{"record":{"id":"1c9a220a738b5ed3","repo":"aaif-goose/goose","slug":"goose-serve-did-not-emit-tls-certificate-fingerpri","errorCode":null,"errorMessage":"goose serve did not emit TLS certificate fingerprint on ${statusUrl}.${exitDetails}${stderrDetails}","messagePattern":"goose serve did not emit TLS certificate fingerprint on (.+?)\\.(.+?)(.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ui/desktop/src/gooseServe.ts","lineNumber":582,"sourceCode":"  }\n\n  if (tls) {\n    startupTrace?.record('fingerprint_wait_start', { timeoutMs: TLS_FINGERPRINT_TIMEOUT_MS });\n    const fingerprint = await waitForFingerprint(fingerprintReady, TLS_FINGERPRINT_TIMEOUT_MS);\n    if (!fingerprint) {\n      stopOutputCollection();\n      await cleanup();\n      const exitDetails = exited\n        ? ` Process exited with code ${exitCode} and signal ${exitSignal}.`\n        : '';\n      const stderrDetails = errorLog.length ? ` Stderr: ${errorLog.join('\\n')}` : '';\n      startupTrace?.record('fingerprint_missing', {\n        timeoutMs: TLS_FINGERPRINT_TIMEOUT_MS,\n        exited,\n        exitCode,\n        exitSignal,\n      });\n      throw new Error(\n        withStartupDiagnosticsPath(\n          `goose serve did not emit TLS certificate fingerprint on ${statusUrl}.${exitDetails}${stderrDetails}`,\n          startupDiagnosticsPath\n        )\n      );\n    }\n  }\n\n  stopOutputCollection();\n\n  return {\n    acpUrl,\n    workingDir,\n    process: gooseProcess,\n    errorLog,\n    certFingerprint,\n    cleanup,\n    hasExited: () => exited,","sourceCodeStart":564,"sourceCodeEnd":600,"githubUrl":"https://github.com/aaif-goose/goose/blob/3810898a7447ec3299be72e223d3570a7aabf0ab/ui/desktop/src/gooseServe.ts#L564-L600","documentation":"When TLS is enabled, startGooseServe waits not only for /status readiness but also for the server to emit its self-signed certificate fingerprint (used later for trust pinning). This error means readiness succeeded (or was skipped) but no fingerprint appeared within TLS_FINGERPRINT_TIMEOUT_MS; exit details and stderr are appended, and a 'fingerprint_missing' event is recorded in the startup trace.","triggerScenarios":"goose serve version that prints the fingerprint in a different format/stream than expected; TLS enabled on the client while the server was started without TLS env (or vice versa); server becomes ready but the fingerprint writer (file or stdout) is missing; slow disk under diagnosticsDir delaying emission past the timeout.","commonSituations":"Version skew between desktop app and goose binary after a partial update; GOOSE_SERVER__TLS / TLS-related env set on only one side; CI runners without TLS support where the fingerprint is never emitted; stdout buffering swallowing the fingerprint line in dev mode.","solutions":["Check the appended stderr and the 'fingerprint_wait_start'/'fingerprint_missing' events in the diagnostics file to see how far startup got","Verify TLS is enabled consistently: the same env that makes the client expect a fingerprint must make goose serve emit one","Update the goose binary so its fingerprint output matches what gooseServe.ts parses","If you intentionally run without TLS, disable it so this fingerprint wait is skipped entirely"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  result = await startGooseServe({ ...opts, tls: true });\n} catch (e) {\n  if (e instanceof Error && e.message.includes('did not emit TLS certificate fingerprint')) {\n    // TLS contract mismatch: verify env parity and binary version; not retryable as-is\n  }\n  throw e;\n}","preventionTips":["Set TLS env vars in one shared config object used by both client and server sides","Pin desktop app and goose binary to matching versions in CI","Record fingerprint_wait timing in diagnostics to distinguish 'slow' from 'never emitted'"],"tags":["tls","certificates","goose-serve","startup","timeout","version-skew"],"backgroundTag":null,"analyzedSha":"3810898a7447ec3299be72e223d3570a7aabf0ab","analyzedAt":"2026-08-16T10:14:26.282Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}