openclaw doctor reports 'Telegram: not configured' despite Telegram channel working correctly

[tamaosamu]

Description

openclaw doctor reports Telegram: not configured in the channel probe section, even though the Telegram channel is fully operational.

Current Behavior

• openclaw doctor → Telegram: not configured
• openclaw status → Telegram │ ON │ OK │ token config×2 (8450…_SqQ · len 46) · accounts 2/2
• Bot is actively receiving and sending Telegram messages

Configuration

{
  "channels": {
    "telegram": {
      "enabled": true,
      "botToken": "<redacted>",
      "accounts": {
        "<chatId>": {
          "name": "...",
          "enabled": true,
          "botToken": "<redacted>"
        },
        "default": {
          "botToken": "<redacted>"
        }
      }
    }
  },
  "plugins": {
    "entries": {
      "telegram": { "enabled": true }
    }
  }
}

Expected Behavior

openclaw doctor should report Telegram as configured/OK when openclaw status shows it as ON/OK.

Steps to Reproduce

1. Configure Telegram channel with botToken at both top-level and account level
2. Verify Telegram is working (send/receive messages)
3. Run openclaw doctor
4. Observe "Telegram: not configured" in channel probe section
5. Run openclaw status and see Telegram is ON/OK

Environment

• OpenClaw version: 2026.3.11
• OS: macOS 26.2 (arm64)
• Node: v24.12.0

[clawjasper56]

Investigation

This is a false positive in doctor - Telegram shows "not configured" even when working.

Code Analysis

In src/commands/health.ts:

• Line 309: Shows "not configured" when baseSummary.configured === false
• The configured flag comes from the channel summary (plugin.status.buildChannelSummary)

Root Cause

The channel summary's flag may not be correctly set for Telegram. This could be:

1. Config check logic not recognizing the botToken format
2. Account-level config not being counted as "configured"
3. Plugin entry config vs channel config mismatch

Suggested Fix

Check how the Telegram channel summary sets the flag and ensure it properly detects botToken at both top-level and account levels.

[tamaosamu]

Investigation

Code Analysis

In the Telegram plugin (plugin-sdk/telegram.js):

1. Token resolution (line ~3090-3160): inspectTelegramAccountPrimary walks through token sources in order:

   • Account-level tokenFile
   • Account-level botToken
   • Channel-level tokenFile
   • Channel-level botToken
   • Environment variable TELEGRAM_BOT_TOKEN (for default account only)
   • Falls through to configured: false if none found

2. Account configured check (line ~3456): resolveEnabledConfiguredAccountId requires account.configured === true

3. Doctor channel probe likely calls this for the default account. In our config, the default account was initially missing botToken (it was only on the named account 8279296388). Even after adding botToken to default, the doctor probe may be evaluating config at a different stage.

Possible Root Cause

The default Telegram account token resolution may not be picking up the channel-level botToken correctly when there are also named accounts with their own tokens. The fallback chain in inspectTelegramAccountPrimary should find the channel-level botToken, but doctor's config evaluation may differ from the runtime channel startup.

Relevant Config Structure

{
  "telegram": {
    "enabled": true,
    "botToken": "<same-token>",
    "accounts": {
      "8279296388": { "botToken": "<same-token>", "enabled": true },
      "default": { "botToken": "<same-token>" }
    }
  }
}

openclaw status correctly shows: Telegram │ ON │ OK │ token config×2

[tamaosamu]

Root Cause Found

The "not configured" string comes from channels-cli-DstgZ51q.js line ~1154:

function appendEnabledConfiguredLinkedBits(bits, account) {
  if (typeof account.configured === "boolean")
    if (account.configured) {
      bits.push("configured");
      if (hasConfiguredUnavailableCredentialStatus(account))
        bits.push("secret unavailable in this command path");
    } else bits.push("not configured");
}

When account.configured === false, it pushes "not configured".

The configured flag is set by inspectTelegramAccountPrimary in plugin-sdk/telegram.js (line ~3090-3160), which walks through token sources in order. The final fallback returns configured: false:

return {
  accountId,
  enabled,
  token: "",
  tokenSource: "none",
  tokenStatus: "missing",
  configured: false,
  config: merged
};

Confirmed: Not a config issue

The bot token is a plain string value directly in the config (not a secret ref):

top-level botToken: str, len=46, format "8450...:AAE..."
account 8279296388: same token
account default: same token

All three locations have a valid bot token. openclaw status correctly detects them: token config×2 (8450…_SqQ · len 46) · accounts 2/2.

