Summary

openclaw message send fails with unresolved SecretRef for Slack bot token even when:

• Gateway is running and healthy
• openclaw channels status --probe reports Slack ok=true
• Slack token is valid (direct Slack Web API send succeeds)

This reproduces for both file and env SecretRef shapes.

Environment

• OpenClaw: 2026.3.8
• OS: macOS 14.6.1 (arm64)
• Date observed: 2026-03-11 (Asia/Shanghai)

Repro (env SecretRef)

Config:

"channels": {
  "slack": {
    "botToken": {"source":"env","provider":"default","id":"SLACK_BOT_TOKEN"},
    "appToken": {"source":"env","provider":"default","id":"SLACK_APP_TOKEN"}
  }
}

Then:

openclaw channels status --probe --json
openclaw message send --channel slack --target C0AHUBRJU8N --message "repro" --json

Actual

channels status --probe shows Slack probe success, but message send fails:

Error: channels.slack.accounts.default.botToken: unresolved SecretRef "env:default:SLACK_BOT_TOKEN". Resolve this command against an active gateway runtime snapshot before reading it.

Also reproduces with file SecretRef

file:local:/slack/botToken and file:local:/slack/appToken produce the same failure in message send.

Control check

Direct Slack Web API call using same bot token succeeds (chat.postMessage returns ok=true).
This suggests transport/token are valid, and bug is in message send SecretRef resolution path.

Expected

openclaw message send should resolve channel SecretRefs using active runtime snapshot (or equivalent resolution path) consistently with channels status --probe.