Summary

openclaw doctor --fix crashes with an unresolved SecretRef error when channels.discord.accounts.default.token is configured as an env-source SecretRef. The gateway resolves the token correctly at runtime (Discord is fully functional), but doctor fails before completing checks.

This is the same class of bug as #48195 and #45416 (both closed), but for env:default: SecretRefs rather than exec:pass: refs. The fix for those issues apparently did not cover the env-source path.

Environment

• OpenClaw version: 2026.3.13 (61d171a)
• OS: macOS (Darwin 25.3.0)
• Gateway: running, RPC probe ok, Discord connected and working

Config (relevant excerpt)

{
  "secrets": {
    "providers": {
      "default": {
        "source": "env"
      }
    }
  },
  "channels": {
    "discord": {
      "accounts": {
        "default": {
          "token": {
            "source": "env",
            "provider": "default",
            "id": "DISCORD_BOT_TOKEN"
          }
        }
      }
    }
  }
}

The token is stored in ~/.openclaw/.env and loaded by the gateway via shellEnv. The env var is NOT in the shell profile.

Steps to Reproduce

1. Configure Discord token as an env-source SecretRef (as above)
2. Store the token in ~/.openclaw/.env (loaded by gateway shellEnv, not shell profile)
3. Confirm gateway is running and Discord works: openclaw channels status shows connected
4. Run openclaw doctor --fix

Actual Behavior

Error: channels.discord.accounts.default.token: unresolved SecretRef "env:default:DISCORD_BOT_TOKEN". Resolve this command against an active gateway runtime snapshot before reading it.

Doctor exits immediately. Exporting the env var in the shell before running doctor does NOT help — the error persists even with DISCORD_BOT_TOKEN in the environment.

Expected Behavior

Doctor should resolve env-source SecretRefs via the gateway RPC (secrets.resolve) — which is already working (confirmed by openclaw channels status succeeding) — or degrade gracefully with a warning instead of crashing.

Additional context

• openclaw channels status works fine (resolves via gateway RPC)
• openclaw gateway status --deep reports RPC probe ok
• Exporting the env var before running doctor does not resolve the issue, suggesting doctor is hitting assertSecretInputResolved() before attempting gateway RPC resolution
• Related closed issues: doctor crashes with 'unresolved SecretRef' when config uses exec:pass: tokens #48195, [Bug]: openclaw doctor crashes on exec SecretRef channel credentials (exit 1) #45416 — same bug class for exec:pass: SecretRefs, reportedly fixed but env-source path was not covered