latchkey 2.6.0 → 2.7.0

package/dist/tests/cli.test.js

@@ -5,12 +5,12 @@ import { tmpdir } from 'node:os';
 import { execSync } from 'node:child_process';
 import { Command } from 'commander';
 import { registerCommands } from '../src/cliCommands.js';
-import { extractUrlFromCurlArguments } from '../src/curl.js';
+import { CurlParseError, extractUrlFromCurlArguments } from '../src/curl.js';
 import { hasGraphicalEnvironment } from '../src/playwrightUtils.js';
 import { EncryptedStorage } from '../src/encryptedStorage.js';
 import { Config } from '../src/config.js';
-import { Registry } from '../src/registry.js';
-import { ApiCredentialStatus } from '../src/apiCredentials.js';
+import { ServiceRegistry } from '../src/serviceRegistry.js';
+import { ApiCredentialStatus } from '../src/apiCredentials/base.js';
 import { SlackApiCredentials } from '../src/services/slack.js';
 import { NoCurlCredentialsNotSupportedError, Service } from '../src/services/core/base.js';
 import { RegisteredService } from '../src/services/core/registered.js';
@@ -18,7 +18,7 @@ import { GITLAB } from '../src/services/gitlab.js';
 import { GITHUB } from '../src/services/github.js';
 import { TELEGRAM } from '../src/services/telegram.js';
 import { deleteRegisteredService, loadRegisteredServices, saveRegisteredService, } from '../src/configDataStore.js';
-import { loadRegisteredServicesIntoRegistry } from '../src/registry.js';
+import { loadRegisteredServicesIntoServiceRegistry } from '../src/serviceRegistry.js';
 // Use a fixed test key for deterministic test behavior (32 bytes = 256 bits, base64 encoded)
 const TEST_ENCRYPTION_KEY = 'dGVzdGtleXRlc3RrZXl0ZXN0a2V5dGVzdGtleXRlc3Q=';
 async function writeSecureFile(path, content) {
@@ -98,13 +98,13 @@ describe('extractUrlFromCurlArguments', () => {
         const arguments_ = ['--header', 'Authorization: Bearer token', 'https://api.example.com'];
         expect(extractUrlFromCurlArguments(arguments_)).toBe('https://api.example.com');
     });
-    it('should return null when no URL is present', () => {
+    it('should throw CurlParseError when no URL is present', () => {
         const arguments_ = ['-X', 'POST', '-H', 'Content-Type: application/json'];
-        expect(extractUrlFromCurlArguments(arguments_)).toBeNull();
+        expect(() => extractUrlFromCurlArguments(arguments_)).toThrow(CurlParseError);
     });
-    it('should return null for empty arguments', () => {
+    it('should throw CurlParseError for empty arguments', () => {
         const arguments_ = [];
-        expect(extractUrlFromCurlArguments(arguments_)).toBeNull();
+        expect(() => extractUrlFromCurlArguments(arguments_)).toThrow(CurlParseError);
     });
     it('should handle verbose flag', () => {
         let arguments_ = ['-v', 'https://api.example.com'];
@@ -118,6 +118,16 @@ describe('extractUrlFromCurlArguments', () => {
         const arguments_ = ['-k', '--compressed', '-s', '-i', 'https://api.example.com'];
         expect(extractUrlFromCurlArguments(arguments_)).toBe('https://api.example.com');
     });
+    it('should return the raw arg for schemeless URLs (curl defaults to http://)', () => {
+        expect(extractUrlFromCurlArguments(['www.seznam.cz'])).toBe('www.seznam.cz');
+        expect(extractUrlFromCurlArguments(['-X', 'POST', 'api.example.com/path'])).toBe('api.example.com/path');
+    });
+    it('should return null for non-http(s) schemes', () => {
+        expect(extractUrlFromCurlArguments(['ftp://example.com/'])).toBeNull();
+    });
+    it('should propagate CurlParseError for malformed arguments', () => {
+        expect(() => extractUrlFromCurlArguments(['-H', 'no-colon-here'])).toThrow(CurlParseError);
+    });
 });
 describe('hasGraphicalEnvironment', () => {
     const originalPlatform = process.platform;
@@ -257,6 +267,11 @@ describe('CLI commands with dependency injection', () => {
             accountName: overrides.accountName ?? defaultConfig.accountName,
             browserDisabled: overrides.browserDisabled ?? false,
             countingDisabled: overrides.countingDisabled ?? false,
+            permissionsDoNotUseBuiltinSchemas: overrides.permissionsDoNotUseBuiltinSchemas ?? false,
+            passthroughUnknown: overrides.passthroughUnknown ?? false,
+            gatewayUrl: overrides.gatewayUrl ?? null,
+            gatewayListenHost: overrides.gatewayListenHost ?? 'localhost',
+            gatewayListenPort: overrides.gatewayListenPort ?? 1989,
             checkSensitiveFilePermissions: () => undefined,
             checkSystemPrerequisites: () => undefined,
