OpenClaw Feishu Channel No Longer Authenticates With Environment Credentials SecretRef Policy Rejects

If you run OpenClaw’s Feishu channel with SecretRef-based provider policy, a merged fix changes how ambient environment variables are treated during account inspection. The pre-fix behavior could authenticate requests with a credential your own policy was supposed to reject.

The gap in one paragraph

Feishu account inspection used to accept an ambient environment credential as “configured” even when the configured SecretRef provider policy said otherwise: an unconfigured provider alias, a provider resolved from the wrong source, or an allowlist exclusion all failed to block it. That inspected account then flowed into authenticated paths — document-comment delivery and live directory lookup — so requests went out under credentials the operator had deliberately fenced off.

What changed

Account inspection now delegates provider authorization to the canonical Plugin SDK read-only SecretRef policy seam before any environment variable is read. The same four-case policy matrix (unconfigured provider, wrong source, allowlist rejection, explicitly allowed access) covers the account owner, live directory lookup, and authenticated document-comment delivery. Message-tool discovery also passes the full root config into the same inspection owner, closing a fallback path found during review.

Per the merge record: valid literal credentials, configured provider defaults, and explicitly allowed environment references continue to work; strict runtime snapshots remain fail-closed for unresolved references. Pre-fix regressions demonstrated ten denied cases reaching authenticated boundaries; those now fail closed before egress.

Operator guidance

• If you rely on Feishu + SecretRef policy, re-test after picking up this change: your intended deny cases should now actually deny, and your allowed cases should still work. A behavior change here is expected and is the point.
• Audit which ambient environment variables exist on your Gateway host. This class of bug turns host-level leakage into channel-level authentication.
• If you were unknowingly depending on ambient fallback (policy says deny, ambient var says go), fix your config rather than expecting the fallback back — the relaxed resolution option was removed, not deprecated.

Interpretation: this is containment hardening rather than evidence of active exploitation — the advisory value is that default-deny operators previously could not rely on their policy being enforced on this path.