fix: prevent undefined gateway token defaults (#4873) (thanks @Hisleren)

Co-authored-by: Hisleren <Hisleren@users.noreply.github.com>

CHANGELOG.md

@@ -74,6 +74,7 @@ Status: stable.
 - **BREAKING:** Gateway auth mode "none" is removed; gateway now requires token/password (Tailscale Serve identity still allowed).
 
 ### Fixes
+- Gateway: prevent blank token prompts from storing "undefined". (#4873) Thanks @Hisleren.
 - Telegram: use undici fetch for per-account proxy dispatcher. (#4456) Thanks @spiceoogway.
 - Telegram: fix HTML nesting for overlapping styles and links. (#4578) Thanks @ThanhNguyxn.
 - Telegram: avoid silent empty replies by tracking normalization skips before fallback. (#3796)

src/commands/onboard-helpers.test.ts

@@ -119,7 +119,7 @@ describe("normalizeGatewayTokenInput", () => {
     expect(normalizeGatewayTokenInput("  token  ")).toBe("token");
   });
 
-  it("coerces non-string input to string", () => {
-    expect(normalizeGatewayTokenInput(123)).toBe("123");
+  it("returns empty string for non-string input", () => {
+    expect(normalizeGatewayTokenInput(123)).toBe("");
   });
 });

src/commands/onboard-helpers.ts

@@ -63,8 +63,8 @@ export function randomToken(): string {
 }
 
 export function normalizeGatewayTokenInput(value: unknown): string {
-  if (value == null) return "";
-  return String(value).trim();
+  if (typeof value !== "string") return "";
+  return value.trim();
 }
 
 export function printWizardHeader(runtime: RuntimeEnv) {