Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

openclaw status --deep can falsely report Gateway HTTP APIs are reachable without auth and gateway.auth.mode="none" even when the live gateway is configured for token auth and the structured status/audit commands confirm auth is healthy.

Steps to reproduce

1. Configure gateway.auth.mode as token, with the token supplied through a secret reference rather than inline plaintext.
2. Run openclaw config get gateway --json and confirm the gateway auth mode is token.
3. Run openclaw status --deep --json and openclaw security audit --deep --json.
4. Run the human-readable openclaw status --deep.
5. Compare the structured outputs with the human-readable status output.

Expected behavior

All status and audit surfaces should agree on gateway auth state. If token auth is configured and resolves correctly, status --deep should not emit the gateway.http.no_auth warning or claim gateway.auth.mode="none".

Actual behavior

The human-readable openclaw status --deep output emits WARN Gateway HTTP APIs are reachable without auth and says gateway.auth.mode="none". In the same environment, openclaw config get gateway --json reports auth.mode: "token", openclaw status --deep --json reports authWarning: null, and openclaw security audit --deep --json does not emit a gateway-auth finding.

OpenClaw version

2026.5.27 (27ae826)

Operating system

Ubuntu 26.04 LTS

Install method

pnpm

Model

Not model-specific; reproduced entirely through CLI status commands

Provider / routing chain

Not model-specific; local CLI status and security-audit commands against a token-authenticated local gateway

Additional provider/model setup details

Gateway auth was configured in token mode with the token supplied through a secret reference/provider, not inline plaintext in the config file.

Logs, screenshots, and evidence

- `openclaw config get gateway --json` reported `auth.mode: "token"` and a token secret reference object.
- `openclaw status --deep --json | jq ...` reported `authWarning: null` with no gateway-auth finding.
- `openclaw security audit --deep --json` reported only `gateway.trusted_proxies_missing` and `security.trust_model.multi_user_heuristic`.
- The human-readable `openclaw status --deep` output still printed `WARN Gateway HTTP APIs are reachable without auth` and `gateway.auth.mode="none"`.

Impact and severity

Medium. It creates a false security/configuration alarm, can send operators chasing nonexistent auth drift, and undermines trust in status --deep as a diagnostic surface.

Additional information

Root cause appears to be in the status command's secret-target selection, not the actual gateway config. On this machine, inspecting the installed runtime showed the status path did not include gateway.auth.token or gateway.auth.password in its secret-target set, so the pretty-text status audit evaluated unresolved secret references. The dedicated security-audit path did include those secret targets, resolved the token correctly, and stayed clean.