         };
@@ -269,7 +284,7 @@ describe('CLI commands with dependency injection', () => {
             loginUrl: 'https://slack.com/signin',
             info: 'Test info for Slack service.',
             credentialCheckCurlArguments: ['https://slack.com/api/auth.test'],
-            checkApiCredentials: vi.fn().mockReturnValue(ApiCredentialStatus.Valid),
+            checkApiCredentials: vi.fn().mockResolvedValue(ApiCredentialStatus.Valid),
             setCredentialsExample(serviceName) {
                 return `latchkey auth set ${serviceName} -H "Authorization: Bearer xoxb-your-token"`;
             },
@@ -280,7 +295,7 @@ describe('CLI commands with dependency injection', () => {
                 login: vi.fn().mockResolvedValue(new SlackApiCredentials('xoxc-test-token', 'test-cookie')),
             }),
         };
-        const mockRegistry = new Registry([mockSlackService]);
+        const mockRegistry = new ServiceRegistry([mockSlackService]);
         return {
             registry: mockRegistry,
             config: createMockConfig(),
@@ -288,6 +303,7 @@ describe('CLI commands with dependency injection', () => {
                 capturedArgs.push(...args);
                 return { returncode: 0, stdout: '', stderr: '' };
             },
+            runCurlAsync: () => Promise.resolve({ returncode: 0, stdout: Buffer.from(''), stderr: '' }),
             checkPermission: () => Promise.resolve(true),
             confirm: () => Promise.resolve(true),
             exit: (code) => {
@@ -300,6 +316,7 @@ describe('CLI commands with dependency injection', () => {
             errorLog: (message) => {
                 errorLogs.push(message);
             },
+            version: '0.0.0-test',
             ...overrides,
         };
     }
@@ -399,7 +416,7 @@ describe('CLI commands with dependency injection', () => {
                 loginUrl: 'https://nologin.example.com',
                 info: 'A service without browser login support.',
                 credentialCheckCurlArguments: [],
-                checkApiCredentials: vi.fn().mockReturnValue(ApiCredentialStatus.Missing),
+                checkApiCredentials: vi.fn().mockResolvedValue(ApiCredentialStatus.Missing),
                 setCredentialsExample(serviceName) {
                     return `latchkey auth set ${serviceName} -H "Authorization: Bearer <token>"`;
                 },
@@ -408,7 +425,7 @@ describe('CLI commands with dependency injection', () => {
                 },
             };
             const deps = createMockDependencies({
-                registry: new Registry([noLoginService]),
+                registry: new ServiceRegistry([noLoginService]),
             });
             await runCommand(['services', 'list', '--viable'], deps);
             expect(logs).toHaveLength(1);
@@ -563,7 +580,7 @@ describe('CLI commands with dependency injection', () => {
                 loginUrl: 'https://nologin.example.com',
                 info: 'A service without browser login support.',
                 credentialCheckCurlArguments: [],
-                checkApiCredentials: vi.fn().mockReturnValue(ApiCredentialStatus.Missing),
+                checkApiCredentials: vi.fn().mockResolvedValue(ApiCredentialStatus.Missing),
                 setCredentialsExample(serviceName) {
                     return `latchkey auth set ${serviceName} -H "Authorization: Bearer <token>"`;
                 },
@@ -572,7 +589,7 @@ describe('CLI commands with dependency injection', () => {
                 },
             };
             const deps = createMockDependencies({
-                registry: new Registry([noLoginService]),
+                registry: new ServiceRegistry([noLoginService]),
             });
             await runCommand(['services', 'info', 'nologin'], deps);
             const info = JSON.parse(logs[0] ?? '');
@@ -743,7 +760,7 @@ describe('CLI commands with dependency injection', () => {
             const storePath = join(tempDir, 'credentials.json');
             await writeSecureFile(storePath, '{}');
             const deps = createMockDependencies({
-                registry: new Registry([TELEGRAM]),
+                registry: new ServiceRegistry([TELEGRAM]),
             });
             await runCommand(['auth', 'set-nocurl', 'telegram', '123456:ABC-DEF'], deps);
             expect(logs).toContain('Credentials stored.');
@@ -765,14 +782,14 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should return error when telegram token is missing', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([TELEGRAM]),
