Greptile Summary

This PR fixes a real TypeError crash in openclaw doctor and Ollama embedding resolution by guarding .trim() calls against non-string SecretRef objects that the config resolver can return.

Changes verified:

• src/commands/doctor-memory-search.ts (line 30): Adds typeof rawApiKey === "string" check before calling .trim(). A non-string SecretRef is still truthy, correctly indicating that a key was configured.
• src/memory/embeddings-ollama.ts (lines 49-50): Same pattern—guards .trim() with a typeof check, gracefully falling back to provider-config and env-var sources when the value is a SecretRef.

Design rationale:
The inline typeof check diverges intentionally from the shared normalizeResolvedSecretInputString helper used by other remote embedding providers. This is appropriate because Ollama is a local, optional provider where silent fallback to env-vars is the correct behavior, whereas the shared helper would throw an error if a SecretRef were unresolved. The fix respects these semantic differences.

Test coverage:
All 16 pre-existing tests pass (14 doctor-memory-search + 2 embeddings-ollama). The fix is backward-compatible—string API keys behave identically.

Verdict: The fix is correct, minimal, and well-scoped to the reported issue.

Confidence Score: 4/5

• Safe to merge—the fix directly addresses the reported crash without introducing new dependencies or behavioral changes for string-valued API keys.
• The fix is correct, minimal, and directly addresses the reported TypeError crash. Both changes follow the same defensive pattern: check typeof rawApiKey === "string" before calling .trim(). All 16 pre-existing tests pass. The design choice to use inline typeof guards (rather than the shared helper) is intentional and appropriate for Ollama's semantics as a local optional provider. The only minor gap is the absence of a specific regression test for SecretRef-shaped values, but this is not critical given the simplicity and correctness of the fix.
• No files require special attention

_{Last reviewed commit: 5a3ce5a}

Thanks for the contribution here, and for helping narrow down the SecretRef doctor crash.

We merged #36835, which supersedes this PR and fixes the broader doctor/memory SecretRef surface in one place, including the related runtime embedding paths.

I’m closing this as superseded by #36835, but I appreciate the fix and the investigation that went into it.