nastechai-desktop 18.1.0

package/electron/oauth-net-request.cjs

@@ -0,0 +1,20 @@
+/**
+ * Helpers for Electron net.request calls that ride the OAuth session partition.
+ *
+ * Electron's ClientRequest forbids app-set restricted headers such as
+ * Content-Length. Let Chromium frame the body itself; only set the JSON content
+ * type here.
+ */
+
+function serializeJsonBody(body) {
+  return body === undefined ? undefined : Buffer.from(JSON.stringify(body))
+}
+
+function setJsonRequestHeaders(request) {
+  request.setHeader('Content-Type', 'application/json')
+}
+
+module.exports = {
+  serializeJsonBody,
+  setJsonRequestHeaders
+}

package/electron/oauth-net-request.test.cjs

@@ -0,0 +1,34 @@
+/**
+ * Tests for OAuth-session Electron net.request helpers.
+ *
+ * Run with: node --test electron/oauth-net-request.test.cjs
+ */
+
+const test = require('node:test')
+const assert = require('node:assert/strict')
+
+const { serializeJsonBody, setJsonRequestHeaders } = require('./oauth-net-request.cjs')
+
+test('serializeJsonBody returns undefined for absent bodies', () => {
+  assert.equal(serializeJsonBody(undefined), undefined)
+})
+
+test('serializeJsonBody JSON-encodes request bodies', () => {
+  const body = serializeJsonBody({ archived: true })
+  assert.ok(Buffer.isBuffer(body))
+  assert.equal(body.toString('utf8'), '{"archived":true}')
+})
+
+test('setJsonRequestHeaders does not set Electron-restricted Content-Length', () => {
+  const headers = []
+  const request = {
+    setHeader(name, value) {
+      headers.push([name, value])
+    }
+  }
+
+  setJsonRequestHeaders(request)
+
+  assert.deepEqual(headers, [['Content-Type', 'application/json']])
+  assert.equal(headers.some(([name]) => name.toLowerCase() === 'content-length'), false)
+})

