From b01612c2622460b9cad02e934a1ba2c65a77abe5 Mon Sep 17 00:00:00 2001
From: Shadow <shadow@clawd.bot>
Date: Tue, 27 Jan 2026 22:47:17 -0600
Subject: [PATCH] Discord: gate username lookups

---
 CHANGELOG.md           |  1 +
 src/discord/targets.ts | 43 +++++++++++++++++++++++++++++-------------
 2 files changed, 31 insertions(+), 13 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c6819e29a..3e11f1ef7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -78,6 +78,7 @@ Status: beta.
 - Web UI: auto-expand the chat compose textarea while typing (with sensible max height). (#2950) Thanks @shivamraut101.
 - Gateway: prevent crashes on transient network errors (fetch failures, timeouts, DNS). Added fatal error detection to only exit on truly critical errors. Fixes #2895, #2879, #2873. (#2980) Thanks @elliotsecops.
 - Agents: guard channel tool listActions to avoid plugin crashes. (#2859) Thanks @mbelinky.
+- Discord: avoid resolving bare channel names to user DMs when a username matches. Thanks @thewilloftheshadow.
 - Providers: update MiniMax API endpoint and compatibility mode. (#3064) Thanks @hlbbbbbbb.
 - Telegram: treat more network errors as recoverable in polling. (#3013) Thanks @ryancontent.
 - Discord: resolve usernames to user IDs for outbound messages. (#2649) Thanks @nonggialiang.
diff --git a/src/discord/targets.ts b/src/discord/targets.ts
index 311955182..00514a0ff 100644
--- a/src/discord/targets.ts
+++ b/src/discord/targets.ts
@@ -81,11 +81,14 @@ export async function resolveDiscordTarget(
   const trimmed = raw.trim();
   if (!trimmed) return undefined;
 
-  // If already a known format, parse directly
-  const directParse = parseDiscordTarget(trimmed, options);
-  if (directParse && directParse.kind !== "channel" && !isLikelyUsername(trimmed)) {
+  const shouldLookup = isExplicitUserLookup(trimmed, options);
+  const directParse = safeParseDiscordTarget(trimmed, options);
+  if (directParse && directParse.kind !== "channel") {
     return directParse;
   }
+  if (!shouldLookup) {
+    return directParse ?? parseDiscordTarget(trimmed, options);
+  }
 
   // Try to resolve as a username via directory lookup
   try {
@@ -110,15 +113,29 @@ export async function resolveDiscordTarget(
   return parseDiscordTarget(trimmed, options);
 }
 
-/**
- * Check if a string looks like a Discord username (not a mention, prefix, or ID).
- * Usernames typically don't start with special characters except underscore.
- */
-function isLikelyUsername(input: string): boolean {
-  // Skip if it's already a known format
-  if (/^(user:|channel:|discord:|@|<@!?)|[\d]+$/.test(input)) {
-    return false;
+function safeParseDiscordTarget(
+  input: string,
+  options: DiscordTargetParseOptions,
+): MessagingTarget | undefined {
+  try {
+    return parseDiscordTarget(input, options);
+  } catch {
+    return undefined;
   }
-  // Likely a username if it doesn't match known patterns
-  return true;
+}
+
+function isExplicitUserLookup(input: string, options: DiscordTargetParseOptions): boolean {
+  if (/^<@!?(\d+)>$/.test(input)) {
+    return true;
+  }
+  if (/^(user:|discord:)/.test(input)) {
+    return true;
+  }
+  if (input.startsWith("@")) {
+    return true;
+  }
+  if (/^\d+$/.test(input)) {
+    return options.defaultKind === "user";
+  }
+  return false;
 }