fix(auth): hoist get_env_value import + strengthen .env fallback tests

Follow-up to cherry-picked PR #15920:

- agent/credential_pool.py: hoist 'from hermes_cli.config import get_env_value'
  to module top instead of inline try/except in each seed site (3 sites).
  No import cycle — hermes_cli/config.py doesn't depend on agent.credential_pool.
- hermes_cli/auth.py: same hoist for the _resolve_api_key_provider_secret loop.
- tests/tools/test_credential_pool_env_fallback.py: replace smoke-only tests
  with real .env file I/O. Each test writes a temp ~/.hermes/.env, verifies
  _seed_from_env / _resolve_api_key_provider_secret read from it, and asserts
  the full priority chain: os.environ > .env > credential_pool. Uses
  'deepseek' as the test provider since 'openai' isn't in PROVIDER_REGISTRY
  and _seed_from_env's generic path requires a real pconfig lookup.
This commit is contained in:
Teknium 2026-04-26 08:30:56 -07:00 committed by Teknium
parent 27f4dba5ce
commit f2d655529a
3 changed files with 184 additions and 98 deletions

View file

@ -467,13 +467,10 @@ def _resolve_api_key_provider_secret(
pass
return "", ""
from hermes_cli.config import get_env_value
for env_var in pconfig.api_key_env_vars:
# Check both os.environ and ~/.hermes/.env file
try:
from hermes_cli.config import get_env_value
val = (get_env_value(env_var) or "").strip()
except Exception:
val = os.getenv(env_var, "").strip()
val = (get_env_value(env_var) or "").strip()
if has_usable_secret(val):
return val, env_var