package/electron/preload.cjs

@@ -0,0 +1,135 @@
+const { contextBridge, ipcRenderer, webUtils } = require('electron')
+
+contextBridge.exposeInMainWorld('nastechDesktop', {
+  getConnection: profile => ipcRenderer.invoke('nastech:connection', profile),
+  touchBackend: profile => ipcRenderer.invoke('nastech:backend:touch', profile),
+  getGatewayWsUrl: profile => ipcRenderer.invoke('nastech:gateway:ws-url', profile),
+  getBootProgress: () => ipcRenderer.invoke('nastech:boot-progress:get'),
+  getConnectionConfig: profile => ipcRenderer.invoke('nastech:connection-config:get', profile),
+  saveConnectionConfig: payload => ipcRenderer.invoke('nastech:connection-config:save', payload),
+  applyConnectionConfig: payload => ipcRenderer.invoke('nastech:connection-config:apply', payload),
+  testConnectionConfig: payload => ipcRenderer.invoke('nastech:connection-config:test', payload),
+  probeConnectionConfig: remoteUrl => ipcRenderer.invoke('nastech:connection-config:probe', remoteUrl),
+  oauthLoginConnectionConfig: remoteUrl => ipcRenderer.invoke('nastech:connection-config:oauth-login', remoteUrl),
+  oauthLogoutConnectionConfig: remoteUrl => ipcRenderer.invoke('nastech:connection-config:oauth-logout', remoteUrl),
+  profile: {
+    get: () => ipcRenderer.invoke('nastech:profile:get'),
+    set: name => ipcRenderer.invoke('nastech:profile:set', name)
+  },
+  api: request => ipcRenderer.invoke('nastech:api', request),
+  notify: payload => ipcRenderer.invoke('nastech:notify', payload),
+  requestMicrophoneAccess: () => ipcRenderer.invoke('nastech:requestMicrophoneAccess'),
+  readFileDataUrl: filePath => ipcRenderer.invoke('nastech:readFileDataUrl', filePath),
+  readFileText: filePath => ipcRenderer.invoke('nastech:readFileText', filePath),
+  selectPaths: options => ipcRenderer.invoke('nastech:selectPaths', options),
+  writeClipboard: text => ipcRenderer.invoke('nastech:writeClipboard', text),
+  saveImageFromUrl: url => ipcRenderer.invoke('nastech:saveImageFromUrl', url),
+  saveImageBuffer: (data, ext) => ipcRenderer.invoke('nastech:saveImageBuffer', { data, ext }),
+  saveClipboardImage: () => ipcRenderer.invoke('nastech:saveClipboardImage'),
+  getPathForFile: file => {
+    try {
+      return webUtils.getPathForFile(file) || ''
+    } catch {
+      return ''
+    }
+  },
+  normalizePreviewTarget: (target, baseDir) => ipcRenderer.invoke('nastech:normalizePreviewTarget', target, baseDir),
+  watchPreviewFile: url => ipcRenderer.invoke('nastech:watchPreviewFile', url),
+  stopPreviewFileWatch: id => ipcRenderer.invoke('nastech:stopPreviewFileWatch', id),
+  setTitleBarTheme: payload => ipcRenderer.send('nastech:titlebar-theme', payload),
+  setPreviewShortcutActive: active => ipcRenderer.send('nastech:previewShortcutActive', Boolean(active)),
+  openExternal: url => ipcRenderer.invoke('nastech:openExternal', url),
+  fetchLinkTitle: url => ipcRenderer.invoke('nastech:fetchLinkTitle', url),
+  settings: {
+    getDefaultProjectDir: () => ipcRenderer.invoke('nastech:setting:defaultProjectDir:get'),
+    setDefaultProjectDir: dir => ipcRenderer.invoke('nastech:setting:defaultProjectDir:set', dir),
+    pickDefaultProjectDir: () => ipcRenderer.invoke('nastech:setting:defaultProjectDir:pick')
+  },
+  revealLogs: () => ipcRenderer.invoke('nastech:logs:reveal'),
+  getRecentLogs: () => ipcRenderer.invoke('nastech:logs:recent'),
+  readDir: dirPath => ipcRenderer.invoke('nastech:fs:readDir', dirPath),
+  gitRoot: startPath => ipcRenderer.invoke('nastech:fs:gitRoot', startPath),
+  terminal: {
+    dispose: id => ipcRenderer.invoke('nastech:terminal:dispose', id),
+    resize: (id, size) => ipcRenderer.invoke('nastech:terminal:resize', id, size),
+    start: options => ipcRenderer.invoke('nastech:terminal:start', options),
+    write: (id, data) => ipcRenderer.invoke('nastech:terminal:write', id, data),
