feat(cli): show gateway config source in list and term

Expose whether a gateway registration comes from user or system config in `openshell gateway list`, the TUI gateway pane, and list JSON output. The CLI also refuses to remove system-managed registrations and the smoke tests cover the new list output.

Signed-off-by: Alex Lewontin <alex.lewontin@canonical.com>

Author: alexclewontin

crates/openshell-bootstrap/src/metadata.rs

@@ -82,6 +82,14 @@ pub enum GatewayMetadataSource {
     System,
 }
 
+impl GatewayMetadataSource {
+    pub const fn label(self) -> &'static str {
+        match self {
+            Self::User => "user",
+            Self::System => "system",
+        }
+    }
+}
 
 fn stored_metadata_path(name: &str) -> Result<PathBuf> {
     Ok(gateways_dir()?.join(name).join("metadata.json"))

crates/openshell-cli/src/run.rs

@@ -19,10 +19,10 @@ use hyper_util::{client::legacy::Client, rt::TokioExecutor};
 use indicatif::{MultiProgress, ProgressBar, ProgressStyle};
 use miette::{IntoDiagnostic, Result, WrapErr, miette};
 use openshell_bootstrap::{
-    GatewayMetadata, clear_active_gateway, clear_last_sandbox_if_matches,
-    extract_host_from_ssh_destination, get_gateway_metadata, list_gateways, load_active_gateway,
-    remove_gateway_metadata, resolve_ssh_hostname, save_active_gateway, save_last_sandbox,
-    store_gateway_metadata,
+    GatewayMetadata, GatewayMetadataSource, clear_active_gateway, clear_last_sandbox_if_matches,
+    extract_host_from_ssh_destination, gateway_metadata_source, get_gateway_metadata,
+    list_gateways, load_active_gateway, remove_gateway_metadata, resolve_ssh_hostname,
+    save_active_gateway, save_last_sandbox, store_gateway_metadata,
 };
 use openshell_core::progress::{
     PROGRESS_ACTIVE_DETAIL_KEY, PROGRESS_ACTIVE_STEP_KEY, PROGRESS_COMPLETE_LABEL_KEY,
@@ -658,6 +658,19 @@ fn gateway_select_column_widths(gateways: &[GatewayMetadata]) -> (usize, usize,
 
     (name_width, endpoint_width, type_width)
 }
+fn listed_gateway_source(name: &str) -> Result<GatewayMetadataSource> {
+    gateway_metadata_source(name)?
+        .ok_or_else(|| miette!("gateway '{name}' disappeared while resolving its config source"))
+}
+
+fn listed_gateways_with_source(
+    gateways: &[GatewayMetadata],
+) -> Result<Vec<(&GatewayMetadata, GatewayMetadataSource)>> {
+    gateways
+        .iter()
+        .map(|gateway| Ok((gateway, listed_gateway_source(&gateway.name)?)))
+        .collect()
+}
 
 fn gateway_type_label(gateway: &GatewayMetadata) -> &'static str {
     match gateway.auth_mode.as_deref() {
@@ -1291,13 +1304,14 @@ pub fn gateway_logout(name: &str) -> Result<()> {
 /// List all registered gateways.
 pub fn gateway_list(gateway_flag: &Option<String>, output: &str) -> Result<()> {
     let gateways = list_gateways()?;
+    let gateway_sources = listed_gateways_with_source(&gateways)?;
     let active = gateway_flag.clone().or_else(load_active_gateway);
 
     match output {
         "json" => {
-            let items: Vec<serde_json::Value> = gateways
+            let items: Vec<serde_json::Value> = gateway_sources
                 .iter()
-                .map(|g| gateway_to_json(g, &active))
+                .map(|(gateway, source)| gateway_to_json(gateway, &active, *source))
                 .collect();
             println!(
                 "{}",
@@ -1306,9 +1320,9 @@ pub fn gateway_list(gateway_flag: &Option<String>, output: &str) -> Result<()> {
             return Ok(());
         }
         "yaml" => {
-            let items: Vec<serde_json::Value> = gateways
+            let items: Vec<serde_json::Value> = gateway_sources
                 .iter()
-                .map(|g| gateway_to_json(g, &active))
+                .map(|(gateway, source)| gateway_to_json(gateway, &active, *source))
                 .collect();
             print!("{}", serde_yml::to_string(&items).into_diagnostic()?);
             return Ok(());
@@ -1327,7 +1341,6 @@ pub fn gateway_list(gateway_flag: &Option<String>, output: &str) -> Result<()> {
         return Ok(());
     }
 