+                registry: new ServiceRegistry([TELEGRAM]),
             });
             await runCommand(['auth', 'set-nocurl', 'telegram'], deps);
             expect(exitCode).toBe(1);
         });
         it('should return error when telegram token format is invalid', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([TELEGRAM]),
+                registry: new ServiceRegistry([TELEGRAM]),
             });
             await runCommand(['auth', 'set-nocurl', 'telegram', 'not-a-valid-token'], deps);
             expect(exitCode).toBe(1);
@@ -848,6 +865,38 @@ describe('CLI commands with dependency injection', () => {
             await runCommand(['curl', 'https://unknown-api.example.com'], deps);
             expect(exitCode).toBe(1);
         });
+        it('should pass through unknown service when passthroughUnknown is enabled', async () => {
+            const deps = createMockDependencies({
+                config: createMockConfig({ passthroughUnknown: true }),
+            });
+            await runCommand(['curl', 'https://unknown-api.example.com/test'], deps);
+            expect(exitCode).toBe(0);
+            expect(capturedArgs).toEqual(['https://unknown-api.example.com/test']);
+            expect(errorLogs).toHaveLength(0);
+        });
+        it('should pass through missing credentials when passthroughUnknown is enabled', async () => {
+            const storePath = join(tempDir, 'credentials.json');
+            await writeSecureFile(storePath, '{}');
+            const deps = createMockDependencies({
+                config: createMockConfig({ passthroughUnknown: true }),
+            });
+            await runCommand(['curl', 'https://slack.com/api/test'], deps);
+            expect(exitCode).toBe(0);
+            expect(capturedArgs).toEqual(['https://slack.com/api/test']);
+            expect(errorLogs).toHaveLength(0);
+        });
+        it('should still inject credentials for known services when passthroughUnknown is enabled', async () => {
+            const storePath = join(tempDir, 'credentials.json');
+            await writeSecureFile(storePath, JSON.stringify({
+                slack: { objectType: 'slack', token: 'stored-token', dCookie: 'stored-cookie' },
+            }));
+            const deps = createMockDependencies({
+                config: createMockConfig({ passthroughUnknown: true }),
+            });
+            await runCommand(['curl', 'https://slack.com/api/test'], deps);
+            expect(exitCode).toBe(0);
+            expect(capturedArgs).toContain('Authorization: Bearer stored-token');
+        });
         it('should read credentials from store and not call login', async () => {
             const storePath = join(tempDir, 'credentials.json');
             await writeSecureFile(storePath, JSON.stringify({
@@ -871,7 +920,7 @@ describe('CLI commands with dependency injection', () => {
                 getSession: vi.fn().mockReturnValue({ login: mockLogin }),
             };
             const deps = createMockDependencies({
-                registry: new Registry([mockSlackService]),
+                registry: new ServiceRegistry([mockSlackService]),
             });
             await runCommand(['curl', 'https://slack.com/api/test'], deps);
             expect(mockLogin).not.toHaveBeenCalled();
@@ -890,7 +939,7 @@ describe('CLI commands with dependency injection', () => {
                 telegram: { objectType: 'telegramBot', token: '123456:ABC-DEF' },
             }));
             const deps = createMockDependencies({
-                registry: new Registry([TELEGRAM]),
+                registry: new ServiceRegistry([TELEGRAM]),
             });
             await runCommand(['curl', 'https://api.telegram.org/getMe'], deps);
             expect(capturedArgs).toEqual(['https://api.telegram.org/bot123456:ABC-DEF/getMe']);
@@ -908,7 +957,7 @@ describe('CLI commands with dependency injection', () => {
                 loginUrl: 'https://nologin.example.com',
                 info: 'A service without browser login support.',
                 credentialCheckCurlArguments: [],
-                checkApiCredentials: vi.fn().mockReturnValue(ApiCredentialStatus.Valid),
+                checkApiCredentials: vi.fn().mockResolvedValue(ApiCredentialStatus.Valid),
                 setCredentialsExample(serviceName) {
                     return `latchkey auth set ${serviceName} -H "Authorization: Bearer <token>"`;
                 },
@@ -918,7 +967,7 @@ describe('CLI commands with dependency injection', () => {