+    onData: (id, callback) => {
+      const channel = `nastech:terminal:${id}:data`
+      const listener = (_event, payload) => callback(payload)
+      ipcRenderer.on(channel, listener)
+      return () => ipcRenderer.removeListener(channel, listener)
+    },
+    onExit: (id, callback) => {
+      const channel = `nastech:terminal:${id}:exit`
+      const listener = (_event, payload) => callback(payload)
+      ipcRenderer.on(channel, listener)
+      return () => ipcRenderer.removeListener(channel, listener)
+    }
+  },
+  onClosePreviewRequested: callback => {
+    const listener = () => callback()
+    ipcRenderer.on('nastech:close-preview-requested', listener)
+    return () => ipcRenderer.removeListener('nastech:close-preview-requested', listener)
+  },
+  onOpenUpdatesRequested: callback => {
+    const listener = () => callback()
+    ipcRenderer.on('nastech:open-updates', listener)
+    return () => ipcRenderer.removeListener('nastech:open-updates', listener)
+  },
+  onWindowStateChanged: callback => {
+    const listener = (_event, payload) => callback(payload)
+    ipcRenderer.on('nastech:window-state-changed', listener)
+    return () => ipcRenderer.removeListener('nastech:window-state-changed', listener)
+  },
+  onPreviewFileChanged: callback => {
+    const listener = (_event, payload) => callback(payload)
+    ipcRenderer.on('nastech:preview-file-changed', listener)
+    return () => ipcRenderer.removeListener('nastech:preview-file-changed', listener)
+  },
+  onBackendExit: callback => {
+    const listener = (_event, payload) => callback(payload)
+    ipcRenderer.on('nastech:backend-exit', listener)
+    return () => ipcRenderer.removeListener('nastech:backend-exit', listener)
+  },
+  onPowerResume: callback => {
+    const listener = () => callback()
+    ipcRenderer.on('nastech:power-resume', listener)
+    return () => ipcRenderer.removeListener('nastech:power-resume', listener)
+  },
+  onBootProgress: callback => {
+    const listener = (_event, payload) => callback(payload)
+    ipcRenderer.on('nastech:boot-progress', listener)
+    return () => ipcRenderer.removeListener('nastech:boot-progress', listener)
+  },
+  // First-launch bootstrap progress -- emitted by the install.ps1 stage
+  // runner in main.cjs (apps/desktop/electron/bootstrap-runner.cjs).
+  // Renderer's install overlay subscribes to live events and queries the
+  // current snapshot via getBootstrapState() to recover after a devtools
+  // reload mid-bootstrap.
+  getBootstrapState: () => ipcRenderer.invoke('nastech:bootstrap:get'),
+  resetBootstrap: () => ipcRenderer.invoke('nastech:bootstrap:reset'),
+  repairBootstrap: () => ipcRenderer.invoke('nastech:bootstrap:repair'),
+  cancelBootstrap: () => ipcRenderer.invoke('nastech:bootstrap:cancel'),
+  onBootstrapEvent: callback => {
+    const listener = (_event, payload) => callback(payload)
+    ipcRenderer.on('nastech:bootstrap:event', listener)
+    return () => ipcRenderer.removeListener('nastech:bootstrap:event', listener)
+  },
+  getVersion: () => ipcRenderer.invoke('nastech:version'),
+  uninstall: {
+    summary: () => ipcRenderer.invoke('nastech:uninstall:summary'),
+    run: mode => ipcRenderer.invoke('nastech:uninstall:run', { mode })
+  },
+  updates: {
+    check: () => ipcRenderer.invoke('nastech:updates:check'),
+    apply: opts => ipcRenderer.invoke('nastech:updates:apply', opts),
+    getBranch: () => ipcRenderer.invoke('nastech:updates:branch:get'),
+    setBranch: name => ipcRenderer.invoke('nastech:updates:branch:set', name),
+    onProgress: callback => {
+      const listener = (_event, payload) => callback(payload)
+      ipcRenderer.on('nastech:updates:progress', listener)
+      return () => ipcRenderer.removeListener('nastech:updates:progress', listener)
+    }
+  }
+})

