const artifact = `cli-${os}-${arch}`;
if (commit) {
// Defense-in-depth: same validation as getRemoteCLIBin so the URL
sshRemoteAgentHostHelpers.ts
// can never be formed with a non-SHA commit (would 404) and stays
// consistent with the commit-keyed install path.
const c = validateCommit(commit);
return `${base}/commit:${c}/${artifact}/${quality}`;
}
return `${base}/latest/${artifact}/${quality}`;
}