                 // No getSession - service doesn't support browser login
             };
             const deps = createMockDependencies({
-                registry: new Registry([noLoginService]),
+                registry: new ServiceRegistry([noLoginService]),
             });
             await runCommand(['curl', 'https://nologin.example.com/api/test'], deps);
             expect(exitCode).toBe(0);
@@ -985,7 +1034,7 @@ describe('CLI commands with dependency injection', () => {
                 // No getSession - service doesn't support browser login
             };
             const deps = createMockDependencies({
-                registry: new Registry([noLoginService]),
+                registry: new ServiceRegistry([noLoginService]),
             });
             await runCommand(['auth', 'browser', 'nologin'], deps);
             expect(exitCode).toBe(1);
@@ -1042,7 +1091,7 @@ describe('CLI commands with dependency injection', () => {
                 // No getSession - service doesn't support browser login
             };
             const deps = createMockDependencies({
-                registry: new Registry([nocurlService]),
+                registry: new ServiceRegistry([nocurlService]),
             });
             await runCommand(['auth', 'browser', 'nocurl-only'], deps);
             expect(exitCode).toBe(1);
@@ -1051,7 +1100,7 @@ describe('CLI commands with dependency injection', () => {
     describe('services register command', () => {
         it('should register a new service', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             await runCommand([
                 'services',
@@ -1071,7 +1120,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should persist registration to config.json', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             await runCommand([
                 'services',
@@ -1091,7 +1140,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should reject unknown service family', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             await runCommand([
                 'services',
@@ -1107,7 +1156,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should reject duplicate service name', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             await runCommand([
                 'services',
@@ -1123,7 +1172,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should canonicalize service name to lowercase', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             await runCommand([
                 'services',
@@ -1140,7 +1189,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should convert spaces to hyphens in service name', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             await runCommand(['services', 'register', 'my api', '--base-api-url', 'https://api.example.com/'], deps);
             expect(exitCode).toBeNull();
@@ -1149,7 +1198,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should reject service name with invalid characters', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             await runCommand(['services', 'register', 'my@service!', '--base-api-url', 'https://api.example.com/'], deps);
             expect(exitCode).toBe(1);
@@ -1159,7 +1208,7 @@ describe('CLI commands with dependency injection', () => {
             const storePath = join(tempDir, 'credentials.json');
             await writeSecureFile(storePath, '{}');
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             await runCommand([
                 'services',
@@ -1178,7 +1227,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should persist and restore loginUrl', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITHUB]),
+                registry: new ServiceRegistry([GITHUB]),
             });
             await runCommand([
                 'services',
@@ -1196,7 +1245,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should reject --login-url without --service-family', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([]),
+                registry: new ServiceRegistry([]),
             });
             await runCommand([
                 'services',
@@ -1212,7 +1261,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should reject --login-url when service family does not support browser login', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             await runCommand([
                 'services',
@@ -1230,7 +1279,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should require --login-url when service family supports browser login', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITHUB]),
