Fix Discord SecretRef configured state

80mills · 80mills · commit f98e14b1d15a · 2026-05-03T03:59:20.000Z
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -13,6 +13,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- Discord: report unresolved SecretRef bot tokens as configured but unavailable in status snapshots without treating them as runtime-startable tokens.
 - Gateway/sessions: keep async `sessions.list` title and preview hydration bounded to transcript head/tail reads so Control UI polling cannot full-scan large session transcripts every refresh. Thanks @vincentkoc.
 - Gateway: preserve stack diagnostics when `chat.send` or agent attachment parsing/staging fails, improving image-send failure triage. Refs #63432. (#75135) Thanks @keen0206.
 - Maintainer workflow: push prepared PR heads through GitHub's verified commit API by default and require an explicit override before git-protocol pushes can publish unsigned commits. Thanks @BunsDev.
diff --git a/extensions/discord/src/accounts.ts b/extensions/discord/src/accounts.ts
@@ -22,6 +22,7 @@ export type ResolvedDiscordAccount = {
   name?: string;
   token: string;
   tokenSource: "env" | "config" | "none";
+  tokenStatus: "available" | "configured_unavailable" | "missing";
   config: DiscordAccountConfig;
 };
 
@@ -114,6 +115,7 @@ export function resolveDiscordAccount(params: {
     name: normalizeOptionalString(merged.name),
     token: tokenResolution.token,
     tokenSource: tokenResolution.source,
+    tokenStatus: tokenResolution.tokenStatus,
     config: merged,
   };
 }
diff --git a/extensions/discord/src/client.test.ts b/extensions/discord/src/client.test.ts
@@ -58,7 +58,7 @@ describe("createDiscordRestClient", () => {
     expect(result.account.config.retry).toMatchObject({ attempts: 7 });
   });
 
-  it("still throws when no explicit token is provided and config token is unresolved", () => {
+  it("throws a missing token error when no explicit token is provided and config token is unresolved", () => {
     const cfg = {
       channels: {
         discord: {
@@ -71,6 +71,8 @@ describe("createDiscordRestClient", () => {
       },
     } as OpenClawConfig;
 
-    expect(() => createDiscordRestClient({ cfg, rest: fakeRest })).toThrow(/unresolved SecretRef/i);
+    expect(() => createDiscordRestClient({ cfg, rest: fakeRest })).toThrow(
+      /Discord bot token missing/,
+    );
   });
 });
diff --git a/extensions/discord/src/client.ts b/extensions/discord/src/client.ts
@@ -92,6 +92,7 @@ function resolveAccountWithoutToken(params: {
     name: normalizeOptionalString(merged.name),
     token: "",
     tokenSource: "none",
+    tokenStatus: "missing",
     config: merged,
   };
 }
diff --git a/extensions/discord/src/security-audit.test.ts b/extensions/discord/src/security-audit.test.ts
@@ -22,6 +22,7 @@ function createAccount(
     enabled: true,
     token: "t",
     tokenSource: "config",
+    tokenStatus: "available",
     config,
   };
 }
diff --git a/extensions/discord/src/shared.test.ts b/extensions/discord/src/shared.test.ts
@@ -62,6 +62,29 @@ describe("createDiscordPluginBase", () => {
     );
     expect(plugin.config.isEnabled?.(workAccount, cfg)).toBe(true);
   });
+
+  it("does not treat unavailable SecretRef tokens as runtime configured", async () => {
+    const plugin = createDiscordPluginBase({ setup: {} as never });
+    const cfg = {
+      channels: {
+        discord: {
+          token: {
+            source: "env",
+            provider: "default",
+            id: "DISCORD_BOT_TOKEN",
+          },
+        },
+      },
+    } as OpenClawConfig;
+
+    const account = plugin.config.resolveAccount(cfg, "default");
+
+    expect(await plugin.config.isConfigured?.(account, cfg)).toBe(false);
+    expect(plugin.config.describeAccount?.(account, cfg)).toMatchObject({
+      configured: true,
+      tokenStatus: "configured_unavailable",
+    });
+  });
 });
 
 describe("discordConfigAdapter", () => {
diff --git a/extensions/discord/src/shared.ts b/extensions/discord/src/shared.ts
@@ -149,13 +149,14 @@ export function createDiscordPluginBase(params: {
         typeof env?.DISCORD_BOT_TOKEN === "string" && env.DISCORD_BOT_TOKEN.trim().length > 0,
       isEnabled: (account, cfg) => isDiscordAccountEnabledForRuntime(account, cfg),
       disabledReason: (account, cfg) => resolveDiscordAccountDisabledReason(account, cfg),
-      isConfigured: (account) => Boolean(account.token?.trim()),
+      isConfigured: (account) => account.tokenStatus === "available",
       describeAccount: (account) =>
         describeAccountSnapshot({
           account,
-          configured: Boolean(account.token?.trim()),
+          configured: account.tokenStatus !== "missing",
           extra: {
             tokenSource: account.tokenSource,
+            tokenStatus: account.tokenStatus,
           },
         }),
     },
diff --git a/extensions/discord/src/token.test.ts b/extensions/discord/src/token.test.ts
@@ -91,7 +91,7 @@ describe("resolveDiscordToken", () => {
     expect(res.source).toBe("config");
   });
 
-  it("throws when token is an unresolved SecretRef object", () => {
+  it("marks unresolved SecretRef token as configured unavailable", () => {
     const cfg = {
       channels: {
         discord: {
@@ -100,8 +100,27 @@ describe("resolveDiscordToken", () => {
       },
     } as unknown as OpenClawConfig;
 
