From c8c7da47cfeaa1db31d999446106d6f9942b2d26 Mon Sep 17 00:00:00 2001
From: dj-oyu <68707227+dj-oyu@users.noreply.github.com>
Date: Sun, 15 Mar 2026 17:31:22 +0900
Subject: [PATCH 1/2] fix: launcher health check fails when gateway serves TLS

The launcher always used http:// to probe the gateway health endpoint,
but when web_app_url is configured with https://, the gateway starts
with TLS causing "client sent HTTP request to HTTPS server" errors.

Now detect TLS mode from config and use the correct scheme, with
InsecureSkipVerify for localhost self-signed cert access.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 web/backend/api/gateway.go | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/web/backend/api/gateway.go b/web/backend/api/gateway.go
index 1813cac92..db036ebde 100644
--- a/web/backend/api/gateway.go
+++ b/web/backend/api/gateway.go
@@ -2,6 +2,7 @@ package api
 
 import (
 	"bufio"
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -44,10 +45,24 @@ var (
 )
 
 var gatewayHealthGet = func(url string, timeout time.Duration) (*http.Response, error) {
-	client := http.Client{Timeout: timeout}
+	transport := http.DefaultTransport
+	if strings.HasPrefix(url, "https://") {
+		transport = &http.Transport{
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec // localhost self-signed
+		}
+	}
+	client := http.Client{Timeout: timeout, Transport: transport}
 	return client.Get(url)
 }
 
+// gatewayHealthScheme returns "https" if the gateway is serving TLS, "http" otherwise.
+func gatewayHealthScheme(cfg *config.Config) string {
+	if cfg != nil && strings.HasPrefix(cfg.Channels.Telegram.WebAppURL, "https://") {
+		return "https"
+	}
+	return "http"
+}
+
 // registerGatewayRoutes binds gateway lifecycle endpoints to the ServeMux.
 func (h *Handler) registerGatewayRoutes(mux *http.ServeMux) {
 	mux.HandleFunc("GET /api/gateway/status", h.handleGatewayStatus)
@@ -356,7 +371,7 @@ func (h *Handler) startGatewayLocked(initialStatus string) (int, error) {
 			if healthPort == 0 {
 				healthPort = 18790
 			}
-			healthURL := fmt.Sprintf("http://%s/health", net.JoinHostPort(healthHost, strconv.Itoa(healthPort)))
+			healthURL := fmt.Sprintf("%s://%s/health", gatewayHealthScheme(cfg), net.JoinHostPort(healthHost, strconv.Itoa(healthPort)))
 			resp, err := gatewayHealthGet(healthURL, 1*time.Second)
 			if err == nil {
 				resp.Body.Close()
@@ -609,7 +624,7 @@ func (h *Handler) gatewayStatusData() map[string]any {
 			}
 		}
 
-		url := fmt.Sprintf("http://%s/health", net.JoinHostPort(host, strconv.Itoa(port)))
+		url := fmt.Sprintf("%s://%s/health", gatewayHealthScheme(cfg), net.JoinHostPort(host, strconv.Itoa(port)))
 		resp, err := gatewayHealthGet(url, 2*time.Second)
 
 		if err != nil {

From c1397924577aa0f9da2a9233b2c7b0ad0709481f Mon Sep 17 00:00:00 2001
From: dj-oyu <68707227+dj-oyu@users.noreply.github.com>
Date: Sun, 15 Mar 2026 17:48:48 +0900
Subject: [PATCH 2/2] fix: break long line for golines linter

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 web/backend/api/gateway.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/web/backend/api/gateway.go b/web/backend/api/gateway.go
index db036ebde..4c341ec77 100644
--- a/web/backend/api/gateway.go
+++ b/web/backend/api/gateway.go
@@ -371,7 +371,9 @@ func (h *Handler) startGatewayLocked(initialStatus string) (int, error) {
 			if healthPort == 0 {
 				healthPort = 18790
 			}
-			healthURL := fmt.Sprintf("%s://%s/health", gatewayHealthScheme(cfg), net.JoinHostPort(healthHost, strconv.Itoa(healthPort)))
+			scheme := gatewayHealthScheme(cfg)
+			hostPort := net.JoinHostPort(healthHost, strconv.Itoa(healthPort))
+			healthURL := fmt.Sprintf("%s://%s/health", scheme, hostPort)
 			resp, err := gatewayHealthGet(healthURL, 1*time.Second)
 			if err == nil {
 				resp.Body.Close()