Summary

openclaw doctor and openclaw update fail with:

channels.telegram.botToken: unresolved SecretRef "env:default:OPENCLAW_TELEGRAM_BOT_TOKEN". Resolve this command against an active gateway runtime snapshot before reading it.

Even though Telegram channel runtime is healthy and message flow works.

Environment

• OpenClaw: 2026.3.13
• Install type: npm global (~/.npm-global/lib/node_modules/openclaw)
• OS: Ubuntu Linux (x64)
• Gateway: systemd user service
• Secret provider: env (.env + EnvironmentFile)

Config shape (sanitized)

"channels": {
  "telegram": {
    "enabled": true,
    "botToken": {
      "source": "env",
      "provider": "default",
      "id": "OPENCLAW_TELEGRAM_BOT_TOKEN"
    }
  }
}

Repro

1. Configure Telegram token as env SecretRef (env:default:OPENCLAW_TELEGRAM_BOT_TOKEN).
2. Ensure gateway service uses env file:
   • EnvironmentFile=-/home/<user>/.openclaw/.env
3. Verify runtime works:
   • Telegram chats work normally
   • openclaw status shows Telegram channel OK
4. Run:
   • openclaw doctor --non-interactive
   • openclaw update

Actual behavior

• openclaw doctor exits with unresolved SecretRef error (above).
• openclaw update fails because it runs doctor checks.

Expected behavior

• Doctor should resolve SecretRefs the same way runtime does (or use active gateway snapshot) and not fail when channel is healthy.
• Update should not be blocked by this false-positive/diagnostic-path SecretRef failure.

Notes

• This appears related to existing SecretRef/reporting inconsistencies:
  • [Bug]: openclaw doctor crashes on exec SecretRef channel credentials (exit 1) #45416
  • [Bug]: openclaw gateway status emits false-positive SecretRef error in diagnostic output when gateway is healthy #44754
  • SecretRef resolution fails at reply time for channel tokens (Slack/Telegram) #45838
• No secrets included here; all values are redacted/sanitized.