Greptile Summary

This PR fixes a crash in openclaw doctor that occurred when agents.defaults.memorySearch.remote.apiKey was set to a SecretRef-like object (e.g. { fromEnv: "OPENAI_API_KEY" }) instead of a plain string. The previous one-liner resolved?.remote?.apiKey?.trim() silently calls .trim() on the object, throwing a TypeError at runtime. The fix adds a typeof remoteApiKey === "string" guard before calling .trim(), so non-string values fall through to hasApiKeyForProvider, which already handles SecretRef resolution correctly.

Key changes:

• doctor-memory-search.ts — replace the single optional-chain expression with an explicit type guard; behavior for plain-string keys is identical.
• doctor-memory-search.test.ts — adds a regression test asserting that a SecretRef-shaped apiKey does not crash, that resolveApiKeyForProvider is called as the fallback, and that no spurious warning is emitted.

One minor coverage gap worth noting: the "auto" provider path also uses hasRemoteApiKey in its loop (line 122), but no test covers the scenario where provider: "auto" is combined with a SecretRef apiKey. The existing fix is still correct for that path — hasRemoteApiKey evaluates to false, causing the loop to fall back to hasApiKeyForProvider per-provider — but an additional test case could make that coverage explicit.

Confidence Score: 5/5

• This PR is safe to merge; it is a narrowly-scoped bug fix with no breaking changes and a direct regression test.
• The change is a two-line surgical fix that only affects a single boolean derivation. The logic is correct, the existing string-key behaviour is unaffected, and a regression test directly covers the crash path. There are no architectural changes, no new dependencies, and no modifications to config schema or public API.
• No files require special attention.

_{Last reviewed commit: b1ae802}

Thanks for the contribution here, and for helping narrow down the SecretRef doctor crash.

We merged #36835, which supersedes this PR and fixes the broader doctor/memory SecretRef surface in one place, including the related runtime embedding paths.

I’m closing this as superseded by #36835, but I appreciate the fix and the investigation that went into it.