Summary

• Fix root auth-policy drift by making secure startup the default:
  • unresolved/missing gateway auth now resolves to token mode (no implicit fallback-to-open behavior)
  • gateway startup auto-generates and persists gateway.auth.token when missing
• Restore explicit advanced opt-out via gateway.auth.mode: "none" (manual config only)
  • not surfaced in onboarding/configure auth prompts
  • non-loopback binds still reject without auth
• Centralize startup auth bootstrap logic in one shared helper and reuse it across gateway startup + browser control auth bootstrap
• Harden CLI startup override handling to avoid passing undefined override fields that could clobber configured auth
• Update docs/changelog to reflect explicit mode: "none" and secure defaults

Root Problem

The previous behavior mixed multiple auth defaults across codepaths and allowed implicit runtime states that diverged from setup/configure/doctor expectations. This created policy drift and unclear operator behavior.

Implementation Plan (executed)

1. One source of truth for startup auth bootstrap
2. Secure default when auth is missing (auto-generate token)
3. Explicit mode: "none" support only when intentionally configured
4. Preserve strict bind/auth matrix for non-loopback
5. Align docs/changelog + regression tests

Key Files

• src/gateway/startup-auth.ts
• src/gateway/server.impl.ts
• src/browser/control-auth.ts
• src/gateway/auth.ts
• src/cli/gateway-cli/run.ts
• src/config/types.gateway.ts
• src/config/zod-schema.ts

Tests

• pnpm check
• pnpm vitest run src/gateway/auth.test.ts src/gateway/startup-auth.test.ts src/browser/control-auth.test.ts src/browser/control-auth.auto-token.test.ts src/gateway/server-runtime-config.test.ts src/cli/gateway-cli/run.option-collisions.test.ts
• pnpm vitest run --config vitest.e2e.config.ts src/gateway/server.auth.e2e.test.ts

Notes

• Added real regression coverage for explicit mode: "none" loopback connect behavior in gateway auth e2e tests.

Greptile Summary

This PR enhances gateway security by making token authentication the secure default while preserving explicit opt-out capability. The implementation centralizes auth bootstrap logic and eliminates implicit fallback-to-open behavior that previously created policy drift.

Key changes:

• Centralized startup auth bootstrap in startup-auth.ts with auto-generation and persistence of gateway.auth.token when missing
• Changed default auth resolution from "none" to "token" mode in auth.ts:198
• Added explicit mode: "none" support for intentional open loopback setups (rejected for non-loopback binds)
• Hardened CLI override handling to prevent undefined fields from clobbering configured auth via explicit merge logic
• Reused bootstrap logic across gateway startup and browser control auth paths

The change maintains strict bind/auth matrix validation - non-loopback binds still require authentication or explicit trusted-proxy mode, and mode: "none" is correctly rejected for non-loopback binds as shown in test coverage.

Confidence Score: 5/5

• This PR is safe to merge with very high confidence
• The implementation is well-architected with comprehensive test coverage across unit tests, integration tests, and E2E tests. The security-focused changes (secure defaults, explicit opt-out, centralized bootstrap logic) follow security best practices. All edge cases are covered including explicit mode: "none", undefined override handling, non-loopback bind validation, and integration with browser control auth. The changes are backwards-compatible for users with existing auth configuration while improving security for new deployments.
• No files require special attention

_{Last reviewed commit: 7c1a7ee}