@link-assistant/hive-mind 2.8.5 → 2.8.7

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @link-assistant/hive-mind
 
+## 2.8.7
+
+### Patch Changes
+
+- f8abac0: fix(telegram): apply operator `TELEGRAM_SOLVE_OVERRIDES` to the `/solve` started by `/fix` (#2085)
+
+  `/fix --ci-cd` genuinely spawns the real `solve.mjs`, but the Telegram bot's
+  operator solve overrides (e.g. `--attach-logs`) were only merged into `/solve`
+  and `/hive` — never `/fix`. As a result the solve launched by `/fix` ran
+  without the operator's defaults. The `mergeArgsWithOverrides` helper is now
+  extracted into a shared `src/args-overrides.lib.mjs` module and the `/fix`
+  handler applies `solveOverrides` (including an optional `--isolation` override)
+  exactly like `/solve` does, restoring the missing defaults.
+
+## 2.8.6
+
+### Patch Changes
+
+- 0140e87: Verify required Codex Agent Skills against the catalog the model actually receives instead of trusting plugin enablement, so a plugin reported as installed but whose skills are invisible is reported with an actionable diagnostic rather than passing the preflight.
+
 ## 2.8.5
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "2.8.5",
+  "version": "2.8.7",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",

package/src/args-overrides.lib.mjs

@@ -0,0 +1,74 @@
+/**
+ * Shared CLI-argument override merging (issue #2085).
+ *
+ * The Telegram bot lets operators configure "override" options that are always
+ * applied to a command regardless of what the requester typed — e.g.
+ * `TELEGRAM_SOLVE_OVERRIDES="(\n  --attach-logs\n  --auto-continue\n)"`. These
+ * overrides encode the operator's defaults for `/solve`.
+ *
+ * `mergeArgsWithOverrides` used to live inside `telegram-bot.mjs`, where only
+ * the `/solve` and `/hive` handlers could reach it. `/fix` hands its generated
+ * issue off to `/solve`, so it must apply the very same solve overrides —
+ * otherwise the solve started by `/fix` silently runs without the operator's
+ * defaults (issue #2085: "`--attach-logs` were not applied"). Extracting the
+ * helper here lets `telegram-fix-command.lib.mjs` reuse the exact same merge
+ * semantics without importing the bot entry point (which would be circular).
+ */
+
+/**
+ * Merge operator override options into a user-supplied argument list.
+ *
+ * Override flags win: any user flag that also appears in `overrides` (together
+ * with its value, if any) is dropped, then every override is appended. Boolean
+ * flags and `--flag value` pairs are both handled. The relative order of the
+ * surviving user args (including positionals like the issue/repository URL) is
+ * preserved, and the overrides are appended at the end so they take precedence
+ * in last-wins CLI parsers.
+ *
+ * @param {string[]} userArgs - Arguments the requester supplied.
+ * @param {string[]} overrides - Operator override options (already tokenized).
+ * @returns {string[]} The merged argument list.
+ */
+export function mergeArgsWithOverrides(userArgs, overrides) {
+  if (!overrides || overrides.length === 0) {
+    return Array.isArray(userArgs) ? userArgs : [];
+  }
+  const safeUserArgs = Array.isArray(userArgs) ? userArgs : [];
+
+  // Parse overrides to identify flags and their values
+  const overrideFlags = new Map(); // Map of flag -> value (or null for boolean flags)
+
+  for (let i = 0; i < overrides.length; i++) {
+    const arg = overrides[i];
+    if (arg.startsWith('--')) {
+      // Check if next item is a value (doesn't start with --)
+      if (i + 1 < overrides.length && !overrides[i + 1].startsWith('--')) {
+        overrideFlags.set(arg, overrides[i + 1]);
+        i++; // Skip the value in next iteration
+      } else {
+        overrideFlags.set(arg, null); // Boolean flag
+      }
+    }
+  }
+
+  // Filter user args to remove any that conflict with overrides
+  const filteredArgs = [];
+  for (let i = 0; i < safeUserArgs.length; i++) {
+    const arg = safeUserArgs[i];
+    if (arg.startsWith('--')) {
+      // If this flag exists in overrides, skip it and its value
+      if (overrideFlags.has(arg)) {
+        // Skip the flag
+        // Also skip next arg if it's a value (doesn't start with --)
+        if (i + 1 < safeUserArgs.length && !safeUserArgs[i + 1].startsWith('--')) {
+          i++; // Skip the value too
+        }
+        continue;
+      }
+    }
+    filteredArgs.push(arg);
+  }
+
+  // Merge: filtered user args + overrides
+  return [...filteredArgs, ...overrides];
+}

package/src/codex-capability-preflight.lib.mjs

@@ -155,6 +155,61 @@ const parseJsonCommand = (result, label) => {
 
 const catalogEntries = catalog => [...(catalog?.installed || []), ...(catalog?.available || [])];
 
