fix(macos): validate embedded CLI helper

apps/macos/Tests/ClawdisIPCTests/CLIInstallerTests.swift

@@ -0,0 +1,43 @@
+import Foundation
+import Testing
+@testable import Clawdis
+
+@Suite(.serialized)
+@MainActor
+struct CLIInstallerTests {
+    @Test func installedLocationOnlyAcceptsEmbeddedHelper() throws {
+        let fm = FileManager.default
+        let root = fm.temporaryDirectory.appendingPathComponent(
+            "clawdis-cli-installer-\(UUID().uuidString)")
+        defer { try? fm.removeItem(at: root) }
+
+        let embedded = root.appendingPathComponent("Relay/clawdis")
+        try fm.createDirectory(at: embedded.deletingLastPathComponent(), withIntermediateDirectories: true)
+        fm.createFile(atPath: embedded.path, contents: Data())
+        try fm.setAttributes([.posixPermissions: 0o755], ofItemAtPath: embedded.path)
+
+        let binDir = root.appendingPathComponent("bin")
+        try fm.createDirectory(at: binDir, withIntermediateDirectories: true)
+        let link = binDir.appendingPathComponent("clawdis")
+        try fm.createSymbolicLink(at: link, withDestinationURL: embedded)
+
+        let found = CLIInstaller.installedLocation(
+            searchPaths: [binDir.path],
+            embeddedHelper: embedded,
+            fileManager: fm)
+        #expect(found == link.path)
+
+        try fm.removeItem(at: link)
+        let other = root.appendingPathComponent("Other/clawdis")
+        try fm.createDirectory(at: other.deletingLastPathComponent(), withIntermediateDirectories: true)
+        fm.createFile(atPath: other.path, contents: Data())
+        try fm.setAttributes([.posixPermissions: 0o755], ofItemAtPath: other.path)
+        try fm.createSymbolicLink(at: link, withDestinationURL: other)
+
+        let rejected = CLIInstaller.installedLocation(
+            searchPaths: [binDir.path],
+            embeddedHelper: embedded,
+            fileManager: fm)
+        #expect(rejected == nil)
+    }
+}

apps/macos/Tests/ClawdisIPCTests/GatewayDiscoveryModelTests.swift

@@ -1,7 +1,9 @@
 import Testing
 @testable import Clawdis
 
-@Suite struct GatewayDiscoveryModelTests {
+@Suite
+@MainActor
+struct GatewayDiscoveryModelTests {
     @Test func localGatewayMatchesLanHost() {
         let local = GatewayDiscoveryModel.LocalIdentity(
             hostTokens: ["studio"],

apps/macos/Tests/ClawdisIPCTests/MacGatewayChatTransportMappingTests.swift

@@ -16,6 +16,7 @@ import Testing
             server: [:],
             features: [:],
             snapshot: snapshot,
+            canvashosturl: nil,
             policy: [:])
 
         let mapped = MacGatewayChatTransport.mapPushToTransportEvent(.snapshot(hello))

apps/macos/Tests/ClawdisIPCTests/MasterDiscoveryMenuSmokeTests.swift

@@ -6,41 +6,56 @@ import Testing
 @MainActor
 struct MasterDiscoveryMenuSmokeTests {
     @Test func inlineListBuildsBodyWhenEmpty() {
-        let discovery = MasterDiscoveryModel()
+        let discovery = GatewayDiscoveryModel()
         discovery.statusText = "Searching…"
-        discovery.masters = []
+        discovery.gateways = []
 
-        let view = MasterDiscoveryInlineList(discovery: discovery, currentTarget: nil, onSelect: { _ in })
+        let view = GatewayDiscoveryInlineList(discovery: discovery, currentTarget: nil, onSelect: { _ in })
         _ = view.body
     }
 
     @Test func inlineListBuildsBodyWithMasterAndSelection() {
-        let discovery = MasterDiscoveryModel()
+        let discovery = GatewayDiscoveryModel()
         discovery.statusText = "Found 1"
-        discovery.masters = [
-            .init(
+        discovery.gateways = [
+            GatewayDiscoveryModel.DiscoveredGateway(
                 displayName: "Office Mac",
                 lanHost: "office.local",
                 tailnetDns: "office.tailnet-123.ts.net",
                 sshPort: 2222,
-                debugID: "office"),
+                stableID: "office",
+                debugID: "office",
+                isLocal: false),
         ]
 
         let currentTarget = "\(NSUserName())@office.tailnet-123.ts.net:2222"
-        let view = MasterDiscoveryInlineList(discovery: discovery, currentTarget: currentTarget, onSelect: { _ in })
+        let view = GatewayDiscoveryInlineList(discovery: discovery, currentTarget: currentTarget, onSelect: { _ in })
         _ = view.body
     }
 
     @Test func menuBuildsBodyWithMasters() {
-        let discovery = MasterDiscoveryModel()
+        let discovery = GatewayDiscoveryModel()
         discovery.statusText = "Found 2"
-        discovery.masters = [
-            .init(displayName: "A", lanHost: "a.local", tailnetDns: nil, sshPort: 22, debugID: "a"),
-            .init(displayName: "B", lanHost: nil, tailnetDns: "b.ts.net", sshPort: 22, debugID: "b"),
+        discovery.gateways = [
+            GatewayDiscoveryModel.DiscoveredGateway(
+                displayName: "A",
+                lanHost: "a.local",
+                tailnetDns: nil,
+                sshPort: 22,
+                stableID: "a",
+                debugID: "a",
+                isLocal: false),
+            GatewayDiscoveryModel.DiscoveredGateway(
+                displayName: "B",
+                lanHost: nil,
+                tailnetDns: "b.ts.net",
+                sshPort: 22,
+                stableID: "b",
+                debugID: "b",
+                isLocal: false),
         ]
 
-        let view = MasterDiscoveryMenu(discovery: discovery, onSelect: { _ in })
+        let view = GatewayDiscoveryMenu(discovery: discovery, onSelect: { _ in })
         _ = view.body
     }
 }
-

apps/macos/Tests/ClawdisIPCTests/OnboardingViewSmokeTests.swift

@@ -10,7 +10,7 @@ struct OnboardingViewSmokeTests {
         let view = OnboardingView(
             state: state,
             permissionMonitor: PermissionMonitor.shared,
-            discoveryModel: MasterDiscoveryModel())
+            discoveryModel: GatewayDiscoveryModel())
         _ = view.body
     }
 }