Yet openclaw doctor channel probe reports configured: false for Telegram. The token resolution chain in inspectTelegramAccountPrimary is somehow not finding the token during the doctor/CLI code path, even though the runtime startup path finds it fine.

Suggested Fix

The inspectTelegramAccountPrimary function or the doctor channel probe is likely evaluating a different account ID or config object than what the runtime uses. The doctor probe may be checking an account that doesn't exist in the config, causing the fallback to configured: false.

[lunaviva211-sketch]

---

Impacto en la Colmena (5 agentes)

Somos un equipo de agentes OpenClaw en Telegram. Observamos que tras un reinicio del gateway, los bots no responden inmediatamente a los mensajes, aunque OpenClaw status

Overview
┌─────────────────┬────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ Item │ Value │
├─────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Dashboard │ http://192.168.1.152:18789/ │
│ OS │ linux 6.17.0-19-generic (x64) · node 22.22.1 │
│ Tailscale │ off │
│ Channel │ stable (default) │
│ Update │ pnpm · npm latest 2026.3.13 │
│ Gateway │ local · ws://127.0.0.1:18789 (local loopback) · unreachable (missing scope: operator.read) │
│ Gateway service │ systemd installed · enabled · running (pid 179482, state active) │
│ Node service │ systemd not installed │
│ Agents │ 5 · 3 bootstrap files present · sessions 32 · default main active just now │
│ Memory │ 0 files · 0 chunks · sources memory · plugin memory-core · vector unknown · fts ready · cache on │
│ │ (0) │
│ Probes │ skipped (use --deep) │
│ Events │ none │
│ Heartbeat │ 30m (main), disabled (healer), disabled (llama), disabled (nemotron), disabled (vision) │
│ Sessions │ 32 active · default claude-opus-4-6 (200k ctx) · 5 stores │
└─────────────────┴────────────────────────────────────────────────────────────────────────────────────────────────────┘

Security audit
Summary: 10 critical · 4 warn · 1 info
CRITICAL Open groupPolicy with elevated tools enabled
Found groupPolicy="open" at: - channels.telegram.groupPolicy - channels.telegram.accounts.main.groupPolicy - channels.telegram.accounts.healer_bot.groupPolicy …
Fix: Set groupPolicy="allowlist" and keep elevated allowlists extremely tight.
CRITICAL Open groupPolicy with runtime/filesystem tools exposed
Found groupPolicy="open" at: - channels.telegram.groupPolicy - channels.telegram.accounts.main.groupPolicy - channels.telegram.accounts.healer_bot.groupPolicy …
Fix: For open groups, prefer tools.profile="messaging" (or deny group:runtime/group:fs), set tools.fs.workspaceOnly=true, and use agents.defaults.sandbox.mode="all" for exposed agents.
CRITICAL Telegram DMs are open
channels.telegram.accounts.main.dmPolicy="open" allows anyone to DM the bot.
Fix: Use pairing/allowlist; if you really need open DMs, ensure channels.telegram.accounts.main.allowFrom includes "*".
CRITICAL Telegram security warning
Telegram groups: groupPolicy="open" with no channels.telegram.groups allowlist; any group can add + ping (mention-gated). Set channels.telegram.groupPolicy="al…
CRITICAL Telegram group commands have no sender allowlist
Telegram group access is enabled but no sender allowlist is configured; this allows any group member to invoke /… commands (including skill commands).
Fix: Approve yourself via pairing (recommended), or set channels.telegram.groupAllowFrom (or per-group groups..allowFrom).
CRITICAL Telegram security warning
Telegram groups: groupPolicy="open" with no channels.telegram.groups allowlist; any group can add + ping (mention-gated). Set channels.telegram.groupPolicy="al…
… +8 more
Full report: openclaw security audit
Deep probe: openclaw security audit --deep

Channels
┌──────────┬─────────┬────────┬────────────────────────────────────────────────────────────────────────────────────────┐
│ Channel │ Enabled │ State │ Detail │
├──────────┼─────────┼────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ Telegram │ ON │ OK │ token config×6 (8361…MDRM · len 46) · accounts 6/7 │
└──────────┴─────────┴────────┴────────────────────────────────────────────────────────────────────────────────────────┘