+// Issue #2084: `codex plugin list` reports enablement, not model visibility.
+//
+// Codex renders the skills the model can actually see into a
+// `<skills_instructions>` block in the prompt. `codex debug prompt-input`
+// prints that prompt, so parsing the block is the only client-side signal that
+// matches what the model receives. Entries are rendered as
+// `- <name>: <description> (file: <path>)`, where `<name>` is bare for skills
+// under `$CODEX_HOME/skills` and `<plugin>:<skill>` for plugin-provided ones.
+const SKILLS_INSTRUCTIONS_BLOCK = /<skills_instructions>([\s\S]*?)<\/skills_instructions>/u;
+const SKILL_CATALOG_ENTRY = /(?:^|\\n)\s*-\s+([a-z0-9][a-z0-9_-]*(?::[a-z0-9][a-z0-9_-]*)?)\s*:/giu;
+
+export const parseModelVisibleSkills = (promptInput = '') => {
+  // `codex debug prompt-input` emits JSON, so newlines inside the prompt arrive
+  // as the two-character escape `\n`. Match both that and real newlines.
+  const block = SKILLS_INSTRUCTIONS_BLOCK.exec(String(promptInput).replace(/\r\n/gu, '\n').replace(/\n/gu, '\\n'));
+  if (!block) return null;
+  const skills = new Set();
+  for (const match of block[1].matchAll(SKILL_CATALOG_ENTRY)) skills.add(match[1].toLowerCase());
+  return skills;
+};
+
+// Verification is advisory when the probe itself cannot run: an older Codex
+// without `debug prompt-input`, or a sandbox that blocks it, must not fail a
+// run that the previous verification would have allowed.
+const readModelVisibleSkills = async ({ command, env, runCommand, log }) => {
+  const result = await runCommand({ command, args: ['debug', 'prompt-input', 'hive-mind capability probe'], env });
+  if (result.code !== 0) {
+    await log(
+      `   ⚠️  Could not read the model-visible skill catalog: ${String(result.stderr || result.stdout)
+        .trim()
+        .slice(0, 200)}`,
+      { verbose: true }
+    );
+    return null;
+  }
+  const skills = parseModelVisibleSkills(result.stdout);
+  if (!skills) await log('   ⚠️  Codex prompt did not contain a <skills_instructions> block; skipping skill visibility verification', { verbose: true });
+  return skills;
+};
+
+const verifyModelVisibleSkills = async ({ command, env, runCommand, log, requiredSkills }) => {
+  if (!requiredSkills || requiredSkills.length === 0) return;
+  const visible = await readModelVisibleSkills({ command, env, runCommand, log });
+  if (!visible) return;
+
+  await log(`   🔎 Model-visible skills (${visible.size}): ${[...visible].sort().join(', ') || 'none'}`, { verbose: true });
+  const invisible = requiredSkills.filter(skill => !visible.has(skill.toLowerCase()));
+  if (invisible.length === 0) {
+    await log(`   ✅ Verified ${requiredSkills.length} required skill(s) are visible to the model`);
+    return;
+  }
+
+  throw new CodexCapabilityPreflightError(`Codex reports the required plugins as installed, but the model cannot see: ${invisible.join(', ')}. ` + `Codex exposes a plugin's skills only while its payload is materialized under ` + `CODEX_HOME/plugins/cache/<marketplace>/<plugin>/<version>/skills. ` + `Visible skills were: ${[...visible].sort().join(', ') || 'none'}.`, { missing: invisible });
+};
+
 const skillParts = skill => {
   const separator = skill.indexOf(':');
   return separator === -1 ? { namespace: null, name: skill } : { namespace: skill.slice(0, separator), name: skill.slice(separator + 1) };
@@ -341,6 +396,7 @@ async function provisionCodexCapabilities({ owner, repo, issueNumber, projectDir
   }
   if (plugins.length === 0) {
     await log('   ✅ Required Agent Skills are already available from standard skill directories');
+    await verifyModelVisibleSkills({ command, env: baseEnv, runCommand, log, requiredSkills: requirements.skills });
     return { required: true, plugins, skills: requirements.skills, codexHome: null, baseCodexHome };
   }
 
@@ -365,6 +421,13 @@ async function provisionCodexCapabilities({ owner, repo, issueNumber, projectDir
   const unverified = plugins.filter(plugin => !verified.has(plugin));
   if (unverified.length > 0) throw new CodexCapabilityPreflightError(`Codex capability installation did not verify successfully: ${unverified.join(', ')}`, { missing: unverified });
 
