From ebe5e0554975c7c111793a8f0ad203846078466b Mon Sep 17 00:00:00 2001
From: Khaliq <khaliq@agentrelay.com>
Date: Wed, 5 Aug 2026 14:05:48 +0200
Subject: [PATCH] test(cli): cover login --token defaulting to hosted relayfile
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Verified — no production code change needed — that the CLI already
defaults to https://file.agentrelay.com. Traced defaultServerURL
through runLogin, loginWithAPIKey, newAPIClient, and resolveServer;
no Go code retains the stale https://api.relayfile.dev default. Adds
a real regression test asserting login --token with no --server
issues its health check against, and persists, the hosted endpoint.

Closes #328.

Verified:
- go build ./...
- go test ./cmd/relayfile-cli/... -run TestLoginWithTokenDefaultsToHostedRelayfile -v -count=1
- go test ./cmd/relayfile-cli/... -count=1 (full package suite)
---
 cmd/relayfile-cli/main_test.go | 45 ++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/cmd/relayfile-cli/main_test.go b/cmd/relayfile-cli/main_test.go
index 71b4e9c2..afcaf5a2 100644
--- a/cmd/relayfile-cli/main_test.go
+++ b/cmd/relayfile-cli/main_test.go
@@ -6665,6 +6665,51 @@ func TestStatusUsesSavedTokenToDisambiguateDuplicateWorkspaceNames(t *testing.T)
 	}
 }
 
+type funcRoundTripper func(*http.Request) (*http.Response, error)
+
+func (fn funcRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) {
+	return fn(request)
+}
+
+func TestLoginWithTokenDefaultsToHostedRelayfile(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	clearRelayfileEnv(t)
+
+	previousTransport := http.DefaultTransport
+	t.Cleanup(func() {
+		http.DefaultTransport = previousTransport
+	})
+
+	var requestedURL string
+	http.DefaultTransport = funcRoundTripper(func(request *http.Request) (*http.Response, error) {
+		requestedURL = request.URL.String()
+		if got := request.Header.Get("Authorization"); got != "Bearer rf_test" {
+			t.Fatalf("unexpected Authorization: %q", got)
+		}
+		return &http.Response{
+			StatusCode: http.StatusOK,
+			Body:       io.NopCloser(strings.NewReader("")),
+			Header:     make(http.Header),
+			Request:    request,
+		}, nil
+	})
+
+	var stdout bytes.Buffer
+	if err := run([]string{"login", "--token", "rf_test"}, strings.NewReader(""), &stdout, &stdout); err != nil {
+		t.Fatalf("run login failed: %v\noutput:\n%s", err, stdout.String())
+	}
+	if want := defaultServerURL + "/health"; requestedURL != want {
+		t.Fatalf("login health check URL = %q, want %q", requestedURL, want)
+	}
+	creds, err := loadCredentials()
+	if err != nil {
+		t.Fatalf("loadCredentials failed: %v", err)
+	}
+	if creds.Server != defaultServerURL {
+		t.Fatalf("stored server = %q, want %q", creds.Server, defaultServerURL)
+	}
+}
+
 // TestLoginDelegatesToAgentRelay covers the unified auth behavior: relayfile
 // login no longer writes its own cloud credential store; it delegates to the
 // canonical agent-relay login command.