From e66e02dc83e7b49d1d0e312883328f5c9db7f39b Mon Sep 17 00:00:00 2001
From: Teknium <127238744+teknium1@users.noreply.github.com>
Date: Tue, 21 Jul 2026 19:45:22 -0700
Subject: [PATCH] test(gateway): activate multiplex flag in cross-profile env
 isolation test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The test installs a secret scope and asserts a scope miss does NOT fall
back to the default profile's env — that isolation guarantee only holds
under multiplexing, which the real gateway activates at startup via
set_multiplex_active().  With the #67827 overlay fallthrough (scope miss
→ os.environ when multiplex is OFF), the test needs to model the
multiplexed runtime it is actually testing.
---
 tests/gateway/test_config.py | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/tests/gateway/test_config.py b/tests/gateway/test_config.py
index fae172bb3275..910961dd7bf1 100644
--- a/tests/gateway/test_config.py
+++ b/tests/gateway/test_config.py
@@ -7,7 +7,11 @@ from unittest.mock import patch
 
 import pytest
 
-from agent.secret_scope import reset_secret_scope, set_secret_scope
+from agent.secret_scope import (
+    reset_secret_scope,
+    set_multiplex_active,
+    set_secret_scope,
+)
 from hermes_constants import reset_hermes_home_override, set_hermes_home_override
 from gateway.config import (
     ChannelOverride,
@@ -1831,6 +1835,12 @@ class TestLoadGatewayConfig:
         monkeypatch.setenv("API_SERVER_ENABLED", "true")
         monkeypatch.setenv("DISCORD_BOT_TOKEN", "default-token")
 
+        # Model the real multiplexed gateway: run.py flips the runtime flag at
+        # startup (set_multiplex_active) BEFORE any secondary-profile config
+        # loads.  Without the flag, a scope miss legitimately falls through to
+        # os.environ (single-profile overlay semantics, #67827) and this test
+        # would no longer exercise the cross-profile isolation it's about.
+        set_multiplex_active(True)
         home_token = set_hermes_home_override(str(secondary_home))
         secret_token = set_secret_scope({"DISCORD_BOT_TOKEN": "worker-token"})
         try:
@@ -1838,6 +1848,7 @@ class TestLoadGatewayConfig:
         finally:
             reset_secret_scope(secret_token)
             reset_hermes_home_override(home_token)
+            set_multiplex_active(False)
 
         assert config.multiplex_profiles is True
         assert config.platforms[Platform.DISCORD].token == "worker-token"