refactor(desktop): isolate relay auth policy

desktop/src-tauri/src/commands/identity.rs

@@ -8,9 +8,8 @@ use crate::{
     app_state::AppState,
     models::IdentityInfo,
     nostr_bind,
-    relay::{
-        self, nip42_auth_relay_url, relay_api_base_url_with_override, relay_ws_url_with_override,
-    },
+    relay::{self, relay_api_base_url_with_override, relay_ws_url_with_override},
+    relay_auth::nip42_auth_relay_url,
 };
 
 /// Encode `pubkey` as npub bech32 and truncate it for display: first 10 chars

desktop/src-tauri/src/lib.rs

@@ -24,6 +24,7 @@ mod prevent_sleep;
 mod ptt_shortcut;
 mod relay;
 mod relay_admission;
+mod relay_auth;
 mod reset;
 mod secret_store;
 mod shutdown;

desktop/src-tauri/src/managed_agents/discovery/tests.rs

@@ -3,12 +3,13 @@ use std::path::PathBuf;
 use super::overrides::{divergent_agent_command_override, update_time_agent_command_override};
 use super::{
     apply_agent_command_update, classify_runtime, codex_adapter_availability,
-    codex_adapter_is_outdated, create_time_agent_command_override, default_agent_command,
-    effective_agent_command, find_nvm_default_bin, find_via_login_shell,
-    is_login_shell_path_uninit, is_safe_nvm_tag, managed_agent_avatar_url, normalize_agent_args,
-    parse_semver_tag, preset_catalog_entry, probe_codex_acp_version, record_agent_command,
-    refresh_login_shell_path, try_record_agent_command, PresetHarness, BUZZ_AGENT_AVATAR_URL,
-    CLAUDE_CODE_AVATAR_URL, CODEX_AVATAR_URL, GOOSE_AVATAR_URL,
+    codex_adapter_is_outdated, codex_adapter_is_outdated_with_path,
+    create_time_agent_command_override, default_agent_command, effective_agent_command,
+    find_nvm_default_bin, find_via_login_shell, is_login_shell_path_uninit, is_safe_nvm_tag,
+    managed_agent_avatar_url, normalize_agent_args, parse_semver_tag, preset_catalog_entry,
+    probe_codex_acp_version, record_agent_command, refresh_login_shell_path,
+    try_record_agent_command, PresetHarness, BUZZ_AGENT_AVATAR_URL, CLAUDE_CODE_AVATAR_URL,
+    CODEX_AVATAR_URL, GOOSE_AVATAR_URL,
 };
 use crate::managed_agents::AcpAvailabilityStatus;
 
@@ -832,14 +833,10 @@ fn codex_adapter_availability_available_for_minimum_supported_binary() {
     .expect("write script");
     std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755)).expect("chmod script");
 
-    let status = codex_adapter_availability(&bin);
+    let is_outdated = codex_adapter_is_outdated_with_path(&bin, Some("/usr/bin:/bin"));
     let _ = std::fs::remove_dir_all(dir);
 
-    assert_eq!(
-        status,
-        AcpAvailabilityStatus::Available,
-        "minimum supported adapter must classify as Available"
-    );
+    assert!(!is_outdated, "minimum supported adapter must be available");
 }
 
 #[cfg(unix)]

desktop/src-tauri/src/relay.rs

@@ -29,40 +29,6 @@ pub fn relay_ws_url() -> String {
         .unwrap_or_else(|| DEFAULT_RELAY_WS_URL.to_string())
 }
 
-fn resolve_nip42_auth_relay_url(
-    requested_relay_url: &str,
-    configured_relay_url: &str,
-    canonical_relay_url: Option<&str>,
-) -> String {
-    let requested = requested_relay_url.trim().trim_end_matches('/');
-    let configured = configured_relay_url.trim().trim_end_matches('/');
-
-    if requested == configured {
-        if let Some(canonical) = canonical_relay_url
-            .map(str::trim)
-            .filter(|value| !value.is_empty())
-        {
-            return canonical.trim_end_matches('/').to_string();
-        }
-    }
-
-    requested.to_string()
-}
-
-/// Returns the NIP-42 relay tag for a socket connected to `requested_relay_url`.
-///
-/// A Kiingo preview build can dial its restricted Front Door alias while the
-/// relay remains bound to the canonical production tenant URL. The canonical
-/// override applies only when the requested URL exactly matches this build's
-/// configured relay; user-selected communities continue signing their own URL.
-pub fn nip42_auth_relay_url(requested_relay_url: &str) -> String {
-    let configured = relay_ws_url();
-    let canonical = configured_env_var("BUZZ_CANONICAL_RELAY_URL")
-        .or_else(|| option_env!("BUZZ_DESKTOP_BUILD_CANONICAL_RELAY_URL").map(str::to_string));
-
-    resolve_nip42_auth_relay_url(requested_relay_url, &configured, canonical.as_deref())
-}
-
 /// Read the workspace relay URL override, if set. Returns `None` when no
 /// override is active or when the mutex is poisoned (best-effort).
 fn workspace_relay_override(state: &AppState) -> Option<String> {
@@ -637,46 +603,10 @@ mod tests {
     use super::{
         build_profile_event, classify_intercepted_response, effective_agent_relay_url,
         extract_retry_in_hint, parse_command_response, relay_http_base_url,
-        resolve_nip42_auth_relay_url, MALFORMED_RESPONSE_MESSAGE,
+        MALFORMED_RESPONSE_MESSAGE,
     };
     use serde::Deserialize;
 
