fix: pass resolved Slack download tokens (#62097) (thanks @martingarramon)

CHANGELOG.md

@@ -8,6 +8,7 @@ Docs: https://docs.openclaw.ai
 
 - Slack: honor ambient HTTP(S) proxy settings for Socket Mode WebSocket connections, including NO_PROXY exclusions, so proxy-only deployments can connect without a monkey patch. (#62878) Thanks @mjamiv.
 - Network/fetch guard: skip target DNS pinning when trusted env-proxy mode is active so proxy-only sandboxes can let the trusted proxy resolve outbound hosts. (#59007) Thanks @cluster2600.
+- Slack/actions: pass the already resolved read token into `downloadFile` so SecretRef-backed bot tokens no longer fail after a raw config re-read. (#62097) Thanks @martingarramon.
 
 ## 2026.4.7-1
 

extensions/slack/src/action-runtime.test.ts

@@ -244,14 +244,28 @@ describe("handleSlackAction", () => {
 
   it("forwards resolved botToken to action functions instead of relying on config re-read", async () => {
     downloadSlackFile.mockResolvedValueOnce(null);
-    await handleSlackAction(
-      { action: "downloadFile", fileId: "F123" },
-      slackConfig(),
-    );
+    await handleSlackAction({ action: "downloadFile", fileId: "F123" }, slackConfig());
     const opts = downloadSlackFile.mock.calls[0]?.[1] as { token?: string } | undefined;
     expect(opts?.token).toBe("tok");
   });
 
+  it("keeps resolved userToken for downloadFile reads when configured", async () => {
+    downloadSlackFile.mockResolvedValueOnce(null);
+    await handleSlackAction(
+      { action: "downloadFile", fileId: "F123" },
+      slackConfig({
+        accounts: {
+          default: {
+            botToken: "xoxb-bot",
+            userToken: "xoxp-user",
+          },
+        },
+      }),
+    );
+    const opts = downloadSlackFile.mock.calls[0]?.[1] as { token?: string } | undefined;
+    expect(opts?.token).toBe("xoxp-user");
+  });
+
   it.each([
     {
       name: "JSON blocks",