Skip to content

fix: ignore Telegram commands addressed to other bots - #10241

Open
fzf404 wants to merge 4 commits into
AstrBotDevs:masterfrom
fzf404:fix/telegram-command-target
Open

fzf404 wants to merge 4 commits into
AstrBotDevs:masterfrom
fzf404:fix/telegram-command-target

Conversation

@fzf404

@fzf404 fzf404 commented Sep 26, 2026 •

Copy link
Copy Markdown

Fixes #10240.

Telegram currently leaves /command@OtherBot unchanged when the target username does not match the current bot. The generic waking stage can then treat the leading / as a wake prefix before command matching, so a command intended for another Telegram bot may wake AstrBot and reach LLM handling.

Modifications / 改动点

  • Ignore Telegram commands explicitly addressed to another bot before they enter AstrBot's event pipeline.

  • Strip the @username suffix from commands addressed to the current bot.

  • Compare Telegram bot usernames case-insensitively.

  • Preserve bare commands such as /help, leaving their behavior to the existing AstrBot configuration.

  • Add regression tests for current-bot targets, case-insensitive targets, arguments, bare commands, and other-bot targets.

  • This is NOT a breaking change. / 这不是一个破坏性变更。

Screenshots or Test Results / 运行截图或测试结果

$ uv run pytest tests/test_telegram_adapter.py -q
37 passed, 1 warning in 4.04s

$ uv run ruff format --check astrbot/core/platform/sources/telegram/tg_adapter.py tests/test_telegram_adapter.py
2 files already formatted

$ uv run ruff check astrbot/core/platform/sources/telegram/tg_adapter.py tests/test_telegram_adapter.py
All checks passed!

The warning is the existing Python 3.12 audioop deprecation warning from tencent_record_helper.py.


Checklist / 检查清单

  • 😊 The bug and expected routing behavior are documented in [Bug] Telegram 群聊中发给其他机器人的命令会误唤醒 AstrBot #10240.
  • 👀 The change is covered by Telegram adapter regression tests and the verification results are included above.
  • 📚 No WebUI navigation, page structure, labels, or user-facing documentation changed.
  • 🤓 No new dependencies were introduced.
  • 😮 This change does not introduce malicious code.

Summary by Sourcery

Prevent Telegram commands intended for other bots from waking AstrBot while preserving existing command behavior.

Bug Fixes:

  • Prevent Telegram group commands addressed to other bots from entering AstrBot's event pipeline and potentially triggering LLM handling.
  • Normalize commands addressed to the current Telegram bot, including case-insensitive usernames, while preserving bare commands and ordinary mentions.

Tests:

  • Add regression coverage for targeted commands, case-insensitive usernames, arguments, bare commands, non-target mentions, private messages, and reply side effects.

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've found 1 issue

Prompt for AI Agents
Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="astrbot/core/platform/sources/telegram/tg_adapter.py" line_range="617" />
<code_context>
-                        )
+                    command, bot_name = command_parts[0].split("@", 1)
+                    if bot_name.casefold() != context.bot.username.casefold():
+                        return None
+                    plain_text = command + (
+                        f" {command_parts[1]}" if len(command_parts) > 1 else ""
</code_context>
<issue_to_address>
**issue (broader_impact):** A command addressed to another bot is filtered only after the message's reply chain has already been recursively converted. If the ignored message replies to `/start`, the recursive conversion invokes `self.start()` and sends AstrBot's start message even though the outer command should be ignored.

**Triggers:** When a user sends `/command@OtherBot` as a reply to a Telegram `/start` message.

**Suggested fix:** Normalize and reject explicitly addressed commands before recursively converting the reply message, or suppress side effects while converting reply chains.
</issue_to_address>

Sourcery assessment

Approval pending. 1 finding to address first.

Blocking findings: astrbot/core/platform/sources/telegram/tg_adapter.py:617


Sourcery is free for open source - if you like our reviews please consider sharing them ✨

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sourcery assessment

Approved.

and update.message.text
and update.message.text.startswith("/")
):
command_token = update.message.text.split(" ", 1)[0]

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

command_token splits on the first space, so a command with a newline before any space merges into bot_name.
A mismatched comparison drops a command addressed to this bot instead of processing it.

@Soulter Soulter moved this to In Progress in AstrBot Roadmap Nov 2, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: In Progress

Development

Successfully merging this pull request may close these issues.

[Bug] Telegram 群聊中发给其他机器人的命令会误唤醒 AstrBot

2 participants