+                registry: new ServiceRegistry([GITHUB]),
             });
             await runCommand([
                 'services',
@@ -1246,7 +1295,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should make registered service usable with auth set', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             // Register the service
             await runCommand([
@@ -1269,7 +1318,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should register a service without --service-family', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             await runCommand(['services', 'register', 'my-api', '--base-api-url', 'https://api.example.com/'], deps);
             expect(exitCode).toBeNull();
@@ -1281,7 +1330,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should persist registration without service family to config.json', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             await runCommand(['services', 'register', 'my-api', '--base-api-url', 'https://api.example.com/'], deps);
             const configPath = deps.config.configPath;
@@ -1294,7 +1343,7 @@ describe('CLI commands with dependency injection', () => {
             const storePath = join(tempDir, 'credentials.json');
             await writeSecureFile(storePath, '{}');
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             await runCommand(['services', 'register', 'my-api', '--base-api-url', 'https://api.example.com/'], deps);
             logs = [];
@@ -1305,7 +1354,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should make service without family usable with auth set and curl', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             // Register the service without family
             await runCommand(['services', 'register', 'my-api', '--base-api-url', 'https://api.example.com/'], deps);
@@ -1327,7 +1376,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should reject browser login for service without family', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             await runCommand(['services', 'register', 'my-api', '--base-api-url', 'https://api.example.com/'], deps);
             logs = [];
@@ -1339,7 +1388,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should reject set-nocurl for service without family', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             await runCommand(['services', 'register', 'my-api', '--base-api-url', 'https://api.example.com/'], deps);
             logs = [];
@@ -1351,7 +1400,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should make registered service usable with curl', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             // Register the service
             await runCommand([
@@ -1383,7 +1432,7 @@ describe('CLI commands with dependency injection', () => {
     describe('services deregister command', () => {
         it('should deregister a registered service', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             // Register a service first
             await runCommand([
@@ -1403,7 +1452,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should remove service from config.json', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             await runCommand([
                 'services',
@@ -1434,7 +1483,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should reject deregistering when credentials still exist', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             // Register a service
             await runCommand([
@@ -1467,7 +1516,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should allow deregistering after credentials are cleared', async () => {
             const deps = createMockDependencies({
-                registry: new Registry([GITLAB]),
+                registry: new ServiceRegistry([GITLAB]),
             });
             // Register
             await runCommand([
@@ -1500,6 +1549,143 @@ describe('CLI commands with dependency injection', () => {
             expect(logs).toContain("Service 'my-gitlab' deregistered.");
         });
     });
+    describe('gateway mode (LATCHKEY_GATEWAY)', () => {
+        const GATEWAY_URL = 'http://localhost:9000';
+        const originalFetch = globalThis.fetch;
+        afterEach(() => {
+            globalThis.fetch = originalFetch;
+        });
+        function makeFetchMock(response) {
+            const fetchMock = vi.fn().mockResolvedValue(response);
+            globalThis.fetch = fetchMock;
+            return fetchMock;
+        }
