From e4ca4c7fbf151e14b646e0fa25898d96c05def47 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EC=B2=9C=EC=9C=A0=EC=8B=A0?=
 <eusin@cheon-yusin-ui-MacBookPro.local>
Date: Thu, 30 Apr 2026 10:46:43 +0900
Subject: [PATCH] fix(discord): avoid resolving tokens for read-only accessors

---
 extensions/discord/src/shared.test.ts | 28 +++++++++++++++++++++++++++
 extensions/discord/src/shared.ts      | 11 ++++++++---
 2 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/extensions/discord/src/shared.test.ts b/extensions/discord/src/shared.test.ts
index 9b2121f4ef8..93b6ae37b40 100644
--- a/extensions/discord/src/shared.test.ts
+++ b/extensions/discord/src/shared.test.ts
@@ -128,4 +128,32 @@ describe("discordConfigAdapter", () => {
       "123456789",
     ]);
   });
+
+  it("keeps read-only accessors from resolving token SecretRefs", () => {
+    const cfg = {
+      secrets: {
+        providers: {
+          discord_token: {
+            source: "file",
+            path: "/tmp/openclaw-missing-discord-token",
+            mode: "singleValue",
+          },
+        },
+      },
+      channels: {
+        discord: {
+          token: { source: "file", provider: "discord_token", id: "value" },
+          allowFrom: ["1128540374256849009"],
+          defaultTo: "1498959610751750304",
+        },
+      },
+    } as OpenClawConfig;
+
+    expect(discordConfigAdapter.resolveAllowFrom?.({ cfg, accountId: "default" })).toEqual([
+      "1128540374256849009",
+    ]);
+    expect(discordConfigAdapter.resolveDefaultTo?.({ cfg, accountId: "default" })).toBe(
+      "1498959610751750304",
+    );
+  });
 });
diff --git a/extensions/discord/src/shared.ts b/extensions/discord/src/shared.ts
index 098cf885367..2a5a30af5cd 100644
--- a/extensions/discord/src/shared.ts
+++ b/extensions/discord/src/shared.ts
@@ -1,4 +1,5 @@
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
+import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { formatAllowFromLowercase } from "openclaw/plugin-sdk/allow-from";
 import { adaptScopedAccountAccessor } from "openclaw/plugin-sdk/channel-config-helpers";
 import { createScopedChannelConfigAdapter } from "openclaw/plugin-sdk/channel-config-helpers";
@@ -7,6 +8,7 @@ import { inspectDiscordAccount } from "./account-inspect.js";
 import {
   isDiscordAccountEnabledForRuntime,
   listDiscordAccountIds,
+  mergeDiscordAccountConfig,
   resolveDefaultDiscordAccountId,
   resolveDiscordAccount,
   resolveDiscordAccountAllowFrom,
@@ -66,10 +68,13 @@ function resolveDiscordConfigAccessorAccount(params: {
   cfg: OpenClawConfig;
   accountId?: string | null;
 }): DiscordConfigAccessorAccount {
-  const account = resolveDiscordAccount(params);
+  const accountId = normalizeAccountId(
+    params.accountId ?? resolveDefaultDiscordAccountId(params.cfg),
+  );
+  const config = mergeDiscordAccountConfig(params.cfg, accountId);
   return {
-    allowFrom: resolveDiscordAccountAllowFrom({ cfg: params.cfg, accountId: account.accountId }),
-    defaultTo: account.config.defaultTo,
+    allowFrom: resolveDiscordAccountAllowFrom({ cfg: params.cfg, accountId }),
+    defaultTo: config.defaultTo,
   };
 }