-    #[test]
-    fn configured_preview_uses_canonical_nip42_relay_tag() {
-        assert_eq!(
-            resolve_nip42_auth_relay_url(
-                "wss://buzz-preview.kiingo.com",
-                "wss://buzz-preview.kiingo.com",
-                Some("wss://chat.kiingo.com"),
-            ),
-            "wss://chat.kiingo.com"
-        );
-    }
-
-    #[test]
-    fn user_selected_relay_cannot_inherit_canonical_override() {
-        assert_eq!(
-            resolve_nip42_auth_relay_url(
-                "wss://another-community.example",
-                "wss://buzz-preview.kiingo.com",
-                Some("wss://chat.kiingo.com"),
-            ),
-            "wss://another-community.example"
-        );
-    }
-
-    #[test]
-    fn canonical_override_normalizes_only_trailing_slashes() {
-        assert_eq!(
-            resolve_nip42_auth_relay_url(
-                "wss://buzz-preview.kiingo.com/",
-                "wss://buzz-preview.kiingo.com",
-                Some(" wss://chat.kiingo.com/ "),
-            ),
-            "wss://chat.kiingo.com"
-        );
-    }
-
     // ── extract_retry_in_hint ────────────────────────────────────────────────
 
     #[test]

desktop/src-tauri/src/relay_auth.rs

@@ -0,0 +1,76 @@
+fn resolve_nip42_auth_relay_url(
+    requested_relay_url: &str,
+    configured_relay_url: &str,
+    canonical_relay_url: Option<&str>,
+) -> String {
+    let requested = requested_relay_url.trim().trim_end_matches('/');
+    let configured = configured_relay_url.trim().trim_end_matches('/');
+
+    if requested == configured {
+        if let Some(canonical) = canonical_relay_url
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+        {
+            return canonical.trim_end_matches('/').to_string();
+        }
+    }
+
+    requested.to_string()
+}
+
+/// Returns the NIP-42 relay tag for a socket connected to `requested_relay_url`.
+///
+/// A Kiingo preview build can dial its restricted Front Door alias while the
+/// relay remains bound to the canonical production tenant URL. The canonical
+/// override applies only when the requested URL exactly matches this build's
+/// configured relay; user-selected communities continue signing their own URL.
+pub fn nip42_auth_relay_url(requested_relay_url: &str) -> String {
+    let configured = crate::relay::relay_ws_url();
+    let canonical = std::env::var("BUZZ_CANONICAL_RELAY_URL")
+        .ok()
+        .filter(|value| !value.trim().is_empty())
+        .or_else(|| option_env!("BUZZ_DESKTOP_BUILD_CANONICAL_RELAY_URL").map(str::to_string));
+
+    resolve_nip42_auth_relay_url(requested_relay_url, &configured, canonical.as_deref())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::resolve_nip42_auth_relay_url;
+
+    #[test]
+    fn configured_preview_uses_canonical_nip42_relay_tag() {
+        assert_eq!(
+            resolve_nip42_auth_relay_url(
+                "wss://buzz-preview.kiingo.com",
+                "wss://buzz-preview.kiingo.com",
+                Some("wss://chat.kiingo.com"),
+            ),
+            "wss://chat.kiingo.com"
+        );
+    }
+
+    #[test]
+    fn user_selected_relay_cannot_inherit_canonical_override() {
+        assert_eq!(
+            resolve_nip42_auth_relay_url(
+                "wss://another-community.example",
+                "wss://buzz-preview.kiingo.com",
+                Some("wss://chat.kiingo.com"),
+            ),
+            "wss://another-community.example"
+        );
+    }
+
+    #[test]
+    fn canonical_override_normalizes_only_trailing_slashes() {
+        assert_eq!(
+            resolve_nip42_auth_relay_url(
+                "wss://buzz-preview.kiingo.com/",
+                "wss://buzz-preview.kiingo.com",
+                Some(" wss://chat.kiingo.com/ "),
+            ),
+            "wss://chat.kiingo.com"
+        );
+    }
+}