-    // Calculate column widths
     let name_width = gateways
         .iter()
         .map(|g| g.name.len())
@@ -1346,25 +1359,33 @@ pub fn gateway_list(gateway_flag: &Option<String>, output: &str) -> Result<()> {
         .max()
         .unwrap_or(4)
         .max(4);
+    let source_width = gateway_sources
+        .iter()
+        .map(|(_, source)| source.label().len())
+        .max()
+        .unwrap_or(6)
+        .max(6);
 
-    // Print header
     println!(
-        "  {:<name_width$}  {:<endpoint_width$}  {:<type_width$}  {}",
+        "  {:<name_width$}  {:<endpoint_width$}  {:<type_width$}  {:<source_width$}  {}",
         "NAME".bold(),
         "ENDPOINT".bold(),
         "TYPE".bold(),
+        "SOURCE".bold(),
         "AUTH".bold(),
     );
 
-    // Print rows
-    for gateway in &gateways {
+    for (gateway, source) in gateway_sources {
         let is_active = active.as_deref() == Some(&gateway.name);
         let marker = if is_active { "*" } else { " " };
         let gw_type = gateway_type_label(gateway);
         let gw_auth = gateway_auth_label(gateway);
         let line = format!(
-            "{marker} {:<name_width$}  {:<endpoint_width$}  {:<type_width$}  {gw_auth}",
-            gateway.name, gateway.gateway_endpoint, gw_type,
+            "{marker} {:<name_width$}  {:<endpoint_width$}  {:<type_width$}  {:<source_width$}  {gw_auth}",
+            gateway.name,
+            gateway.gateway_endpoint,
+            gw_type,
+            source.label(),
         );
         if is_active {
             println!("{}", line.green());
@@ -1376,11 +1397,16 @@ pub fn gateway_list(gateway_flag: &Option<String>, output: &str) -> Result<()> {
     Ok(())
 }
 
-fn gateway_to_json(gateway: &GatewayMetadata, active: &Option<String>) -> serde_json::Value {
+fn gateway_to_json(
+    gateway: &GatewayMetadata,
+    active: &Option<String>,
+    source: GatewayMetadataSource,
+) -> serde_json::Value {
     serde_json::json!({
         "name": gateway.name,
         "endpoint": gateway.gateway_endpoint,
         "type": gateway_type_label(gateway),
+        "source": source.label(),
         "auth": gateway_auth_label(gateway),
         "active": active.as_deref() == Some(&gateway.name),
     })
@@ -1458,11 +1484,20 @@ fn remove_gateway_registration(name: &str) {
 
 /// Remove a local gateway registration without touching the gateway service.
 pub fn gateway_remove(name: &str) -> Result<()> {
-    if get_gateway_metadata(name).is_none() {
-        return Err(miette::miette!(
-            "No gateway metadata found for '{name}'.\n\
-             List available gateways: openshell gateway select"
-        ));
+    match gateway_metadata_source(name)? {
+        Some(GatewayMetadataSource::User) => {}
+        Some(GatewayMetadataSource::System) => {
+            return Err(miette::miette!(
+                "Gateway registration '{name}' is installed by the system and cannot be removed from user config.\n\
+                 Register a per-user gateway with the same name to override it, or select another gateway."
+            ));
+        }
+        None => {
+            return Err(miette::miette!(
+                "No gateway metadata found for '{name}'.\n\
+                 List available gateways: openshell gateway select"
+            ));
+        }
     }
 
