From 0c4cab56b4ba0f01f37fd4d36cc7021b1bc69894 Mon Sep 17 00:00:00 2001
From: Teknium <127238744+teknium1@users.noreply.github.com>
Date: Wed, 22 Jul 2026 03:46:35 -0700
Subject: [PATCH] test(secrets): match real ApplyReport shape in isolation test

The fake apply_all in test_external_secret_values_are_isolated_between_homes
returned an ApplyReport with no SourceReports; since #69056 the env_loader
marks _APPLIED_HOMES (and records snapshots) only when at least one enabled
source actually reported, so the fake must include a SourceReport like the
real orchestrator always does.
---
 tests/test_env_loader_secret_sources.py | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/tests/test_env_loader_secret_sources.py b/tests/test_env_loader_secret_sources.py
index ffb5fcc0c10e..4efbfed10f9f 100644
--- a/tests/test_env_loader_secret_sources.py
+++ b/tests/test_env_loader_secret_sources.py
@@ -253,7 +253,12 @@ def test_apply_external_secret_sources_status_line_suppresses_secret_names(
 def test_external_secret_values_are_isolated_between_homes(tmp_path, monkeypatch):
     """A later apply for the same key must not mutate an earlier home snapshot."""
     from agent.secret_scope import build_profile_secret_scope
-    from agent.secret_sources.registry import AppliedVar, ApplyReport
+    from agent.secret_sources.base import FetchResult
+    from agent.secret_sources.registry import (
+        AppliedVar,
+        ApplyReport,
+        SourceReport,
+    )
     from agent.secret_sources import registry as reg_module
 
     home_a = tmp_path / "profile-a"
@@ -274,6 +279,17 @@ def test_external_secret_values_are_isolated_between_homes(tmp_path, monkeypatch
         value = values[str(Path(home_path).resolve())]
         monkeypatch.setenv("SHARED_API_KEY", value)
         return ApplyReport(
+            # Real apply_all always appends a SourceReport per enabled
+            # source; the env_loader guard (#40597) early-returns on an
+            # empty sources list, so the fake must match the real shape.
+            sources=[
+                SourceReport(
+                    name="test-source",
+                    label="Test Source",
+                    result=FetchResult(),
+                    applied=["SHARED_API_KEY"],
+                )
+            ],
             provenance={
                 "SHARED_API_KEY": AppliedVar(
                     name="SHARED_API_KEY",