test(cli): certify native-root websocket trust

crates/buzz-cli/src/lib.rs

@@ -2028,6 +2028,22 @@ async fn run(cli: Cli) -> Result<(), CliError> {
 #[cfg(test)]
 mod tests {
     use super::*;
+
+    #[tokio::test]
+    #[ignore = "requires BUZZ_TEST_WSS_URL and network access"]
+    async fn configured_wss_trusts_native_platform_roots() {
+        let _ = rustls::crypto::ring::default_provider().install_default();
+        let url = std::env::var("BUZZ_TEST_WSS_URL")
+            .expect("BUZZ_TEST_WSS_URL must name the WSS endpoint to verify");
+
+        let connection = buzz_ws_client::NostrWsConnection::connect(&url)
+            .await
+            .expect("configured WSS endpoint should trust the platform certificate store");
+        connection
+            .disconnect()
+            .await
+            .expect("configured WSS endpoint should close cleanly");
+    }
     use clap::CommandFactory;
 
     /// Raw shorthand `[auth,hex,,hex]` normalizes to strict JSON; the empty

desktop/src-tauri/src/key_backup_tests.rs

@@ -211,12 +211,16 @@ fn generated_passphrase_respects_word_count_and_separator() {
 
 #[test]
 fn generated_passphrase_clamps_word_count() {
+    // Use a separator that cannot appear in the EFF wordlist so a generated
+    // word such as "yo-yo" cannot be mistaken for two words.
+    const SEPARATOR: &str = "|";
+
     // Below the floor: clamped up to MIN_PASSPHRASE_WORDS, never shorter.
-    let phrase = generate_passphrase(1, "-").unwrap();
-    assert_eq!(phrase.split('-').count(), MIN_PASSPHRASE_WORDS);
+    let phrase = generate_passphrase(1, SEPARATOR).unwrap();
+    assert_eq!(phrase.split(SEPARATOR).count(), MIN_PASSPHRASE_WORDS);
     // Above the ceiling: clamped down to MAX_PASSPHRASE_WORDS.
-    let phrase = generate_passphrase(50, "-").unwrap();
-    assert_eq!(phrase.split('-').count(), MAX_PASSPHRASE_WORDS);
+    let phrase = generate_passphrase(50, SEPARATOR).unwrap();
+    assert_eq!(phrase.split(SEPARATOR).count(), MAX_PASSPHRASE_WORDS);
 }
 
 #[test]