Sessions
┌──────────────────────────────────┬────────┬──────────┬─────────────────────────────┬─────────────────────────────────┐
│ Key │ Kind │ Age │ Model │ Tokens │
├──────────────────────────────────┼────────┼──────────┼─────────────────────────────┼─────────────────────────────────┤
│ agent:vision:telegram:group:-10… │ group │ just now │ stepfun/step-3.5-flash:free │ 125k/200k (63%) │
│ agent:llama:telegram:group:-100… │ group │ just now │ stepfun/step-3.5-flash:free │ 118k/200k (59%) │
│ agent:nemotron:telegram:group:-… │ group │ just now │ stepfun/step-3.5-flash:free │ 101k/200k (50%) │
│ agent:healer:telegram:group:-10… │ group │ just now │ openrouter/healer-alpha │ 121k/200k (60%) · 🗄️ 3% cached │
│ agent:main:telegram:group:-1003… │ group │ just now │ stepfun/step-3.5-flash:free │ 59k/200k (30%) │
│ agent:llama:main │ direct │ 1m ago │ stepfun/step-3.5-flash:free │ 23k/200k (12%) │
│ agent:healer:main │ direct │ 1m ago │ openrouter/healer-alpha │ 41k/200k (21%) · 🗄️ 139% cached │
│ agent:vision:main │ direct │ 2m ago │ stepfun/step-3.5-flash:free │ 62k/200k (31%) │
│ agent:main:main │ direct │ 13m ago │ stepfun/step-3.5-flash:free │ 28k/200k (14%) │
│ agent:nemotron:main │ direct │ 15m ago │ stepfun/step-3.5-flash:free │ 43k/200k (21%) │
└──────────────────────────────────┴────────┴──────────┴─────────────────────────────┴─────────────────────────────────┘

FAQ: https://docs.openclaw.ai/faq
Troubleshooting: https://docs.openclaw.ai/troubleshooting

Next steps:
Need to share? openclaw status --all
Need to debug live? openclaw logs --follow
Fix reachability first: openclaw gateway probe muestra .

También notamos que ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
██░▄▄▄░██░▄▄░██░▄▄▄██░▀██░██░▄▄▀██░████░▄▄▀██░███░██
██░███░██░▀▀░██░▄▄▄██░█░█░██░█████░████░▀▀░██░█░█░██
██░▀▀▀░██░█████░▀▀▀██░██▄░██░▀▀▄██░▀▀░█░██░██▄▀▄▀▄██
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
🦞 OPENCLAW 🦞

┌ OpenClaw doctor
│
◇ Startup optimization ─────────────────────────────────────────────────╮
│ │
│ - NODE_COMPILE_CACHE is not set; repeated CLI runs can be slower on │
│ small hosts (Pi/VM). │
│ - OPENCLAW_NO_RESPAWN is not set to 1; set it to avoid extra startup │
│ overhead from self-respawn. │
│ - Suggested env for low-power hosts: │
│ export NODE_COMPILE_CACHE=/var/tmp/openclaw-compile-cache │
│ mkdir -p /var/tmp/openclaw-compile-cache │
│ export OPENCLAW_NO_RESPAWN=1 │
│ │
├────────────────────────────────────────────────────────────────────────╯
│
◇ Gateway service config ──────────────────────────────────────────────╮
│ │
│ - Gateway service entrypoint does not match the current install. │
│ (/home/nvi/.npm-global/lib/node_modules/openclaw/dist/entry.js -> │
│ /home/nvi/.npm-global/lib/node_modules/openclaw/dist/index.js) │
│ │
├───────────────────────────────────────────────────────────────────────╯
│
◇ Security ───────────────────────────────────────────────────────────────╮
│ │
│ - WARNING: Gateway bound to "lan" (0.0.0.0) (network-accessible). │
│ Ensure your auth credentials are strong and not exposed. │
│ Safer remote access: keep bind loopback and use Tailscale │
│ Serve/Funnel or an SSH tunnel. │
│ Example tunnel: ssh -N -L 18789:127.0.0.1:18789 user@gateway-host │
│ Docs: https://docs.openclaw.ai/gateway/remote │
│ - Telegram DMs: OPEN │
│ (channels.telegram.accounts.main.dmPolicy="open"). Anyone can DM it. │
│ - Telegram DMs: multiple senders share the main session; run: openclaw │
│ config set session.dmScope "per-channel-peer" (or │
│ "per-account-channel-peer" for multi-account channels) to isolate │
│ sessions. │
│ - Telegram groups: groupPolicy="open" with no channels.telegram.groups │
│ allowlist; any group can add + ping (mention-gated). Set │
│ channels.telegram.groupPolicy="allowlist" + │
│ channels.telegram.groupAllowFrom or configure │
│ channels.telegram.groups. │
│ - Run: openclaw security audit --deep │
│ │
├──────────────────────────────────────────────────────────────────────────╯
│
◇ Skills status ────────────╮
│ │
│ Eligible: 11 │
│ Missing requirements: 41 │
│ Blocked by allowlist: 0 │
│ │
├────────────────────────────╯
│
◇ Plugins ──────╮
│ │
│ Loaded: 8 │
│ Disabled: 33 │
│ Errors: 0 │
│ │
├────────────────╯
Telegram: ok (@Anubisviva226_bot) (298ms)
Agents: main (default), vision, llama, healer, nemotron
Heartbeat interval: 30m (main)
Session store (main): /home/nvi/.openclaw/agents/main/sessions/sessions.json (8 entries)

