From 960246fc4a513b5ff1aaecd71b6e9a0e157037fd Mon Sep 17 00:00:00 2001
From: Sean Kane <sean.kane@temporal.io>
Date: Wed, 10 Jun 2026 10:31:16 -0600
Subject: [PATCH] fix: tls is not added for profiles without tls

---
 internal/temporalcli/commands.config.go      |  8 ++++++-
 internal/temporalcli/commands.config_test.go | 24 ++++++++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/internal/temporalcli/commands.config.go b/internal/temporalcli/commands.config.go
index e8a423dd0..0b88bfaac 100644
--- a/internal/temporalcli/commands.config.go
+++ b/internal/temporalcli/commands.config.go
@@ -111,13 +111,19 @@ func (c *TemporalConfigGetCommand) run(cctx *CommandContext, _ []string) error {
 		}
 		return cctx.Printer.PrintStructured(tomlConf.Profiles[profileName], printer.StructuredOptions{})
 	} else {
+		// Capture whether TLS is configured before the loop below. Looking up
+		// any "tls.*" property via reflectEnvConfigProp lazily initializes
+		// confProfile.TLS to a non-nil empty struct, which would otherwise make
+		// TLS appear configured when it is not (#1077).
+		tlsConfigured := confProfile.TLS != nil
+
 		// Get every property individually as a property-value pair except zero
 		// vals
 		var props []prop
 		for k := range envConfigPropsToFieldNames {
 			// TLS is a special case
 			if k == "tls" {
-				if confProfile.TLS != nil {
+				if tlsConfigured {
 					props = append(props, prop{Property: "tls", Value: true})
 				}
 				continue
diff --git a/internal/temporalcli/commands.config_test.go b/internal/temporalcli/commands.config_test.go
index 5cc89ec86..9375402bf 100644
--- a/internal/temporalcli/commands.config_test.go
+++ b/internal/temporalcli/commands.config_test.go
@@ -151,6 +151,30 @@ disable_host_verification = true`))
 	}
 }
 
+func TestConfig_Get_NoTLSWhenUnconfigured(t *testing.T) {
+	// Regression test for #1077: `config get` (table output) must not display
+	// "tls true" for a profile that has no TLS configuration.
+	h := NewCommandHarness(t)
+	defer h.Close()
+
+	f, err := os.CreateTemp("", "")
+	h.NoError(err)
+	defer os.Remove(f.Name())
+	_, err = f.Write([]byte(`
+[profile.devtest]
+address = "localhost:17233"
+namespace = "default"`))
+	f.Close()
+	h.NoError(err)
+	h.Options.EnvLookup = EnvLookupMap{"TEMPORAL_CONFIG_FILE": f.Name(), "TEMPORAL_PROFILE": "devtest"}
+
+	res := h.Execute("config", "get")
+	h.NoError(res.Err)
+	h.Contains(res.Stdout.String(), "localhost:17233")
+	// No TLS section was configured, so "tls" should not appear at all.
+	h.NotContains(res.Stdout.String(), "tls")
+}
+
 func TestConfig_TLS_Boolean(t *testing.T) {
 	h := NewCommandHarness(t)
 	defer h.Close()