // and is not part of the solve vocabulary the probe parser validates.
+    const optionsError = await validateFixCommandOptions(filteredArgs);
+    if (optionsError) {
+      await safeReply(ctx, `❌ Invalid options: ${escapeMarkdown(optionsError)}\n\nUse /help to see available options`, { reply_to_message_id: ctx.message.message_id });
+      return;
+    }
+
     // Issue #2085: /fix hands the generated issue off to /solve, so it must
     // apply the operator's solve overrides (TELEGRAM_SOLVE_OVERRIDES) exactly
     // like the /solve handler does — otherwise the solve started by /fix runs

package/src/telegram-language-command.lib.mjs

@@ -11,6 +11,7 @@
  */
 
 import { t, getSupportedLocales, normalizeLocale, setUserLocale, clearUserLocale, resolveLocaleFromTelegramCtx } from './i18n.lib.mjs';
+import { safeReply } from './telegram-safe-reply.lib.mjs';
 
 export function registerLanguageCommand(bot, options = {}) {
   const { VERBOSE = false, isOldMessage, isForwardedOrReply } = options;
@@ -27,14 +28,14 @@ export function registerLanguageCommand(bot, options = {}) {
     const arg = parts.length > 1 ? parts[1] : null;
     if (!arg) {
       const langName = t(`language.${locale}`, {}, { locale });
-      await ctx.reply(t('telegram.language_current', { language: langName, supported: supportedList }, { locale }), { parse_mode: 'Markdown', reply_to_message_id: ctx.message.message_id });
+      await safeReply(ctx, t('telegram.language_current', { language: langName, supported: supportedList }, { locale }), { reply_to_message_id: ctx.message.message_id });
       return;
     }
     if (['default', 'reset', 'clear'].includes(arg.toLowerCase())) {
       clearUserLocale(userId);
       const newLocale = resolveLocaleFromTelegramCtx(ctx);
       const langName = t(`language.${newLocale}`, {}, { locale: newLocale });
-      await ctx.reply(t('telegram.language_set', { language: langName }, { locale: newLocale }), { parse_mode: 'Markdown', reply_to_message_id: ctx.message.message_id });
+      await safeReply(ctx, t('telegram.language_set', { language: langName }, { locale: newLocale }), { reply_to_message_id: ctx.message.message_id });
       return;
     }
     const target = normalizeLocale(arg);
@@ -44,6 +45,6 @@ export function registerLanguageCommand(bot, options = {}) {
     }
     setUserLocale(userId, target);
     const langName = t(`language.${target}`, {}, { locale: target });
-    await ctx.reply(t('telegram.language_set', { language: langName }, { locale: target }), { parse_mode: 'Markdown', reply_to_message_id: ctx.message.message_id });
+    await safeReply(ctx, t('telegram.language_set', { language: langName }, { locale: target }), { reply_to_message_id: ctx.message.message_id });
   });
 }