fix: allow local quickstart control ui without pairing

src/wizard/setup.gateway-config.test.ts

@@ -119,6 +119,35 @@ describe("configureGatewayForSetup", () => {
     }
   });
 
+  it("enables insecure local control ui auth for fresh quickstart loopback setups", async () => {
+    mocks.randomToken.mockReturnValue("generated-token");
+
+    const result = await runGatewayConfig({
+      flow: "quickstart",
+      textQueue: [],
+    });
+
+    expect(result.nextConfig.gateway?.controlUi?.allowInsecureAuth).toBe(true);
+  });
+
+  it("preserves explicit control ui auth policy in quickstart", async () => {
+    mocks.randomToken.mockReturnValue("generated-token");
+
+    const result = await runGatewayConfig({
+      flow: "quickstart",
+      textQueue: [],
+      nextConfig: {
+        gateway: {
+          controlUi: {
+            allowInsecureAuth: false,
+          },
+        },
+      },
+    });
+
+    expect(result.nextConfig.gateway?.controlUi?.allowInsecureAuth).toBe(false);
+  });
+
   it("does not set password to literal 'undefined' when prompt returns undefined", async () => {
     mocks.randomToken.mockReturnValue("unused");
     const result = await runGatewayConfig({

src/wizard/setup.gateway-config.ts

@@ -294,6 +294,24 @@ export async function configureGatewayForSetup(
     },
   };
 
+  if (
+    flow === "quickstart" &&
+    bind === "loopback" &&
+    !quickstartGateway.hasExisting &&
+    nextConfig.gateway?.controlUi?.allowInsecureAuth === undefined
+  ) {
+    nextConfig = {
+      ...nextConfig,
+      gateway: {
+        ...nextConfig.gateway,
+        controlUi: {
+          ...nextConfig.gateway?.controlUi,
+          allowInsecureAuth: true,
+        },
+      },
+    };
+  }
+
   nextConfig = ensureControlUiAllowedOriginsForNonLoopbackBind(nextConfig, {
     requireControlUiEnabled: true,
   }).config;