fix(gateway): narrow serve+none guard to tailscaleMode=serve only

coygeek · coygeek · commit 6bd6ea52f8dc · 2026-03-23T18:05:19.000-07:00
The new auth.mode=none guard was dead code for the funnel path because the preceding funnel guard (line 125) already rejects funnel+non-password. Narrow the condition from tailscaleMode !== "off" to tailscaleMode === "serve" so the guard matches only the configuration it actually covers, and update the error message and test assertion accordingly. Addresses Greptile review feedback on PR #50631.
diff --git a/src/gateway/server-runtime-config.test.ts b/src/gateway/server-runtime-config.test.ts
@@ -264,7 +264,7 @@ describe("resolveGatewayRuntimeConfig", () => {
           tailscale: { mode: "serve" },
         }),
       ).rejects.toThrow(
-        "tailscale serve/funnel requires gateway auth — refusing to start with auth.mode=none when tailscale is active",
+        "tailscale serve requires gateway auth — refusing to start with auth.mode=none when tailscale serve is active",
       );
     });
 
diff --git a/src/gateway/server-runtime-config.ts b/src/gateway/server-runtime-config.ts
@@ -127,9 +127,9 @@ export async function resolveGatewayRuntimeConfig(params: {
       "tailscale funnel requires gateway auth mode=password (set gateway.auth.password or OPENCLAW_GATEWAY_PASSWORD)",
     );
   }
-  if (tailscaleMode !== "off" && authMode === "none") {
+  if (tailscaleMode === "serve" && authMode === "none") {
     throw new Error(
-      "tailscale serve/funnel requires gateway auth — refusing to start with auth.mode=none when tailscale is active",
+      "tailscale serve requires gateway auth — refusing to start with auth.mode=none when tailscale serve is active",
     );
   }
   if (tailscaleMode !== "off" && !isLoopbackHost(bindHost)) {

Original file line number	Diff line number	Diff line change
`@@ -127,9 +127,9 @@ export async function resolveGatewayRuntimeConfig(params: {`
`127`	`127`	`"tailscale funnel requires gateway auth mode=password (set gateway.auth.password or OPENCLAW_GATEWAY_PASSWORD)",`
`128`	`128`	`);`
`129`	`129`	`}`
`130`		`- if (tailscaleMode !== "off" && authMode === "none") {`
	`130`	`+ if (tailscaleMode === "serve" && authMode === "none") {`
`131`	`131`	`throw new Error(`
`132`		`- "tailscale serve/funnel requires gateway auth — refusing to start with auth.mode=none when tailscale is active",`
	`132`	`+ "tailscale serve requires gateway auth — refusing to start with auth.mode=none when tailscale serve is active",`
`133`	`133`	`);`
`134`	`134`	`}`
`135`	`135`	`if (tailscaleMode !== "off" && !isLoopbackHost(bindHost)) {`