diff --git a/extensions/telegram/src/token.test.ts b/extensions/telegram/src/token.test.ts index c81e5d57b2c..74218f83ddd 100644 --- a/extensions/telegram/src/token.test.ts +++ b/extensions/telegram/src/token.test.ts @@ -188,6 +188,24 @@ describe("resolveTelegramToken", () => { expect(res.source).toBe("none"); }); + it("does not fall through to channel-level token when non-default accountId is not in config", () => { + vi.stubEnv("TELEGRAM_BOT_TOKEN", ""); + const cfg = { + channels: { + telegram: { + botToken: "wrong-bot-token", + accounts: { + knownBot: { botToken: "known-bot-token" }, + }, + }, + }, + } as OpenClawConfig; + + const res = resolveTelegramToken(cfg, { accountId: "unknownBot" }); + expect(res.token).toBe(""); + expect(res.source).toBe("none"); + }); + it("throws when botToken is an unresolved SecretRef object", () => { const cfg = { channels: { diff --git a/extensions/telegram/src/token.ts b/extensions/telegram/src/token.ts index 6727e9a7ee4..87ee2a7e11b 100644 --- a/extensions/telegram/src/token.ts +++ b/extensions/telegram/src/token.ts @@ -44,6 +44,17 @@ export function resolveTelegramToken( const accountCfg = resolveAccountCfg( accountId !== DEFAULT_ACCOUNT_ID ? accountId : DEFAULT_ACCOUNT_ID, ); + + // When a non-default accountId is explicitly specified but not found in config, + // return empty immediately — do NOT fall through to channel-level defaults, + // which would silently route the message via the wrong bot's token. + if (accountId !== DEFAULT_ACCOUNT_ID && !accountCfg) { + opts.logMissingFile?.( + `channels.telegram.accounts: unknown accountId "${accountId}" — not found in config, refusing channel-level fallback`, + ); + return { token: "", source: "none" }; + } + const accountTokenFile = accountCfg?.tokenFile?.trim(); if (accountTokenFile) { const token = tryReadSecretFileSync(