Summary

openclaw doctor crashes with an unresolved SecretRef error when the config uses exec:pass: SecretRefs for secrets (e.g. Discord bot token). This prevents the doctor from completing any checks or applying fixes, even when the GPG agent is unlocked and pass resolves correctly.

Environment

• OpenClaw version: 2026.3.13 (61d171a)
• OS: Linux (ARM64, Ubuntu)
• Gateway: running and fully functional (Discord works)

Config (relevant excerpt)

{
  "channels": {
    "discord": {
      "token": "exec:pass:discord/servers/renegadeparrot-server-token"
    }
  }
}

Steps to Reproduce

1. Configure a channel token as a exec:pass: SecretRef
2. Ensure GPG agent is unlocked and pass resolves the secret correctly (verified: pass discord/servers/... returns the token)
3. Run openclaw doctor or openclaw doctor --fix

Actual Behavior

Error: channels.discord.token: unresolved SecretRef "exec:pass:discord/servers/renegadeparrot-server-token". Resolve this command against an active gateway runtime snapshot before reading it.

Doctor exits immediately after session lock checks, before completing the full health check or applying any repairs.

Expected Behavior

Doctor should resolve exec:pass: SecretRefs the same way the gateway does at startup — by running the command — so it can complete health checks when the GPG agent is active.

Alternatively, doctor should gracefully skip or redact unresolved SecretRef fields rather than crashing, so the rest of the health check still runs.

Additional Notes

• openclaw config validate passes cleanly (no error)
• The gateway itself starts and runs correctly — Discord is fully functional
• Only openclaw doctor is affected
• The error occurs even when pass is explicitly verified to work in the same shell session