openclaw - 💡(How to fix) Fix [Bug]: Feishu MEDIA/image upload fails when appSecret uses SecretRef (Keychain)

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

After migrating Feishu bot credentials (appSecret) from plaintext to SecretRef (macOS Keychain via exec provider), the MEDIA directive can no longer send local images to Feishu chats. The image upload silently fails because the Feishu SDK in the MEDIA code path does not resolve SecretRef objects — it reads the raw appSecret field value, which is now { source: "exec", provider: "...", id: "value" } instead of the actual secret string.

Steps to reproduce

1. Configure Feishu channel with appSecret as a SecretRef:

{
  "channels": {
    "feishu": {
      "accounts": {
        "main-bot": {
          "appId": "cli_xxx",
          "appSecret": {
            "source": "exec",
            "provider": "keychain_feishu_main-bot",
            "id": "value"
          }
        }
      }
    }
  }
}

1. Restart gateway and verify normal chat works (WebSocket connection succeeds)
2. Try sending a local image via MEDIA directive in a Feishu DM:

MEDIA:/path/to/image.jpg

1. Recipient does not receive the image

Expected behavior

The Feishu SDK should resolve SecretRef objects before using appSecret, or the MEDIA upload code path should use the same credential resolution mechanism as the main WebSocket connection.

Actual behavior

Root Cause

The Feishu SDK's image upload path (used by MEDIA directive to call POST /open-apis/im/v1/images) does not go through the SecretRef resolution layer when reading appSecret. It reads the raw field value from the config object.

When appSecret was a plain string, this worked fine. After migration to SecretRef, the value is an object { source: "exec", ... }, which the SDK passes as-is to the authentication call. This results in a failed token acquisition, and the image upload silently fails.

Other Feishu features (WebSocket messaging, document read/write) work correctly because they use a different credential resolution path that properly handles SecretRef.

Confirmed by Testing

Impact

• Any agent using SecretRef-stored credentials cannot send local images via MEDIA directive
• This affects all agents that have migrated to Keychain-based secret storage
• The send_feishu_file.sh workaround (which hardcodes the secret) is not a viable cross-agent solution

OpenClaw version

2026.5.28

Operating system

macOS Tahoe 26.5 (arm64)

Install method

No response

Model

Deepseek V4 Flash

Provider / routing chain

Deepseek

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response