Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug]: message tool - accountId partial matching routes to wrong bot [3 pull requests, 2 comments, 3 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#49383•Fetched 2026-04-08 00:55:41
View on GitHub
Comments
2
Participants
3
Timeline
23
Reactions
0
Author
allen0373allen0373
Participants
allen0373allen0373Hollychou924Hollychou924RyceRyce
Timeline (top)
referenced ×14cross-referenced ×3commented ×2labeled ×2

When using message tool with partial accountId, message routes to wrong Telegram bot

Error Message

Message should be sent from the exact matching bot, or return an error if partial ID doesn't uniquely match

Root Cause

When using message tool with partial accountId, message routes to wrong Telegram bot

Fix Action

Fixed

PR fix notes

PR #49650: fix: reject unrecognized accountId in message tool routing

Description (problem / solution / changelog)

Summary

  • Adds explicit validation in runMessageAction that rejects accountIds not found among the channel plugin's configured accounts
  • Prevents messages from being silently routed to the wrong bot when the message tool receives a partial or incorrect accountId
  • Only validates accountIds explicitly provided in tool params (not those derived from agent bindings or defaults)

Fixes #49383

Test plan

  • Added test: rejects partial accountId that does not match any configured account
  • Added test: accepts exact accountId match
  • Added test: does not reject defaultAccountId from bindings (non-tool-param path)
  • Existing tests pass (13/13)

🤖 Generated with Claude Code

Changed files

  • src/infra/outbound/message-action-runner.plugin-dispatch.test.ts (modified, +92/-0)
  • src/infra/outbound/message-action-runner.ts (modified, +21/-1)

PR #49663: fix(telegram): prevent silent wrong-bot routing when accountId not in config

Description (problem / solution / changelog)

lobster-biscuit

Closes #49383

Problem

When message tool passes an accountId that doesn't match any configured account, resolveTelegramToken() silently falls through to the channel-level botToken — routing the message via the wrong Telegram bot. No error, no warning.

Root cause

extensions/telegram/src/token.ts:44-46 — resolveAccountCfg() returns undefined for unknown accountIds, but the code continues to channel-level fallbacks (lines 72-95) instead of stopping. Introduced in e5bca0832f when Telegram was moved to extensions/.

User impact

Silent cross-bot message leak. Messages intended for Bot A (e.g. support bot) get sent via Bot B's token (e.g. internal bot). User discovers only when the wrong bot responds. Privacy/correctness issue.

Fix

Return { token: "", source: "none" } immediately when a non-default accountId is explicitly specified but not found in config. Existing behavior for known accounts (with or without per-account tokens) is preserved — they still fall through to channel-level defaults as designed.

Changes

  • extensions/telegram/src/token.ts — early return for unknown non-default accountId (+6 lines)
  • extensions/telegram/src/token.test.ts — test: unknown accountId returns empty, not channel-level token (+15 lines)

How to verify

  1. Configure 2 Telegram bots with different accountIds
  2. Call message tool with an accountId not in config
  3. Before fix: message sent via wrong bot. After fix: token resolution returns empty, surfaces as error

Tests

Added: "does not fall through to channel-level token when non-default accountId is not in config" (1/1 new test) Existing: all 10 tests unaffected (verified — known accounts still fall through correctly)

🤖 Generated with Claude Code

Changed files

  • extensions/telegram/src/token.test.ts (modified, +19/-0)
  • extensions/telegram/src/token.ts (modified, +11/-0)

PR #50853: fix(telegram): prevent silent wrong-bot routing when accountId not in config

Description (problem / solution / changelog)

lobster-biscuit

Closes #49383

Problem

When message tool passes an accountId that doesn't match any configured account, resolveTelegramToken() silently falls through to the channel-level botToken — routing the message via the wrong Telegram bot. No error, no warning.

Root cause

extensions/telegram/src/token.ts:44-46 — resolveAccountCfg() returns undefined for unknown accountIds, but the code continues to channel-level fallbacks instead of stopping. Introduced in e5bca0832f when Telegram was moved to extensions/.