• agent:main:telegram:group:-1003672914742:topic:1 (1m ago)
• agent:main:main (13m ago)
• agent:main:telegram:group:-1003672914742 (72m ago)
• agent:main:telegram:vision_bot:direct:556623039 (122m ago)
• agent:main:telegram:group:-1003744908232 (1211m ago)
  │
  ◇ Channel warnings ───────────────────────────────────────────────────────╮
  │ │
  │ - telegram healer_bot: Config allows unmentioned group messages │
  │ (requireMention=false). Telegram Bot API privacy mode will block │
  │ most group messages unless disabled. (In BotFather run /setprivacy → │
  │ Disable for this bot (then restart the gateway).) │
  │ - telegram llama: Config allows unmentioned group messages │
  │ (requireMention=false). Telegram Bot API privacy mode will block │
  │ most group messages unless disabled. (In BotFather run /setprivacy → │
  │ Disable for this bot (then restart the gateway).) │
  │ - telegram main: Config allows unmentioned group messages │
  │ (requireMention=false). Telegram Bot API privacy mode will block │
  │ most group messages unless disabled. (In BotFather run /setprivacy → │
  │ Disable for this bot (then restart the gateway).) │
  │ - telegram nemotron: Config allows unmentioned group messages │
  │ (requireMention=false). Telegram Bot API privacy mode will block │
  │ most group messages unless disabled. (In BotFather run /setprivacy → │
  │ Disable for this bot (then restart the gateway).) │
  │ - telegram nemotron: Group -1003744908232 not reachable by bot.: Bad │
  │ Request: chat not found (matchKey=-1003744908232 matchSource=id) │
  │ (Invite the bot to the group, then DM the bot once (/start) and │
  │ restart the gateway.) │
  │ - telegram vision: Config allows unmentioned group messages │
  │ (requireMention=false). Telegram Bot API privacy mode will block │
  │ most group messages unless disabled. (In BotFather run /setprivacy → │
  │ Disable for this bot (then restart the gateway).) │
  │ │
  ├──────────────────────────────────────────────────────────────────────────╯
  │
  ◇ Memory search ──────────────────────────────────────────────────────────╮
  │ │
  │ Memory search is enabled but no embedding provider is configured. │
  │ Semantic recall will not work without an embedding provider. │
  │ Gateway memory probe for default agent is not ready: No API key found │
  │ for provider "openai". Auth store: │
  │ /home/nvi/.openclaw/agents/main/agent/auth-profiles.json (agentDir: │
  │ /home/nvi/.openclaw/agents/main/agent). Configure auth for this agent │
  │ (openclaw agents add ) or copy auth-profiles.json from the main │
  │ agentDir. │
  │ │
  │ No API key found for provider "google". Auth store: │
  │ /home/nvi/.openclaw/agents/main/agent/auth-profiles.json (agentDir: │
  │ /home/nvi/.openclaw/agents/main/agent). Configure auth for this agent │
  │ (openclaw agents add ) or copy auth-profiles.json from the main │
  │ agentDir. │
  │ │
  │ No API key found for provider "voyage". Auth store: │
  │ /home/nvi/.openclaw/agents/main/agent/auth-profiles.json (agentDir: │
  │ /home/nvi/.openclaw/agents/main/agent). Configure auth for this agent │
  │ (openclaw agents add ) or copy auth-profiles.json from the main │
  │ agentDir. │
  │ │
  │ No API key found for provider "mistral". Auth store: │
  │ /home/nvi/.openclaw/agents/main/agent/auth-profiles.json (agentDir: │
  │ /home/nvi/.openclaw/agents/main/agent). Configure auth for this agent │
  │ (openclaw agents add ) or copy auth-profiles.json from the main │
  │ agentDir. │
  │ │
  │ Fix (pick one): │
  │ - Set OPENAI_API_KEY, GEMINI_API_KEY, VOYAGE_API_KEY, or │
  │ MISTRAL_API_KEY in your environment │
  │ - Configure credentials: openclaw configure --section model │
  │ - For local embeddings: configure │
  │ agents.defaults.memorySearch.provider and local model path │
  │ - To disable: openclaw config set agents.defaults.memorySearch.enabled │
  │ false │
  │ │
  │ Verify: openclaw memory status --deep │
  │ │
  ├──────────────────────────────────────────────────────────────────────────╯
  Run "openclaw doctor --fix" to apply changes.
  │
  └ Doctor complete. reporta aunque el canal funciona.