package/electron/session-windows.cjs

@@ -0,0 +1,99 @@
+// Secondary "session windows" — one extra OS window per chat so a user can
+// work with multiple chats side by side. The pure, Electron-free pieces live
+// here so they can be unit-tested with node --test (mirroring how the rest of
+// electron/*.cjs splits testable logic out of the main.cjs monolith).
+
+const { pathToFileURL } = require('node:url')
+
+// Secondary windows open at the minimum usable size — a compact side panel for
+// subagent watch / cmd-click session pop-out, not a second full desktop.
+const SESSION_WINDOW_MIN_WIDTH = 420
+const SESSION_WINDOW_MIN_HEIGHT = 620
+
+// Build the renderer URL for a secondary window. The renderer uses a
+// HashRouter, so the session route lives after the '#'. The `?win=secondary`
+// flag MUST sit in the query string BEFORE the '#': anything after the '#' is
+// treated as the route by HashRouter and would break routeSessionId(). The
+// renderer reads the flag from window.location.search to suppress the install /
+// onboarding overlays and the global session sidebar. `watch=1` marks a
+// spectator window (e.g. a running subagent's session): the renderer resumes
+// it lazily so the gateway never builds an agent just to stream into it.
+function buildSessionWindowUrl(sessionId, { devServer, rendererIndexPath, watch } = {}) {
+  const query = `?win=secondary${watch ? '&watch=1' : ''}`
+  const route = `#/${encodeURIComponent(sessionId)}`
+
+  if (devServer) {
+    const base = devServer.endsWith('/') ? devServer.slice(0, -1) : devServer
+
+    return `${base}/${query}${route}`
+  }
+
+  return `${pathToFileURL(rendererIndexPath).toString()}${query}${route}`
+}
+
+// A small registry keyed by sessionId that guarantees one window per chat:
+// opening a session that already has a live window focuses it instead of
+// spawning a duplicate, and a window removes itself from the registry when it
+// closes. The actual BrowserWindow construction is injected (the `factory`) so
+// this module stays free of Electron and is unit-testable.
+function createSessionWindowRegistry() {
+  const windows = new Map()
+
+  function openOrFocus(sessionId, factory) {
+    const key = typeof sessionId === 'string' ? sessionId.trim() : ''
+
+    if (!key) {
+      return null
+    }
+
+    const existing = windows.get(key)
+
+    if (existing && !existing.isDestroyed()) {
+      // Focus-or-create: never duplicate a window for the same chat.
+      if (typeof existing.isMinimized === 'function' && existing.isMinimized()) {
+        existing.restore?.()
+      }
+
+      if (typeof existing.isVisible === 'function' && !existing.isVisible()) {
+        existing.show?.()
+      }
+
+      existing.focus?.()
+
+      return existing
+    }
+
+    const win = factory(key)
+
+    if (!win) {
+      return null
+    }
+
+    windows.set(key, win)
+
+    // Self-cleanup on close so the registry never holds a destroyed window.
+    win.on?.('closed', () => {
+      if (windows.get(key) === win) {
+        windows.delete(key)
+      }
+    })
+
+    return win
+  }
+
+  return {
+    openOrFocus,
+    get: key => windows.get(key),
+    has: key => windows.has(key),
+    get size() {
+      return windows.size
+    }
+  }
+}
+
+module.exports = {
+  buildSessionWindowUrl,
+  createSessionWindowRegistry,
+  SESSION_WINDOW_MIN_HEIGHT,
+  SESSION_WINDOW_MIN_WIDTH
+}

