PR #71024: fix(mattermost): keep status read-only for SecretRef tokens

• Repository: openclaw/openclaw
• Author: afurm
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/71024

Description (problem / solution / changelog)

Summary

• Problem: openclaw status text mode crashed when Mattermost botToken used an unresolved exec:keychain SecretRef.
• Why it matters: Mattermost could be healthy at runtime, but read-only diagnostics failed before printing the channel table.
• What changed: Added a Mattermost read-only account inspector that reports configured-but-unavailable credential metadata without dereferencing the secret, and taught status snapshots to preserve that state.
• What did NOT change (scope boundary): Runtime Mattermost token resolution remains strict; this only changes read-only inspection/status behavior.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes #70942
• Related #
• This PR fixes a bug or regression

Root Cause (if applicable)

• Root cause: Mattermost had strict runtime account resolution but no read-only inspectAccount path. Status rendering fell back to resolveAccount, which throws on unresolved SecretRefs.
• Missing detection / guardrail: No Mattermost regression test covered read-only status inspection with an unresolved SecretRef credential.
• Contributing context (if known): Telegram, Discord, and Slack already had read-only inspectors; Mattermost was missing the equivalent path.

Regression Test Plan (if applicable)

• Coverage level that should have caught this:
  • Unit test
  • Seam / integration test
  • End-to-end test
  • Existing coverage already sufficient
• Target test or file:
  • extensions/mattermost/src/mattermost/accounts.test.ts
  • extensions/mattermost/src/channel-actions-setup-status.contract.test.ts
• Scenario the test should lock in: unresolved Mattermost SecretRef bot tokens are reported as configured/unavailable in read-only inspection without throwing.
• Why this is the smallest reliable guardrail: It tests the plugin resolver and the status snapshot contract directly without requiring a live Mattermost server.
• Existing test that already covers this (if any): None.
• If no new test is added, why not: N/A.

User-visible / Behavior Changes

openclaw status no longer crashes for Mattermost accounts whose bot token is configured as an unresolved SecretRef. It reports degraded credential availability instead.

Diagram (if applicable)

Before:
openclaw status -> Mattermost resolveAccount -> unresolved SecretRef throw -> CLI crash

After:
openclaw status -> Mattermost inspectAccount -> configured_unavailable metadata -> status table renders

Security Impact (required)

• New permissions/capabilities? (No)
• Secrets/tokens handling changed? (Yes)
• New/changed network calls? (No)
• Command/tool execution surface changed? (No)
• Data access scope changed? (No)
• If any Yes, explain risk + mitigation: Read-only status now detects configured SecretRefs without resolving them. It does not expose token values, and runtime resolution remains strict.

Repro + Verification

Environment

• OS: macOS local checkout
• Runtime/container: Node 22 / pnpm
• Model/provider: N/A
• Integration/channel (if any): Mattermost
• Relevant config (redacted): channels.mattermost.botToken as exec:keychain SecretRef plus baseUrl

Steps

1. Configure Mattermost with botToken as an unresolved SecretRef.
2. Run openclaw status.
3. Inspect the Mattermost status row.

Expected

• Status renders and reports Mattermost as configured with unavailable credentials.

Actual

• Fixed by this PR. Before the fix, status crashed with an unresolved SecretRef error.

Evidence

• Failing test/log before + passing after
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant)

Validation:

• pnpm test extensions/mattermost/src/mattermost/accounts.test.ts extensions/mattermost/src/channel-actions-setup-status.contract.test.ts
• pnpm check:changed

Human Verification (required)

• Verified scenarios:
  • Mattermost account inspection preserves unresolved SecretRef state without dereferencing the secret.
  • Mattermost status snapshots include botTokenStatus: configured_unavailable.
  • Changed-lane validation passed.
• Edge cases checked:
  • Runtime resolveMattermostAccount still throws on unresolved SecretRefs.
  • Read-only inspection treats SecretRef + baseUrl as configured but unavailable.
• What you did not verify:
  • A live Mattermost server connection.
  • A real exec:keychain secret provider returning a token.

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

• Backward compatible? (Yes)
• Config/env changes? (No)
• Migration needed? (No)
• If yes, exact upgrade steps: N/A.

Risks and Mitigations

• Risk: Status may treat a configured-but-unavailable SecretRef as configured even when the command cannot read it.
  • Mitigation: The row is marked with unavailable credential metadata, and runtime token use still requires successful strict resolution.

Changed files

• extensions/mattermost/src/channel-actions-setup-status.contract.test.ts (modified, +38/-1)
• extensions/mattermost/src/channel-config-shared.ts (modified, +3/-1)
• extensions/mattermost/src/channel.ts (modified, +2/-1)
• extensions/mattermost/src/mattermost/accounts.test.ts (modified, +32/-0)
• extensions/mattermost/src/mattermost/accounts.ts (modified, +97/-1)