Skip to content

Bug: hasBotMention substring match causes cross-bot mention collision in Telegram multi-account groups #29173

@xdanger

Description

@xdanger

Description

When running multiple Telegram bot accounts in the same group, hasBotMention() in send-CpkY_YZv.js uses String.includes() for mention detection, which matches substrings instead of exact usernames. This causes a bot to incorrectly believe it was mentioned when a different bot with a longer username sharing the same prefix is mentioned.

Reproduction

  1. Configure two Telegram bot accounts in the same group:
    • default with username @gaian
    • gaia-chat with username @GaianChat_Bot
  2. In the group, send: @GaianChat_Bot what is the group id?
  3. The default bot (@gaian) also processes the message, because "@gaianchat_bot".includes("@gaian")true

Root Cause

send-CpkY_YZv.js line ~771:

function hasBotMention(msg, botUsername) {
    // BUG: substring match — "@gaian" matches inside "@gaianchat_bot"
    if ((msg.text ?? msg.caption ?? "").toLowerCase().includes(`@${botUsername}`)) return true;
    // ...entity-based check below is correct (uses ===)
}

The entity-based check on line ~775 correctly uses exact comparison (===), but the text-based fallback on line ~771 uses .includes() which matches prefixes.

Fix

Replace the substring check with a word-boundary check:

const text = (msg.text ?? msg.caption ?? "").toLowerCase();
const mention = `@${botUsername}`;
const idx = text.indexOf(mention);
if (idx !== -1 && (idx + mention.length >= text.length || !/\w/.test(text[idx + mention.length]))) return true;

This ensures @gaian matches only when followed by a non-word character or end of string.

Environment

  • OpenClaw 2026.2.26
  • Telegram multi-account setup with 4 bots in the same group

Related Issues

Metadata

Metadata

Assignees

No one assigned

    Labels

    staleMarked as stale due to inactivity

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions