Fix Telegram DM last-route metadata leakage (#19491)

Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 16b025b3aa
Co-authored-by: guirguispierre <22091706+guirguispierre@users.noreply.github.com>
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com>
Reviewed-by: @obviyus

src/channels/session.test.ts

@@ -0,0 +1,78 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { MsgContext } from "../auto-reply/templating.js";
+
+const recordSessionMetaFromInboundMock = vi.fn((_args?: unknown) => Promise.resolve(undefined));
+const updateLastRouteMock = vi.fn((_args?: unknown) => Promise.resolve(undefined));
+
+vi.mock("../config/sessions.js", () => ({
+  recordSessionMetaFromInbound: (args: unknown) => recordSessionMetaFromInboundMock(args),
+  updateLastRoute: (args: unknown) => updateLastRouteMock(args),
+}));
+
+describe("recordInboundSession", () => {
+  const ctx: MsgContext = {
+    Provider: "telegram",
+    From: "telegram:1234",
+    SessionKey: "agent:main:telegram:1234:thread:42",
+    OriginatingTo: "telegram:1234",
+  };
+
+  beforeEach(() => {
+    recordSessionMetaFromInboundMock.mockClear();
+    updateLastRouteMock.mockClear();
+  });
+
+  it("does not pass ctx when updating a different session key", async () => {
+    const { recordInboundSession } = await import("./session.js");
+
+    await recordInboundSession({
+      storePath: "/tmp/openclaw-session-store.json",
+      sessionKey: "agent:main:telegram:1234:thread:42",
+      ctx,
+      updateLastRoute: {
+        sessionKey: "agent:main:main",
+        channel: "telegram",
+        to: "telegram:1234",
+      },
+      onRecordError: vi.fn(),
+    });
+
+    expect(updateLastRouteMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        sessionKey: "agent:main:main",
+        ctx: undefined,
+        deliveryContext: expect.objectContaining({
+          channel: "telegram",
+          to: "telegram:1234",
+        }),
+      }),
+    );
+  });
+
+  it("passes ctx when updating the same session key", async () => {
+    const { recordInboundSession } = await import("./session.js");
+
+    await recordInboundSession({
+      storePath: "/tmp/openclaw-session-store.json",
+      sessionKey: "agent:main:telegram:1234:thread:42",
+      ctx,
+      updateLastRoute: {
+        sessionKey: "agent:main:telegram:1234:thread:42",
+        channel: "telegram",
+        to: "telegram:1234",
+      },
+      onRecordError: vi.fn(),
+    });
+
+    expect(updateLastRouteMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        sessionKey: "agent:main:telegram:1234:thread:42",
+        ctx,
+        deliveryContext: expect.objectContaining({
+          channel: "telegram",
+          to: "telegram:1234",
+        }),
+      }),
+    );
+  });
+});

src/channels/session.ts

@@ -45,7 +45,8 @@ export async function recordInboundSession(params: {
       accountId: update.accountId,
       threadId: update.threadId,
     },
-    ctx,
+    // Avoid leaking inbound origin metadata into a different target session.
+    ctx: update.sessionKey === sessionKey ? ctx : undefined,
     groupResolution,
   });
 }