     remove_gateway_registration(name);
@@ -6983,19 +7018,21 @@ mod tests {
         ProvisioningDisplay, ProvisioningStep, TlsOptions, build_sandbox_resource_limits,
         dockerfile_sources_supported_for_gateway, format_endpoint, format_gateway_select_header,
         format_gateway_select_items, format_provider_attachment_table, gateway_add,
-        gateway_auth_label, gateway_env_override_warning, gateway_select_with, gateway_type_label,
-        git_sync_files, http_health_check, image_requests_gpu, import_local_package_mtls_bundle,
-        inferred_provider_type, local_upload_path_exists, local_upload_path_is_symlink,
-        package_managed_tls_dirs, parse_cli_setting_value, parse_credential_expiry_cli_value,
-        parse_credential_expiry_pairs, parse_credential_pairs, plaintext_gateway_is_remote,
-        progress_step_from_metadata, provider_profile_allows_refresh_bootstrap,
-        provisioning_timeout_message, ready_false_condition_message, refresh_status_header,
-        refresh_status_row, resolve_from, sandbox_should_persist, service_expose_status_error,
-        service_url_for_gateway,
+        gateway_auth_label, gateway_env_override_warning, gateway_select_with, gateway_to_json,
+        gateway_type_label, git_sync_files, http_health_check, image_requests_gpu,
+        import_local_package_mtls_bundle, inferred_provider_type, local_upload_path_exists,
+        local_upload_path_is_symlink, package_managed_tls_dirs, parse_cli_setting_value,
+        parse_credential_expiry_cli_value, parse_credential_expiry_pairs, parse_credential_pairs,
+        plaintext_gateway_is_remote, progress_step_from_metadata,
+        provider_profile_allows_refresh_bootstrap, provisioning_timeout_message,
+        ready_false_condition_message, refresh_status_header, refresh_status_row, resolve_from,
+        sandbox_should_persist, service_expose_status_error, service_url_for_gateway,
     };
     use crate::TEST_ENV_LOCK;
     use hyper::StatusCode;
-    use openshell_bootstrap::{load_active_gateway, load_gateway_metadata, store_gateway_metadata};
+    use openshell_bootstrap::{
+        GatewayMetadataSource, load_active_gateway, load_gateway_metadata, store_gateway_metadata,
+    };
     use std::fs;
     use std::io::{Read, Write};
     use std::net::TcpListener;
@@ -7935,6 +7972,27 @@ mod tests {
         assert!(items[1].contains("http://127.0.0.1:8080"));
     }
 
+    #[test]
+    fn gateway_to_json_includes_config_source() {
+        let gateway = GatewayMetadata {
+            name: "local-vm".to_string(),
+            gateway_endpoint: "http://127.0.0.1:17670".to_string(),
+            auth_mode: Some("plaintext".to_string()),
+            ..Default::default()
+        };
+
+        let json = gateway_to_json(
+            &gateway,
+            &Some("local-vm".to_string()),
+            GatewayMetadataSource::System,
+        );
+
+        assert_eq!(json["source"], "system");
+        assert_eq!(json["type"], "local");
+        assert_eq!(json["auth"], "plaintext");
+        assert_eq!(json["active"], true);
+    }
+
     #[test]
     fn gateway_auth_label_defaults_https_gateways_to_mtls() {
         let gateway = GatewayMetadata {

crates/openshell-tui/src/app.rs

@@ -5,6 +5,7 @@ use std::collections::HashMap;
 use std::time::{Duration, Instant};
 
 use crossterm::event::{KeyCode, KeyEvent, KeyModifiers};
+use openshell_bootstrap::GatewayMetadataSource;
 use openshell_core::auth::EdgeAuthInterceptor;
 use openshell_core::proto::open_shell_client::OpenShellClient;
 use openshell_core::proto::setting_value;
@@ -214,10 +215,21 @@ pub fn display_setting_value(value: &Option<setting_value::Value>) -> String {
 // Gateway entry
 // ---------------------------------------------------------------------------
 
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub struct GatewayEntry {
     pub name: String,
     pub endpoint: String,
     pub is_remote: bool,
+    pub source: Option<GatewayMetadataSource>,
+}
+
+impl GatewayEntry {
+    pub const fn source_label(&self) -> &'static str {
+        match self.source {
+            Some(source) => source.label(),
+            None => "unknown",
+        }
+    }
 }
 
 // ---------------------------------------------------------------------------
@@ -2231,3 +2243,40 @@ fn unique_provider_name(base: &str, existing: &[String]) -> String {
     }
     base.to_string()
 }
+
+#[cfg(test)]
+mod tests {
+    use super::GatewayEntry;
+    use openshell_bootstrap::GatewayMetadataSource;
+
+    #[test]
+    fn gateway_entry_source_label_formats_known_sources() {
+        let user_gateway = GatewayEntry {
+            name: "user-gw".to_string(),
+            endpoint: "https://user.example.com".to_string(),
+            is_remote: true,
+            source: Some(GatewayMetadataSource::User),
+        };
+        let system_gateway = GatewayEntry {
+            name: "system-gw".to_string(),
+            endpoint: "http://127.0.0.1:17670".to_string(),
+            is_remote: false,
+            source: Some(GatewayMetadataSource::System),
+        };
+
+        assert_eq!(user_gateway.source_label(), "user");
+        assert_eq!(system_gateway.source_label(), "system");
+    }
+
+    #[test]
+    fn gateway_entry_source_label_handles_unknown_source() {
+        let gateway = GatewayEntry {
+            name: "mystery".to_string(),
+            endpoint: "https://mystery.example.com".to_string(),
+            is_remote: true,
+            source: None,
+        };
+
+        assert_eq!(gateway.source_label(), "unknown");
+    }
+}

