fix(line): dedupe webhook message replays by message id [AI-assisted]

Mark L · Mark L · commit f2dfd366bb02 · 2026-03-01T19:18:55.000+08:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -78,6 +78,7 @@ Docs: https://docs.openclaw.ai
 ### Fixes
 
 - Onboarding/Custom providers: raise default custom-provider model context window to the runtime hard minimum (16k) and auto-heal existing custom model entries below that threshold during reconfiguration, preventing immediate `Model context window too small (4096 tokens)` failures. (#21653) Thanks @r4jiv007.
+- LINE/inbound dedupe: skip duplicate webhook message redeliveries by LINE message ID before dispatch, preventing the same inbound message from being replayed into sessions as repeated user turns after provider-side failures. (#30574)
 - Web UI/Assistant text: strip internal `<relevant-memories>...</relevant-memories>` scaffolding from rendered assistant messages (while preserving code-fence literals), preventing memory-context leakage in chat output for models that echo internal blocks. (#29851) Thanks @Valkster70.
 - Dashboard/Sessions: allow authenticated Control UI clients to delete and patch sessions while still blocking regular webchat clients from session mutation RPCs, fixing Dashboard session delete failures. (#21264) Thanks @jskoiz.
 - TUI/Session model status: clear stale runtime model identity when model overrides change so `/model` updates are reflected immediately in `sessions.patch` responses and `sessions.list` status surfaces. (#28619) Thanks @lejean2000.
diff --git a/src/line/bot-handlers.test.ts b/src/line/bot-handlers.test.ts
@@ -64,6 +64,7 @@ const { readAllowFromStoreMock, upsertPairingRequestMock } = vi.hoisted(() => ({
 }));
 
 let handleLineWebhookEvents: typeof import("./bot-handlers.js").handleLineWebhookEvents;
+let resetLineWebhookEventDedupeForTests: typeof import("./bot-handlers.js").resetLineWebhookEventDedupeForTests;
 
 const createRuntime = () => ({ log: vi.fn(), error: vi.fn(), exit: vi.fn() });
 
@@ -74,10 +75,12 @@ vi.mock("../pairing/pairing-store.js", () => ({
 
 describe("handleLineWebhookEvents", () => {
   beforeAll(async () => {
-    ({ handleLineWebhookEvents } = await import("./bot-handlers.js"));
+    ({ handleLineWebhookEvents, resetLineWebhookEventDedupeForTests } =
+      await import("./bot-handlers.js"));
   });
 
   beforeEach(() => {
+    resetLineWebhookEventDedupeForTests();
     buildLineMessageContextMock.mockClear();
     buildLinePostbackContextMock.mockClear();
     readAllowFromStoreMock.mockClear();
@@ -248,4 +251,64 @@ describe("handleLineWebhookEvents", () => {
     expect(processMessage).not.toHaveBeenCalled();
     expect(buildLineMessageContextMock).not.toHaveBeenCalled();
   });
+
+  it("skips duplicate inbound LINE message events by message id", async () => {
+    const processMessage = vi.fn();
+    const event = {
+      type: "message",
+      message: { id: "m-dup-1", type: "text", text: "hello" },
+      replyToken: "reply-token",
+      timestamp: Date.now(),
+      source: { type: "group", groupId: "group-dup", userId: "user-dup" },
+      mode: "active",
+      webhookEventId: "evt-dup-1",
+      deliveryContext: { isRedelivery: false },
+    } as MessageEvent;
+
+    await handleLineWebhookEvents([event], {
+      cfg: {
+        channels: { line: { groupPolicy: "allowlist", groupAllowFrom: ["user-dup"] } },
+      },
+      account: {
+        accountId: "default",
+        enabled: true,
+        channelAccessToken: "token",
+        channelSecret: "secret",
+        tokenSource: "config",
+        config: { groupPolicy: "allowlist", groupAllowFrom: ["user-dup"] },
+      },
+      runtime: createRuntime(),
+      mediaMaxBytes: 1,
+      processMessage,
+    });
+
+    await handleLineWebhookEvents(
+      [
+        {
+          ...event,
+          webhookEventId: "evt-dup-redelivery",
+          deliveryContext: { isRedelivery: true },
+        } as MessageEvent,
+      ],
+      {
+        cfg: {
+          channels: { line: { groupPolicy: "allowlist", groupAllowFrom: ["user-dup"] } },
+        },
+        account: {
+          accountId: "default",
+          enabled: true,
+          channelAccessToken: "token",
+          channelSecret: "secret",
+          tokenSource: "config",
+          config: { groupPolicy: "allowlist", groupAllowFrom: ["user-dup"] },
+        },
+        runtime: createRuntime(),
+        mediaMaxBytes: 1,
+        processMessage,
+      },
+    );
+
+    expect(buildLineMessageContextMock).toHaveBeenCalledTimes(1);
+    expect(processMessage).toHaveBeenCalledTimes(1);
+  });
 });
diff --git a/src/line/bot-handlers.ts b/src/line/bot-handlers.ts
@@ -14,6 +14,7 @@ import {
   warnMissingProviderGroupPolicyFallbackOnce,
 } from "../config/runtime-group-policy.js";
 import { danger, logVerbose } from "../globals.js";
+import { createDedupeCache } from "../infra/dedupe.js";
 import { resolvePairingIdLabel } from "../pairing/pairing-labels.js";
 import { buildPairingReply } from "../pairing/pairing-messages.js";
 import {
@@ -50,6 +51,33 @@ export interface LineHandlerContext {
   processMessage: (ctx: LineInboundContext) => Promise<void>;
 }
 
+const lineWebhookEventDedupe = createDedupeCache({
+  ttlMs: 20 * 60_000,
+  maxSize: 5000,
+});
+
+function buildLineWebhookEventDedupeKey(event: WebhookEvent): string | null {
+  if (event.type === "message") {
+    const messageId = event.message?.id?.trim();
+    return messageId ? `message:${messageId}` : null;
+  }
+  if (event.type === "postback") {
+    const replyToken = event.replyToken?.trim();
+    if (replyToken) {
+      return `postback:${replyToken}`;
+    }
+  }
+  const webhookEventId = (event as { webhookEventId?: unknown }).webhookEventId;
+  if (typeof webhookEventId === "string" && webhookEventId.trim()) {
+    return `event:${webhookEventId.trim()}`;
+  }
+  return null;
+}
+
+export function resetLineWebhookEventDedupeForTests(): void {
+  lineWebhookEventDedupe.clear();
+}
+
 function resolveLineGroupConfig(params: {
   config: ResolvedLineAccount["config"];
   groupId?: string;
@@ -319,6 +347,11 @@ export async function handleLineWebhookEvents(
   context: LineHandlerContext,
 ): Promise<void> {
   for (const event of events) {
+    const dedupeKey = buildLineWebhookEventDedupeKey(event);
+    if (dedupeKey && lineWebhookEventDedupe.check(dedupeKey)) {
+      logVerbose(`line: skipped duplicate webhook event (${dedupeKey})`);
+      continue;
+    }
     try {
       switch (event.type) {
         case "message":
