Problem

openclaw doctor --fix applies changes without preview. There is no --dry-run or --preview flag to see what --fix would change before it changes it. sessions cleanup has --dry-run (doctor-state-integrity-BPSD4cAx.js); doctor itself does not.

Originally filed as part of #65824 (item 6) and #65818. Re-audited against 2026.5.7 (eeef486) — no changes.

Source evidence (5.7 dist/ file names)

• Doctor config flow entry: doctor-config-flow-Cqgy0iUL.js:1211 — const shouldRepair = params.options.repair === true || params.options.yes === true — this is the sole repair gate. No dryRun parameter or branch exists anywhere in this flow.
• Pending changes gate: doctor-config-flow-Cqgy0iUL.js:901 — if (!params.shouldRepair && params.pendingChanges) — the pendingChanges object contains the full proposed change set. When shouldRepair is false, the only output is deferred fixHints text. When true (line 915), changes are written immediately. There is no intermediate "show what would change" path.
• Fix application: doctor-config-flow-Cqgy0iUL.js:915 — if (params.shouldRepair && params.pendingChanges) return { ... } — writes the config directly. No diff preview, no confirmation gate, no backup-then-apply pattern.
• Plugin issue handling: doctor-config-flow-Cqgy0iUL.js:1248 — if (pluginIssueLines.length > 0 && !shouldRepair && !fixHints.includes(...)) — plugin config issues also follow the binary shouldRepair/don't-repair pattern with no preview.
• Sessions cleanup contrast: doctor-state-integrity-BPSD4cAx.js — the session cleanup path exposes --dry-run. The doctor config path in doctor-config-flow-Cqgy0iUL.js has no equivalent.
• Doctor modules count: 48 files matching doctor-*.js in 5.7 dist/. None contain dryRun logic for the --fix config repair path.
• CLI help output: openclaw doctor --help shows --fix, --repair, --force, --non-interactive, --yes. No --dry-run or --preview.

We have experienced doctor --fix silently stripping custom config fields in the past — fields that were valid and intentional but not in the expected schema. Without a preview, the user cannot catch these before they're applied.

Workaround

oc-doctor-safe — creates a full config backup, runs doctor --fix, shows a diff of changes, requires confirmation before keeping them, and supports rollback if the changes are unwanted.

Proposed solution

Add --dry-run to doctor --fix that:

1. Runs the same diagnostic checks as --fix
2. Collects all proposed changes (the pendingChanges object at line 901 already contains these)
3. Displays them as a diff (or structured JSON) without applying
4. Exits without modifying anything

The plumbing is already there — pendingChanges at line 901 contains the full proposed change set before shouldRepair decides whether to write. A --dry-run flag would simply serialize that object as a diff and exit before the write at line 915.

This matches the pattern already established by sessions cleanup --dry-run.

Impact

High. doctor --fix is the most common maintenance command and it mutates config without preview. A diff mode would prevent accidental field stripping and build operator confidence in the tool.

Environment

• OpenClaw 2026.5.7 (eeef486) · macOS arm64