fix(switch): disable unvalidated network features on NX

Co-authored-by: Cursor <cursoragent@cursor.com>

src/import/RomImporter.lua

@@ -542,6 +542,7 @@ end
 -- import-only run all skip the release check so headless and CI runs never spin
 -- up the background worker or reach out to the network.
 local function updaterAllowed()
+  if not Platform.networkValidated() then return false end
   if not (love.filesystem.isFused and love.filesystem.isFused()) then return false end
   if os.getenv("POKEPORT_AUTOPILOT") or os.getenv("POKEPORT_DRIVER") then return false end
   if os.getenv("POKEPORT_IMPORT_ONLY") == "1" then return false end
@@ -3063,12 +3064,14 @@ function RomImporter:_drawTabBar(x, y, w, h, chip)
       under = PAL.gold,   label = Strings("YELLOW"), ink = PAL.chipInkGold },
     { id = "mods",   mods = true,  top = PAL.chipModTop,  bot = PAL.chipModBot,
       under = PAL.modDot, label = Strings("MODS") },
+  }
+  if Platform.networkValidated() then
     -- Browsing a community index sits beside the installed list rather than
     -- inside it: one answers "what do I have", the other "what is out there",
     -- and the second is empty until the player adds an index of their own.
-    { id = "find",   find = true,  top = PAL.chipModTop,  bot = PAL.chipModBot,
-      under = PAL.modDot, label = Strings("FIND MODS") },
-  }
+    tabs[#tabs + 1] = { id = "find",   find = true,  top = PAL.chipModTop,  bot = PAL.chipModBot,
+      under = PAL.modDot, label = Strings("FIND MODS") }
+  end
   local gap = 10 * s
   local r = 12 * s
   local chipY = y + (h - chip) / 2 - 2 * s
@@ -3952,6 +3955,11 @@ end
 -- Update button: when a newer release is known, confirm then install; when
 -- already current, force-refresh the 6h cache and report / offer update.
 function RomImporter:_modGithubAction(id, action)
+  if not Platform.networkValidated() then
+    self.modNotice = { ok = false,
+      text = "Remote mod download is unavailable on this platform." }
+    return
+  end
   local ran, err = pcall(function()
     local ModUpdate = require("src.mods.ModUpdate")
     local row
@@ -4189,7 +4197,7 @@ function RomImporter:_drawModsPanel(x, y, w, h, paged)
     local chipW = self.hintFont:getWidth(chipText) + 20 * s
     local delW = self.hintFont:getWidth("Delete") + 24 * s
     local verW = self.hintFont:getWidth("Versions") + 24 * s
-    local hasGh = m.github and m.github ~= ""
+    local hasGh = m.github and m.github ~= "" and Platform.networkValidated()
     local info = hasGh and self:_modUpdateInfo(m.id) or nil
     local updLabel = "Check for updates"
     local updateKind = "neutral"
@@ -4421,6 +4429,11 @@ end
 -- must not offer two.  Per-source failures are collected rather than fatal: an
 -- index that is down should cost its own rows, not everybody else's.
 function RomImporter:_refreshFind(force)
+  if not Platform.networkValidated() then
+    self.findLoaded = true
+    self.findIndex = { mods = {}, categories = {} }
+    return
+  end
   local ModIndex = require("src.mods.ModIndex")
   self:_refreshFindSources()
   local mods, seen, cats, catSeen, errs = {}, {}, {}, {}, {}

tests/platform_nx_network_gate_test.lua

@@ -0,0 +1,47 @@
+-- Self-updater and remote mod download must stay off on NX until validated.
+package.path = "./?.lua;./?/init.lua;" .. package.path
+if not _G.love then _G.love = require("tests.love_stub") end
+love.system = love.system or {}
+love.filesystem = love.filesystem or {}
+
+local S = require("tests.harness").suite("platform NX network gate")
+local check = S.check
+local eq = S.eq
+
+local checkStarted = false
+package.loaded["src.update.Check"] = {
+  start = function() checkStarted = true end,
+  state = function() return { status = "idle" } end,
+}
+
+love.system.getOS = function() return "NX" end
+love.filesystem.isFused = function() return true end
+love.filesystem.getSaveDirectory = function() return "/save/pokemon-love2d" end
+
+package.loaded["src.core.Platform"] = nil
+package.loaded["src.import.RomImporter"] = nil
+local RomImporter = require("src.import.RomImporter")
+
+local ri = RomImporter.new(function() end, { launcher = true })
+ri.ready = { red = false, blue = false, yellow = false }
+eq(checkStarted, false, "self-updater does not start on NX fused launcher")
+check(ri.Check == nil, "launcher has no Check module on NX")
+
+eq(require("src.core.Platform").networkValidated(), false,
+  "NX reports networkValidated false")
+
+ri.mods = { { id = "demo", name = "Demo", github = "owner/repo", version = "1.0.0" } }
+ri:_modGithubAction("demo", "update")
+check(ri.modNotice and not ri.modNotice.ok,
+  "remote mod github action is blocked on NX")
+
+ri.tab = "find"
+ri:_refreshFind(true)
+eq(#((ri.findIndex and ri.findIndex.mods) or {}), 0,
+  "find mods refresh stays empty on NX")
+
+package.loaded["src.update.Check"] = nil
+package.loaded["src.core.Platform"] = nil
+package.loaded["src.import.RomImporter"] = nil
+
+S.finish()

tests/run_tests.lua

@@ -3372,6 +3372,7 @@ runSuites({ "tests/rom_importer_double_pick_test.lua" })
 -- ---------------------------------------------- Switch platform capabilities
 runSuites({ "tests/platform_nx_test.lua" })
 runSuites({ "tests/platform_nx_shell_gate_test.lua" })
+runSuites({ "tests/platform_nx_network_gate_test.lua" })
 -- ---------------------------------------------- parity workstream tests
 -- Each tests/parity_*.lua is a self-contained file (own bootstrap + check,
 -- error()s if any assertion fails).  Globbed, so dropping a new parity