Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

CLI commands including openclaw browser doctor, openclaw gateway health, and openclaw channels status fail with GatewaySecretRefUnavailableError when gateway.auth.password is configured via SecretRef, while openclaw gateway status --deep reports the gateway as healthy and reachable.

Steps to reproduce

1. Configure OpenClaw with gateway.auth.password stored as a SecretRef.
2. Start the gateway and verify it is running:
   openclaw gateway status --deep
3. Run:
   openclaw gateway health
4. Observe:
   GatewaySecretRefUnavailableError
5. Run:
   openclaw browser doctor
   or
   openclaw channels status
6. Observe the same GatewaySecretRefUnavailableError.
7. Run:
   openclaw gateway status --deep
8. Observe that the gateway reports:
   • Runtime: running
   • Connectivity probe: ok
   • Capability: admin-capable

Expected behavior

Commands that communicate with a healthy local gateway should resolve SecretRef-backed gateway credentials the same way as openclaw gateway status --deep and should not fail with GatewaySecretRefUnavailableError.

Actual behavior

openclaw gateway health, openclaw browser doctor, and openclaw channels status fail with:

GatewaySecretRefUnavailableError: gateway.auth.password is configured as a secret reference but is unavailable in this command path.

At the same time, openclaw gateway status --deep reports:

• Runtime: running
• Connectivity probe: ok
• Capability: admin-capable

The issue was observed with gateway.auth.password configured as a SecretRef.

OpenClaw version

2026.6.5

Operating system

Linux Mint 22.3 (based on Ubuntu 24.04 LTS)

Install method

npm global install

Model

google/gemini-3.1-pro-preview

Provider / routing chain

OpenRouter -> Google Gemini

Additional provider/model setup details

Issue reproduces before any model inference occurs. The problem appears related to SecretRef-backed gateway authentication resolution in CLI commands.

Logs, screenshots, and evidence

openclaw gateway health

GatewaySecretRefUnavailableError: gateway.auth.password is configured as a secret reference but is unavailable in this command path.
Fix: set OPENCLAW_GATEWAY_TOKEN/OPENCLAW_GATEWAY_PASSWORD, pass explicit --token/--password,
or run a gateway command path that resolves secret references before credential selection.

openclaw channels status

Gateway not reachable: gateway.auth.password is configured as a secret reference but is unavailable in this command path.

openclaw browser doctor

FAIL gateway: GatewaySecretRefUnavailableError: gateway.auth.password is configured as a secret reference but is unavailable in this command path.

<img width="1920" height="1080" alt="Image" src="https://github.com/user-attachments/assets/d6e99f27-588f-4619-a677-83e50abb624d" />
<img width="1920" height="1080" alt="Image" src="https://github.com/user-attachments/assets/86768883-fb61-4290-8c84-bbe3b36a6eb3" />
<img width="1920" height="1080" alt="Image" src="https://github.com/user-attachments/assets/f6e4d396-65e4-4270-982b-d94d5be9e95a" />

Impact and severity

Operators using SecretRef-backed gateway authentication may be unable to use gateway-dependent CLI commands even when the gateway is healthy and reachable. The issue affects diagnostics and browser/channel tooling and can make a healthy installation appear broken.

Additional information

The gateway password is configured as a SecretRef and intentionally not stored in plaintext. This installation uses Bitwarden Secrets Manager. The gateway starts successfully, reports healthy status via openclaw gateway status --deep, and Google Chat functions correctly, but several CLI commands fail with GatewaySecretRefUnavailableError.