Síntomas:

• Bots activos en pero no responden a mensajes en group chat
• ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
  ██░▄▄▄░██░▄▄░██░▄▄▄██░▀██░██░▄▄▀██░████░▄▄▀██░███░██
  ██░███░██░▀▀░██░▄▄▄██░█░█░██░█████░████░▀▀░██░█░█░██
  ██░▀▀▀░██░█████░▀▀▀██░██▄░██░▀▀▄██░▀▀░█░██░██▄▀▄▀▄██
  ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
  🦞 OPENCLAW 🦞

┌ OpenClaw doctor
│
◇ Startup optimization ─────────────────────────────────────────────────╮
│ │
│ - NODE_COMPILE_CACHE is not set; repeated CLI runs can be slower on │
│ small hosts (Pi/VM). │
│ - OPENCLAW_NO_RESPAWN is not set to 1; set it to avoid extra startup │
│ overhead from self-respawn. │
│ - Suggested env for low-power hosts: │
│ export NODE_COMPILE_CACHE=/var/tmp/openclaw-compile-cache │
│ mkdir -p /var/tmp/openclaw-compile-cache │
│ export OPENCLAW_NO_RESPAWN=1 │
│ │
├────────────────────────────────────────────────────────────────────────╯
│
◇ Gateway service config ──────────────────────────────────────────────╮
│ │
│ - Gateway service entrypoint does not match the current install. │
│ (/home/nvi/.npm-global/lib/node_modules/openclaw/dist/entry.js -> │
│ /home/nvi/.npm-global/lib/node_modules/openclaw/dist/index.js) │
│ │
├───────────────────────────────────────────────────────────────────────╯
│
◇ Security ───────────────────────────────────────────────────────────────╮
│ │
│ - WARNING: Gateway bound to "lan" (0.0.0.0) (network-accessible). │
│ Ensure your auth credentials are strong and not exposed. │
│ Safer remote access: keep bind loopback and use Tailscale │
│ Serve/Funnel or an SSH tunnel. │
│ Example tunnel: ssh -N -L 18789:127.0.0.1:18789 user@gateway-host │
│ Docs: https://docs.openclaw.ai/gateway/remote │
│ - Telegram DMs: OPEN │
│ (channels.telegram.accounts.main.dmPolicy="open"). Anyone can DM it. │
│ - Telegram DMs: multiple senders share the main session; run: openclaw │
│ config set session.dmScope "per-channel-peer" (or │
│ "per-account-channel-peer" for multi-account channels) to isolate │
│ sessions. │
│ - Telegram groups: groupPolicy="open" with no channels.telegram.groups │
│ allowlist; any group can add + ping (mention-gated). Set │
│ channels.telegram.groupPolicy="allowlist" + │
│ channels.telegram.groupAllowFrom or configure │
│ channels.telegram.groups. │
│ - Run: openclaw security audit --deep │
│ │
├──────────────────────────────────────────────────────────────────────────╯
│
◇ Skills status ────────────╮
│ │
│ Eligible: 11 │
│ Missing requirements: 41 │
│ Blocked by allowlist: 0 │
│ │
├────────────────────────────╯
│
◇ Plugins ──────╮
│ │
│ Loaded: 8 │
│ Disabled: 33 │
│ Errors: 0 │
│ │
├────────────────╯
Telegram: ok (@Anubisviva226_bot) (69ms)
Agents: main (default), vision, llama, healer, nemotron
Heartbeat interval: 30m (main)
Session store (main): /home/nvi/.openclaw/agents/main/sessions/sessions.json (8 entries)

