fix: ignore disabled approval accounts in ambiguity checks

extensions/matrix/src/exec-approvals.test.ts

@@ -454,4 +454,61 @@ describe("matrix exec approvals", () => {
       }),
     ).toBe(false);
   });
+
+  it("ignores disabled matrix accounts when checking foreign-channel ambiguity", () => {
+    const cfg = {
+      channels: {
+        matrix: {
+          accounts: {
+            default: {
+              homeserver: "https://matrix.example.org",
+              userId: "@bot-default:example.org",
+              accessToken: "tok-default",
+              execApprovals: {
+                enabled: true,
+                approvers: ["@owner:example.org"],
+              },
+            },
+            ops: {
+              enabled: false,
+              homeserver: "https://matrix.example.org",
+              userId: "@bot-ops:example.org",
+              accessToken: "tok-ops",
+              execApprovals: {
+                enabled: true,
+                approvers: ["@owner:example.org"],
+              },
+            },
+          },
+        },
+      },
+    } as OpenClawConfig;
+    const request = {
+      id: "req-6",
+      request: {
+        command: "echo hi",
+        agentId: "ops-agent",
+        sessionKey: "agent:ops-agent:missing",
+        turnSourceChannel: "slack",
+        turnSourceTo: "channel:C123",
+      },
+      createdAtMs: 0,
+      expiresAtMs: 1000,
+    };
+
+    expect(
+      shouldHandleMatrixExecApprovalRequest({
+        cfg,
+        accountId: "default",
+        request,
+      }),
+    ).toBe(true);
+    expect(
+      shouldHandleMatrixExecApprovalRequest({
+        cfg,
+        accountId: "ops",
+        request,
+      }),
+    ).toBe(false);
+  });
 });

extensions/matrix/src/exec-approvals.ts

@@ -40,12 +40,16 @@ function resolveMatrixExecApprovalConfig(params: {
 }
 
 function countMatrixExecApprovalHandlerAccounts(cfg: OpenClawConfig): number {
-  return listMatrixAccountIds(cfg).filter((accountId) =>
-    isChannelExecApprovalClientEnabledFromConfig({
+  return listMatrixAccountIds(cfg).filter((accountId) => {
+    const account = resolveMatrixAccount({ cfg, accountId });
+    if (!account.enabled || !account.configured) {
+      return false;
+    }
+    return isChannelExecApprovalClientEnabledFromConfig({
       enabled: resolveMatrixExecApprovalConfig({ cfg, accountId }).enabled,
       approverCount: getMatrixExecApprovalApprovers({ cfg, accountId }).length,
-    }),
-  ).length;
+    });
+  }).length;
 }
 
 function matchesMatrixRequestAccount(params: {

extensions/telegram/src/exec-approvals.test.ts

@@ -292,6 +292,58 @@ describe("telegram exec approvals", () => {
     ).toBe(false);
   });
 
+  it("ignores disabled telegram accounts when checking foreign-channel ambiguity", () => {
+    const cfg = {
+      channels: {
+        telegram: {
+          accounts: {
+            default: {
+              botToken: "tok-default",
+              execApprovals: {
+                enabled: true,
+                approvers: ["123"],
+              },
+            },
+            ops: {
+              enabled: false,
+              botToken: "tok-ops",
+              execApprovals: {
+                enabled: true,
+                approvers: ["123"],
+              },
+            },
+          },
+        },
+      },
+    } as OpenClawConfig;
+    const request = {
+      id: "req-5",
+      request: {
+        command: "echo hi",
+        sessionKey: "agent:ops:missing",
+        turnSourceChannel: "slack",
+        turnSourceTo: "channel:C123",
+      },
+      createdAtMs: 0,
+      expiresAtMs: 1000,
+    };
+
+    expect(
+      shouldHandleTelegramExecApprovalRequest({
+        cfg,
+        accountId: "default",
+        request,
+      }),
+    ).toBe(true);
+    expect(
+      shouldHandleTelegramExecApprovalRequest({
+        cfg,
+        accountId: "ops",
+        request,
+      }),
+    ).toBe(false);
+  });
+
   it("only injects approval buttons on eligible telegram targets", () => {
     const dmCfg = buildConfig({ enabled: true, approvers: ["123"], target: "dm" });
     const channelCfg = buildConfig({ enabled: true, approvers: ["123"], target: "channel" });

extensions/telegram/src/exec-approvals.ts

@@ -66,12 +66,16 @@ export function isTelegramExecApprovalTargetRecipient(params: {
 }
 
 function countTelegramExecApprovalHandlerAccounts(cfg: OpenClawConfig): number {
-  return listTelegramAccountIds(cfg).filter((accountId) =>
-    isChannelExecApprovalClientEnabledFromConfig({
+  return listTelegramAccountIds(cfg).filter((accountId) => {
+    const account = resolveTelegramAccount({ cfg, accountId });
+    if (!account.enabled || account.tokenSource === "none") {
+      return false;
+    }
+    return isChannelExecApprovalClientEnabledFromConfig({
       enabled: resolveTelegramExecApprovalConfig({ cfg, accountId })?.enabled,
       approverCount: getTelegramExecApprovalApprovers({ cfg, accountId }).length,
-    }),
-  ).length;
+    });
+  }).length;
 }
 
 function matchesTelegramRequestAccount(params: {