Bug Description

SecretRef-based channel tokens (botToken, appToken) fail to resolve at reply time with:

channels.slack.accounts.default.botToken: unresolved SecretRef "exec:keychain_slack_bot:value". 
Resolve this command against an active gateway runtime snapshot before reading it.

Tokens resolve fine at startup (socket mode connects), but when the gateway tries to send a reply, SecretRef resolution fails. Affects both Slack and Telegram channels.

Environment

• OS: macOS 26.3.1 (arm64), Apple Silicon
• Node: v25.8.0
• OpenClaw: Reproduced on 2026.3.12 and 2026.3.13
• Channel mode: Slack socket mode
• SecretRef provider: exec (keychain wrapper scripts calling security find-generic-password)

Steps to Reproduce

1. Configure Slack channel with SecretRef-based botToken and appToken (exec provider, keychain scripts)
2. Gateway starts fine — socket mode connects, channel resolve runs
3. Send a message in a configured Slack channel
4. Gateway receives the message and attempts to reply
5. Reply fails with unresolved SecretRef error

Timeline

• Working: 2026-03-13 14:54 PDT — last successful delivered reply to channel
• Broken: 2026-03-13 15:04 PDT — first final reply failed after a gateway restart (npm update from 2026.3.11 to 2026.3.12)
• Attempted fixes: Multiple gateway restarts, hard stop/start, update to 2026.3.13 — none resolved it
• Workaround: Hardcoding tokens as plain strings in config works

Relevant Logs

Startup (works fine)

[slack] [default] starting provider
[slack] socket mode connected

Reply attempt (fails)

[slack] final reply failed: Error: channels.slack.accounts.default.botToken: unresolved SecretRef "exec:keychain_slack_bot:value". Resolve this command against an active gateway runtime snapshot before reading it.

Also affects Telegram

Error: channels.telegram.botToken: unresolved SecretRef "exec:keychain_telegram:value". Resolve this command against an active gateway runtime snapshot before reading it.

Workaround

Replace SecretRef objects with hardcoded token strings in openclaw.json:

// Before (broken)
"botToken": { "source": "exec", "provider": "keychain_slack_bot", "id": "value" }

// After (works)
"botToken": "xoxb-..."

Notes

• The missing_scope error on channel resolve is a separate pre-existing issue (non-fatal)
• The stale-socket health monitor restarts every ~35 min may be related
• The error message suggests the runtime snapshot context is not being passed to the reply code path