onboard: SLACK_APP_TOKEN not forwarded to sandbox — Socket Mode broken out of the box

[kssgill]

Description

NemoClaw onboard passes SLACK_BOT_TOKEN to the sandbox (via Dockerfile ARG → openclaw.json botToken), but completely ignores SLACK_APP_TOKEN. With
out the app-level token, OpenClaw cannot start Socket Mode — Slack shows as "enabled, not configured, stopped".

bin/lib/onboard.js only references SLACK_BOT_TOKEN (lines 2089, 2278, 3181, 3380, 3653). There is no handling for SLACK_APP_TOKEN anywhere in the
NemoClaw source. OpenShell strips non-OPENSHELL env vars from the sandbox entrypoint, so the token never reaches the sandbox even if set in the install
environment.

SLACK_APP_TOKEN should be forwarded alongside SLACK_BOT_TOKEN — passed as a Dockerfile ARG, written into openclaw.json as channels.slack.accounts .main.appToken, or injected as a sandbox env var.

Reproduction Steps

Reproduction Steps

1. Set both SLACK_BOT_TOKEN and SLACK_APP_TOKEN in the environment
2. Run nemoclaw onboard (or install-airgap.sh with both tokens exported)
3. SSH into sandbox: openshell sandbox ssh-config <name> > /tmp/ssh-cfg && ssh -F /tmp/ssh-cfg openshell-<name>
4. Run openclaw channels status
5. Observe: Slack main: enabled, not configured, stopped, bot:config, error:not configured
6. Run env | grep SLACK — only SLACK_BOT_TOKEN is present, no SLACK_APP_TOKEN

Environment

• NemoClaw v0.1.0 (main branch)
• OpenShell 0.0.25
• OpenClaw 2026.3.11
• OS: Ubuntu/Debian
• Node.js v22.22.1

Debug Output

$ grep -rn "SLACK_BOT_TOKEN" bin/lib/onboard.js
2089:      envKey: "SLACK_BOT_TOKEN",
2090:      token: getMessagingToken("SLACK_BOT_TOKEN"),
2234:      if (envKey === "SLACK_BOT_TOKEN") return "slack";
2278:    "SLACK_BOT_TOKEN",
3181:    envKey: "SLACK_BOT_TOKEN",
3380:  if (getCredential("SLACK_BOT_TOKEN") || process.env.SLACK_BOT_TOKEN) {
3382:    console.log("  Auto-detected: SLACK_BOT_TOKEN → suggesting slack preset");
3653:  if (getCredential("SLACK_BOT_TOKEN") || process.env.SLACK_BOT_TOKEN) suggestions.push("slack");

$ grep -rn "SLACK_APP_TOKEN" bin/lib/onboard.js
(no results)

Logs

$ openclaw channels status
Checking channel status…
Gateway reachable.
- Slack main: enabled, not configured, stopped, bot:config, error:not configured

$ env | grep SLACK
SLACK_BOT_TOKEN=openshell:resolve:env:SLACK_BOT_TOKEN

Checklist

• I confirmed this bug is reproducible
• I searched existing issues and this is not a duplicate

[wscurran]

✨ Thanks for reporting this issue, which identifies a problem with Slack messaging and provides detailed reproduction steps.