package/electron/session-windows.test.cjs

@@ -0,0 +1,177 @@
+const assert = require('node:assert/strict')
+const test = require('node:test')
+
+const { buildSessionWindowUrl, createSessionWindowRegistry } = require('./session-windows.cjs')
+
+// A minimal fake BrowserWindow: tracks listeners + destroyed state and lets a
+// test fire the 'closed' event, mirroring the slice of the Electron API the
+// registry actually touches.
+function makeFakeWindow() {
+  const listeners = {}
+  const calls = { focus: 0, show: 0, restore: 0 }
+  let destroyed = false
+  let minimized = false
+  let visible = true
+
+  return {
+    on(event, handler) {
+      listeners[event] = handler
+
+      return this
+    },
+    emit(event) {
+      listeners[event]?.()
+    },
+    isDestroyed: () => destroyed,
+    destroy() {
+      destroyed = true
+    },
+    isMinimized: () => minimized,
+    setMinimized(value) {
+      minimized = value
+    },
+    isVisible: () => visible,
+    setVisible(value) {
+      visible = value
+    },
+    restore() {
+      calls.restore += 1
+      minimized = false
+    },
+    show() {
+      calls.show += 1
+      visible = true
+    },
+    focus() {
+      calls.focus += 1
+    },
+    calls
+  }
+}
+
+test('buildSessionWindowUrl puts the secondary flag before the hash route (dev server)', () => {
+  const url = buildSessionWindowUrl('abc123', { devServer: 'http://localhost:5173' })
+
+  assert.equal(url, 'http://localhost:5173/?win=secondary#/abc123')
+})
+
+test('buildSessionWindowUrl avoids a double slash when the dev server has a trailing slash', () => {
+  const url = buildSessionWindowUrl('abc123', { devServer: 'http://localhost:5173/' })
+
+  assert.equal(url, 'http://localhost:5173/?win=secondary#/abc123')
+})
+
+test('buildSessionWindowUrl encodes the session id in the hash route', () => {
+  const url = buildSessionWindowUrl('a b/c', { devServer: 'http://localhost:5173' })
+
+  // The query flag must precede the '#' or HashRouter would swallow it as the
+  // route; the id is URL-encoded so slashes/spaces survive routeSessionId().
+  assert.equal(url, 'http://localhost:5173/?win=secondary#/a%20b%2Fc')
+  assert.ok(url.indexOf('?win=secondary') < url.indexOf('#'))
+})
+
+test('buildSessionWindowUrl builds a packaged file URL with the flag before the hash', () => {
+  const url = buildSessionWindowUrl('abc', { rendererIndexPath: '/opt/app/index.html' })
+
+  assert.match(url, /^file:\/\/.*index\.html\?win=secondary#\/abc$/)
+})
+
+test('buildSessionWindowUrl adds the watch flag for spectator windows, before the hash', () => {
+  const url = buildSessionWindowUrl('abc', { devServer: 'http://localhost:5173', watch: true })
+
+  assert.equal(url, 'http://localhost:5173/?win=secondary&watch=1#/abc')
+})
+
+test('buildSessionWindowUrl routes new-session windows to the draft (#/)', () => {
+  const url = buildSessionWindowUrl(null, { devServer: 'http://localhost:5173', newSession: true })
+
+  assert.equal(url, 'http://localhost:5173/?win=secondary&new=1#/')
+})
+
+test('registry opens one window per session and focuses on re-open', () => {
+  const registry = createSessionWindowRegistry()
+  let built = 0
+  const win = makeFakeWindow()
+  const factory = () => {
+    built += 1
+
+    return win
+  }
+
+  const first = registry.openOrFocus('s1', factory)
+  const second = registry.openOrFocus('s1', factory)
+
+  assert.equal(built, 1, 'factory runs once for the same session')
+  assert.equal(first, second)
+  assert.equal(registry.size, 1)
+  assert.equal(win.calls.focus, 1, 'second open focuses the existing window')
+})
+
+test('registry restores + shows a minimized/hidden window on re-open', () => {
+  const registry = createSessionWindowRegistry()
+  const win = makeFakeWindow()
+  registry.openOrFocus('s1', () => win)
+
+  win.setMinimized(true)
+  win.setVisible(false)
+  registry.openOrFocus('s1', () => win)
+
+  assert.equal(win.calls.restore, 1)
+  assert.equal(win.calls.show, 1)
+  assert.equal(win.calls.focus, 1)
+})
+
+test('registry drops the entry when the window closes', () => {
+  const registry = createSessionWindowRegistry()
+  const win = makeFakeWindow()
+  registry.openOrFocus('s1', () => win)
+  assert.equal(registry.size, 1)
+
+  win.emit('closed')
+
+  assert.equal(registry.size, 0)
+  assert.equal(registry.has('s1'), false)
+})
+
+test('registry rebuilds a fresh window after the previous one was destroyed', () => {
+  const registry = createSessionWindowRegistry()
+  const first = makeFakeWindow()
+  registry.openOrFocus('s1', () => first)
+  first.destroy()
+
+  let built = 0
+  const second = makeFakeWindow()
+  const result = registry.openOrFocus('s1', () => {
+    built += 1
+
+    return second
+  })
+
+  assert.equal(built, 1, 'a destroyed window is replaced, not focused')
+  assert.equal(result, second)
+})
+
+test('registry ignores empty / non-string session ids', () => {
+  const registry = createSessionWindowRegistry()
+  let built = 0
+  const factory = () => {
+    built += 1
+
+    return makeFakeWindow()
+  }
+
+  assert.equal(registry.openOrFocus('', factory), null)
+  assert.equal(registry.openOrFocus('   ', factory), null)
+  assert.equal(registry.openOrFocus(null, factory), null)
+  assert.equal(registry.openOrFocus(42, factory), null)
+  assert.equal(built, 0)
+  assert.equal(registry.size, 0)
+})
+
+test('registry trims the session id before keying', () => {
+  const registry = createSessionWindowRegistry()
+  const win = makeFakeWindow()
+  registry.openOrFocus('  s1  ', () => win)
+
+  assert.equal(registry.has('s1'), true)
+})