+        it('forwards `services list` to the gateway /latchkey endpoint', async () => {
+            const fetchMock = makeFetchMock(new Response(JSON.stringify({ result: ['slack', 'github'] }), { status: 200 }));
+            const deps = createMockDependencies({
+                config: createMockConfig({ gatewayUrl: GATEWAY_URL }),
+            });
+            await runCommand(['services', 'list', '--builtin'], deps);
+            expect(fetchMock).toHaveBeenCalledTimes(1);
+            const [url, init] = fetchMock.mock.calls[0];
+            expect(url).toBe(`${GATEWAY_URL}/latchkey`);
+            expect(init.method).toBe('POST');
+            expect(JSON.parse(init.body)).toEqual({
+                command: 'services list',
+                params: { builtin: true },
+            });
+            expect(logs).toHaveLength(1);
+            expect(JSON.parse(logs[0] ?? '')).toEqual(['slack', 'github']);
+        });
+        it('forwards `services info` to the gateway /latchkey endpoint', async () => {
+            const fetchMock = makeFetchMock(new Response(JSON.stringify({ result: { type: 'built-in' } }), { status: 200 }));
+            const deps = createMockDependencies({
+                config: createMockConfig({ gatewayUrl: GATEWAY_URL }),
+            });
+            await runCommand(['services', 'info', 'slack'], deps);
+            expect(fetchMock).toHaveBeenCalledTimes(1);
+            const [, init] = fetchMock.mock.calls[0];
+            expect(JSON.parse(init.body)).toEqual({
+                command: 'services info',
+                params: { serviceName: 'slack' },
+            });
+        });
+        it('forwards `auth list` to the gateway /latchkey endpoint', async () => {
+            const fetchMock = makeFetchMock(new Response(JSON.stringify({ result: { slack: { credentialType: 'slack' } } }), {
+                status: 200,
+            }));
+            const deps = createMockDependencies({
+                config: createMockConfig({ gatewayUrl: GATEWAY_URL }),
+            });
+            await runCommand(['auth', 'list'], deps);
+            const [, init] = fetchMock.mock.calls[0];
+            expect(JSON.parse(init.body)).toEqual({ command: 'auth list' });
+            expect(JSON.parse(logs[0] ?? '')).toEqual({
+                slack: { credentialType: 'slack' },
+            });
+        });
+        it('forwards `auth browser` to the gateway /latchkey endpoint', async () => {
+            const fetchMock = makeFetchMock(new Response(JSON.stringify({ result: null }), { status: 200 }));
+            const deps = createMockDependencies({
+                config: createMockConfig({ gatewayUrl: GATEWAY_URL }),
+            });
+            await runCommand(['auth', 'browser', 'slack'], deps);
+            const [, init] = fetchMock.mock.calls[0];
+            expect(JSON.parse(init.body)).toEqual({
+                command: 'auth browser',
+                params: { serviceName: 'slack' },
+            });
+            expect(logs).toContain('Done');
+        });
+        it('forwards `auth browser-prepare` and reports `Already prepared.` when the gateway says so', async () => {
+            makeFetchMock(new Response(JSON.stringify({ result: { alreadyPrepared: true } }), { status: 200 }));
+            const deps = createMockDependencies({
+                config: createMockConfig({ gatewayUrl: GATEWAY_URL }),
+            });
+            await runCommand(['auth', 'browser-prepare', 'slack'], deps);
+            expect(logs).toContain('Already prepared.');
+        });
+        it.each([
+            ['services list', ['services', 'list']],
+            ['services info', ['services', 'info', 'foo']],
+            ['auth list', ['auth', 'list']],
+            ['auth browser', ['auth', 'browser', 'slack']],
+            ['auth browser-prepare', ['auth', 'browser-prepare', 'slack']],
+        ])('reports gateway errors on stderr (not stdout) for `%s`', async (_name, argv) => {
+            makeFetchMock(new Response(JSON.stringify({ error: 'Unknown service: foo.' }), { status: 400 }));
+            const deps = createMockDependencies({
+                config: createMockConfig({ gatewayUrl: GATEWAY_URL }),
+            });
+            await runCommand(argv, deps);
+            expect(exitCode).toBe(1);
+            expect(errorLogs.some((message) => message.includes('Unknown service: foo.'))).toBe(true);
+            // The error message must never be printed to stdout — that would
+            // interleave into JSON output consumed by callers.
+            expect(logs.join('\n')).not.toContain('Unknown service: foo.');
+            expect(logs).toEqual([]);
+        });
+        it('rewrites the curl target URL to the gateway /gateway endpoint', async () => {
+            const fetchMock = vi.fn();
+            globalThis.fetch = fetchMock;
+            const deps = createMockDependencies({
+                config: createMockConfig({ gatewayUrl: GATEWAY_URL }),
+            });
+            await runCommand(['curl', '-X', 'GET', 'https://slack.com/api/auth.test'], deps);
+            expect(fetchMock).not.toHaveBeenCalled();
+            expect(capturedArgs).toEqual([
+                '-X',
+                'GET',
+                `${GATEWAY_URL}/gateway/https://slack.com/api/auth.test`,
+            ]);
+        });
+        it('errors when `latchkey curl` has no URL to rewrite', async () => {
+            const deps = createMockDependencies({
+                config: createMockConfig({ gatewayUrl: GATEWAY_URL }),
+            });
+            await runCommand(['curl', '-X', 'GET'], deps);
+            expect(exitCode).toBe(1);
+            expect(capturedArgs).toEqual([]);
+        });
+        it.each([
+            [
+                'services register',
+                ['services', 'register', 'my-gitlab', '--base-api-url', 'https://gitlab.example.com'],
+            ],
+            ['services deregister', ['services', 'deregister', 'my-gitlab']],
+            ['auth clear', ['auth', 'clear', 'slack']],
+            ['auth set', ['auth', 'set', 'slack', '-H', 'Authorization: Bearer xoxb-test']],
+            ['auth set-nocurl', ['auth', 'set-nocurl', 'slack', 'x']],
+            ['gateway', ['gateway']],
+            ['ensure-browser', ['ensure-browser']],
+        ])('refuses to run `%s` in gateway mode', async (_name, argv) => {
+            const deps = createMockDependencies({
+                config: createMockConfig({ gatewayUrl: GATEWAY_URL }),
+            });
+            await runCommand(argv, deps);
+            expect(exitCode).toBe(1);
+            expect(errorLogs.some((message) => message.includes('LATCHKEY_GATEWAY'))).toBe(true);
+        });
+    });
 });
 describe('registeredServiceStore', () => {
     let tempDir;
@@ -1544,8 +1730,8 @@ describe('registeredServiceStore', () => {
             baseApiUrl: 'https://gitlab.mycompany.com/api/',
             serviceFamily: 'gitlab',
         });
-        const registry = new Registry([GITLAB]);
-        loadRegisteredServicesIntoRegistry(configPath, registry);
+        const registry = new ServiceRegistry([GITLAB]);
+        loadRegisteredServicesIntoServiceRegistry(configPath, registry);
         const service = registry.getByName('my-gitlab');
         expect(service).not.toBeNull();
         expect(service.baseApiUrls).toEqual(['https://gitlab.mycompany.com/api/']);
@@ -1557,8 +1743,8 @@ describe('registeredServiceStore', () => {
             serviceFamily: 'gitlab',
             loginUrl: 'https://gitlab.mycompany.com/users/sign_in',
         });
-        const registry = new Registry([GITLAB]);
-        loadRegisteredServicesIntoRegistry(configPath, registry);
+        const registry = new ServiceRegistry([GITLAB]);
+        loadRegisteredServicesIntoServiceRegistry(configPath, registry);
         const service = registry.getByName('my-gitlab');
         expect(service).not.toBeNull();
         expect(service.loginUrl).toBe('https://gitlab.mycompany.com/users/sign_in');
@@ -1568,8 +1754,8 @@ describe('registeredServiceStore', () => {
         saveRegisteredService(configPath, 'my-api', {
             baseApiUrl: 'https://api.example.com/',
         });
-        const registry = new Registry([GITLAB]);
-        loadRegisteredServicesIntoRegistry(configPath, registry);
+        const registry = new ServiceRegistry([GITLAB]);
+        loadRegisteredServicesIntoServiceRegistry(configPath, registry);
         const service = registry.getByName('my-api');
         expect(service).not.toBeNull();
         expect(service.baseApiUrls).toEqual(['https://api.example.com/']);
@@ -1582,8 +1768,8 @@ describe('registeredServiceStore', () => {
             baseApiUrl: 'https://unknown.example.com/api/',
             serviceFamily: 'nonexistent',
         });
-        const registry = new Registry([GITLAB]);
-        loadRegisteredServicesIntoRegistry(configPath, registry);
+        const registry = new ServiceRegistry([GITLAB]);
+        loadRegisteredServicesIntoServiceRegistry(configPath, registry);
         expect(registry.getByName('my-unknown')).toBeNull();
     });
     it('should delete a registered service from config', () => {