From 909be7bcbc709630fedbfe9c4ef5f0def28e8029 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <peter@steipete.me>
Date: Wed, 1 Jul 2026 15:35:58 +0100
Subject: [PATCH] fix: validate message timeout before secret resolution
 (#98652)

Co-authored-by: Peter Steinberger <58493+steipete@users.noreply.github.com>
---
 src/agents/tools/message-tool.test.ts | 1 +
 src/agents/tools/message-tool.ts      | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/agents/tools/message-tool.test.ts b/src/agents/tools/message-tool.test.ts
index 600f0cd136a0..bf62794165d5 100644
--- a/src/agents/tools/message-tool.test.ts
+++ b/src/agents/tools/message-tool.test.ts
@@ -457,6 +457,7 @@ describe("message tool gateway timeout", () => {
           timeoutMs,
         }),
       ).rejects.toThrow("timeoutMs must be a positive integer");
+      expect(mocks.resolveCommandSecretRefsViaGateway).not.toHaveBeenCalled();
       expect(mocks.runMessageAction).not.toHaveBeenCalled();
     },
   );
diff --git a/src/agents/tools/message-tool.ts b/src/agents/tools/message-tool.ts
index 2cf697960f59..c2d2168965f9 100644
--- a/src/agents/tools/message-tool.ts
+++ b/src/agents/tools/message-tool.ts
@@ -1348,6 +1348,7 @@ export function createMessageTool(options?: MessageToolOptions): AnyAgentTool {
         }
       }
 
+      const gatewayOpts = readGatewayCallOptions(params);
       const rawConfig = options?.config ?? loadConfigForTool();
       const scope = resolveMessageSecretScope({
         channel: params.channel,
@@ -1413,7 +1414,7 @@ export function createMessageTool(options?: MessageToolOptions): AnyAgentTool {
         }
       }
 
-      const gatewayResolved = resolveGatewayOptions(readGatewayCallOptions(params));
+      const gatewayResolved = resolveGatewayOptions(gatewayOpts);
       const gateway = {
         url: gatewayResolved.url,
         token: gatewayResolved.token,