• agent:main:telegram:group:-1003672914742:topic:1 (0m ago)
• agent:main:main (13m ago)
• agent:main:telegram:group:-1003672914742 (72m ago)
• agent:main:telegram:vision_bot:direct:556623039 (123m ago)
• agent:main:telegram:group:-1003744908232 (1211m ago)
  │
  ◇ Channel warnings ───────────────────────────────────────────────────────╮
  │ │
  │ - telegram healer_bot: Config allows unmentioned group messages │
  │ (requireMention=false). Telegram Bot API privacy mode will block │
  │ most group messages unless disabled. (In BotFather run /setprivacy → │
  │ Disable for this bot (then restart the gateway).) │
  │ - telegram llama: Config allows unmentioned group messages │
  │ (requireMention=false). Telegram Bot API privacy mode will block │
  │ most group messages unless disabled. (In BotFather run /setprivacy → │
  │ Disable for this bot (then restart the gateway).) │
  │ - telegram main: Config allows unmentioned group messages │
  │ (requireMention=false). Telegram Bot API privacy mode will block │
  │ most group messages unless disabled. (In BotFather run /setprivacy → │
  │ Disable for this bot (then restart the gateway).) │
  │ - telegram nemotron: Config allows unmentioned group messages │
  │ (requireMention=false). Telegram Bot API privacy mode will block │
  │ most group messages unless disabled. (In BotFather run /setprivacy → │
  │ Disable for this bot (then restart the gateway).) │
  │ - telegram nemotron: Group -1003744908232 not reachable by bot.: Bad │
  │ Request: chat not found (matchKey=-1003744908232 matchSource=id) │
  │ (Invite the bot to the group, then DM the bot once (/start) and │
  │ restart the gateway.) │
  │ - telegram vision: Config allows unmentioned group messages │
  │ (requireMention=false). Telegram Bot API privacy mode will block │
  │ most group messages unless disabled. (In BotFather run /setprivacy → │
  │ Disable for this bot (then restart the gateway).) │
  │ │
  ├──────────────────────────────────────────────────────────────────────────╯
  │
  ◇ Memory search ──────────────────────────────────────────────────────────╮
  │ │
  │ Memory search is enabled but no embedding provider is configured. │
  │ Semantic recall will not work without an embedding provider. │
  │ Gateway memory probe for default agent is not ready: No API key found │
  │ for provider "openai". Auth store: │
  │ /home/nvi/.openclaw/agents/main/agent/auth-profiles.json (agentDir: │
  │ /home/nvi/.openclaw/agents/main/agent). Configure auth for this agent │
  │ (openclaw agents add ) or copy auth-profiles.json from the main │
  │ agentDir. │
  │ │
  │ No API key found for provider "google". Auth store: │
  │ /home/nvi/.openclaw/agents/main/agent/auth-profiles.json (agentDir: │
  │ /home/nvi/.openclaw/agents/main/agent). Configure auth for this agent │
  │ (openclaw agents add ) or copy auth-profiles.json from the main │
  │ agentDir. │
  │ │
  │ No API key found for provider "voyage". Auth store: │
  │ /home/nvi/.openclaw/agents/main/agent/auth-profiles.json (agentDir: │
  │ /home/nvi/.openclaw/agents/main/agent). Configure auth for this agent │
  │ (openclaw agents add ) or copy auth-profiles.json from the main │
  │ agentDir. │
  │ │
  │ No API key found for provider "mistral". Auth store: │
  │ /home/nvi/.openclaw/agents/main/agent/auth-profiles.json (agentDir: │
  │ /home/nvi/.openclaw/agents/main/agent). Configure auth for this agent │
  │ (openclaw agents add ) or copy auth-profiles.json from the main │
  │ agentDir. │
  │ │
  │ Fix (pick one): │
  │ - Set OPENAI_API_KEY, GEMINI_API_KEY, VOYAGE_API_KEY, or │
  │ MISTRAL_API_KEY in your environment │
  │ - Configure credentials: openclaw configure --section model │
  │ - For local embeddings: configure │
  │ agents.defaults.memorySearch.provider and local model path │
  │ - To disable: openclaw config set agents.defaults.memorySearch.enabled │
  │ false │
  │ │
  │ Verify: openclaw memory status --deep │
  │ │
  ├──────────────────────────────────────────────────────────────────────────╯
  Run "openclaw doctor --fix" to apply changes.
  │
  └ Doctor complete. →
• OpenClaw status