+  // Issue #2084: enablement is not exposure. The failing run reached this point
+  // with `superpowers@openai-curated` reported as "installed, enabled" while
+  // the model saw zero `superpowers:*` skills, so the run proceeded and then
+  // stalled on the repository's mandatory preflight. Confirm the requirement
+  // against the catalog the model actually receives.
+  await verifyModelVisibleSkills({ command, env: scopedEnv, runCommand, log, requiredSkills: requirements.skills });
+
   await log(`   Codex capability state: ${codexHome}`, { verbose: true });
   return { required: true, plugins, skills: requirements.skills, codexHome, baseCodexHome };
 }

package/src/telegram-bot.mjs

@@ -29,6 +29,7 @@ const { createYargsConfig: createHiveYargsConfig } = await import('./hive.config
 const { enhanceUnknownArgumentError } = await import('./option-suggestions.lib.mjs');
 const { validateBranchInArgs } = await import('./solve.branch.lib.mjs');
 const { extractIsolationFromArgs, isValidPerCommandIsolation } = await import('./telegram-isolation.lib.mjs');
+const { mergeArgsWithOverrides } = await import('./args-overrides.lib.mjs'); // issue #2085
 
 const config = createTelegramYargsConfig(yargs(hideBin(process.argv))).parse();
 
@@ -367,49 +368,6 @@ function validateModelInArgs(args, tool = 'claude') {
   return null;
 }
 
-function mergeArgsWithOverrides(userArgs, overrides) {
-  if (!overrides || overrides.length === 0) {
-    return userArgs;
-  }
-
-  // Parse overrides to identify flags and their values
-  const overrideFlags = new Map(); // Map of flag -> value (or null for boolean flags)
-
-  for (let i = 0; i < overrides.length; i++) {
-    const arg = overrides[i];
-    if (arg.startsWith('--')) {
-      // Check if next item is a value (doesn't start with --)
-      if (i + 1 < overrides.length && !overrides[i + 1].startsWith('--')) {
-        overrideFlags.set(arg, overrides[i + 1]);
-        i++; // Skip the value in next iteration
-      } else {
-        overrideFlags.set(arg, null); // Boolean flag
-      }
-    }
-  }
-
-  // Filter user args to remove any that conflict with overrides
-  const filteredArgs = [];
-  for (let i = 0; i < userArgs.length; i++) {
-    const arg = userArgs[i];
-    if (arg.startsWith('--')) {
-      // If this flag exists in overrides, skip it and its value
-      if (overrideFlags.has(arg)) {
-        // Skip the flag
-        // Also skip next arg if it's a value (doesn't start with --)
-        if (i + 1 < userArgs.length && !userArgs[i + 1].startsWith('--')) {
-          i++; // Skip the value too
-        }
-        continue;
-      }
-    }
-    filteredArgs.push(arg);
-  }
-
-  // Merge: filtered user args + overrides
-  return [...filteredArgs, ...overrides];
-}
-
 // Inject --language LOCALE into spawn args if no language flag is already present.
 // Issue #378: telegram bot resolves the user's effective locale and propagates
 // it to spawned solve/hive sessions so the AI tool replies in the same language.
@@ -595,7 +553,7 @@ registerSubscribeCommands(bot, sharedCommandOpts);
 const { registerTaskCommands } = await import('./telegram-task-command.lib.mjs');
 const { handleTaskCommand, TASK_COMMAND_NAMES } = registerTaskCommands(bot, { ...sharedCommandOpts, taskEnabled, safeReply, executeAndUpdateMessage, resolveLocale: resolveLocaleFromTelegramCtx });
 const { registerFixCommand } = await import('./telegram-fix-command.lib.mjs');
-const { handleFixCommand, FIX_COMMAND_NAMES } = registerFixCommand(bot, { ...sharedCommandOpts, fixEnabled, safeReply, executeAndUpdateMessage, resolveLocale: resolveLocaleFromTelegramCtx });
+const { handleFixCommand, FIX_COMMAND_NAMES } = registerFixCommand(bot, { ...sharedCommandOpts, fixEnabled, safeReply, executeAndUpdateMessage, resolveLocale: resolveLocaleFromTelegramCtx, solveOverrides });
 const { registerAuthCommand } = await import('./telegram-auth-command.lib.mjs');
 const { handleAuthCommand } = registerAuthCommand(bot, { ...sharedCommandOpts, allowedChats, authEnabled, safeReply });
 

package/src/telegram-fix-command.lib.mjs

@@ -12,6 +12,7 @@ import { validateModelName } from './models/index.mjs';
 import { parseFixRepository } from './fix.ci-cd.lib.mjs';
 import { escapeMarkdown } from './telegram-markdown.lib.mjs';
 import { extractIsolationFromArgs, isValidPerCommandIsolation } from './telegram-isolation.lib.mjs';
+import { mergeArgsWithOverrides } from './args-overrides.lib.mjs';
 import { moveArgumentToFront, parseCommandArgs } from './telegram-solve-command.lib.mjs';
 import { formatStartingWorkSessionMessage } from './work-session-formatting.lib.mjs';
 
