Summary

openclaw doctor --fix writes redaction placeholders (__OPENCLAW_REDACTED__) into the actual config file on disk, permanently destroying secrets. It also strips the gateway.auth block entirely. This is not a display issue — the redacted values are persisted and break the gateway on next restart.

Steps to Reproduce

1. Have a working openclaw.json with:
   • channels.telegram.botToken set to a valid Telegram bot token
   • gateway.auth block with mode: "token" and a valid token
2. Run openclaw doctor --fix (or have it run via cron: openclaw update --yes && openclaw doctor --fix && openclaw gateway restart)
3. Check openclaw.json

Actual Result

"channels": {
  "telegram": {
    "botToken": "__OPENCLAW_REDACTED__"
  }
}

• gateway.auth block is completely removed
• Gateway fails on next start: Call to 'getMe' failed! (404: Not Found) and Refusing to bind gateway to lan without auth

Expected Result

doctor --fix should never write redaction placeholders to the config file. Redaction belongs in display/log output only. The gateway.auth block should not be stripped.

Impact

Destructive — silently destroys credentials in the live config. Especially dangerous when run on a schedule (e.g., cron every 3 hours), as it repeatedly breaks the gateway and requires manual secret restoration each time.

Workaround

• Remove --fix from any cron jobs
• Manually restore botToken and gateway.auth after each doctor --fix run

Related

• openclaw doctor --fix overwrites valid config without backup #12858 — doctor --fix overwrites valid config without backup (general case)
• This issue is specifically about writing redaction placeholders to disk, which is a distinct bug from config restructuring

Environment

• macOS (arm64)
• OpenClaw 2026.2.15