OpenClaw merged a high-priority channel reliability fix tonight: PR #127539 changes how ClickClack, Zalo, and Microsoft Teams accounts behave when a selected credential file is missing, unsafe, or otherwise unavailable.
The old behavior could fail in several different ways. An account might fall through to a lower-priority credential, appear unconfigured, or fail later while exposing raw filesystem-path context in diagnostics. That is especially risky for channel plugins because one bad account should not disturb healthy sibling accounts on the same Gateway.
The new behavior is more explicit: the affected account remains configured, but OpenClaw marks it unavailable and keeps it cold until the credential is repaired.
Exact Account Degradation
The PR routes direct credential-file failures through the generic CREDENTIAL_FILE_UNAVAILABLE account lifecycle instead of leaving each channel to drift into its own fallback path.
That matters because selected credentials are identity. If an operator chose a certificate or file-backed token for a channel account, OpenClaw should not silently swap in another source just because the preferred file disappeared. The fix preserves credential precedence, keeps managed identity distinct, and emits typed plugin-owned diagnostics that identify the configuration field without leaking the credential value or raw path.
For operators, the outcome is straightforward:
- The broken account is isolated.
- Healthy sibling accounts keep running.
- Repairing the file and reloading or restarting the exact account recovers it.
- Diagnostics point at the configuration field while redacting sensitive details.
- Microsoft Teams actions are hidden while the selected certificate is unavailable.
That last point closes a practical failure mode. Microsoft Teams proactive sends and model-facing message actions now use the resolved account state as the canonical eligibility source. If the chosen certificate cannot be used, OpenClaw avoids offering actions that would fail later.
Microsoft Teams Auth Gets Stricter
PR #127539 also tightens Microsoft Teams federated authentication. The PR notes that pinned @microsoft/teams.apps behavior could prefer an ambient CLIENT_SECRET before custom-token or managed-identity branches.
OpenClaw now explicitly prevents an ambient client secret from overriding certificate or managed-identity authentication. That keeps the configured authentication mode in charge and avoids a surprising environment-variable takeover.
This is one of those fixes that is easy to miss from the outside. It does not add a flashy new channel. It makes the existing channel setup path behave less mysteriously when credentials age, move, or get revoked.
Why It Matters
Channel plugins live at a trust boundary. They hold account identity, inbound routing, outbound sends, and sometimes proactive delivery. A stale or unreadable credential file should be a contained operational problem, not a reason to downgrade silently or leave actions visible when they cannot succeed.
The PR’s labels reflect that blast radius: P1, merge-risk: compatibility, merge-risk: auth-provider, and merge-risk: message-delivery. The patch stays focused on the plugin-owner boundary and account consumers rather than adding channel-specific branches to core.
Validation
The evidence reported on the PR is broad. Focused regressions covered credential availability, precedence, redaction, federated authentication, action discovery, and proactive outbound behavior.
After the repair, the original plugin regressions passed alongside generic Gateway account-lifecycle tests. A follow-up ClawSweeper pass covered 170 Microsoft Teams tests across action discovery, proactive send context, account resolution, SDK authentication, and token selection.
For OpenClaw operators, the takeaway is simple: missing selected credentials now fail visibly, locally, and recoverably. That is the behavior you want from a multi-channel agent runtime.