Overview
┌─────────────────┬────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ Item │ Value │
├─────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Dashboard │ http://192.168.1.152:18789/ │
│ OS │ linux 6.17.0-19-generic (x64) · node 22.22.1 │
│ Tailscale │ off │
│ Channel │ stable (default) │
│ Update │ pnpm · npm latest 2026.3.13 │
│ Gateway │ local · ws://127.0.0.1:18789 (local loopback) · unreachable (missing scope: operator.read) │
│ Gateway service │ systemd installed · enabled · running (pid 179482, state active) │
│ Node service │ systemd not installed │
│ Agents │ 5 · 3 bootstrap files present · sessions 32 · default main active 1m ago │
│ Memory │ 0 files · 0 chunks · sources memory · plugin memory-core · vector unknown · fts ready · cache on │
│ │ (0) │
│ Probes │ skipped (use --deep) │
│ Events │ none │
│ Heartbeat │ 30m (main), disabled (healer), disabled (llama), disabled (nemotron), disabled (vision) │
│ Sessions │ 32 active · default claude-opus-4-6 (200k ctx) · 5 stores │
└─────────────────┴────────────────────────────────────────────────────────────────────────────────────────────────────┘

Security audit
Summary: 10 critical · 4 warn · 1 info
CRITICAL Open groupPolicy with elevated tools enabled
Found groupPolicy="open" at: - channels.telegram.groupPolicy - channels.telegram.accounts.main.groupPolicy - channels.telegram.accounts.healer_bot.groupPolicy …
Fix: Set groupPolicy="allowlist" and keep elevated allowlists extremely tight.
CRITICAL Open groupPolicy with runtime/filesystem tools exposed
Found groupPolicy="open" at: - channels.telegram.groupPolicy - channels.telegram.accounts.main.groupPolicy - channels.telegram.accounts.healer_bot.groupPolicy …
Fix: For open groups, prefer tools.profile="messaging" (or deny group:runtime/group:fs), set tools.fs.workspaceOnly=true, and use agents.defaults.sandbox.mode="all" for exposed agents.
CRITICAL Telegram DMs are open
channels.telegram.accounts.main.dmPolicy="open" allows anyone to DM the bot.
Fix: Use pairing/allowlist; if you really need open DMs, ensure channels.telegram.accounts.main.allowFrom includes "*".
CRITICAL Telegram security warning
Telegram groups: groupPolicy="open" with no channels.telegram.groups allowlist; any group can add + ping (mention-gated). Set channels.telegram.groupPolicy="al…
CRITICAL Telegram group commands have no sender allowlist
Telegram group access is enabled but no sender allowlist is configured; this allows any group member to invoke /… commands (including skill commands).
Fix: Approve yourself via pairing (recommended), or set channels.telegram.groupAllowFrom (or per-group groups..allowFrom).
CRITICAL Telegram security warning
Telegram groups: groupPolicy="open" with no channels.telegram.groups allowlist; any group can add + ping (mention-gated). Set channels.telegram.groupPolicy="al…
… +8 more
Full report: openclaw security audit
Deep probe: openclaw security audit --deep

Channels
┌──────────┬─────────┬────────┬────────────────────────────────────────────────────────────────────────────────────────┐
│ Channel │ Enabled │ State │ Detail │
├──────────┼─────────┼────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ Telegram │ ON │ OK │ token config×6 (8361…MDRM · len 46) · accounts 6/7 │
└──────────┴─────────┴────────┴────────────────────────────────────────────────────────────────────────────────────────┘

