Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix openclaw status fails on Telegram file SecretRef while resolving allowlist metadata [3 pull requests, 1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#74832•Fetched 2026-05-01 05:40:56
View on GitHub
Comments
1
Participants
2
Timeline
5
Reactions
0
Author
coolmannscoolmanns
Participants
clawsweeper[bot]clawsweeper[bot]coolmannscoolmanns
Timeline (top)
cross-referenced ×4commented ×1

On 2026.4.27, openclaw status can hard-fail when the Telegram bot token is configured via a file-backed SecretRef, even though the gateway is live and openclaw secrets audit reports the SecretRef as resolved.

Observed error:

channels.telegram.botToken: unresolved SecretRef "file:filemain:/telegram/botToken". Resolve this command against an active gateway runtime snapshot before reading it.

Error Message

Observed error:

Root Cause

On 2026.4.27, openclaw status can hard-fail when the Telegram bot token is configured via a file-backed SecretRef, even though the gateway is live and openclaw secrets audit reports the SecretRef as resolved.

Observed error:

channels.telegram.botToken: unresolved SecretRef "file:filemain:/telegram/botToken". Resolve this command against an active gateway runtime snapshot before reading it.

Fix Action

Fix / Workaround

I have a tested patch locally and will open a PR.

Validation from local patch

PR fix notes

PR #74833: fix(telegram): avoid resolving secrets for status accessors

Description (problem / solution / changelog)

Summary

Fix Telegram config/status accessors so read-only metadata paths (allowFrom, defaultTo) do not strict-resolve botToken SecretRefs.

openclaw status can currently fail when Telegram uses a valid file-backed SecretRef:

channels.telegram.botToken: unresolved SecretRef "file:filemain:/telegram/botToken". Resolve this command against an active gateway runtime snapshot before reading it.

The runtime account resolver should still resolve tokens strictly. This PR only adds a config-only accessor account for status/allowlist/default-target metadata, using mergeTelegramAccountConfig instead of resolveTelegramAccount.

Fixes #74832.

Testing

pnpm exec vitest run extensions/telegram/src/shared.test.ts extensions/telegram/src/account-inspect.test.ts --config test/vitest/vitest.extension-telegram.config.ts
# 2 files, 15 tests passed

NODE_OPTIONS=--max-old-space-size=8192 pnpm exec tsc -p tsconfig.extensions.test.json --noEmit --pretty false
# passed

Changed files

  • extensions/telegram/src/shared.test.ts (modified, +45/-0)
  • extensions/telegram/src/shared.ts (modified, +31/-4)

PR #74895: fix(telegram): remove strict SecretRef resolve in read-only token inspection

Description (problem / solution / changelog)

Summary

Targeted single-issue fix.

Closes #74832

🤖 Generated with Claude Code

Changed files

  • extensions/telegram/src/token.ts (modified, +4/-7)

PR #75354: fix(telegram): remove strict SecretRef resolve in read-only token inspection

Description (problem / solution / changelog)

Resubmit of #74895 (rebased on current main). Closes #74832

🤖 Generated with Claude Code

Changed files

  • extensions/telegram/src/token.ts (modified, +1/-7)

Code Example

channels.telegram.botToken: unresolved SecretRef "file:filemain:/telegram/botToken". Resolve this command against an active gateway runtime snapshot before reading it.

---

{
  "secrets": {
    "providers": {
      "filemain": { "source": "file", "path": "/path/to/secrets.json" }
    }
  },
  "channels": {
    "telegram": {
      "botToken": { "source": "file", "provider": "filemain", "id": "/telegram/botToken" },
      "allowFrom": ["8197233951"]
    }
  }
}

---

openclaw status

---

pnpm exec vitest run extensions/telegram/src/shared.test.ts extensions/telegram/src/account-inspect.test.ts --config test/vitest/vitest.extension-telegram.config.ts
# 2 files, 15 tests passed

NODE_OPTIONS=--max-old-space-size=8192 pnpm exec tsc -p tsconfig.extensions.test.json --noEmit --pretty false
# passed
RAW_BUFFERClick to expand / collapse

Summary

On 2026.4.27, openclaw status can hard-fail when the Telegram bot token is configured via a file-backed SecretRef, even though the gateway is live and openclaw secrets audit reports the SecretRef as resolved.

Observed error:

channels.telegram.botToken: unresolved SecretRef "file:filemain:/telegram/botToken". Resolve this command against an active gateway runtime snapshot before reading it.

Impact

The status command becomes unusable for a valid Telegram configuration using botToken: { source: "file", provider: "filemain", id: "/telegram/botToken" }.

Likely cause

Telegram already has a read-only inspector (extensions/telegram/src/account-inspect.ts) that marks non-env configured secrets as configured_unavailable instead of strict-resolving them.

But extensions/telegram/src/shared.ts wires createScopedChannelConfigAdapter without a Telegram-specific resolveAccessorAccount, so metadata/accessor paths such as resolveAllowFrom fall back to strict resolveAccount. That dereferences botToken while building status/allowlist metadata.

Slack/Discord appear to already use a config-accessor pattern for this split.

Repro shape

Telegram config shape:

{
  "secrets": {
    "providers": {
      "filemain": { "source": "file", "path": "/path/to/secrets.json" }
    }
  },
  "channels": {
    "telegram": {
      "botToken": { "source": "file", "provider": "filemain", "id": "/telegram/botToken" },
      "allowFrom": ["8197233951"]
    }
  }
}

Then run:

openclaw status

Suggested fix

Add a Telegram resolveAccessorAccount that uses config-only merged account data (mergeTelegramAccountConfig) for allowFrom / defaultTo, without resolving botToken. Runtime resolveAccount should stay strict.

I have a tested patch locally and will open a PR.

Validation from local patch

pnpm exec vitest run extensions/telegram/src/shared.test.ts extensions/telegram/src/account-inspect.test.ts --config test/vitest/vitest.extension-telegram.config.ts
# 2 files, 15 tests passed

NODE_OPTIONS=--max-old-space-size=8192 pnpm exec tsc -p tsconfig.extensions.test.json --noEmit --pretty false
# passed

Adjacent related work: #71024 (Mattermost read-only SecretRef status), #66936 (older Telegram SecretRef CLI failure/hang).

extent analysis

TL;DR

Implement a Telegram-specific resolveAccessorAccount to handle botToken resolution without strict-resolving, allowing the openclaw status command to work with file-backed SecretRef configurations.

Guidance

  • Review the suggested fix to add a Telegram resolveAccessorAccount that uses config-only merged account data for allowFrom and defaultTo without resolving botToken.
  • Verify the fix by running the provided test commands, ensuring that the openclaw status command works as expected with the updated implementation.
  • Consider the adjacent related work, such as #71024 and #66936, to ensure consistency in handling SecretRef configurations across different platforms.
  • Test the updated implementation with various Telegram configurations to ensure the fix does not introduce any regressions.

Example

No code snippet is provided as the issue already includes a suggested fix and the focus is on guiding the implementation and verification of the solution.

Notes

The provided patch and test results suggest a promising solution, but it is essential to thoroughly review and test the implementation to ensure it works as expected in all scenarios.

Recommendation

Apply the suggested workaround by implementing the Telegram-specific resolveAccessorAccount as described, allowing the openclaw status command to work with file-backed SecretRef configurations. This approach addresses the root cause of the issue and provides a targeted solution.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#runtime error#dependency conflict#environment setup#docker error#permission error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING