From 471d00cd6421742bbabb84b05d42899e58792f61 Mon Sep 17 00:00:00 2001
From: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Date: Sat, 1 Aug 2026 18:21:23 -0700
Subject: [PATCH] test(ssh): isolate connection tests from the developer's own
 FIDO2 keys

Transport selection now scans every default identity instead of stopping at
the first normal key, so a `~/.ssh/id_ed25519_sk` on the machine running the
suite would decide which transport the default-target tests take. Mock
`findSystemSsh` to null by default and opt the two security-key tests in.
---
 src/main/ssh/ssh-connection.test.ts | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/main/ssh/ssh-connection.test.ts b/src/main/ssh/ssh-connection.test.ts
index db5287d2aef..25bcaf447af 100644
--- a/src/main/ssh/ssh-connection.test.ts
+++ b/src/main/ssh/ssh-connection.test.ts
@@ -148,17 +148,23 @@ vi.mock('ssh2', () => {
 })
 
 const {
+  findSystemSshMock,
   getOrcaControlSocketPathMock,
   removeControlSocketPathMock,
   spawnSystemSshCommandMock,
   spawnSystemSshMock
 } = vi.hoisted(() => ({
+  findSystemSshMock: vi.fn<() => string | null>(),
   getOrcaControlSocketPathMock: vi.fn(),
   removeControlSocketPathMock: vi.fn(),
   spawnSystemSshMock: vi.fn(),
   spawnSystemSshCommandMock: vi.fn()
 }))
 
+// Why: security-key transport selection scans the real ~/.ssh defaults, so a developer's own
+// FIDO2 key would otherwise decide which transport these tests take.
+vi.mock('./system-ssh-binary', () => ({ findSystemSsh: findSystemSshMock }))
+
 vi.mock('./ssh-system-fallback', () => ({
   getOrcaControlSocketPath: getOrcaControlSocketPathMock,
   spawnSystemSsh: spawnSystemSshMock,
@@ -331,6 +337,8 @@ describe('SshConnection', () => {
     vi.mocked(writeFileViaSystemSsh).mockResolvedValue(undefined)
     vi.mocked(resolveWithSshG).mockReset()
     vi.mocked(resolveWithSshG).mockResolvedValue(null)
+    findSystemSshMock.mockReset()
+    findSystemSshMock.mockReturnValue(null)
     vi.unstubAllEnvs()
   })
 
@@ -1697,6 +1705,7 @@ describe('SshConnection', () => {
   })
 
   it('uses system SSH before ssh2 parses a security-key private key', async () => {
+    findSystemSshMock.mockReturnValue('/usr/bin/ssh')
     const directory = mkdtempSync(join(tmpdir(), 'orca-security-key-connect-'))
     const keyPath = join(directory, 'id_ed25519_sk')
     writeFileSync(
@@ -1718,6 +1727,7 @@ describe('SshConnection', () => {
   })
 
   it('uses system SSH for an agent-backed security-key public identity', async () => {
+    findSystemSshMock.mockReturnValue('/usr/bin/ssh')
     const directory = mkdtempSync(join(tmpdir(), 'orca-security-key-agent-connect-'))
     const identityPath = join(directory, 'id_ed25519_sk')
     writeFileSync(