Description

openclaw doctor crashes at the end of its run with:

TypeError: resolved?.remote?.apiKey?.trim is not a function

This happens when the configuration uses SecretRef values (e.g., $OPENCLAW_GATEWAY_TOKEN env var references or vault-resolved secrets) for API keys. The gateway runtime resolves these correctly, but the doctor diagnostic tool attempts to call .trim() on the resolved object, which is not a string.

Reproduction

1. Configure openclaw.json with environment variable references for API keys (e.g., memory search remote API key, or any field that resolves through SecretRef)
2. Run openclaw doctor
3. The diagnostic completes all checks successfully, then crashes on the final line with the TypeError

Output

┌  OpenClaw doctor
│
◇  State integrity ─────────────────────╮
│  ...                                   │
├────────────────────────────────────────╯
│
[... all checks pass normally ...]

Telegram: ok (@jmzlx_bot) (334ms)
WhatsApp: linked (auth age 4916m)
Discord: ok (@clemente) (524ms)
Agents: main (default), inbox, creative, voice

TypeError: resolved?.remote?.apiKey?.trim is not a function

Impact

• openclaw doctor cannot be used for pre-flight config validation (exits with error)
• Does not affect runtime — the gateway starts and operates normally
• Prevents using openclaw doctor --fix for automated config repair

Expected behavior

openclaw doctor should handle SecretRef objects the same way the runtime does — either resolve them before calling string methods, or skip the .trim() call when the value is not a plain string.

Environment

• OpenClaw: 2026.3.2
• OS: macOS (arm64), Darwin 25.3.0
• Node: v25.6.1