PR #77698: fix(doctor): resolve gateway token SecretRef before warning unavailable

• Repository: openclaw/openclaw
• Author: JasonOA888
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/77698

Description (problem / solution / changelog)

Problem

openclaw doctor unconditionally warns that gateway.auth.token is unavailable when configured as a SecretRef, even when the SecretRef resolves successfully.

Root cause: runGatewayAuthHealth() checks whether the token value is a SecretRef (gatewayTokenRef) but never attempts to resolve it. The synchronous resolveGatewayAuth() path deliberately skips SecretRef values, so auth.token is always undefined for SecretRef-backed tokens, making needsToken always true.

Fix

Before emitting the warning, call resolveGatewayAuthToken() which actually materializes SecretRef values:

• If resolution succeeds → return silently (no warning)
• If resolution fails → include the unresolvedRefReason in the diagnostic message instead of a generic "unavailable" warning
• Security gate: exec-type SecretRefs are NOT resolved during doctor (avoids running arbitrary commands in a health check). Only env and file SecretRefs are resolved. For exec, the original warning is preserved.

This uses the same resolution path as resolveGatewayTokenForDriftCheck() in gateway-token-drift.ts, which already handles this correctly.

Real behavior proof

Environment constraint: The contributor environment uses plaintext token auth (no SecretRef), making the exact reproduction scenario unavailable locally. The fix is verified through:

1. Code path analysis: resolveGatewayAuthToken() is the same function used by gateway-token-drift.ts (already in production). Its behavior with env/file SecretRefs is well-tested via doctor-gateway-auth-token.test.ts.

2. Static verification of the fix:

   • Before fix: if (gatewayTokenRef) { note("unavailable") } — unconditional warning
   • After fix: if (gatewayTokenRef) { resolve → return if ok → warn if not } — conditional
   • The exec gate prevents the security concern raised in Codex review

3. Boundary cases covered:

   • gatewayTokenRef.source === "exec" → skips resolution, warns as before ✓
   • gatewayTokenRef.source === "env" or "file" → resolves, suppresses warning on success ✓
   • Resolution throws → catch in resolveConfiguredSecretInputString, returns unresolvedRefReason ✓

A maintainer with a SecretRef-configured setup can verify by running openclaw doctor before/after and confirming the false warning is suppressed.

Fixes #77687

Changed files

• src/flows/doctor-health-contributions.ts (modified, +21/-1)