package/electron/update-remote.cjs

@@ -0,0 +1,56 @@
+/**
+ * Pure helpers for choosing a remote URL during passive update checks.
+ *
+ * A public install can end up with `origin=git@github.com:nastechai/nastech-agent.git`.
+ * If the user's GitHub SSH key is FIDO2/passkey-backed, a background `git fetch
+ * origin` triggers an unexplained hardware-touch prompt. For passive checks
+ * against the official repo we substitute the public HTTPS `ls-remote` path,
+ * which needs no auth and cannot prompt. Active update/apply flows are left
+ * unchanged.
+ *
+ * Extracted from main.cjs so the security-critical remote detection is unit
+ * testable without booting Electron (main.cjs requires('electron') at load).
+ */
+
+const OFFICIAL_REPO_HTTPS_URL = 'https://github.com/nastechai/nastech-agent.git'
+const OFFICIAL_REPO_CANONICAL = 'github.com/nastechai/nastech-agent'
+
+// Normalize common GitHub remote URL forms to `host/owner/repo` (lowercased,
+// no trailing slash, no .git suffix) so SSH and HTTPS forms of the same repo
+// compare equal.
+function canonicalGitHubRemote(url) {
+  if (!url) return ''
+  let value = String(url).trim()
+  if (value.startsWith('git@github.com:')) {
+    value = `github.com/${value.slice('git@github.com:'.length)}`
+  } else if (value.startsWith('ssh://git@github.com/')) {
+    value = `github.com/${value.slice('ssh://git@github.com/'.length)}`
+  } else {
+    try {
+      const parsed = new URL(value)
+      if (parsed.hostname && parsed.pathname) value = `${parsed.hostname}${parsed.pathname}`
+    } catch {
+      // Leave non-URL forms unchanged.
+    }
+  }
+  value = value.trim().replace(/\/+$/, '')
+  if (value.endsWith('.git')) value = value.slice(0, -4)
+  return value.toLowerCase()
+}
+
+function isSshRemote(url) {
+  const value = String(url || '').trim().toLowerCase()
+  return value.startsWith('git@') || value.startsWith('ssh://')
+}
+
+function isOfficialSshRemote(url) {
+  return isSshRemote(url) && canonicalGitHubRemote(url) === OFFICIAL_REPO_CANONICAL
+}
+
+module.exports = {
+  OFFICIAL_REPO_HTTPS_URL,
+  OFFICIAL_REPO_CANONICAL,
+  canonicalGitHubRemote,
+  isSshRemote,
+  isOfficialSshRemote
+}

