@lifeaitools/clauth 2.1.1 → 2.10.0

package/cli/services/terminal-window.js

@@ -0,0 +1,106 @@
+// cli/services/terminal-window.js
+// Focuses or opens a visible Windows window for a terminal session (either
+// the session's own active Claude process window, or a PowerShell inspector
+// window showing the session's metadata). Split out of terminal-sessions.js
+// -- the SOLID scorer flagged that file's original shape as mixing this
+// Windows-window-control concern with shared-registry state, session
+// lifecycle, and message dispatch.
+
+import os from "node:os";
+import { spawn as spawnProc, spawnSync } from "node:child_process";
+import { terminalSessions } from "./terminal-registry.js";
+
+export function showTerminalSession(session_id) {
+  const session = terminalSessions.get(session_id);
+  if (!session) return { error: 'not_found', message: `Session ${session_id} not found` };
+
+  const pid = session.activeProc?.pid || null;
+  if (process.platform === "win32" && pid) {
+    try {
+      const script = [
+        "Add-Type @'",
+        "using System;",
+        "using System.Runtime.InteropServices;",
+        "public class Win32ShowWindow {",
+        "  [DllImport(\"user32.dll\")] public static extern bool ShowWindowAsync(IntPtr hWnd, int nCmdShow);",
+        "  [DllImport(\"user32.dll\")] public static extern bool SetForegroundWindow(IntPtr hWnd);",
+        "}",
+        "'@",
+        `$p = Get-Process -Id ${Number(pid)} -ErrorAction SilentlyContinue`,
+        "if ($p -and $p.MainWindowHandle -ne 0) {",
+        "  [Win32ShowWindow]::ShowWindowAsync($p.MainWindowHandle, 5) | Out-Null",
+        "  [Win32ShowWindow]::SetForegroundWindow($p.MainWindowHandle) | Out-Null",
+        "  'shown'",
+        "} else {",
+        "  'no-window'",
+        "}",
+      ].join("\n");
+      const result = spawnSync("powershell.exe", [
+        "-NoProfile",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-Command",
+        script,
+      ], {
+        encoding: "utf8",
+        windowsHide: true,
+        timeout: 5000,
+      });
+      const stdout = String(result.stdout || "").trim();
+      if (stdout.includes("shown")) {
+        session.lastShownAt = new Date().toISOString();
+        return { shown: true, mode: "active_process", session_id, pid };
+      }
+    } catch (e) {
+      console.log(`[terminal] session ${session_id} active process show failed: ${e.message}`);
+    }
+  }
+
+  if (process.platform === "win32") {
+    try {
+      const title = `clauth terminal ${session.name || session_id}`;
+      const lines = [
+        `$Host.UI.RawUI.WindowTitle = ${JSON.stringify(title)}`,
+        `Set-Location -LiteralPath ${JSON.stringify(session.cwd || os.homedir())}`,
+        "Clear-Host",
+        `Write-Host ${JSON.stringify(`clauth terminal session ${session_id}`)} -ForegroundColor Cyan`,
+        `Write-Host ${JSON.stringify(`Name: ${session.name || ""}`)}`,
+        `Write-Host ${JSON.stringify(`Status: ${session.status}`)}`,
+        `Write-Host ${JSON.stringify(`CWD: ${session.cwd || ""}`)}`,
+        `Write-Host ${JSON.stringify(`Turn: ${session.turn || 0}`)}`,
+        `Write-Host ${JSON.stringify("This viewer is attached to clauth session metadata. If a Claude turn is active, terminal_show focuses it; otherwise this is the visible session inspection point.")} -ForegroundColor Yellow`,
+        "Write-Host ''",
+        "Write-Host 'Recent response preview:' -ForegroundColor Green",
+        `Write-Host ${JSON.stringify((session.lastResponse || "").slice(0, 1500))}`,
+        "Write-Host ''",
+        "Write-Host 'Leave this window open or close it when done.' -ForegroundColor DarkGray",
+      ].join("; ");
+      const child = spawnProc("powershell.exe", [
+        "-NoExit",
+        "-NoProfile",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-Command",
+        lines,
+      ], {
+        cwd: session.cwd || os.homedir(),
+        env: process.env,
+        stdio: "ignore",
+        detached: true,
+        windowsHide: false,
+      });
+      child.unref?.();
+      session.lastShownAt = new Date().toISOString();
+      return { shown: true, mode: "session_inspector", session_id, pid: child.pid || null };
+    } catch (e) {
+      return { error: "show_failed", message: e.message };
+    }
+  }
+
+  return {
+    shown: false,
+    mode: "unsupported_platform",
+    session_id,
+    message: "terminal_show currently opens/focuses local Windows sessions only.",
+  };
+}

package/cli/services/vault-read.js

@@ -0,0 +1,14 @@
+// cli/services/vault-read.js
+// One function: read a single credential value from the vault inside an MCP
+// handler, honoring the caller's service whitelist. Split out of fs-mount.js
+// for SRP — this is a vault-read concern, not a filesystem-mount concern.
+
+import { deriveToken } from "../fingerprint.js";
+import * as api from "../api.js";
+
+export async function vaultRetrieveValue(vault, service) {
+  if (!vault.password) return { error: "locked" };
+  if (vault.whitelist && !vault.whitelist.includes(service.toLowerCase())) return { error: "not_in_whitelist" };
+  const { token, timestamp } = deriveToken(vault.password, vault.machineHash);
+  return api.retrieve(vault.password, vault.machineHash, token, timestamp, service);
+}

package/cli/services/vault-read.test.js

@@ -0,0 +1,35 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { vaultRetrieveValue } from "./vault-read.js";
+
+test("vaultRetrieveValue refuses when the vault is locked", async () => {
+  const result = await vaultRetrieveValue({ password: null }, "github");
+  assert.equal(result.error, "locked");
+});
+
+test("vaultRetrieveValue refuses a service outside the caller's whitelist", async () => {
+  const result = await vaultRetrieveValue({ password: "pw", machineHash: "h", whitelist: ["github"] }, "anthropic");
+  assert.equal(result.error, "not_in_whitelist");
+});
+
+test("vaultRetrieveValue's whitelist check is case-insensitive on the requested service", async () => {
+  // A case match ("GitHub" against ["github"]) passes the whitelist gate and
+  // falls through to a real vault round-trip -- mock fetch so this stays an
+  // offline unit test rather than a live network call.
+  const oldFetch = globalThis.fetch;
+  const oldUrl = process.env.CLAUTH_SUPABASE_URL;
+  const oldKey = process.env.CLAUTH_SUPABASE_ANON_KEY;
+  process.env.CLAUTH_SUPABASE_URL = "https://example.supabase.co";
+  process.env.CLAUTH_SUPABASE_ANON_KEY = "anon-key-not-real";
+  globalThis.fetch = async () => ({ ok: true, status: 200, json: async () => ({ value: "fake-value" }) });
+  try {
+    const result = await vaultRetrieveValue({ password: "pw", machineHash: "h", whitelist: ["github"] }, "GitHub");
+    assert.notEqual(result.error, "not_in_whitelist", "a case-insensitive whitelist match must not be rejected");
+    assert.equal(result.value, "fake-value");
+  } finally {
+    globalThis.fetch = oldFetch;
+    if (oldUrl === undefined) delete process.env.CLAUTH_SUPABASE_URL; else process.env.CLAUTH_SUPABASE_URL = oldUrl;
+    if (oldKey === undefined) delete process.env.CLAUTH_SUPABASE_ANON_KEY; else process.env.CLAUTH_SUPABASE_ANON_KEY = oldKey;
+  }
+});

package/cli/supervisor-registry.js

@@ -160,6 +160,122 @@ export async function reconcileSurfaceHealth({ fetchImpl = globalThis.fetch, tim
   return { inspected };
 }
 
+/**
+ * The URL that answers "is this surface up right now" for ANY surface, local
+ * or remote. `healthUrlForSurface` only ever resolves a LOCAL one: it needs an
+ * absolute health value or a port, and normalizeSurface() forbids a remote
+ * surface from carrying either (a loopback URL would probe this box, not the
+ * one the service actually runs on). So a remote surface's health path is
+ * joined onto the ORIGIN of its public route — `https://host/mcp` + `/health`
+ * is `https://host/health`, not `https://host/mcp/health`; the route names the
+ * endpoint, not a prefix.
+ */
+function surfaceProbeUrl(surface) {
+  const local = healthUrlForSurface(surface);
+  if (local && /^https?:\/\//i.test(local)) return local;
+  const route = (surface?.routes || []).find((item) => item?.url && /^https?:\/\//i.test(item.url));
+  if (!route) return null;
+  const healthPath = String(surface.health || "/health");
+  if (/^https?:\/\//i.test(healthPath)) return healthPath;
+  try {
+    return new URL(healthPath.startsWith("/") ? healthPath : `/${healthPath}`, route.url).toString();
+  } catch {
+    return null;
+  }
+}
+
+const MCP_TRANSPORT_PATHS = new Set(["/mcp", "/sse", "/message", "/messages", "/stream"]);
+
+/**
+ * Where the dashboard's "Open" button should point: a browser-facing address,
+ * never a transport endpoint. Opening /mcp or /sse renders the raw SSE
+ * handshake, which is what clauth's own Open button used to do. Kept next to
+ * the health resolver on purpose — the two must agree about which box a
+ * surface lives on.
+ */
+export function surfaceOpenUrl(surface) {
+  if (surface?.port && surface.port !== "auto") return `http://127.0.0.1:${surface.port}/`;
+  const route = (surface?.routes || []).find((item) => item?.kind === "external" && item?.url);
+  if (!route) return null;
+  try {
+    const parsed = new URL(route.url);
+    if (MCP_TRANSPORT_PATHS.has(parsed.pathname.replace(/\/+$/, "").toLowerCase())) {
+      parsed.pathname = "/";
+      parsed.search = "";
+    }
+    return parsed.toString();
+  } catch {
+    return route.url;
+  }
+}
+
+/**
+ * Read-only health sweep across EVERY surface. Probes and records; never
+ * starts, stops, restarts, or reconciles anything.
+ *
+ * This is deliberately NOT reconcileSurfaceHealth(). That one repairs what it
+ * finds broken, which is correct for a background loop the operator opted into
+ * and wrong for a UI refresh: focusing a browser tab must never restart a
+ * process. It also covers only enabled clauth-owned local pm2 surfaces, so the
+ * external and remote ones — most of the fleet — had no health signal at all.
+ *
+ * Health is written to its own `last_health_*` fields and never to `state`.
+ * They answer different questions: `state` is a MANIFEST fact (registered,
+ * enabled, hash unchanged — hence every surface reading `current` while one of
+ * them is not listening), health is a RUNTIME fact.
+ */
+export async function probeAllSurfaceHealth({ fetchImpl = globalThis.fetch, timeoutMs = DEFAULT_HEALTH_TIMEOUT_MS } = {}) {
+  const probed = await Promise.all(listSurfaces().map(async (surface) => {
+    const surface_id = `${surface.plugin_id}:${surface.id}`;
+    const url = surfaceProbeUrl(surface);
+    // Probe the "Open" target as well as the health target. They are different
+    // questions and three surfaces in the live fleet answer them differently:
+    // an MCP server is healthy at /health and 404s at /, so an Open button
+    // pointed at its root opens an error page. Probing it here — inside a sweep
+    // that is already running — is what lets the button say so instead of
+    // finding out by clicking.
+    const openUrl = surfaceOpenUrl(surface);
+    const [health, open] = await Promise.all([
+      url ? probeSurfaceHealth(url, fetchImpl, timeoutMs) : null,
+      openUrl ? probeSurfaceHealth(openUrl, fetchImpl, timeoutMs) : null,
+    ]);
+    return {
+      surface_id,
+      health: !url ? "no_probe" : (health.healthy ? "healthy" : "down"),
+      url: url || null,
+      error: url && !health.healthy ? (health.error || null) : null,
+      open_url: openUrl || null,
+      open_ok: open ? open.healthy : null,
+      observed_at: now(),
+    };
+  }));
+
+  // ONE state write for the whole sweep. updateSurfaceState() is a
+  // load-modify-save per call, so N concurrent probes calling it would each
+  // save a copy loaded before its siblings finished — last writer wins and the
+  // rest are silently lost.
+  const byId = new Map(probed.map((entry) => [entry.surface_id, entry]));
+  const state = loadSupervisorState();
+  state.surfaces = (state.surfaces || []).map((surface) => {
+    const entry = byId.get(`${surface.plugin_id}:${surface.id}`);
+    if (!entry) return surface;
+    // last_health_url is the RESOLVED probe target, not the manifest's health
+    // field. A remote surface carries a relative "/health" by contract, so the
+    // manifest value alone cannot be opened in a browser — only the resolved
+    // one can, and it is the fallback when the Open root turns out to be dead.
+    const next = { ...surface, last_open_url: entry.open_url, last_open_ok: entry.open_ok, last_health_url: entry.url };
+    if (entry.health === "no_probe") return next;
+    return {
+      ...next,
+      last_health_at: entry.observed_at,
+      last_health_ok: entry.health === "healthy",
+      last_health_error: entry.health === "healthy" ? null : entry.error,
+    };
+  });
+  saveSupervisorState(state);
+  return { probed };
+}
+
 function normalizeCommand(command, field) {
   if (!command) return [];
   if (!Array.isArray(command)) throw new Error(`${field} must be a command array`);

package/cli/supervisor-registry.test.js

@@ -11,6 +11,8 @@ import {
   getClauthPm2Home,
   listPlugins,
   listSurfaces,
+  probeAllSurfaceHealth,
+  surfaceOpenUrl,
   reconcileSurfaceHealth,
   registerPlugin,
   runPluginAction,
@@ -461,6 +463,113 @@ test("health reconciliation never restarts external or plugin-owned surfaces", a
   }
 });
 
+test("probeAllSurfaceHealth covers external and REMOTE surfaces, which reconcile skips entirely", async () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-supervisor-probe-all-"));
+  const oldDir = process.env.CLAUTH_SUPERVISOR_DIR;
+  const oldManaged = process.env.CLAUTH_MANAGED_PLUGIN_ROOTS;
+  const oldUser = process.env.CLAUTH_USER_PLUGIN_ROOTS;
+  process.env.CLAUTH_SUPERVISOR_DIR = root;
+  process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = path.join(root, "managed");
+  process.env.CLAUTH_USER_PLUGIN_ROOTS = path.join(root, "user");
+  try {
+    writePlugin(root, "managed", "probe-demo", baseManifest("probe-demo", {
+      core: true,
+      enable_default: true,
+      surfaces: [
+        // clauth-owned local — the ONLY shape reconcileSurfaceHealth looks at.
+        { id: "local", destination: "local/clauth/pm2", lifecycle_owner: "clauth", port: 39211, health: "/health" },
+        // externally-owned local — reconcile skips on lifecycle_owner.
+        { id: "observed", destination: "local/clauth/pm2", lifecycle_owner: "external", port: 39212, health: "/health" },
+        // remote — reconcile skips on destination, AND it has no port and no
+        // absolute health by contract, so healthUrlForSurface() alone returns
+        // null for it. Its probe URL can only come from the route.
+        { id: "remote", destination: "vultr/clauth/pm2", lifecycle_owner: "external", health: "/health", routes: [{ id: "provider", kind: "external", url: "https://example.invalid/mcp", public: true }] },
+      ],
+    }));
+    discoverPlugins();
+    const seen = [];
+    const result = await probeAllSurfaceHealth({ fetchImpl: async (url) => { seen.push(url); return { ok: true, status: 200 }; } });
+    const ids = result.probed.map((p) => p.surface_id).sort();
+    assert.deepEqual(ids, ["probe-demo:local", "probe-demo:observed", "probe-demo:remote"]);
+    assert.ok(result.probed.every((p) => p.health === "healthy"), JSON.stringify(result.probed));
+    // The remote surface is probed at the route's ORIGIN plus the health path —
+    // https://host/health, NOT https://host/mcp/health. The route names the
+    // endpoint, not a path prefix, so joining onto it would 404 forever and
+    // report a live service as down.
+    assert.ok(seen.includes("https://example.invalid/health"),
+      `remote surface was not probed at its route origin (probed: ${JSON.stringify(seen)})`);
+    assert.ok(seen.includes("http://127.0.0.1:39212/health"));
+    // Every surface carries a fresh reading — the sweep is ONE state write, so
+    // a concurrent probe finishing first must not be clobbered by a later one.
+    for (const surface of listSurfaces()) {
+      assert.equal(surface.last_health_ok, true, `${surface.id} lost its health write`);
+      assert.ok(surface.last_health_at, `${surface.id} has no last_health_at`);
+    }
+  } finally {
+    if (oldDir === undefined) delete process.env.CLAUTH_SUPERVISOR_DIR;
+    else process.env.CLAUTH_SUPERVISOR_DIR = oldDir;
+    if (oldManaged === undefined) delete process.env.CLAUTH_MANAGED_PLUGIN_ROOTS;
