Description

Running openclaw doctor (or processes that trigger doctor internally) can re-inject raw API key values directly into openclaw.json, replacing ${ENV_VAR} references with the resolved plaintext secrets.

Problem

The config file supports environment variable substitution (e.g. ${GOOGLE_API_KEY}), and secrets are intended to live in ~/.openclaw/.env. However, when the doctor process runs — either explicitly or as part of config validation — it can write the resolved (plaintext) values back into the config JSON.

This means:

• Secrets end up in plaintext in openclaw.json
• The config file becomes unsafe to share, back up, or commit
• Users who carefully set up ${VAR} references find them silently replaced with raw keys

Expected Behavior

• Doctor/configure should never resolve ${ENV_VAR} references when writing config back to disk
• If a config value contains an env var reference, it should be preserved as-is in the written file
• Validation should resolve vars in-memory only, not persist the resolved values

Environment

• OpenClaw version: 2026.2.6-3
• OS: macOS (arm64)

Workaround

Avoid running openclaw doctor or openclaw configure if your config uses ${ENV_VAR} references for secrets. If accidentally run, manually restore the env var references from a backup.