package/electron/update-remote.test.cjs

@@ -0,0 +1,78 @@
+/**
+ * Tests for electron/update-remote.cjs — the remote-detection helpers that
+ * keep passive update checks off the SSH origin for official installs.
+ *
+ * Run with: node --test electron/update-remote.test.cjs
+ * (Wired into npm test:desktop:platforms in package.json.)
+ *
+ * Why this matters: a public install can carry
+ * origin=git@github.com:nastech-ai/NasTech-Agent.git. A background
+ * `git fetch origin` then authenticates over SSH and, with a FIDO2/passkey
+ * key, triggers an unexplained hardware-touch prompt. isOfficialSshRemote
+ * must reliably recognize the official SSH remote (in every URL form,
+ * case-insensitively) so the caller can swap in the anonymous HTTPS path —
+ * while NOT misclassifying forks, other hosts, or the HTTPS remote (which
+ * never prompts and should keep the normal fetch path).
+ */
+
+const test = require('node:test')
+const assert = require('node:assert/strict')
+
+const {
+  OFFICIAL_REPO_HTTPS_URL,
+  OFFICIAL_REPO_CANONICAL,
+  canonicalGitHubRemote,
+  isSshRemote,
+  isOfficialSshRemote
+} = require('./update-remote.cjs')
+
+test('canonicalGitHubRemote normalizes SSH and HTTPS forms to the same value', () => {
+  assert.equal(canonicalGitHubRemote('git@github.com:nastech-ai/NasTech-Agent.git'), OFFICIAL_REPO_CANONICAL)
+  assert.equal(canonicalGitHubRemote('git@github.com:nastech-ai/NasTech-Agent'), OFFICIAL_REPO_CANONICAL)
+  assert.equal(canonicalGitHubRemote('ssh://git@github.com/nastech-ai/NasTech-Agent.git'), OFFICIAL_REPO_CANONICAL)
+  assert.equal(canonicalGitHubRemote('https://github.com/nastech-ai/NasTech-Agent.git'), OFFICIAL_REPO_CANONICAL)
+  // Case-insensitive: an uppercased owner still canonicalizes to the same repo.
+  assert.equal(canonicalGitHubRemote('git@github.com:NASTECHAI/nastech-agent.git'), OFFICIAL_REPO_CANONICAL)
+  // Trailing slashes are stripped.
+  assert.equal(canonicalGitHubRemote('https://github.com/nastech-ai/NasTech-Agent/'), OFFICIAL_REPO_CANONICAL)
+})
+
+test('canonicalGitHubRemote is empty for falsy input', () => {
+  assert.equal(canonicalGitHubRemote(''), '')
+  assert.equal(canonicalGitHubRemote(null), '')
+  assert.equal(canonicalGitHubRemote(undefined), '')
+})
+
+test('isSshRemote detects scp-like and ssh:// forms only', () => {
+  assert.equal(isSshRemote('git@github.com:nastech-ai/NasTech-Agent.git'), true)
+  assert.equal(isSshRemote('ssh://git@github.com/nastech-ai/NasTech-Agent.git'), true)
+  assert.equal(isSshRemote('https://github.com/nastech-ai/NasTech-Agent.git'), false)
+  assert.equal(isSshRemote(''), false)
+  assert.equal(isSshRemote(null), false)
+})
+
+test('isOfficialSshRemote is true only for the official repo over SSH', () => {
+  assert.equal(isOfficialSshRemote('git@github.com:nastech-ai/NasTech-Agent.git'), true)
+  assert.equal(isOfficialSshRemote('git@github.com:nastech-ai/NasTech-Agent'), true)
+  assert.equal(isOfficialSshRemote('ssh://git@github.com/nastech-ai/NasTech-Agent.git'), true)
+  // Case-insensitive owner/repo match.
+  assert.equal(isOfficialSshRemote('git@github.com:NASTECHAI/nastech-agent.git'), true)
+})
+
+test('isOfficialSshRemote does NOT match forks, other hosts, or HTTPS', () => {
+  // A fork over SSH belongs to the user — fetching it is their own remote,
+  // not the official upstream, so the SSH-avoidance swap must not apply.
+  assert.equal(isOfficialSshRemote('git@github.com:someuser/nastech-agent.git'), false)
+  // Same repo name on a different host is not the official repo.
+  assert.equal(isOfficialSshRemote('git@gitlab.com:nastech-ai/NasTech-Agent.git'), false)
+  // HTTPS to the official repo never prompts for SSH/FIDO2, so it keeps the
+  // normal fetch path — must not be flagged as an official SSH remote.
+  assert.equal(isOfficialSshRemote('https://github.com/nastech-ai/NasTech-Agent.git'), false)
+  assert.equal(isOfficialSshRemote(''), false)
+  assert.equal(isOfficialSshRemote(null), false)
+})
+
+test('OFFICIAL_REPO_HTTPS_URL canonicalizes to OFFICIAL_REPO_CANONICAL', () => {
+  // Invariant: the URL we substitute in must be the same repo we detect.
+  assert.equal(canonicalGitHubRemote(OFFICIAL_REPO_HTTPS_URL), OFFICIAL_REPO_CANONICAL)
+})