openclaw - 💡(How to fix) Fix [Bug] openclaw agents list fails with unresolved SecretRef on non-default install [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#68632Fetched 2026-04-19 15:09:16
View on GitHub
Comments
1
Participants
2
Timeline
1
Reactions
0
Timeline (top)
commented ×1

openclaw agents list fails with an unresolved SecretRef error when the CLI is invoked inside a container where channels.telegram.botToken references an env var that is not yet resolved against the active gateway snapshot.

Error Message

[openclaw] Failed to start CLI: Error: channels.telegram.botToken: unresolved SecretRef "env:default:OPENCLAW_TELEGRAM_BOT_TOKEN".
  Resolve this command against an active gateway runtime snapshot before reading it.
    at assertSecretInputResolved (types.secrets-*.js:61:8)
    at normalizeResolvedSecretInputString (types.secrets-*.js:66:2)
    at resolveTelegramToken (token-*.js:63:22)
    ...
    at agentsListCommand (agents-*.js:861:31)

Root Cause

openclaw agents list fails with an unresolved SecretRef error when the CLI is invoked inside a container where channels.telegram.botToken references an env var that is not yet resolved against the active gateway snapshot.

Fix Action

Fix / Workaround

Operators cannot use openclaw agents list to inspect configured agents in non-default installs. Workaround: parse openclaw.json manually with jq.

Code Example

[openclaw] Failed to start CLI: Error: channels.telegram.botToken: unresolved SecretRef "env:default:OPENCLAW_TELEGRAM_BOT_TOKEN".
  Resolve this command against an active gateway runtime snapshot before reading it.
    at assertSecretInputResolved (types.secrets-*.js:61:8)
    at normalizeResolvedSecretInputString (types.secrets-*.js:66:2)
    at resolveTelegramToken (token-*.js:63:22)
    ...
    at agentsListCommand (agents-*.js:861:31)
RAW_BUFFERClick to expand / collapse

Summary

openclaw agents list fails with an unresolved SecretRef error when the CLI is invoked inside a container where channels.telegram.botToken references an env var that is not yet resolved against the active gateway snapshot.

Error message

[openclaw] Failed to start CLI: Error: channels.telegram.botToken: unresolved SecretRef "env:default:OPENCLAW_TELEGRAM_BOT_TOKEN".
  Resolve this command against an active gateway runtime snapshot before reading it.
    at assertSecretInputResolved (types.secrets-*.js:61:8)
    at normalizeResolvedSecretInputString (types.secrets-*.js:66:2)
    at resolveTelegramToken (token-*.js:63:22)
    ...
    at agentsListCommand (agents-*.js:861:31)

Reproduction

  1. Start an OpenClaw container whose openclaw.json has channels.telegram.botToken: "{{env:default:OPENCLAW_TELEGRAM_BOT_TOKEN}}" (SecretRef form).
  2. The env var IS set on the container (confirmed via env | grep OPENCLAW_TELEGRAM_BOT_TOKEN).
  3. Run openclaw agents list inside the container.
  4. Observe: CLI exits 1 with unresolved SecretRef error even though the secret is present.

Expected behaviour

openclaw agents list should not require the telegram token to be resolved — it's only needed if the agent list output includes channel health columns. Either:

  • Skip telegram resolution for commands that don't need it, OR
  • Fall back to env var resolution when the gateway snapshot is unavailable.

Affected installations

Confirmed on an OpenClaw 2026.4.12+ install using a custom OPENCLAW_CONFIG_PATH (Odo Nord deployment). Agent invocation (openclaw agent --agent X) still works — only the agents list listing command is gated.

Impact

Operators cannot use openclaw agents list to inspect configured agents in non-default installs. Workaround: parse openclaw.json manually with jq.

Source

Discovered during Phase 4 cross-installation audit of 4 OpenClaw deployments (host, neba, neba-mkt, odonorth), 2026-04-18.

extent analysis

TL;DR

The openclaw agents list command fails due to an unresolved SecretRef error when the CLI is invoked inside a container, and a workaround is to manually parse openclaw.json with jq or modify the command to skip telegram resolution.

Guidance

  • The error occurs because the channels.telegram.botToken references an env var that is not yet resolved against the active gateway snapshot.
  • To verify the issue, check if the env var OPENCLAW_TELEGRAM_BOT_TOKEN is set in the container using env | grep OPENCLAW_TELEGRAM_BOT_TOKEN.
  • A potential workaround is to parse openclaw.json manually with jq to inspect configured agents, as the openclaw agent --agent X invocation still works.
  • Another possible solution is to modify the openclaw agents list command to skip telegram resolution when the gateway snapshot is unavailable.

Example

No code snippet is provided as it is not clearly supported by the issue.

Notes

The issue is specific to OpenClaw 2026.4.12+ installations using a custom OPENCLAW_CONFIG_PATH, and the workaround may not apply to all scenarios.

Recommendation

Apply workaround: manually parse openclaw.json with jq to inspect configured agents, as this provides an immediate solution to the issue without requiring modifications to the openclaw agents list command.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix [Bug] openclaw agents list fails with unresolved SecretRef on non-default install [1 comments, 2 participants]