Filed on behalf of an OpenClaw user after local diagnosis.

Summary

openclaw doctor --non-interactive fails when Nextcloud Talk botSecret is configured as a file-backed SecretRef, even though the active Gateway runtime can resolve the secret and Nextcloud Talk is working.

The failure appears to be in a doctor/read-path command reading channels.nextcloud-talk.accounts.default.botSecret without resolving it through the active Gateway runtime snapshot or secret resolver.

Environment

• OpenClaw CLI/Gateway: 2026.6.5
• Install type: npm global install
• OS: macOS 26.5.1 arm64
• Node: 25.8.1
• Gateway service: LaunchAgent, running as shoichi
• Gateway command: /opt/homebrew/opt/node/bin/node /opt/homebrew/lib/node_modules/openclaw/dist/index.js gateway --port 18789
• Config: ~/.openclaw/openclaw.json
• SecretRef shape: channels.nextcloud-talk.botSecret = { source: "file", provider: "default", id: "/NEXTCLOUD_TALK_BOT_SECRET" }

Reproduction

Run:

openclaw doctor --non-interactive

Observed output:

Error: channels.nextcloud-talk.accounts.default.botSecret: unresolved SecretRef "file:default:/NEXTCLOUD_TALK_BOT_SECRET". Resolve this command against an active gateway runtime snapshot before reading it.

Commands That Did Not Reproduce

These completed successfully in the same environment:

openclaw status
openclaw status --deep
openclaw channels status --probe
openclaw secrets audit
openclaw update status

Health Checks / Impact

• openclaw status --deep: Gateway reachable, Nextcloud Talk OK.
• openclaw channels status --probe: Nextcloud Talk default: enabled, configured, running, ... works.
• openclaw secrets audit: unresolved=0.
• Real Nextcloud Talk reply path succeeds. A direct ai03 OCS post returned 201 ok and produced a message in the expected thread.
• Gateway startup is not blocked. The Gateway log showed gateway ready and webhook listening before the SecretRef error.

Relevant Timing From Local Logs

• 2026-06-10T21:30:34+09:00: config audit recorded openclaw update.
• 2026-06-10T21:30:45+09:00: Gateway logged gateway ready and Nextcloud Talk webhook listening.
• 2026-06-10T21:30:50+09:00: unresolved SecretRef error logged.
• 2026-06-10T21:48:00+09:00: manually running openclaw doctor --non-interactive reproduced the same error.

Expected Behavior

openclaw doctor --non-interactive should either:

1. Resolve SecretRef-backed channel secrets via the same runtime/secret resolution path used by the active Gateway, or
2. Treat unresolved SecretRef objects as redacted/configured values for checks that do not need the secret value.

It should not fail the whole doctor run when the active Gateway and channel probe already confirm the SecretRef-backed channel is working.

Actual Behavior

doctor --non-interactive aborts with an unresolved SecretRef error for channels.nextcloud-talk.accounts.default.botSecret.

Notes

This does not appear to be a broken secret provider or missing bot secret. It looks like a read-path/runtime snapshot mismatch in doctor or a shared Nextcloud Talk account-resolution helper used by doctor.