fix(discord): report unresolved token refs at startup by giodl73-repo · Pull Request #82009 · openclaw/openclaw

giodl73-repo · 2026-05-15T03:53:22Z

Summary

keep unresolved configured Discord token SecretRefs in the startup-configured state so gateway startup reports the resolver error instead of silently marking the account unconfigured
fail before Discord provider/probe startup with an explicit message telling users to resolve SecretRefs against the active runtime snapshot
add coverage proving active Discord token refs resolve through the secrets runtime snapshot for top-level and default-account token configs

Addresses the Discord token SecretRef diagnostics/runtime-snapshot portion of #81926.

Real behavior proof

Behavior or issue addressed: A configured-but-unresolved Discord token SecretRef now reaches the gateway startup path and fails with an explicit SecretRef runtime-snapshot error before any Discord probe/provider starts, instead of being reported as merely unconfigured.

Real environment tested: WSL Ubuntu-24.04 worktree /root/src/openclaw-branches/fix-discord-token-ref-diagnostics-81926, branch commit 994a593, using live tsx imports of the production Discord plugin and secrets runtime modules.

Exact steps or command run after this patch: Ran a live production-path script that resolves the Discord account, calls discordPlugin.config.isConfigured, invokes discordPlugin.gateway.startAccount, and prepares a secrets runtime snapshot with DISCORD_BOT_TOKEN in env.

$ pnpm exec tsx --eval '...production-path script importing extensions/discord/src/channel.ts and src/secrets/runtime.ts...'

Evidence after fix: Copied live terminal output from the changed branch:

tokenStatus=configured_unavailable
isConfigured=true
startupError=Discord bot token configured for account "default" is unavailable; resolve SecretRefs against the active runtime snapshot before using this account.
runtimeToken=runtime-discord-token

Observed result after fix: The unresolved SecretRef is now startup-configured (isConfigured=true) and throws the explicit runtime-snapshot error before startup proceeds; when the env ref is available to the secrets runtime, the same Discord token ref resolves to runtime-discord-token.

What was not tested: None

Validation

pnpm exec vitest run extensions/discord/src/shared.test.ts extensions/discord/src/channel.test.ts extensions/discord/src/token.test.ts src/secrets/runtime-discord-surface.test.ts --config test/vitest/vitest.runtime-config.config.ts
pnpm check:changed

clawsweeper · 2026-05-15T03:58:01Z

Codex review: needs maintainer review before merge.

Summary
The branch changes Discord account configuration detection so unresolved configured bot-token SecretRefs are treated as startup-configured, throws an explicit startup error before Discord provider/probe startup, adds Discord/secrets regression tests, and adds a changelog entry.

Reproducibility: yes. Source inspection shows a documented Discord token SecretRef reaches configured_unavailable, but current main’s Discord isConfigured returns false and the gateway returns before startAccount can report the resolver error.

Real behavior proof
Sufficient (live_output): The PR body includes after-fix live terminal output from a WSL production-path script showing the configured status, explicit startup error, and runtime snapshot token resolution.

Next step before merge
The remaining action is protected-label maintainer approval and normal landing validation, not an automated repair.

Security
Cleared: The diff only changes Discord SecretRef status handling, tests, and changelog text; it does not add dependencies, workflows, secret exposure, or new code execution paths.

Review details

Best possible solution:

Approve and land this focused Discord diagnostic fix if the protected-label maintainer review agrees, while keeping the broader linked config-patch issue open for its separate remaining behavior.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection shows a documented Discord token SecretRef reaches configured_unavailable, but current main’s Discord isConfigured returns false and the gateway returns before startAccount can report the resolver error.

Is this the best way to solve the issue?

Yes. The patch keeps the change inside the Discord plugin boundary, reuses the existing credential-status helper, and adds focused coverage for both the diagnostic path and active runtime-snapshot resolution.

Acceptance criteria:

pnpm exec vitest run extensions/discord/src/shared.test.ts extensions/discord/src/channel.test.ts extensions/discord/src/token.test.ts src/secrets/runtime-discord-surface.test.ts --config test/vitest/vitest.runtime-config.config.ts
pnpm check:changed

What I checked:

Live PR state: The GitHub PR API reports this PR is open, non-draft, unmerged, and currently labeled channel: discord, maintainer, size: S, and proof: sufficient at head d46a688. (d46a68895b56)
Documented SecretRef surface: Discord setup docs say SecretRef values are supported for channels.discord.token across env/file/exec providers, so this is a documented config path rather than a new feature. Public docs: docs/channels/discord.md. (docs/channels/discord.md:154, e1d69bc43307)
SecretRef contract: The Discord plugin declares channels.discord.token and channels.discord.accounts.*.token as supported secret input targets in its runtime secret contract. (extensions/discord/src/secret-config-contract.ts:27, e1d69bc43307)
Current main bug path: Current main marks Discord accounts configured only when account.token is non-empty, so a configured-but-unresolved SecretRef with an empty token can be treated as unconfigured before startup. (extensions/discord/src/shared.ts:152, e1d69bc43307)
Current main token status: Current main resolves configured but unavailable Discord token refs to tokenStatus: configured_unavailable, which is the status the PR keeps startup-configured so the diagnostic reaches the gateway startup path. (extensions/discord/src/token.ts:41, e1d69bc43307)
Gateway skip path: Gateway startup calls plugin.config.isConfigured; when that returns false it records not configured and returns before startAccount can report the SecretRef resolver error. (src/gateway/server-channels.ts:447, e1d69bc43307)

