openclaw - 💡(How to fix) Fix doctor --fix silently rotates gateway.auth.token on valid configs

Summary

Interactive openclaw doctor --fix can silently regenerate gateway.auth.token even when a valid token is already configured, causing mass consumer disconnects.

Root Cause

runGatewayAuthHealth in doctor-health-contributions.ts generates a new random token whenever it detects auth is "off or missing a token." While the existing gate ((auth.mode !== "token" || !auth.token)) should prevent this when a valid token exists, the config-audit logs prove that interactive runs produce a new random token every time.

Evidence

From production config-audit.jsonl over 7 days:

Key finding: the May 20 22:41 run has the same previous hash as the 01:30 run but produces a different next hash at the same byte count. This confirms crypto.randomBytes(24).toString("hex") generates a new value on each invocation.

Impact

• All gateway consumers that load the token at startup (long-running processes, systemd services, external scripts) lose connectivity silently
• No warning is emitted when the token changes — discovery requires diffing config hashes

Fix Suggested

Add an early-return guard before the existing condition:

if (auth.mode === "token" && auth.token && auth.token.length >= 32) return;

And emit a visible warning when rotation does occur:

note("🔁 gateway.auth.token rotated; consumers will need to be restarted to re-read .env", "Gateway auth");