fix: stabilize isolated gateway test runtime

Author: steipete

src/cron/service/ops.ts

@@ -8,6 +8,7 @@ import {
 import type { CronJob, CronJobCreate, CronJobPatch } from "../types.js";
 import {
   applyJobPatch,
+  assertSupportedJobSpec,
   computeJobNextRunAtMs,
   createJob,
   findJobOrThrow,
@@ -488,6 +489,7 @@ async function inspectManualRunPreflight(
     // persist does not block manual triggers for up to STUCK_RUN_MS (#17554).
     recomputeNextRunsForMaintenance(state);
     const job = findJobOrThrow(state, id);
+    assertSupportedJobSpec(job);
     if (typeof job.state.runningAtMs === "number") {
       return { ok: true, ran: false, reason: "already-running" as const };
     }

src/gateway/server.e2e-ws-harness.ts

@@ -23,7 +23,10 @@ export async function startGatewayServerHarness(): Promise<GatewayServerHarness>
   const envSnapshot = captureEnv(["OPENCLAW_GATEWAY_TOKEN"]);
   delete process.env.OPENCLAW_GATEWAY_TOKEN;
   const port = await getFreePort();
-  const server = await startGatewayServer(port);
+  const server = await startGatewayServer(port, {
+    auth: { mode: "none" },
+    controlUiEnabled: false,
+  });
 
   const openClient = async (opts?: Parameters<typeof connectOk>[1]): Promise<GatewayWsClient> => {
     const ws = new WebSocket(`ws://127.0.0.1:${port}`);

src/gateway/server.impl.ts

@@ -288,15 +288,30 @@ async function prepareGatewayStartupConfig(params: {
       tailscale: params.tailscaleOverride,
     },
   );
-  await params.activateRuntimeSecrets(startupPreflightConfig, {
-    reason: "startup",
-    activate: false,
-  });
+  const preflightConfig = (
+    await params.activateRuntimeSecrets(startupPreflightConfig, {
+      reason: "startup",
+      activate: false,
+    })
+  ).config;
+  const preflightAuthOverride =
+    typeof preflightConfig.gateway?.auth?.token === "string" ||
+    typeof preflightConfig.gateway?.auth?.password === "string"
+      ? {
+          ...params.authOverride,
+          ...(typeof preflightConfig.gateway?.auth?.token === "string"
+            ? { token: preflightConfig.gateway.auth.token }
+            : {}),
+          ...(typeof preflightConfig.gateway?.auth?.password === "string"
+            ? { password: preflightConfig.gateway.auth.password }
+            : {}),
+        }
+      : params.authOverride;
 
   const authBootstrap = await ensureGatewayStartupAuth({
     cfg: params.runtimeConfig,
     env: process.env,
-    authOverride: params.authOverride,
+    authOverride: preflightAuthOverride,
     tailscaleOverride: params.tailscaleOverride,
     persist: true,
     baseHash: params.configSnapshot.hash,
@@ -637,7 +652,8 @@ export async function startGatewayServer(
   } = runtimeConfig;
   const getResolvedAuth = () =>
     resolveGatewayAuth({
-      authConfig: getRuntimeConfig().gateway?.auth,
+      authConfig:
+        getActiveSecretsRuntimeSnapshot()?.config.gateway?.auth ?? getRuntimeConfig().gateway?.auth,
       authOverride: opts.auth,
       env: process.env,
       tailscaleMode,

src/gateway/server.preauth-hardening.test.ts

@@ -7,9 +7,15 @@ import { attachGatewayUpgradeHandler, createGatewayHttpServer } from "./server-h
 import { createPreauthConnectionBudget } from "./server/preauth-connection-budget.js";
 import type { GatewayWsClient } from "./server/ws-types.js";
 import { testState } from "./test-helpers.mocks.js";
-import { createGatewaySuiteHarness, readConnectChallengeNonce } from "./test-helpers.server.js";
+import {
+  createGatewaySuiteHarness,
+  installGatewayTestHooks,
+  readConnectChallengeNonce,
+} from "./test-helpers.server.js";
 import { withTempConfig } from "./test-temp-config.js";
 
+installGatewayTestHooks({ scope: "suite" });
+
 let cleanupEnv: Array<() => void> = [];
 
 afterEach(async () => {