chore: fix lint and add gateway auth tests

apps/macos/Sources/Clawdis/GatewayEndpointStore.swift

@@ -26,40 +26,51 @@ actor GatewayEndpointStore {
             mode: { await MainActor.run { AppStateStore.shared.connectionMode } },
             token: { ProcessInfo.processInfo.environment["CLAWDIS_GATEWAY_TOKEN"] },
             password: {
-                let raw = ProcessInfo.processInfo.environment["CLAWDIS_GATEWAY_PASSWORD"] ?? ""
-                let trimmed = raw.trimmingCharacters(in: .whitespacesAndNewlines)
-                if !trimmed.isEmpty {
-                    return trimmed
-                }
                 let root = ClawdisConfigFile.loadDict()
-                if CommandResolver.connectionModeIsRemote() {
-                    if let gateway = root["gateway"] as? [String: Any],
-                       let remote = gateway["remote"] as? [String: Any],
-                       let password = remote["password"] as? String
-                    {
-                        let pw = password.trimmingCharacters(in: .whitespacesAndNewlines)
-                        if !pw.isEmpty {
-                            return pw
-                        }
-                    }
-                    return nil
-                }
-                if let gateway = root["gateway"] as? [String: Any],
-                   let auth = gateway["auth"] as? [String: Any],
-                   let password = auth["password"] as? String
-                {
-                    let pw = password.trimmingCharacters(in: .whitespacesAndNewlines)
-                    if !pw.isEmpty {
-                        return pw
-                    }
-                }
-                return nil
+                return GatewayEndpointStore.resolveGatewayPassword(
+                    isRemote: CommandResolver.connectionModeIsRemote(),
+                    root: root,
+                    env: ProcessInfo.processInfo.environment)
             },
             localPort: { GatewayEnvironment.gatewayPort() },
             remotePortIfRunning: { await RemoteTunnelManager.shared.controlTunnelPortIfRunning() },
             ensureRemoteTunnel: { try await RemoteTunnelManager.shared.ensureControlTunnel() })
     }
 
+    private static func resolveGatewayPassword(
+        isRemote: Bool,
+        root: [String: Any],
+        env: [String: String]
+    ) -> String? {
+        let raw = env["CLAWDIS_GATEWAY_PASSWORD"] ?? ""
+        let trimmed = raw.trimmingCharacters(in: .whitespacesAndNewlines)
+        if !trimmed.isEmpty {
+            return trimmed
+        }
+        if isRemote {
+            if let gateway = root["gateway"] as? [String: Any],
+               let remote = gateway["remote"] as? [String: Any],
+               let password = remote["password"] as? String
+            {
+                let pw = password.trimmingCharacters(in: .whitespacesAndNewlines)
+                if !pw.isEmpty {
+                    return pw
+                }
+            }
+            return nil
+        }
+        if let gateway = root["gateway"] as? [String: Any],
+           let auth = gateway["auth"] as? [String: Any],
+           let password = auth["password"] as? String
+        {
+            let pw = password.trimmingCharacters(in: .whitespacesAndNewlines)
+            if !pw.isEmpty {
+                return pw
+            }
+        }
+        return nil
+    }
+
     private let deps: Deps
     private let logger = Logger(subsystem: "com.steipete.clawdis", category: "gateway-endpoint")
 
@@ -193,3 +204,15 @@ actor GatewayEndpointStore {
         }
     }
 }
+
+#if DEBUG
+extension GatewayEndpointStore {
+    static func _testResolveGatewayPassword(
+        isRemote: Bool,
+        root: [String: Any],
+        env: [String: String]
+    ) -> String? {
+        self.resolveGatewayPassword(isRemote: isRemote, root: root, env: env)
+    }
+}
+#endif

apps/macos/Sources/Clawdis/GatewayLaunchAgentManager.swift

@@ -226,5 +226,9 @@ extension GatewayLaunchAgentManager {
     static func _testPreferredGatewayToken() -> String? {
         self.preferredGatewayToken()
     }
+
+    static func _testEscapePlistValue(_ raw: String) -> String {
+        self.escapePlistValue(raw)
+    }
 }
 #endif

apps/macos/Tests/ClawdisIPCTests/GatewayEndpointStoreTests.swift

@@ -82,6 +82,44 @@ import Testing
         #expect(password == "pw")
     }
 
+    @Test func resolvesGatewayPasswordByMode() {
+        let root: [String: Any] = [
+            "gateway": [
+                "auth": ["password": " local "],
+                "remote": ["password": " remote "],
+            ],
+        ]
+        let env: [String: String] = [:]
+
+        #expect(GatewayEndpointStore._testResolveGatewayPassword(
+            isRemote: false,
+            root: root,
+            env: env) == "local")
+        #expect(GatewayEndpointStore._testResolveGatewayPassword(
+            isRemote: true,
+            root: root,
+            env: env) == "remote")
+    }
+
+    @Test func gatewayPasswordEnvOverridesConfig() {
+        let root: [String: Any] = [
+            "gateway": [
+                "auth": ["password": "local"],
+                "remote": ["password": "remote"],
+            ],
+        ]
+        let env = ["CLAWDIS_GATEWAY_PASSWORD": " env "]
+
+        #expect(GatewayEndpointStore._testResolveGatewayPassword(
+            isRemote: false,
+            root: root,
+            env: env) == "env")
+        #expect(GatewayEndpointStore._testResolveGatewayPassword(
+            isRemote: true,
+            root: root,
+            env: env) == "env")
+    }
+
     @Test func unconfiguredModeRejectsConfig() async {
         let mode = ModeBox(.unconfigured)
         let store = GatewayEndpointStore(deps: .init(

apps/macos/Tests/ClawdisIPCTests/LowCoverageHelperTests.swift

@@ -114,6 +114,9 @@ struct LowCoverageHelperTests {
         setenv(keyToken, " secret ", 1)
         #expect(GatewayLaunchAgentManager._testPreferredGatewayBind() == "lan")
         #expect(GatewayLaunchAgentManager._testPreferredGatewayToken() == "secret")
+        #expect(
+            GatewayLaunchAgentManager._testEscapePlistValue("a&b<c>\"'") ==
+                "a&amp;b&lt;c&gt;&quot;&apos;")
 
         #expect(GatewayLaunchAgentManager._testGatewayExecutablePath(bundlePath: "/App") == "/App/Contents/Resources/Relay/clawdis")
         #expect(GatewayLaunchAgentManager._testRelayDir(bundlePath: "/App") == "/App/Contents/Resources/Relay")