Auto started gateway is missing tls information

[jeffmaury]

Bug description

The auto started gateway is missing the signing information.

See

kaiden/packages/main/src/plugin/openshell-cli/openshell-gateway.ts

Line 130 in 2719b5c

async start(options?: OpenshellGatewayStartOptions): Promise<void> {

A configuration file needs to be generated (see

kaiden/extensions/openshell-podman-gateway/src/manager/gateway-container-manager.ts

Line 40 in 35094c9

const GATEWAY_CONFIG = `[openshell]

)

In order to generate the 3 files, call openshell-gateway generate-certs --server-san 127.0.0.1 --server-san localhost --server-san host.openshell.internal --output dir tmpdir and then reference the files in the configuration from that file.

Operating system

MacOS

Installation Method

None

Version

0.2.3

Steps to reproduce

No response

Relevant log output

Additional context

No response

[coderabbitai]

🔗 Related PRs

#2020 - feat(openshell): add OpenshellCli wrapper for sandbox and gateway operations [merged]
#2085 - fix(openshell): select healthy gateway on init and fix isRunning check [merged]
#2333 - feat(openshell): add openshell-gateway binary discovery and CLI tool registration [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 3:17 PM UTC · Completed 3:19 PM UTC
Commit: 453067a · View workflow run →

[fullsend-ai-triage]

Triage Summary

Severity: High | Category: Bug

Problem

The auto-started openshell-gateway binary (in OpenshellGateway class) launches with --disable-tls by default and has no JWT signing key configuration. The container-based gateway in the openshell-podman-gateway extension correctly configures signing_key_path, public_key_path, and kid_path, but the binary-based auto-start path does not.

Root Cause

In openshell-gateway.ts, buildArgs() passes --disable-tls when disableTls is true (the default). No certificate generation step runs before starting the binary, and no TOML configuration file with JWT signing paths is created.

Recommended Fix

1. Before spawning the gateway binary, run openshell-gateway generate-certs --server-san 127.0.0.1 --server-san localhost --server-san host.openshell.internal --output dir <tmpdir> to generate signing/TLS files
2. Generate a TOML configuration file referencing those paths (mirroring GATEWAY_CONFIG in gateway-container-manager.ts)
3. Pass the configuration to the gateway binary and remove the default --disable-tls flag
4. Clean up temp cert directory on gateway stop/dispose

Proposed Test Case

Test: OpenshellGateway starts with TLS enabled and valid signing config
- Verify start() calls generate-certs before spawning the binary
- Verify spawn arguments do NOT include --disable-tls by default
- Verify generated config file contains signing_key_path, public_key_path, kid_path
- Verify temp cert directory is cleaned up on stop()/dispose()
- Edge case: verify behavior when generate-certs fails (should throw or fall back gracefully)

---

Labels: This is a bug in the openshell gateway within the agentic workspace area; adding bug label to complement existing area/agentic-workspace.

[jeffmaury]

/fs code

[jeffmaury]

/fs-code

[benoitf]

@jeffmaury only triage agent is enabled