From c598076b76bcef43ffc1e47b8162c5ce84ccffaf Mon Sep 17 00:00:00 2001 From: Ben Date: Mon, 25 May 2026 10:45:53 +1000 Subject: [PATCH] test(dashboard-auth): strip HERMES_DASHBOARD_OAUTH_* env vars in hermetic fixture When these vars are set in the developer's shell, every /api/status call triggers load_gateway_config() -> discover_plugins() -> the bundled dashboard_auth/nous plugin auto-registers itself, leaking a provider into the registry across tests on the same xdist worker. That breaks assertions like 'auth_providers == []' (loopback) and '== ["stub"]' (gated) in test_dashboard_auth_status_endpoint.py. CI never has these set, so this only surfaced locally -- exactly the hermeticity gap _hermetic_environment is meant to close. Add them to _HERMES_BEHAVIORAL_VARS so the autouse fixture strips them, and to the unset list in scripts/run_tests.sh as belt-and-suspenders for direct pytest invocations. --- tests/conftest.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tests/conftest.py b/tests/conftest.py index ee031fc05a4..81067be6f3e 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -213,6 +213,14 @@ _HERMES_BEHAVIORAL_VARS = frozenset({ "HERMES_KANBAN_CLAIM_LOCK", "HERMES_KANBAN_DISPATCH_IN_GATEWAY", "HERMES_TENANT", + # Dashboard OAuth auth gate (PR #30156). When set, the bundled + # dashboard-auth `nous` plugin auto-registers itself on plugin discovery, + # which is triggered by any `/api/status` call. That leaks a provider + # into the dashboard_auth registry across tests in the same worker and + # makes assertions like `auth_providers == []` flaky. CI never sets + # these, so production tests must not see them either. + "HERMES_DASHBOARD_OAUTH_CLIENT_ID", + "HERMES_DASHBOARD_PORTAL_URL", "TERMINAL_CWD", "TERMINAL_ENV", "TERMINAL_CONTAINER_CPU",