+    else process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = oldManaged;
+    if (oldUser === undefined) delete process.env.CLAUTH_USER_PLUGIN_ROOTS;
+    else process.env.CLAUTH_USER_PLUGIN_ROOTS = oldUser;
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("probeAllSurfaceHealth is read-only — a failing probe never spawns a repair command", async () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-supervisor-probe-readonly-"));
+  const oldDir = process.env.CLAUTH_SUPERVISOR_DIR;
+  const oldManaged = process.env.CLAUTH_MANAGED_PLUGIN_ROOTS;
+  const oldUser = process.env.CLAUTH_USER_PLUGIN_ROOTS;
+  process.env.CLAUTH_SUPERVISOR_DIR = root;
+  process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = path.join(root, "managed");
+  process.env.CLAUTH_USER_PLUGIN_ROOTS = path.join(root, "user");
+  const marker = path.join(root, "restart-ran.txt").replaceAll("\\", "/");
+  try {
+    // The restart command writes a marker file. If the probe ever repairs, the
+    // file exists — that is the whole test, and it cannot pass by accident.
+    writePlugin(root, "managed", "readonly-demo", baseManifest("readonly-demo", {
+      core: true,
+      enable_default: true,
+      surfaces: [{
+        id: "primary",
+        destination: "local/clauth/pm2",
+        lifecycle_owner: "clauth",
+        port: 39213,
+        health: "/health",
+        // Path passed as an ARG, not baked into the -e script: on Windows these
+        // commands run under shell:true, so an embedded double-quoted path is
+        // re-quoted by cmd.exe and the write silently lands nowhere.
+        restart: [process.execPath, "-e", "require('fs').writeFileSync(process.argv[1],'ran')", marker],
+      }],
+    }));
+    discoverPlugins();
+    const result = await probeAllSurfaceHealth({ fetchImpl: async () => ({ ok: false, status: 503 }) });
+    assert.equal(result.probed[0].health, "down");
+    assert.equal(fs.existsSync(marker), false, "probeAllSurfaceHealth spawned the restart command — it is not read-only");
+    // Health is recorded, but `state` — a MANIFEST fact — is left alone.
+    // reconcileSurfaceHealth rewrites it to "unavailable"; a read-only sweep
+    // must not, or looking at the dashboard would rewrite registry state.
+    const surface = listSurfaces()[0];
+    assert.equal(surface.last_health_ok, false);
+    assert.equal(surface.state, "current");
+
+    // Positive control: the marker mechanism WORKS. Without this, "the file was
+    // absent" is equally consistent with a command that could never write it.
+    runSurfaceAction("readonly-demo:primary", "restart", "test");
+    assert.equal(fs.existsSync(marker), true,
+      "control failed — the restart command cannot write the marker, so its absence above proved nothing");
+  } finally {
+    if (oldDir === undefined) delete process.env.CLAUTH_SUPERVISOR_DIR;
+    else process.env.CLAUTH_SUPERVISOR_DIR = oldDir;
+    if (oldManaged === undefined) delete process.env.CLAUTH_MANAGED_PLUGIN_ROOTS;
+    else process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = oldManaged;
+    if (oldUser === undefined) delete process.env.CLAUTH_USER_PLUGIN_ROOTS;
+    else process.env.CLAUTH_USER_PLUGIN_ROOTS = oldUser;
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
 test("supervisor write-token policy is temporarily relaxed only for the localhost supervisor port", () => {
   assert.equal(supervisorRequiresWriteToken(52439, {}), false);
