fix(telegram): tolerate unresolved SecretRef in prompt-capability and reaction-guidance discovery

lonexreb · lonexreb · commit e5bc27823adc · 2026-05-01T00:57:58.000-05:00
Codex round-1 review on PR #75445 found that even after hardening describeMessageTool, embedded prompt prep still crashes via two adjacent paths that go through resolveTelegramAccount BEFORE message-action discovery runs: 1. agentPrompt.messageToolCapabilities → resolveTelegramInlineButtonsScope 2. agentPrompt.reactionGuidance → resolveTelegramReactionLevel Both call resolveTelegramAccount on raw config, so a non-env SecretRef botToken still throws unresolved-SecretRef before model output. Wrap both with try/catch that returns the safe minimal default on unresolved-SecretRef and rethrows everything else, matching the pattern already used in extensions/{telegram,discord}/src/channel-actions.ts: - resolveTelegramInlineButtonsScope returns DEFAULT_INLINE_BUTTONS_SCOPE ("all") on unresolved SecretRef - resolveTelegramReactionLevel returns the resolveReactionLevel result with value=undefined → default "minimal" / fallback "ack" Add 4 new regression tests: - inline-buttons.test.ts: resolveTelegramInlineButtonsScope and isTelegramInlineButtonsEnabled both tolerate root-level and account-scoped SecretRef botTokens (do not throw) - reaction-level.test.ts: resolveTelegramReactionLevel returns the minimal-flag default for both root-level and account-scoped SecretRef botTokens (do not throw) Refs #75433
diff --git a/extensions/telegram/src/inline-buttons.test.ts b/extensions/telegram/src/inline-buttons.test.ts
@@ -1,7 +1,12 @@
+import type { OpenClawConfig } from "openclaw/plugin-sdk/config-types";
 import { describe, expect, it } from "vitest";
 import { buildTelegramInteractiveButtons } from "./button-types.js";
 import { describeTelegramInteractiveButtonBehavior } from "./button-types.test-helpers.js";
-import { resolveTelegramTargetChatType } from "./inline-buttons.js";
+import {
+  isTelegramInlineButtonsEnabled,
+  resolveTelegramInlineButtonsScope,
+  resolveTelegramTargetChatType,
+} from "./inline-buttons.js";
 
 describe("resolveTelegramTargetChatType", () => {
   it("returns 'direct' for positive numeric IDs", () => {
@@ -85,3 +90,42 @@ describe("buildTelegramInteractiveButtons callback rewrites", () => {
     ]);
   });
 });
+
+describe("resolveTelegramInlineButtonsScope (#75433 SecretRef tolerance)", () => {
+  // Embedded prompt prep calls this from raw config before the active runtime
+  // snapshot has resolved channel credentials. Returning a benign default
+  // instead of throwing keeps the embedded reply run alive.
+
+  it("returns the safe default scope when botToken is an unresolved SecretRef", () => {
+    const cfg = {
+      channels: {
+        telegram: {
+          botToken: { source: "exec", provider: "default", id: "telegram-token" },
+        },
+      },
+    } as unknown as OpenClawConfig;
+
+    expect(() => resolveTelegramInlineButtonsScope({ cfg })).not.toThrow();
+    // The DEFAULT_INLINE_BUTTONS_SCOPE is "all" — the contract is just that
+    // we do not crash. Verify isTelegramInlineButtonsEnabled also tolerates
+    // the same condition (used by describeMessageTool's buttonsEnabled flag).
+    expect(() => isTelegramInlineButtonsEnabled({ cfg })).not.toThrow();
+  });
+
+  it("returns the safe default scope when scoped account token is an unresolved SecretRef", () => {
+    const cfg = {
+      channels: {
+        telegram: {
+          accounts: {
+            ops: {
+              botToken: { source: "exec", provider: "default", id: "telegram-ops" },
+            },
+          },
+        },
+      },
+    } as unknown as OpenClawConfig;
+
+    expect(() => resolveTelegramInlineButtonsScope({ cfg, accountId: "ops" })).not.toThrow();
+    expect(() => isTelegramInlineButtonsEnabled({ cfg, accountId: "ops" })).not.toThrow();
+  });
+});
diff --git a/extensions/telegram/src/inline-buttons.ts b/extensions/telegram/src/inline-buttons.ts
@@ -60,7 +60,21 @@ export function resolveTelegramInlineButtonsScope(params: {
   cfg: OpenClawConfig;
   accountId?: string | null;
 }): TelegramInlineButtonsScope {
-  const account = resolveTelegramAccount({ cfg: params.cfg, accountId: params.accountId });
+  // Embedded prompt prep calls this from raw config before the active runtime
+  // snapshot has resolved channel credentials. If channels.telegram.botToken is
+  // a non-env SecretRef, `resolveTelegramAccount` throws an unresolved-SecretRef
+  // error (#75433). Treat that as "no inline-button capability for prompt
+  // discovery" instead of crashing the embedded reply run; the runtime send
+  // path uses the resolved snapshot.
+  let account: ReturnType<typeof resolveTelegramAccount>;
+  try {
+    account = resolveTelegramAccount({ cfg: params.cfg, accountId: params.accountId });
+  } catch (err) {
+    if (err instanceof Error && /unresolved SecretRef/i.test(err.message)) {
+      return DEFAULT_INLINE_BUTTONS_SCOPE;
+    }
+    throw err;
+  }
   return resolveTelegramInlineButtonsScopeFromCapabilities(account.config.capabilities);
 }
 