crates/openshell-tui/src/lib.rs

@@ -18,6 +18,7 @@ use crossterm::terminal::{
     EnterAlternateScreen, LeaveAlternateScreen, disable_raw_mode, enable_raw_mode,
 };
 use miette::{IntoDiagnostic, Result};
+use openshell_bootstrap::gateway_metadata_source;
 use openshell_core::auth::EdgeAuthInterceptor;
 use openshell_core::metadata::{ObjectId, ObjectLabels, ObjectName};
 use openshell_core::proto::open_shell_client::OpenShellClient;
@@ -458,24 +459,22 @@ fn refresh_gateway_list(app: &mut App) {
     if let Ok(gateways) = openshell_bootstrap::list_gateways() {
         app.gateways = gateways
             .into_iter()
-            .map(|m| GatewayEntry {
-                name: m.name,
-                endpoint: m.gateway_endpoint,
-                is_remote: m.is_remote,
+            .map(|metadata| GatewayEntry {
+                source: gateway_metadata_source(&metadata.name).ok().flatten(),
+                name: metadata.name,
+                endpoint: metadata.gateway_endpoint,
+                is_remote: metadata.is_remote,
             })
             .collect();
 
-        // Keep selection in bounds.
         if app.gateway_selected >= app.gateways.len() && !app.gateways.is_empty() {
             app.gateway_selected = app.gateways.len() - 1;
         }
 
-        // If the active gateway appears in the list, move cursor to it on first load.
-        if let Some(idx) = app.gateways.iter().position(|g| g.name == app.gateway_name) {
-            // Only snap the cursor when it's still at 0 (initial state).
-            if app.gateway_selected == 0 {
-                app.gateway_selected = idx;
-            }
+        if let Some(idx) = app.gateways.iter().position(|g| g.name == app.gateway_name)
+            && app.gateway_selected == 0
+        {
+            app.gateway_selected = idx;
         }
     }
 }

crates/openshell-tui/src/ui/dashboard.rs

@@ -40,6 +40,7 @@ fn draw_gateway_list(frame: &mut Frame<'_>, app: &App, area: Rect) {
     let header = Row::new(vec![
         Cell::from(Span::styled("  NAME", t.muted)),
         Cell::from(Span::styled("TYPE", t.muted)),
+        Cell::from(Span::styled("SOURCE", t.muted)),
         Cell::from(Span::styled("STATUS", t.muted)),
         Cell::from(Span::styled("", t.muted)),
     ])
@@ -92,6 +93,7 @@ fn draw_gateway_list(frame: &mut Frame<'_>, app: &App, area: Rect) {
             Row::new(vec![
                 name_cell,
                 Cell::from(Span::styled(type_label, t.muted)),
+                Cell::from(Span::styled(entry.source_label(), t.muted)),
                 status_cell,
                 policy_cell,
             ])
@@ -107,9 +109,10 @@ fn draw_gateway_list(frame: &mut Frame<'_>, app: &App, area: Rect) {
         .padding(Padding::horizontal(1));
 
     let widths = [
-        Constraint::Percentage(30),
+        Constraint::Percentage(24),
         Constraint::Percentage(10),
-        Constraint::Percentage(25),
+        Constraint::Percentage(10),
+        Constraint::Percentage(21),
         Constraint::Percentage(35),
     ];
 

crates/openshell-tui/src/ui/mod.rs

@@ -130,13 +130,21 @@ fn draw_title_bar(frame: &mut Frame<'_>, app: &App, area: Rect) {
         _ => Span::styled(&app.status_text, t.muted),
     };
 
+    let active_gateway_source = app
+        .gateways
+        .iter()
+        .find(|gateway| gateway.name == app.gateway_name)
+        .map_or("unknown", app::GatewayEntry::source_label);
+
     let mut parts: Vec<Span<'_>> = vec![
         Span::styled(" >_ OpenShell ", t.accent_bold),
         Span::styled(" ALPHA ", t.badge),
         Span::styled(" | ", t.muted),
         Span::styled("Current Gateway: ", t.text),
         Span::styled(&app.gateway_name, t.heading),
-        Span::styled(" (", t.muted),
+        Span::styled(" [", t.muted),
+        Span::styled(active_gateway_source, t.muted),
+        Span::styled("] (", t.muted),
         status_span,
         Span::styled(")", t.muted),
         Span::styled(" | ", t.muted),