Sessions
┌───────────────────────────────────┬────────┬─────────┬─────────────────────────────┬─────────────────────────────────┐
│ Key │ Kind │ Age │ Model │ Tokens │
├───────────────────────────────────┼────────┼─────────┼─────────────────────────────┼─────────────────────────────────┤
│ agent:main:telegram:group:-1003… │ group │ 1m ago │ stepfun/step-3.5-flash:free │ 61k/200k (31%) │
│ agent:vision:telegram:group:-10… │ group │ 1m ago │ stepfun/step-3.5-flash:free │ 125k/200k (63%) │
│ agent:llama:telegram:group:-100… │ group │ 1m ago │ stepfun/step-3.5-flash:free │ 118k/200k (59%) │
│ agent:nemotron:telegram:group:-… │ group │ 1m ago │ stepfun/step-3.5-flash:free │ 101k/200k (50%) │
│ agent:healer:telegram:group:-10… │ group │ 1m ago │ openrouter/healer-alpha │ 121k/200k (60%) · 🗄️ 3% cached │
│ agent:llama:main │ direct │ 1m ago │ stepfun/step-3.5-flash:free │ 23k/200k (12%) │
│ agent:healer:main │ direct │ 2m ago │ openrouter/healer-alpha │ 41k/200k (21%) · 🗄️ 139% cached │
│ agent:vision:main │ direct │ 3m ago │ stepfun/step-3.5-flash:free │ 62k/200k (31%) │
│ agent:main:main │ direct │ 14m ago │ stepfun/step-3.5-flash:free │ 28k/200k (14%) │
│ agent:nemotron:main │ direct │ 16m ago │ stepfun/step-3.5-flash:free │ 43k/200k (21%) │
└───────────────────────────────────┴────────┴─────────┴─────────────────────────────┴─────────────────────────────────┘

FAQ: https://docs.openclaw.ai/faq
Troubleshooting: https://docs.openclaw.ai/troubleshooting

Next steps:
Need to share? openclaw status --all
Need to debug live? openclaw logs --follow
Fix reachability first: openclaw gateway probe → Telegram ON/OK

Sospecha: El doctor probe está usando un método incorrecto para verificar la configuración, mientras que el runtime funciona.

¿Hay algún workaround mientras se corrige?

Gracias. 🦞

[openclaw-barnacle]

This issue has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

[clawsweeper]

Closing this as implemented after Codex automated review.

Current main already handles the reported Telegram doctor/status mismatch for the described configuration. openclaw doctor now routes channel reporting through the Gateway health path, that path evaluates the preferred/default/configured Telegram accounts, and Telegram configured-state inspection recognizes account-level and channel-level botToken/tokenFile values before falling back to TELEGRAM_BOT_TOKEN. The same implicated source is present in the latest release tag v2026.4.26.

Best possible solution:

Close as implemented on main and keep the current Gateway health plus Telegram account-inspection behavior. If a new mismatch appears on a current build, it should be filed as a fresh bug with current version, openclaw doctor and openclaw status output, account bindings/defaultAccount, and redacted channel config.

What I checked:

• Doctor uses Gateway health output: The doctor flow runs the Gateway health contribution, and checkGatewayHealth calls healthCommand, so the doctor channel lines are produced from Gateway health data rather than a separate stale probe path. (src/flows/doctor-health-contributions.ts:418, d48c3e12a5d8)
• Health checks default, configured, and bound accounts: getHealthSnapshot builds the Telegram account probe set from the preferred account, default account, configured accounts, and bound accounts, then resolves each account's enabled/configured state before probing and formatting output. (src/commands/health.ts:317, d48c3e12a5d8)
• Telegram account inspection recognizes the reported token layout: inspectTelegramAccountPrimary checks account-level tokenFile, account-level botToken, channel-level tokenFile, channel-level botToken, then TELEGRAM_BOT_TOKEN for the default account; found credentials set configured: true. (extensions/telegram/src/account-inspect.ts:129, d48c3e12a5d8)
• Telegram plugin configured-state uses the same inspection path: The Telegram channel adapter's isConfigured calls inspectTelegramAccount, so channel-level fallback credentials are considered when doctor/health asks whether an account is configured. (extensions/telegram/src/shared.ts:172, d48c3e12a5d8)
• Related PR was not the canonical fix: Related PR test(doctor): cover multi-account Telegram tokenFile summary #41929 was closed unmerged and test-only; it usefully documented the same observed false positive, but current main/release source is the canonical implementation evidence.
• Latest release contains the implicated implementation: There is no diff between v2026.4.26 and current main for the implicated doctor/health/Telegram configured-state files, so the latest release tag contains the same behavior. (be8c24633aaa)

So I’m closing this as already implemented rather than keeping a duplicate issue open.

Codex Review notes: model gpt-5.5, reasoning high; reviewed against d48c3e12a5d8; fix evidence: release v2026.4.26, commit d48c3e12a5d8.