fix(cli): canonicalize default gateway identity

tests/cli/test_commands.py

@@ -2504,6 +2504,10 @@ def test_webui_foreground_attaches_to_existing_managed_gateway(monkeypatch, tmp_
     _patch_webui_provider_ready(monkeypatch)
     monkeypatch.setattr("nanobot.cli.webui.sync_workspace_templates", lambda _path: None)
     monkeypatch.setattr("nanobot.cli.webui._gateway_health_ready", lambda *_args, **_kwargs: True)
+    monkeypatch.setattr(
+        "nanobot.cli.webui_support._gateway_health_ready",
+        lambda *_args, **_kwargs: True,
+    )
     monkeypatch.setattr("nanobot.cli.webui._webui_endpoint_reachable", lambda *_args, **_kwargs: True)
     monkeypatch.setattr(
         "nanobot.cli.webui._open_webui_browser",
@@ -2628,6 +2632,10 @@ def test_webui_foreground_refuses_occupied_webui_port(monkeypatch, tmp_path: Pat
     _patch_webui_provider_ready(monkeypatch)
     monkeypatch.setattr("nanobot.cli.webui.sync_workspace_templates", lambda _path: None)
     monkeypatch.setattr("nanobot.cli.webui._gateway_health_ready", lambda *_args, **_kwargs: False)
+    monkeypatch.setattr(
+        "nanobot.cli.webui_support._gateway_health_ready",
+        lambda *_args, **_kwargs: False,
+    )
     monkeypatch.setattr("nanobot.cli.webui._webui_endpoint_reachable", lambda *_args, **_kwargs: True)
     monkeypatch.setattr("nanobot.cli.webui._tcp_endpoint_reachable", lambda *_args, **_kwargs: False)
     result = runner.invoke(app, ["webui", "--config", str(config_file), "--yes"])
@@ -2638,6 +2646,28 @@ def test_webui_foreground_refuses_occupied_webui_port(monkeypatch, tmp_path: Pat
     assert "--gateway-port" in result.stdout
 
 
+def test_webui_foreground_reports_an_existing_gateway_without_leaking_secret(
+    monkeypatch,
+    tmp_path: Path,
+) -> None:
+    config_file = tmp_path / "config.json"
+    config_file.write_text(
+        '{"channels":{"websocket":{"tokenIssueSecret":"do-not-leak"}}}',
+        encoding="utf-8",
+    )
+    _patch_webui_provider_ready(monkeypatch)
+    monkeypatch.setattr("nanobot.cli.webui.sync_workspace_templates", lambda _path: None)
+    monkeypatch.setattr("nanobot.cli.webui._gateway_health_ready", lambda *_args, **_kwargs: True)
+    monkeypatch.setattr("nanobot.cli.webui._webui_endpoint_reachable", lambda *_args, **_kwargs: False)
+
+    result = runner.invoke(app, ["webui", "--config", str(config_file), "--yes"])
+
+    assert result.exit_code == 1
+    assert "gateway is already running for this local instance" in result.stdout
+    assert "bootstrapSecret=<redacted>" in result.stdout
+    assert "do-not-leak" not in result.stdout
+
+
 def _patch_serve_runtime(monkeypatch, config: Config, seen: dict[str, object]) -> None:
     pytest.importorskip("aiohttp")
 

tests/cli/test_gateway_commands.py

@@ -6,7 +6,7 @@ import typer
 from rich.console import Console
 from typer.testing import CliRunner
 
-from nanobot.cli.gateway import create_gateway_app
+from nanobot.cli.gateway import _resolved_config_selector, create_gateway_app
 from nanobot.config.schema import Config
 from nanobot.gateway import GatewayRuntimePaths, GatewayStartOptions, GatewayStatus, RuntimeResult
 from nanobot.gateway.service import GatewayServiceOptions, GatewayServiceResult
@@ -14,6 +14,17 @@ from nanobot.gateway.service import GatewayServiceOptions, GatewayServiceResult
 runner = CliRunner()
 
 
+def test_default_config_has_the_same_gateway_identity_when_explicit(
+    monkeypatch,
+    tmp_path: Path,
+) -> None:
+    config_path = tmp_path / "config.json"
+    monkeypatch.setattr("nanobot.config.loader._current_config_path", config_path)
+
+    assert _resolved_config_selector(None) == config_path
+    assert _resolved_config_selector(str(config_path)) == config_path
+
+
 class FakeRuntime:
     def __init__(self, tmp_path: Path):
         self.paths = GatewayRuntimePaths.for_instance(data_dir=tmp_path)