Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails (#35094)

src/commands/configure.gateway-auth.ts

@@ -1,5 +1,6 @@
 import { ensureAuthProfileStore } from "../agents/auth-profiles.js";
 import type { OpenClawConfig, GatewayAuthConfig } from "../config/config.js";
+import { isSecretRef, type SecretInput } from "../config/types.secrets.js";
 import type { RuntimeEnv } from "../runtime.js";
 import type { WizardPrompter } from "../wizard/prompts.js";
 import { promptAuthChoiceGrouped } from "./auth-choice-prompt.js";
@@ -17,7 +18,7 @@ import { randomToken } from "./onboard-helpers.js";
 type GatewayAuthChoice = "token" | "password" | "trusted-proxy";
 
 /** Reject undefined, empty, and common JS string-coercion artifacts for token auth. */
-function sanitizeTokenValue(value: string | undefined): string | undefined {
+function sanitizeTokenValue(value: unknown): string | undefined {
   if (typeof value !== "string") {
     return undefined;
   }
@@ -39,7 +40,7 @@ const ANTHROPIC_OAUTH_MODEL_KEYS = [
 export function buildGatewayAuthConfig(params: {
   existing?: GatewayAuthConfig;
   mode: GatewayAuthChoice;
-  token?: string;
+  token?: SecretInput;
   password?: string;
   trustedProxy?: {
     userHeader: string;
@@ -54,6 +55,9 @@ export function buildGatewayAuthConfig(params: {
   }
 
   if (params.mode === "token") {
+    if (isSecretRef(params.token)) {
+      return { ...base, mode: "token", token: params.token };
+    }
     // Keep token mode always valid: treat empty/undefined/"undefined"/"null" as missing and generate a token.
     const token = sanitizeTokenValue(params.token) ?? randomToken();
     return { ...base, mode: "token", token };