diff --git a/extensions/telegram/src/reaction-level.test.ts b/extensions/telegram/src/reaction-level.test.ts
@@ -136,4 +136,39 @@ describe("resolveTelegramReactionLevel", () => {
     const result = resolveTelegramReactionLevel({ cfg, accountId: "work" });
     expectMinimalFlags(result);
   });
+
+  // Regression for #75433: when channels.telegram.botToken is configured as
+  // an unresolved SecretRef, prompt-prep reaction guidance must NOT throw and
+  // crash the embedded reply run. Return the safe minimal default instead.
+  it("falls back to minimal when botToken is an unresolved SecretRef instead of throwing", () => {
+    const cfg = {
+      channels: {
+        telegram: {
+          botToken: { source: "exec", provider: "default", id: "telegram-token" },
+        },
+      },
+    } as unknown as OpenClawConfig;
+
+    expect(() => resolveTelegramReactionLevel({ cfg })).not.toThrow();
+    const result = resolveTelegramReactionLevel({ cfg });
+    expectMinimalFlags(result);
+  });
+
+  it("falls back to minimal when scoped account token is an unresolved SecretRef instead of throwing", () => {
+    const cfg = {
+      channels: {
+        telegram: {
+          accounts: {
+            ops: {
+              botToken: { source: "exec", provider: "default", id: "telegram-ops" },
+            },
+          },
+        },
+      },
+    } as unknown as OpenClawConfig;
+
+    expect(() => resolveTelegramReactionLevel({ cfg, accountId: "ops" })).not.toThrow();
+    const result = resolveTelegramReactionLevel({ cfg, accountId: "ops" });
+    expectMinimalFlags(result);
+  });
 });
diff --git a/extensions/telegram/src/reaction-level.ts b/extensions/telegram/src/reaction-level.ts
@@ -16,10 +16,28 @@ export function resolveTelegramReactionLevel(params: {
   cfg: OpenClawConfig;
   accountId?: string;
 }): ResolvedReactionLevel {
-  const account = resolveTelegramAccount({
-    cfg: params.cfg,
-    accountId: params.accountId,
-  });
+  // Prompt prep calls this from raw config before the active runtime snapshot
+  // has resolved channel credentials. When channels.telegram.botToken is a
+  // non-env SecretRef, `resolveTelegramAccount` throws an unresolved-SecretRef
+  // error (#75433); treat that as the safe minimal default for discovery
+  // instead of crashing the embedded reply run. The runtime delivery path
+  // uses the resolved snapshot anyway.
+  let account: ReturnType<typeof resolveTelegramAccount>;
+  try {
+    account = resolveTelegramAccount({
+      cfg: params.cfg,
+      accountId: params.accountId,
+    });
+  } catch (err) {
+    if (err instanceof Error && /unresolved SecretRef/i.test(err.message)) {
+      return resolveReactionLevel({
+        value: undefined,
+        defaultLevel: "minimal",
+        invalidFallback: "ack",
+      });
+    }
+    throw err;
+  }
   return resolveReactionLevel({
     value: account.config.reactionLevel,
     defaultLevel: "minimal",
