openclaw - 💡(How to fix) Fix [Bug]: TUI and CLI tools fail to resolve SecretRef from /etc/ file provider despite active Gateway session [1 comments, 2 participants]

Bug type

Crash (process/app exits or hangs)

Beta release blocker

No

Summary

CLI tools and TUI fail to resolve gateway tokens stored in /etc/openclaw/secrets.json via SecretRef, even while the background daemon is running and authenticated.

Steps to reproduce

1. Define gateway.auth.token in config.json using source: "file" pointing to a secret in /etc/openclaw/secrets.json.
2. Start the gateway daemon: openclaw start (this succeeds).
3. Attempt to run openclaw tui or openclaw devices list.
4. Observe the SecretRef is unresolved error in the terminal.

Expected behavior

CLI and TUI processes should resolve file-based SecretRefs using the same logic and permission context as the daemon, allowing for seamless authentication.

Actual behavior

The CLI returns: Error: gateway.auth.token SecretRef is unresolved (file:default:/OPENCLAW_GATEWAY_TOKEN).

OpenClaw version

2026.5.7

Operating system

Ubuntu 24.04

Install method

npm global

Model

openai-codex/gpt-5.5

Provider / routing chain

openclaw -> openai-codex

Additional provider/model setup details

Secrets are stored in /etc/openclaw/secrets.json. Gateway runs successfully as a service, but user-level CLI commands (like openclaw devices list, approve, ... etc ) fail to resolve the path despite having read permissions via tools like jq.

Logs, screenshots, and evidence

Error: gateway.auth.token SecretRef is unresolved (file:default:/OPENCLAW_GATEWAY_TOKEN).

Impact and severity

Affected: All users utilizing file-based secret providers outside the home directory.

Severity: High (Blocks all management and TUI functionality).

Frequency: Always (4/4 attempts).

Consequence: Unable to manage devices or use the TUI without manual environment variable injection.

Additional information

No response