-    expect(() => resolveDiscordToken(cfg)).toThrow(
-      /channels\.discord\.token: unresolved SecretRef/i,
-    );
+    const res = resolveDiscordToken(cfg);
+    expect(res.token).toBe("");
+    expect(res.source).toBe("config");
+    expect(res.tokenStatus).toBe("configured_unavailable");
+  });
+
+  it("marks explicit blank account token as missing without falling back", () => {
+    const cfg = {
+      channels: {
+        discord: {
+          token: "base-token",
+          accounts: {
+            work: { token: "" },
+          },
+        },
+      },
+    } as OpenClawConfig;
+
+    const res = resolveDiscordToken(cfg, { accountId: "work" });
+    expect(res.token).toBe("");
+    expect(res.source).toBe("none");
+    expect(res.tokenStatus).toBe("missing");
   });
 });
diff --git a/extensions/discord/src/token.ts b/extensions/discord/src/token.ts
@@ -2,12 +2,18 @@ import type { BaseTokenResolution } from "openclaw/plugin-sdk/channel-contract";
 import type { OpenClawConfig } from "openclaw/plugin-sdk/config-types";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/routing";
 import { resolveAccountEntry } from "openclaw/plugin-sdk/routing";
-import { normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
+import {
+  normalizeResolvedSecretInputString,
+  resolveSecretInputString,
+  type SecretInputStringResolution,
+} from "openclaw/plugin-sdk/secret-input";
 
 type DiscordTokenSource = "env" | "config" | "none";
+type DiscordCredentialStatus = SecretInputStringResolution["status"];
 
 export type DiscordTokenResolution = BaseTokenResolution & {
   source: DiscordTokenSource;
+  tokenStatus: DiscordCredentialStatus;
 };
 
 export function normalizeDiscordToken(raw: unknown, path: string): string | undefined {
@@ -18,6 +24,20 @@ export function normalizeDiscordToken(raw: unknown, path: string): string | unde
   return trimmed.replace(/^Bot\s+/i, "");
 }
 
+function inspectDiscordToken(
+  raw: unknown,
+  path: string,
+): {
+  token: string;
+  tokenStatus: DiscordCredentialStatus;
+} {
+  const resolved = resolveSecretInputString({ value: raw, path, mode: "inspect" });
+  if (resolved.status !== "available") {
+    return { token: "", tokenStatus: resolved.status };
+  }
+  return { token: resolved.value.replace(/^Bot\s+/i, ""), tokenStatus: "available" };
+}
+
 export function resolveDiscordToken(
   cfg: OpenClawConfig,
   opts: { accountId?: string | null; envToken?: string | null } = {},
@@ -29,32 +49,50 @@ export function resolveDiscordToken(
     accountCfg &&
     Object.prototype.hasOwnProperty.call(accountCfg as Record<string, unknown>, "token"),
   );
-  const accountToken = normalizeDiscordToken(
-    (accountCfg as { token?: unknown } | undefined)?.token ?? undefined,
+  const inspectedAccountToken = inspectDiscordToken(
+    (accountCfg as { token?: unknown } | undefined)?.token,
     `channels.discord.accounts.${accountId}.token`,
   );
+  const accountToken = inspectedAccountToken.token;
   if (accountToken) {
-    return { token: accountToken, source: "config" };
+    return {
+      token: accountToken,
+      source: "config",
+      tokenStatus: inspectedAccountToken.tokenStatus,
+    };
   }
   if (hasAccountToken) {
-    return { token: "", source: "none" };
+    return {
+      token: inspectedAccountToken.token,
+      source: inspectedAccountToken.tokenStatus === "configured_unavailable" ? "config" : "none",
+      tokenStatus: inspectedAccountToken.tokenStatus,
+    };
   }
 
-  const configToken = normalizeDiscordToken(
-    discordCfg?.token ?? undefined,
-    "channels.discord.token",
-  );
+  const inspectedConfigToken = inspectDiscordToken(discordCfg?.token, "channels.discord.token");
+  const configToken = inspectedConfigToken.token;
   if (configToken) {
-    return { token: configToken, source: "config" };
+    return {
+      token: configToken,
+      source: "config",
+      tokenStatus: inspectedConfigToken.tokenStatus,
+    };
+  }
+  if (inspectedConfigToken.tokenStatus === "configured_unavailable") {
+    return {
+      token: inspectedConfigToken.token,
+      source: "config",
+      tokenStatus: "configured_unavailable",
+    };
   }
 
   const allowEnv = accountId === DEFAULT_ACCOUNT_ID;
   const envToken = allowEnv
     ? normalizeDiscordToken(opts.envToken ?? process.env.DISCORD_BOT_TOKEN, "DISCORD_BOT_TOKEN")
     : undefined;
   if (envToken) {
-    return { token: envToken, source: "env" };
+    return { token: envToken, source: "env", tokenStatus: "available" };
   }
 
-  return { token: "", source: "none" };
+  return { token: "", source: "none", tokenStatus: "missing" };
 }

Original file line number	Diff line number	Diff line change
`@@ -92,6 +92,7 @@ function resolveAccountWithoutToken(params: {`
`92`	`92`	`name: normalizeOptionalString(merged.name),`
`93`	`93`	`token: "",`
`94`	`94`	`tokenSource: "none",`
	`95`	`+ tokenStatus: "missing",`
`95`	`96`	`config: merged,`
`96`	`97`	`};`
`97`	`98`	`}`
Original file line number	Diff line number	Diff line change
`@@ -22,6 +22,7 @@ function createAccount(`
`22`	`22`	`enabled: true,`
`23`	`23`	`token: "t",`
`24`	`24`	`tokenSource: "config",`
	`25`	`+ tokenStatus: "available",`
`25`	`26`	`config,`
`26`	`27`	`};`
`27`	`28`	`}`