Summary

Fixes #5672 — channel-side /commands now filter by account_id, so a multi-bot Telegram (or any other channel sidecar) deployment no longer routes every command to the first-registered agent, and /agent no longer leaks the user's selection across bots.

The non-command message dispatch path already routed correctly because it built a BindingContext and called AgentRouter::resolve_with_context (the account-qualified resolver added in #2183 / #4861). The regression was strictly in the command arms (and in the model: interactive-button callback in dispatch_message) — every one of them called the context-less AgentRouter::resolve(channel_type, platform_id, user_key), which has no account_id parameter and only probes the plain "telegram" channel key. With per-bot defaults stored under qualified "telegram:<account_id>" keys, the lookup fell through to the system default — which the first-registered telegram bot also set — so /model, /new, /reboot, /compact, /stop, /usage, /think, /btw (and the model: button) in bot-b / bot-c always picked bot-a's agent.

Layer B (/agent-leak): /agent <name> wrote the user's selection via router.set_user_default(sender.platform_id, agent_id), keyed by platform_id only — no channel scope. The same lookup is then probed at step 2 of every resolver before the per-channel default, so a /agent agent-C issued in bot-a silently overrode every other bot's default_agent for that user, and stayed leaked until daemon restart (user_defaults is in-memory DashMap, never persisted).

Fix

Single architectural change applied in two places:

1. AgentRouter.user_defaults is now keyed by (Option<channel_account_key>, user_key):
   • Some("<channel>:<account_id>") — per-bot scope, set by set_user_default_for_channel(...) (new).
   • None — channel-agnostic global scope, the legacy semantics relied on by tests/bridge_integration_test.rs and benches/dispatch.rs. set_user_default(user_key, agent) keeps writing to this slot.
   • resolve_with_context probes the per-channel-account entry first, falls back to global.
2. handle_command gains an account_id: Option<&str> parameter; the two dispatch-site callers in dispatch_message thread message.metadata["account_id"] through. Inside, a resolve_for_command closure builds a BindingContext per call and routes through resolve_with_context. /agent writes via set_user_default_for_channel when an account_id is known and falls back to the legacy global write for CLI / single-bot channels. The model: interactive-button callback path in dispatch_message is migrated the same way.
3. resolve_or_fallback 's auto-bind on first-message is migrated identically — otherwise the fallback path would silently re-introduce the cross-bot leak.

Tests

Five new regression tests pin the fix; all existing tests (incl. test_multi_bot_account_id_routing from #2183) still pass:

• router::tests::user_default_does_not_leak_across_bots — /agent agent-C scoped to bot-a does NOT change bot-b's resolution for the same user.
• router::tests::channel_scoped_user_default_overrides_global — per-(channel,account) scope wins over global; different bot still sees only global.
• router::tests::legacy_set_user_default_is_channel_agnostic — set_user_default(user_key, agent) keeps channel-agnostic semantics so existing tests/benches stay valid.
• bridge::tests::command_resolution_respects_account_id — records set_model(agent_id, _) calls via a recording mock; /model issued in bot-b then bot-c records [agent_b, agent_c]. Pre-fix this would be [agent_a, agent_a].
• bridge::tests::agent_command_does_not_leak_across_bots — asserts the post-/agent resolve_with_context for bot-b returns bot-b's default, not bot-a's override.

Verification

• cargo test -p librefang-channels --lib → 465/465 passed (459 pre-existing + 6 new/regression).
• cargo test -p librefang-channels --tests → all integration tests green.
• cargo clippy -p librefang-channels --all-targets -- -D warnings → clean.
• cargo fmt -p librefang-channels --check → clean.
• cargo check --workspace --lib → clean.

Files touched

• crates/librefang-channels/src/router.rs — composite key + set_user_default_for_channel + resolve_with_context user-default probe order + 3 regression tests.
• crates/librefang-channels/src/bridge.rs — handle_command signature gains account_id; resolve_for_command closure replaces every router.resolve(...) command arm; /agent uses set_user_default_for_channel when scoped; dispatch_message button-callback (model:) migrated; resolve_or_fallback auto-bind migrated; 2 new regression tests + caller updates.
• CHANGELOG.md — [Unreleased] / Fixed entry.

Related

• fix: multi-bot Telegram routing uses account_id, not first-match on allowed_users #2183 — added the account-qualified inbound routing path that this PR finally extends to the command arms.
• fix(channels): channel-default key mismatch — resolver used Debug format #4861 — taught AgentRouter the BindingContext probe order this PR re-uses.
• Channel /new wipes ALL agent sessions, not just the channel-derived one #4868 / fix(channels,kernel): scope /new to the calling channel + purge JSONL on delete (#4868) #4905 — scoped /new's session reset to the calling channel but left the agent resolution itself context-less; this PR closes the gap.

Closes #5672