From 28b4fe6007692c5df74a4c3ac3cf90ea2b28cce1 Mon Sep 17 00:00:00 2001 From: Teknium1 <127238744+teknium1@users.noreply.github.com> Date: Sun, 10 May 2026 22:05:08 -0700 Subject: [PATCH] test: stabilize quick-command redaction test against xdist ordering agent.redact._REDACT_ENABLED is snapshotted at import time from HERMES_REDACT_SECRETS env. Under xdist a prior test in the same worker can flip it, so test_exec_command_output_is_redacted was order-dependent. Pin it via monkeypatch like test_terminal_output_transform_still_runs_strip_and_redact does. --- tests/cli/test_quick_commands.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/tests/cli/test_quick_commands.py b/tests/cli/test_quick_commands.py index 35903170bc0..57a39e8c53d 100644 --- a/tests/cli/test_quick_commands.py +++ b/tests/cli/test_quick_commands.py @@ -179,10 +179,15 @@ class TestGatewayQuickCommands: "Quick command leaked OPENROUTER_API_KEY — exec runs without env sanitization" @pytest.mark.asyncio - async def test_exec_command_output_is_redacted(self): + async def test_exec_command_output_is_redacted(self, monkeypatch): """Quick command output must redact sensitive patterns before returning.""" from gateway.run import GatewayRunner + # Ensure redaction is active regardless of host HERMES_REDACT_SECRETS state + # or test ordering (the module snapshots env at import time, so other + # tests in the same xdist worker can flip the flag). + monkeypatch.setattr("agent.redact._REDACT_ENABLED", True) + runner = GatewayRunner.__new__(GatewayRunner) runner.config = {"quick_commands": {"token": {"type": "exec", "command": "echo sk-ant-api03-supersecretkey1234567890"}}} runner._running_agents = {}