Replace WireGuard prototype with native host service and scoped access

test_network.py

@@ -1,3 +1,4 @@
+from pathlib import Path
 import base64
 import hashlib
 import json
@@ -116,24 +117,19 @@ class APITests(unittest.TestCase):
 if __name__=='__main__':unittest.main()
 
 class TransportTests(unittest.TestCase):
-    def test_status_with_nullable_error_is_success(self):
-        import subprocess
+    def test_native_status_with_nullable_error_is_success(self):
         from network.client import NetworkClient
-        with patch.dict(os.environ, {'DECK_NETWORK_SOCKET':'0'}):
-            client=NetworkClient()
-        result={'installed':True,'error':None,'state':'disabled'}
-        with patch('network.client.subprocess.run',return_value=subprocess.CompletedProcess([],0,json.dumps(result),'')):
-            self.assertTrue(client.call('status')['installed'])
-    def test_installer_bundle_is_complete(self):
-        from network.install_remote import FILES
-        from network.client import ROOT
-        for name in FILES:
-            self.assertTrue((ROOT/name).is_file(),name)
-        self.assertNotIn('test_network.py',FILES)
-    def test_install_password_required_before_thread_or_ssh(self):
+        with tempfile.TemporaryDirectory() as t:
+            token=Path(t)/'proxy-token';token.write_text('synthetic-proxy-token')
+            with patch.dict(os.environ, {'DECK_NETWORK_MODE':'native','DECK_PROXY_TOKEN_FILE':str(token)}), patch('network.client.request',return_value={'installed':True,'error':None,'state':'disabled'}) as transport:
+                client=NetworkClient()
+                self.assertTrue(client.call('status')['installed'])
+                self.assertEqual(transport.call_args.kwargs['path'],'/run/athena-deck-network/control.sock')
+    def test_native_installer_bundle_is_complete(self):
+        from deploy.install import FILES,ROOT
+        for name in ('network/native.py','deploy/setup_network_helper.py','network/config.py','network/client.py'):
+            self.assertIn(name,FILES);self.assertTrue((ROOT/name).is_file())
+    def test_no_legacy_container_install(self):
         from network.client import NetworkClient
-        with patch.dict(os.environ, {'DECK_NETWORK_SOCKET':'0'}):
-            client=NetworkClient()
-        with patch('network.client.subprocess.run') as remote:
-            with self.assertRaises(ValueError):client.install('short')
-            remote.assert_not_called()
+        client=NetworkClient()
+        with self.assertRaises(ValueError):client.install('short')