Bug type

Behavior bug (incorrect output/state without crash)

Summary

On OpenClaw v2026.3.2, the openclaw status command fails with unresolved Telegram SecretRef errors even though:

• the required environment variables are present in the process environment
• the same variables are also present in $OPENCLAW_STATE_DIR/.env
• other commands and runtime behavior indicate the configuration is otherwise valid

This looks like a command-path / read-only status resolution bug specific to status (possibly in its security-audit / Telegram account resolution path).

Steps to reproduce

1. Telegram bot tokens are configured via env SecretRef in openclaw.json
   Example:
   "channels": {
   "telegram": {
   "accounts": {
   "stock_expert": {
   "botToken": {
   "source": "env",
   "provider": "default",
   "id": "TG_TOKEN_1"
   }
   }
   }
   }
   }

2. Export the variables before invoking the command
   Example:
   set -a
   . /etc/openclaw/secrets.env
   set +a

sudo -u samtxxx env
HOME=/home/samtxxx
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
OPENCLAW_STATE_DIR=/opt/openclaw/state
OPENCLAW_CONFIG_PATH=/opt/openclaw/state/openclaw.json
OPENCLAW_GATEWAY_PASSWORD="$OPENCLAW_GATEWAY_PASSWORD"
TG_TOKEN_LEE="$TG_TOKEN_1"
TG_TOKEN_WONG="$TG_TOKEN_2"
TG_TOKEN_CUILIAN="$TG_TOKEN_3"
TG_TOKEN_DANA="$TG_TOKEN_4"
GEMINI_API_KEY_1="$GEMINI_API_KEY_1"
GEMINI_API_KEY_2="$GEMINI_API_KEY_2"
/usr/bin/openclaw status

3. Also tested with $OPENCLAW_STATE_DIR/.env

   A copy of /etc/openclaw/secrets.env was written to:
   /opt/openclaw/state/.env

with correct ownership/permissions, but openclaw status still failed with the same unresolved Telegram SecretRef error.

Expected behavior

openclaw status should succeed when:
1. TG_TOKEN_* variables are present in the process environment, or
2. the same variables are present in $OPENCLAW_STATE_DIR/.env

At minimum, status should not fail with unresolved SecretRef errors if the runtime environment already contains the required variables.

Actual behavior

openclaw status fails with:

[openclaw] Failed to start CLI: Error: channels.telegram.accounts.stock_expert.botToken: unresolved SecretRef "env:default:TG_TOKEN_1". Resolve this command against an active gateway runtime snapshot before reading it.

Stack trace points into the status -> security audit -> Telegram account resolve path, for example:

at assertSecretInputResolved (...)
at normalizeResolvedSecretInputString (...)
at resolveTelegramToken (...)
at resolveAccountWithDefaultFallback (...)
at resolveTelegramAccount (...)
at Object.resolveAccount (...)
at collectChannelSecurityFindings (...)
at runSecurityAudit (...)
at async .../status-....js

OpenClaw version

2026.3.2

Operating system

Debian12

Install method

npm global

Logs, screenshots, and evidence

**Additional evidence**

A wrapper self-check confirms the variables are present before launching OpenClaw CLI:

TG_TOKEN_1=SET
TG_TOKEN_2=SET
TG_TOKEN_3=SET
TG_TOKEN_4=SET
OPENCLAW_GATEWAY_PASSWORD=SET
OPENCLAW_STATE_DIR=SET
OPENCLAW_CONFIG_PATH=SET
HOME=SET
PATH=SET

So this does not appear to be caused by missing/empty environment variables.

**Observations**
	•	The failure is specific to openclaw status
	•	It appears during the security-audit / Telegram account resolution path
	•	The error message suggests resolving against an active gateway runtime snapshot, which implies this may be a read-only command-path bug rather than a true configuration error
	•	Other OpenClaw command paths do not necessarily fail in the same way

Impact and severity

This breaks normal CLI operations and day-2 ops workflows, because openclaw status becomes unusable for deployments that use Telegram env-backed SecretRef configuration, even when the environment is correctly present.

Additional information

Version / Environment

• OpenClaw: 2026.3.2
• Install method: global npm install
• OS: Debian 12
• Runtime: systemd service
• State dir: /opt/openclaw/state
• Config path: /opt/openclaw/state/openclaw.json

Telegram config pattern

Telegram accounts are configured with standard env-backed SecretRef values, e.g.:

"botToken": {
  "source": "env",
  "provider": "default",
  "id": "TG_TOKEN_1"
}

---
This same pattern is used for multiple Telegram accounts.