From d98ea211f91e1ae6a59b6cd9160855b3d75a13df Mon Sep 17 00:00:00 2001
From: atakan g <atakan1705@hotmail.com>
Date: Tue, 21 Jul 2026 01:22:27 +0300
Subject: [PATCH] test: cover both multiplex URL policy orderings

---
 tests/tools/test_browser_ssrf_local.py | 13 ++++++++++---
 tests/tools/test_url_safety.py         | 13 ++++++++++---
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/tests/tools/test_browser_ssrf_local.py b/tests/tools/test_browser_ssrf_local.py
index 728c594b2684..8ed0b6eeffa6 100644
--- a/tests/tools/test_browser_ssrf_local.py
+++ b/tests/tools/test_browser_ssrf_local.py
@@ -369,8 +369,13 @@ class TestAllowPrivateUrlsConfig:
 
         assert browser_tool._allow_private_urls() is False
 
+    @pytest.mark.parametrize(
+        "profile_order",
+        [("allowed", "blocked"), ("blocked", "allowed")],
+        ids=["allowed-then-blocked", "blocked-then-allowed"],
+    )
     def test_profile_scoped_config_does_not_reuse_another_profiles_opt_out(
-        self, tmp_path
+        self, tmp_path, profile_order
     ):
         """The browser's independent guard must follow the active profile."""
         from hermes_constants import (
@@ -396,5 +401,7 @@ class TestAllowPrivateUrlsConfig:
             finally:
                 reset_hermes_home_override(token)
 
-        assert under_profile(allowed_home) is True
-        assert under_profile(blocked_home) is False
+        homes = {"allowed": allowed_home, "blocked": blocked_home}
+        expected = {"allowed": True, "blocked": False}
+        for profile in profile_order:
+            assert under_profile(homes[profile]) is expected[profile]
diff --git a/tests/tools/test_url_safety.py b/tests/tools/test_url_safety.py
index 1eb4da14a9be..56bfe9b34c7b 100644
--- a/tests/tools/test_url_safety.py
+++ b/tests/tools/test_url_safety.py
@@ -590,8 +590,13 @@ class TestGlobalAllowPrivateUrls:
         monkeypatch.setenv("HERMES_ALLOW_PRIVATE_URLS", "false")
         assert _global_allow_private_urls() is True
 
+    @pytest.mark.parametrize(
+        "profile_order",
+        [("allowed", "blocked"), ("blocked", "allowed")],
+        ids=["allowed-then-blocked", "blocked-then-allowed"],
+    )
     def test_profile_scoped_config_does_not_reuse_another_profiles_opt_out(
-        self, tmp_path, monkeypatch
+        self, tmp_path, monkeypatch, profile_order
     ):
         """Multiplexed profiles must resolve their own private-URL policy."""
         from hermes_constants import (
@@ -623,8 +628,10 @@ class TestGlobalAllowPrivateUrls:
             finally:
                 reset_hermes_home_override(token)
 
-        assert under_profile(allowed_home) is True
-        assert under_profile(blocked_home) is False
+        homes = {"allowed": allowed_home, "blocked": blocked_home}
+        expected = {"allowed": True, "blocked": False}
+        for profile in profile_order:
+            assert under_profile(homes[profile]) is expected[profile]
 
 
 class TestAllowPrivateUrlsIntegration: