github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-11 21:03:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: harden sessions_spawn delivery params and telegram account routing (#31000, #31110)

Browse Source
This commit is contained in:
Peter Steinberger
2026-03-02 02:35:26 +00:00
parent 684ac44b71
commit b0c7f1ebe2
6 changed files with 89 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/telegram/bot-message-context.ts
View File

@@ -34,7 +34,7 @@ import type { DmPolicy, TelegramGroupConfig, TelegramTopicConfig } from "../conf
import { logVerbose, shouldLogVerbose } from "../globals.js";
import { recordChannelActivity } from "../infra/channel-activity.js";
import { resolveAgentRoute } from "../routing/resolve-route.js";
import { resolveThreadSessionKeys } from "../routing/session-key.js";
import { DEFAULT_ACCOUNT_ID, resolveThreadSessionKeys } from "../routing/session-key.js";
import { withTelegramApiErrorLogging } from "./api-logging.js";
import {
firstDefined,
@@ -188,6 +188,17 @@ export const buildTelegramMessageContext = async ({
},
parentPeer,
});
// Fail closed for named Telegram accounts when route resolution falls back to
// default-agent routing. This prevents cross-account DM/session contamination.
if (route.accountId !== DEFAULT_ACCOUNT_ID && route.matchedBy === "default") {
logInboundDrop({
log: logVerbose,
channel: "telegram",
reason: "non-default account requires explicit binding",
target: route.accountId,
});
return null;
}
const baseSessionKey = route.sessionKey;
// DMs: use raw messageThreadId for thread sessions (not forum topic ids)
const dmThreadId = threadSpec.scope === "dm" ? threadSpec.id : undefined;