telegram-ai-bridge code-review.instructions.md

A code-review checklist for a Telegram bridge that connects Telegram chats to AI command-line tools and stores state in SQLite, a small database file.

In plain words
What is it for?
Use it to review changes to command behavior, backend interfaces, database tables and migrations, chat bindings, message handling, or other stateful bridge code.
Why use it?
It focuses review on contract mismatches, broken session state, data corruption, and accidental exposure of secrets.

Instructions file for GitHub Copilot

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/legate-dev/telegram-ai-bridge/code-review
Clone the repo
git clone --depth 1 https://github.com/legate-dev/telegram-ai-bridge

Made for: GitHub Copilot.

Per session 767 This file is loaded in full into every session.
When invoked 767 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00767 $0.00767
Opus 5 $0.00383 $0.00383
Sonnet 5 $0.00153 $0.00153
Haiku 4.5 $0.00077 $0.00077

Measured yesterday against content hash 8e9f7f45bf71, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

telegram-ai-bridge code-review.instructions.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.github/instructions/code-review.instructions.md · 65 lines

How it starts

The opening of the file, as written. The whole thing — 65 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Code Review Instructions

Review posture

You are reviewing code in a Telegram bridge that wraps AI CLI backends. The codebase is ~5.8k LOC source + ~10.7k LOC tests (1.8× test/source ratio), single-user self-hosted deployment, and handles subprocess spawning, SQLite state, and Telegram API interactions. Bugs here cause silent data corruption, broken sessions, or secret leakage to the operator's phone. Treat every change with the seriousness that production deployments on other people's hosts deserve.

Priority checklist

Check these in order. Stop and flag a finding as soon as you see a violation.

1. Contract compliance

  • Does the change match API_CONTRACT.md? If the PR modifies command behavior, binding schema, or backend interfaces, the contract must be updated in the same PR.
  • Does sendMessage() signature in backends match what message-handler.js passes?
  • Are new columns in db.js reflected in both CREATE TABLE and the migration block?

2. State integrity

  • Binding lifecycle: when a chat rebinds to a different CLI (via /new or inline keyboard), are per-CLI fields (agent, model) explicitly reset to null? The COALESCE pattern in setChatBinding preserves stale values unless the caller passes null.
  • Session cleanup: when sessions are detached or cleaned up, is all associated state cleared?
  • Check for values that silently persist across context switches (CLI changes, session rebinds).

3. Input validation

  • All Telegram ctx.match, ctx.message.text, and ctx.callbackQuery.data are untrusted.
  • Callback query data prefixes (e.g., bind:, setmodel:) must be parsed defensively — colons in values, missing parts, unexpected formats.
  • Directory paths from user input must be validated before use in execFile.

4. Security

  • No secrets (tokens, API keys) in log output or error messages
  • execFile (not exec) for all subprocess spawning — arguments as array, never string concatenation
  • SQL uses named parameters (@param), never string interpolation
  • New dependencies must be justified and version-pinned

Read the full file on GitHub · 65 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 65 lines · 767 tokens per session scan A 8e9f7f45bf71

Subscribe to this mod's changes

telegram-ai-bridge code-review.instructions.md is an instructions file published in the GitHub repository legate-dev/telegram-ai-bridge (1 stars, last pushed 1mo ago), licensed MIT. It adds 767 tokens to every session, about $0.0038 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other instructions, from other repositories

spec-kitty AGENTS.md

Instructions for Priivacy-ai/spec-kitty, covering spec kitty development guidelines, ⚠️ critical: load the project charter first, ⚠️ critical: template source location, ⚠️ critical: use canonical sources, never improvise and ⚠️ critical: git workflow — no direct pushes to origin/main.

Priivacy-ai/spec-kitty · 9,409 tokens

parallel-code CLAUDE.md

Instructions for johannesjo/parallel-code, covering parallel code, stack, commands, project structure and conventions.

johannesjo/parallel-code · 257 tokens

PokeTokenBar CLAUDE.md

Instructions for chattymin/PokeTokenBar, covering poketokenbar — claude 프로젝트 지침, 참조 문서 (필요할 때 읽는다), 기여 언어 규약 (오픈소스 대비 — english first), 릴리스 (자연어 트리거) and 확장 규약 (새 프로바이더/툴 추가 시).

chattymin/PokeTokenBar · 1,918 tokens

cc-statistics CLAUDE.md

Instructions for androidZzT/cc-statistics, covering claude.md, project, setup, usage and architecture.

androidZzT/cc-statistics · 912 tokens

SubFrame AGENTS.md

Instructions for Codename-11/SubFrame, covering subframe - subframe project, core working principle, relationship to native ai tools, session start and concurrent work & worktrees.

Codename-11/SubFrame · 3,973 tokens

stagecraft AGENTS.md

Instructions for telus-labs/stagecraft, covering agents.md, start here (in order), test and lint commands, where things live and load-bearing contracts (do not break without an adr).

telus-labs/stagecraft · 1,093 tokens