@@ -87,7 +88,7 @@ function injectLanguageIfMissing(args, locale) {
 }
 
 export function registerFixCommand(bot, options) {
-  const { VERBOSE, fixEnabled, addBreadcrumb, isOldMessage, isForwardedOrReply, isGroupChat, isTopicAuthorized, buildAuthErrorMessage, isChatStopped, getStoppedChatRejectMessage, safeReply, executeAndUpdateMessage, resolveLocale = null } = options;
+  const { VERBOSE, fixEnabled, addBreadcrumb, isOldMessage, isForwardedOrReply, isGroupChat, isTopicAuthorized, buildAuthErrorMessage, isChatStopped, getStoppedChatRejectMessage, safeReply, executeAndUpdateMessage, resolveLocale = null, solveOverrides = [] } = options;
 
   async function handleFixCommand(ctx) {
     const commandDisplay = '/fix';
@@ -137,7 +138,22 @@ export function registerFixCommand(bot, options) {
       return;
     }
 
-    const modelError = validateFixModel(filteredArgs);
+    // Issue #2085: /fix hands the generated issue off to /solve, so it must
+    // apply the operator's solve overrides (TELEGRAM_SOLVE_OVERRIDES) exactly
+    // like the /solve handler does — otherwise the solve started by /fix runs
+    // without the operator's defaults (e.g. --attach-logs). The overrides are
+    // forwarded to /solve because /fix passes every option it does not consume
+    // through to solve.mjs. An --isolation override applies to the /fix work
+    // session itself (which contains the nested /solve), mirroring /solve.
+    const { backend: overrideIsolation, filteredArgs: solveOverridesWithoutIsolation } = extractIsolationFromArgs(solveOverrides);
+    if (overrideIsolation && !isValidPerCommandIsolation(overrideIsolation)) {
+      await safeReply(ctx, `❌ Invalid --isolation value '${escapeMarkdown(overrideIsolation)}' in solve overrides. Must be: screen, tmux, or docker`, { reply_to_message_id: ctx.message.message_id });
+      return;
+    }
+    const effectiveIsolation = overrideIsolation || perCommandIsolation;
+    const mergedArgs = mergeArgsWithOverrides(filteredArgs, solveOverridesWithoutIsolation);
+
+    const modelError = validateFixModel(mergedArgs);
     if (modelError) {
       await safeReply(ctx, `❌ ${escapeMarkdown(modelError)}`, { reply_to_message_id: ctx.message.message_id });
       return;
@@ -147,12 +163,13 @@ export function registerFixCommand(bot, options) {
     const userOptionsRaw = built.args.slice(1).join(' ');
     let infoBlock = `Requested by: ${requester}\nRepository: ${escapeMarkdown(built.repository.url)}`;
     if (userOptionsRaw) infoBlock += `\n\n🛠 Options: ${escapeMarkdown(userOptionsRaw)}`;
+    if (solveOverrides.length > 0) infoBlock += `\n\n🔒 Solve overrides: ${escapeMarkdown(solveOverrides.join(' '))}`;
 
     const fixUrlContext = { owner: built.repository.owner, repo: built.repository.repo, normalized: built.repository.url };
     const startingMessage = await safeReply(ctx, formatStartingWorkSessionMessage({ infoBlock }), { reply_to_message_id: ctx.message.message_id });
     const fixLocale = resolveLocale ? resolveLocale(ctx) : null;
-    const argsForExec = injectLanguageIfMissing(filteredArgs, fixLocale);
-    await executeAndUpdateMessage(ctx, startingMessage, 'fix', argsForExec, infoBlock, perCommandIsolation || null, getFixToolFromArgs(argsForExec), fixUrlContext);
+    const argsForExec = injectLanguageIfMissing(mergedArgs, fixLocale);
+    await executeAndUpdateMessage(ctx, startingMessage, 'fix', argsForExec, infoBlock, effectiveIsolation || null, getFixToolFromArgs(argsForExec), fixUrlContext);
   }
 
   bot.command(