Likely related people:

joshavant: Authored the recent merged Discord SecretRef runtime status work that introduced or maintained the configured_unavailable handling touched by this PR. (role: feature-history contributor; confidence: high; commits: 911ac6dd1093; files: extensions/discord/src/shared.ts, extensions/discord/src/token.ts)
steipete: Recent history shows repeated Discord plugin, plugin-SDK surface, and channel-status refactors across the affected files, including the current branch's changelog update. (role: recent area contributor; confidence: high; commits: 827b0de0ce74, 7e06455e64bb, 605e89468ebf; files: extensions/discord/src/shared.ts, extensions/discord/src/token.ts, extensions/discord/src/channel.ts)
vincentkoc: Recent history shows adjacent runtime and channel-status work on the touched channel/status surfaces, which may help route review of the shared status-helper behavior. (role: adjacent runtime/status contributor; confidence: medium; commits: c6d4f1fab806, d9aa88dd6cd6; files: extensions/discord/src/channel.ts, src/plugin-sdk/channel-status.ts)

Remaining risk / open question:

The targeted validation commands from the PR body were not rerun during this read-only review.
The linked broader issue also reports a separate recursive config patch behavior that this PR intentionally does not address.
After the later changelog-only force-push, the public commit status API for the current head reports pending; maintainers should wait for the required merge gate if they rely on it.

Codex review notes: model gpt-5.5, reasoning high; reviewed against e1d69bc43307.

Treat configured-but-unresolved Discord token refs as configured so gateway startup reaches the explicit SecretRef resolution error instead of silently classifying the account as unconfigured. Also cover runtime snapshot resolution for active Discord token refs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

steipete · 2026-05-15T07:22:06Z

Verification for f6bb520:

Behavior addressed: Discord accounts with configured but unresolved bot-token SecretRefs are treated as configured for startup selection, then fail loudly before provider startup with an actionable resolver error instead of being silently skipped as unconfigured.
Real environment tested: local macOS checkout plus GitHub Actions pull_request CI.
Exact steps or command run after this patch: /Users/steipete/Projects/agent-scripts/skills/codex-review/scripts/codex-review --mode branch; node scripts/run-vitest.mjs extensions/discord/src/shared.test.ts extensions/discord/src/channel.test.ts src/secrets/runtime-discord-surface.test.ts; git diff --check origin/main...HEAD; GitHub Actions CI run 25905546275.
Evidence after fix: Codex review reported no accepted/actionable findings; focused Discord/secrets tests passed 44 tests; CI completed successfully for head SHA f6bb520.
Observed result after fix: unresolved Discord token SecretRefs now produce startup diagnostics before probe/provider startup, and runtime secret snapshots still resolve active default-account token refs.
What was not tested: live Discord gateway startup against the real Discord API; the provider/probe boundary was verified with focused unit coverage.

steipete

Reviewed the final code-only branch after rebase. Codex review and focused Discord/secrets regression proof are clean.

Treat configured-but-unresolved Discord token refs as configured so gateway startup reaches the explicit SecretRef resolution error instead of silently classifying the account as unconfigured. Also cover runtime snapshot resolution for active Discord token refs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

giodl73-repo requested a review from a team as a code owner May 15, 2026 03:53

openclaw-barnacle Bot added channel: discord Channel integration: discord size: S maintainer Maintainer-authored PR labels May 15, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 15, 2026

steipete force-pushed the fix-discord-token-ref-diagnostics-81926 branch from 994a593 to d46a688 Compare May 15, 2026 07:03

steipete force-pushed the fix-discord-token-ref-diagnostics-81926 branch from d46a688 to f6bb520 Compare May 15, 2026 07:15

steipete approved these changes May 15, 2026

View reviewed changes

steipete merged commit 6623444 into openclaw:main May 15, 2026
112 checks passed

steipete mentioned this pull request May 15, 2026

Discord plugin: channels.discord.*.token ref resolution silently fails (plus companion config patch recursive-merge bug) #81926

Closed

github-actions Bot mentioned this pull request May 15, 2026

📡 Upstream Digest — 2026-05-15 10:13 UTC curtismercier/openclaw-mods#860

Open

This was referenced May 20, 2026

[Bug]: Discord channel-info fails for SecretRef-backed named account while send works #84530

Closed

fix(gateway): resolve message actions against runtime config #84535

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(discord): report unresolved token refs at startup#82009

fix(discord): report unresolved token refs at startup#82009
steipete merged 1 commit into
openclaw:mainfrom
giodl73-repo:fix-discord-token-ref-diagnostics-81926

giodl73-repo commented May 15, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 15, 2026 •

edited

Loading

Uh oh!

steipete commented May 15, 2026

Uh oh!

steipete left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

giodl73-repo commented May 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Real behavior proof

Validation

Uh oh!

clawsweeper Bot commented May 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steipete commented May 15, 2026

Uh oh!

steipete left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

giodl73-repo commented May 15, 2026 •

edited

Loading

clawsweeper Bot commented May 15, 2026 •

edited

Loading