Description

openclaw message send fails with unresolved SecretRef "env:default:TELEGRAM_BOT_TOKEN" when channels.telegram.botToken is configured as a SecretRef object rather than a plaintext string.

The gateway resolves the same SecretRef correctly at startup — Telegram channel works fine for normal agent conversations. Only the CLI message send command fails.

Steps to Reproduce

1. Configure botToken as SecretRef in openclaw.json:

   "channels": {
     "telegram": {
       "botToken": { "source": "env", "provider": "default", "id": "TELEGRAM_BOT_TOKEN" }
     }
   }

2. Export the env var: export TELEGRAM_BOT_TOKEN=<token>
3. Run: openclaw message send --channel telegram --target <chat_id> --message "test"

Expected Behavior

CLI resolves the SecretRef through the same secrets runtime snapshot path the gateway uses, and sends the message.

Actual Behavior

Error: unresolved SecretRef "env:default:TELEGRAM_BOT_TOKEN"

Analysis

This appears to be the same class of issue as #30311 — CLI commands read raw config values directly instead of resolving through the SecretRef pipeline. The gateway has proper resolution at startup, but individual CLI command paths bypass it.

SecretRef support for channels.telegram.botToken was added in #29580 (merged Mar 3, 2026), so this is a gap in the new coverage rather than a regression.

Workaround

Replace openclaw message send with direct Telegram Bot API curl calls in scripts/cron jobs, sourcing the token from the .env file manually.

Environment

• OpenClaw v2026.3.2
• Ubuntu Linux (VPS)
• SecretRef provider: env (default)

Related Issues

• Secrets: expand SecretRef scope to channel credentials (botToken, webhookSecret) #28306 — SecretRef scope expansion to channel credentials (completed, feat(secrets): expand SecretRef coverage across user-supplied credentials #29580)
• [Bug]: models status --probe reports "missing or expired" for exec-based SecretRef auth profiles #30311 — models status --probe doesn't resolve exec-based SecretRefs (open, PRs in progress)
• CLI: openclaw message send hangs after successful delivery (never exits) #16460 — message send hangs after delivery (separate bug, compounds this issue for script usage)