Summary

On 2026.4.27, openclaw status can hard-fail when the Telegram bot token is configured via a file-backed SecretRef, even though the gateway is live and openclaw secrets audit reports the SecretRef as resolved.

Observed error:

channels.telegram.botToken: unresolved SecretRef "file:filemain:/telegram/botToken". Resolve this command against an active gateway runtime snapshot before reading it.

Impact

The status command becomes unusable for a valid Telegram configuration using botToken: { source: "file", provider: "filemain", id: "/telegram/botToken" }.

Likely cause

Telegram already has a read-only inspector (extensions/telegram/src/account-inspect.ts) that marks non-env configured secrets as configured_unavailable instead of strict-resolving them.

But extensions/telegram/src/shared.ts wires createScopedChannelConfigAdapter without a Telegram-specific resolveAccessorAccount, so metadata/accessor paths such as resolveAllowFrom fall back to strict resolveAccount. That dereferences botToken while building status/allowlist metadata.

Slack/Discord appear to already use a config-accessor pattern for this split.

Repro shape

Telegram config shape:

{
  "secrets": {
    "providers": {
      "filemain": { "source": "file", "path": "/path/to/secrets.json" }
    }
  },
  "channels": {
    "telegram": {
      "botToken": { "source": "file", "provider": "filemain", "id": "/telegram/botToken" },
      "allowFrom": ["8197233951"]
    }
  }
}

Then run:

openclaw status

Suggested fix

Add a Telegram resolveAccessorAccount that uses config-only merged account data (mergeTelegramAccountConfig) for allowFrom / defaultTo, without resolving botToken. Runtime resolveAccount should stay strict.

I have a tested patch locally and will open a PR.

Validation from local patch

pnpm exec vitest run extensions/telegram/src/shared.test.ts extensions/telegram/src/account-inspect.test.ts --config test/vitest/vitest.extension-telegram.config.ts
# 2 files, 15 tests passed

NODE_OPTIONS=--max-old-space-size=8192 pnpm exec tsc -p tsconfig.extensions.test.json --noEmit --pretty false
# passed

Adjacent related work: #71024 (Mattermost read-only SecretRef status), #66936 (older Telegram SecretRef CLI failure/hang).