   assert.equal(supervisorRequiresWriteToken(52439, { CLAUTH_SUPERVISOR_REQUIRE_WRITE_TOKEN: "1" }), true);
@@ -962,3 +1071,59 @@ test("registerPlugin resolves ${PACKAGE_ROOT} to the manifest's real origin", ()
   assert.ok(!JSON.stringify(surface).includes("PACKAGE_ROOT"),
     "an unexpanded PACKAGE_ROOT token survived into registered state");
 }));
+
+test("the health sweep also probes the Open target, so a 404 root is known before it is clicked", async () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-supervisor-open-probe-"));
+  const oldDir = process.env.CLAUTH_SUPERVISOR_DIR;
+  const oldManaged = process.env.CLAUTH_MANAGED_PLUGIN_ROOTS;
+  const oldUser = process.env.CLAUTH_USER_PLUGIN_ROOTS;
+  process.env.CLAUTH_SUPERVISOR_DIR = root;
+  process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = path.join(root, "managed");
+  process.env.CLAUTH_USER_PLUGIN_ROOTS = path.join(root, "user");
+  try {
+    writePlugin(root, "managed", "open-demo", baseManifest("open-demo", {
+      core: true,
+      enable_default: true,
+      surfaces: [{ id: "primary", destination: "local/clauth/pm2", lifecycle_owner: "clauth", port: 39311, health: "/health" }],
+    }));
+    discoverPlugins();
+    // The real shape of an MCP server: healthy at /health, 404 at /. Before
+    // this, the Open button pointed at / and opened an error page.
+    const result = await probeAllSurfaceHealth({
+      fetchImpl: async (url) => ({ ok: String(url).endsWith("/health"), status: String(url).endsWith("/health") ? 200 : 404 }),
+    });
+    const entry = result.probed[0];
+    assert.equal(entry.health, "healthy", "control: the health endpoint must read healthy, or open_ok proves nothing");
+    assert.equal(entry.open_url, "http://127.0.0.1:39311/");
+    assert.equal(entry.open_ok, false, "a 404 root must be recorded as a bad Open target");
+    assert.equal(listSurfaces()[0].last_health_url, "http://127.0.0.1:39311/health", "the RESOLVED probe url must be stored — it is what the Open button falls back to");
+    assert.equal(listSurfaces()[0].last_open_ok, false);
+
+    // Inverse: a surface whose root DOES answer is not flagged.
+    const good = await probeAllSurfaceHealth({ fetchImpl: async () => ({ ok: true, status: 200 }) });
+    assert.equal(good.probed[0].open_ok, true);
+    assert.equal(listSurfaces()[0].last_open_ok, true);
+  } finally {
+    if (oldDir === undefined) delete process.env.CLAUTH_SUPERVISOR_DIR;
+    else process.env.CLAUTH_SUPERVISOR_DIR = oldDir;
+    if (oldManaged === undefined) delete process.env.CLAUTH_MANAGED_PLUGIN_ROOTS;
+    else process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = oldManaged;
+    if (oldUser === undefined) delete process.env.CLAUTH_USER_PLUGIN_ROOTS;
+    else process.env.CLAUTH_USER_PLUGIN_ROOTS = oldUser;
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("surfaceOpenUrl never points a browser at an MCP transport endpoint", () => {
+  assert.equal(surfaceOpenUrl({ port: 3110 }), "http://127.0.0.1:3110/");
+  assert.equal(
+    surfaceOpenUrl({ routes: [{ kind: "external", url: "https://media.regendevcorp.com/mcp" }] }),
+    "https://media.regendevcorp.com/",
+  );
+  // A real application path is not a transport path and survives untouched.
+  assert.equal(
+    surfaceOpenUrl({ routes: [{ kind: "external", url: "https://fs.regendevcorp.com/fs" }] }),
+    "https://fs.regendevcorp.com/fs",
+  );
+  assert.equal(surfaceOpenUrl({}), null);
+});