User impact

Silent cross-bot message leak. Messages intended for Bot A get sent via Bot B's token. No error, no warning. User discovers only when the wrong bot responds.

Fix

Return { token: "", source: "none" } with a diagnostic log when a non-default accountId is not found. Existing behavior for known accounts (with or without per-account tokens) preserved — they still fall through to channel-level defaults as designed.

How to verify

  1. Configure 2 Telegram bots with different accountIds
  2. Call message tool with an accountId not in config
  3. Before: message sent via wrong bot. After: empty token, surfaces as error.

Tests

Added: "does not fall through when non-default accountId not in config" (1/1 new, 10/10 existing unaffected)

🤖 Generated with Claude Code

Changed files

  • CHANGELOG.md (modified, +1/-0)
  • extensions/telegram/src/token.test.ts (modified, +18/-0)
  • extensions/telegram/src/token.ts (modified, +11/-0)
RAW_BUFFERClick to expand / collapse

Bug type

Regression (worked before, now fails)

Summary

When using message tool with partial accountId, message routes to wrong Telegram bot

Steps to reproduce

  1. Configure multiple Telegram bots with account IDs (e.g., 8510324544 and 8401457831)
  2. Call message tool with accountId: "8510324544" (partial ID)
  3. Message gets sent from wrong bot (8401457831 instead of 8510324544)

Expected behavior

Message should be sent from the exact matching bot, or return an error if partial ID doesn't uniquely match

Actual behavior

Message silently routes to a different bot. Example: accountId "8510324544" routes to bot 8401457831 instead

OpenClaw version

2026.3.13

Operating system

Linux (OpenCloudOS 9.4)

Install method

No response

Model

minimax-cn/MiniMax-M2.1

Provider / routing chain

direct

Config file / key location

No response

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response

extent analysis

Fix Plan

To resolve the issue of messages routing to the wrong Telegram bot when using a partial accountId, we need to modify the message routing logic to ensure exact matching.

  • Update the accountId comparison logic to use exact matching instead of partial matching.
  • Add error handling to return an error if the partial accountId does not uniquely match a bot.

Example Code

def route_message(account_id):
    # Get all bots with matching account IDs
    matching_bots = [bot for bot in bots if bot['account_id'] == account_id]
    
    # If no exact match is found, check for partial matches
    if not matching_bots:
        partial_matches = [bot for bot in bots if account_id in bot['account_id']]
        
        # If there are multiple partial matches, return an error
        if len(partial_matches) > 1:
            return {"error": "Partial account ID does not uniquely match a bot"}
        
        # If there is a single partial match, use that bot
        elif partial_matches:
            matching_bots = partial_matches
    
    # If still no match is found, return an error
    if not matching_bots:
        return {"error": "Account ID not found"}
    
    # Route the message to the matching bot
    return matching_bots[0]

# Example usage:
bots = [
    {'account_id': '8510324544', 'bot_id': 'bot1'},
    {'account_id': '8401457831', 'bot_id': 'bot2'}
]

print(route_message('8510324544'))  # Should return {'account_id': '8510324544', 'bot_id': 'bot1'}
print(route_message('851032'))  # Should return an error if there are multiple partial matches

Verification

To verify that the fix worked, test the message routing with different accountId values, including partial matches and non-matches. Ensure that the message is routed to the correct bot or an error is returned as expected.

Extra Tips

  • Consider adding additional logging to track message routing and errors.
  • Review the accountId generation and usage to prevent similar issues in the future.
  • Test the fix thoroughly to ensure it works as expected in different scenarios.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Message should be sent from the exact matching bot, or return an error if partial ID doesn't uniquely match

#api#ssr#installation#tensor shape#autograd error#GPU setup#container setup#orchestration issue#cache issue#memory leak

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix [Bug]: message tool - accountId partial matching routes to wrong bot [3 pull requests, 2 comments, 3 participants]