Summary

The message tool with action=read (and likely other REST-dependent actions) fails when the Discord token is configured as a keychain SecretRef. The gateway successfully resolves the token at startup for the WebSocket connection, but runtime REST calls made by the message tool fail to re-resolve the SecretRef, returning:

channels.discord.accounts.default.token: unresolved SecretRef "exec:keychain:DISCORD_DEFAULT_TOKEN". Resolve this command against an active gateway runtime snapshot before reading it.

Environment

• OpenClaw version: 2026.3.13
• OS: macOS Darwin 25.3.0 (arm64)
• Token config: channels.discord.accounts.default.token set as a keychain SecretRef

Config snippet

"accounts": {
  "default": {
    "token": {
      "source": "exec",
      "provider": "keychain",
      "id": "DISCORD_DEFAULT_TOKEN"
    }
  }
}

Steps to reproduce

1. Configure Discord bot token as a keychain SecretRef (not a plain string)
2. Gateway starts successfully — WebSocket connects fine
3. Call message tool with action=read (channel history)
4. Error: unresolved SecretRef

Expected behavior

The message tool should be able to resolve SecretRef tokens at runtime the same way the gateway does at startup.

Actual behavior

message tool fails with unresolved SecretRef error. Sending works fine (presumably uses the already-connected WebSocket), reads do not.

Workaround

Storing the token as a plain env var (env.vars.DISCORD_DEFAULT_TOKEN) as a fallback until this is patched.