From 1773b62b5afceb3db7b8670b6f1b706e424c9787 Mon Sep 17 00:00:00 2001
From: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com>
Date: Fri, 1 May 2026 13:29:03 +0000
Subject: [PATCH] fix(discord): avoid resolving token during action discovery

---
 extensions/discord/src/channel-actions.test.ts |  3 +--
 src/agents/tools/message-tool.test.ts          | 15 +++++++++++++--
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/extensions/discord/src/channel-actions.test.ts b/extensions/discord/src/channel-actions.test.ts
index 5df437ac8f7..e19a9a71baf 100644
--- a/extensions/discord/src/channel-actions.test.ts
+++ b/extensions/discord/src/channel-actions.test.ts
@@ -82,12 +82,11 @@ describe("discordMessageActions", () => {
     );
   });
 
-  it("describes scoped account actions when the account token is an unresolved SecretRef", () => {
+  it("describes scoped account actions when only the account token is an unresolved SecretRef", () => {
     const discovery = discordMessageActions.describeMessageTool?.({
       cfg: {
         channels: {
           discord: {
-            token: "Bot token-main",
             actions: {
               polls: true,
               reactions: false,
diff --git a/src/agents/tools/message-tool.test.ts b/src/agents/tools/message-tool.test.ts
index fdb57c5033d..9023a3e6748 100644
--- a/src/agents/tools/message-tool.test.ts
+++ b/src/agents/tools/message-tool.test.ts
@@ -287,6 +287,9 @@ describe("message tool secret scoping", () => {
       channels: {
         discord: {
           token: { source: "env", provider: "default", id: "DISCORD_BOT_TOKEN" },
+          accounts: {
+            ops: { token: { source: "env", provider: "default", id: "DISCORD_OPS_TOKEN" } },
+          },
         },
       },
     };
@@ -294,6 +297,9 @@ describe("message tool secret scoping", () => {
       channels: {
         discord: {
           token: "resolved-discord-token",
+          accounts: {
+            ops: { token: "resolved-discord-ops-token" },
+          },
         },
       },
     };
@@ -306,6 +312,7 @@ describe("message tool secret scoping", () => {
       config: rawConfig as never,
       currentChannelProvider: "discord",
       currentChannelId: "channel:123",
+      agentAccountId: "ops",
       resolveCommandSecretRefsViaGateway: mocks.resolveCommandSecretRefsViaGateway as never,
       runMessageAction: mocks.runMessageAction as never,
     });
@@ -321,8 +328,12 @@ describe("message tool secret scoping", () => {
       allowedPaths?: Set<string>;
     };
     expect(secretResolveCall.config).toBe(rawConfig);
-    expect(secretResolveCall.targetIds).toEqual(new Set(["channels.discord.token"]));
-    expect(secretResolveCall.allowedPaths).toEqual(new Set(["channels.discord.token"]));
+    expect(secretResolveCall.targetIds).toEqual(
+      new Set(["channels.discord.token", "channels.discord.accounts.ops.token"]),
+    );
+    expect(secretResolveCall.allowedPaths).toEqual(
+      new Set(["channels.discord.token", "channels.discord.accounts.ops.token"]),
+    );
     expect(mocks.runMessageAction.mock.calls[0]?.[0]?.cfg).toBe(resolvedConfig);
   });
 });