"""Regression tests: a user-approved command runs from a clean interrupt slate. Bug (manual approvals, the default): a user approves a scanner-flagged command, then hits Stop / sends a message. `agent.interrupt()` sets the per-thread interrupt bit on the execution thread *during* the blocking approval-wait; the deny that follows is a no-op once the approval was granted, so the bit persists. Nothing cleared it between approval-grant and `env.execute`, so `_wait_for_process` SIGINT-killed the just-approved command on its first poll and returned exit 130 + "[Command interrupted]" while still carrying the "...approved by the user." note (the 3-part signature). Fix: clear the current thread's interrupt bit once before the approved command spawns its child (terminal foreground; execute_code local + remote), and enrich the note on a genuine post-start interrupt instead of implying success. Invariant preserved: a genuine interrupt arriving AFTER execution starts (or during a retry backoff) must still SIGINT the command (exit 130); non-approved commands keep current interrupt behavior. """ import json import threading import time import pytest from tools import terminal_tool as tt from tools.interrupt import ( set_interrupt, is_interrupted, clear_current_thread_interrupt, _interrupted_threads, _lock, ) @pytest.fixture(autouse=True) def _isolate(tmp_path, monkeypatch): monkeypatch.setenv("HERMES_HOME", str(tmp_path)) (tmp_path / "logs").mkdir(exist_ok=True) # Clean interrupt slate before and after every test so a stale tid left in # the module-global set can't leak across tests in the same worker. with _lock: _interrupted_threads.clear() yield with _lock: _interrupted_threads.clear() def _wait_for_sentinel(sentinel, timeout=10.0): """Block until the running command created its sentinel (proving the clean-slate clear already ran and the command is in its poll loop).""" deadline = time.monotonic() + timeout while time.monotonic() < deadline: if sentinel.exists(): return True time.sleep(0.02) return sentinel.exists() # --------------------------------------------------------------------------- # terminal_tool # --------------------------------------------------------------------------- def test_approved_command_clears_stale_interrupt_bit(): """force=True marks the run user-approved -> the stale bit is cleared and the command completes (exit 0), not killed with 130.""" set_interrupt(True) # simulate a bit that landed during the approval-wait assert is_interrupted() result = json.loads(tt.terminal_tool(command="sleep 0.5; echo DONE", force=True)) assert result["exit_code"] == 0, result assert "DONE" in result["output"] assert "[Command interrupted]" not in result["output"] def test_non_approved_command_still_interrupts_on_stale_bit(monkeypatch): """A command that is auto-approved but NOT user-approved keeps the current interrupt behavior: a pre-existing bit still kills it (DO-NOT-BREAK).""" monkeypatch.setattr(tt, "_check_all_guards", lambda *a, **k: {"approved": True}) set_interrupt(True) result = json.loads(tt.terminal_tool(command="sleep 0.5; echo DONE")) assert result["exit_code"] == 130, result assert "[Command interrupted]" in result["output"] def test_approved_command_genuine_interrupt_after_start_still_kills(tmp_path): """The clean-slate clear must NOT make approved commands un-interruptible: an interrupt that arrives after execution starts still SIGINTs (130).""" sentinel = tmp_path / "cmd_started_c" holder = {} def worker(): holder["result"] = tt.terminal_tool( command=f"touch {sentinel}; sleep 5; echo DONE", force=True ) t = threading.Thread(target=worker, daemon=True) t.start() # Barrier: the command is genuinely running (so the clear already ran) before # we fire the interrupt -- no fixed-sleep timing guess. assert _wait_for_sentinel(sentinel), "command did not start" set_interrupt(True, thread_id=t.ident) # genuine interrupt, AFTER start t.join(timeout=15) assert not t.is_alive(), "worker did not exit after a genuine interrupt" result = json.loads(holder["result"]) assert result["exit_code"] == 130, result assert "[Command interrupted]" in result["output"] set_interrupt(False, thread_id=t.ident) def test_approved_note_enriched_not_misleading_on_interrupt(monkeypatch, tmp_path): """On a genuine post-start interrupt of an approved command, the note must read '...approved by the user, then interrupted.' — the bare '...approved by the user.' must never co-occur with exit 130.""" monkeypatch.setattr( tt, "_check_all_guards", lambda *a, **k: {"approved": True, "user_approved": True, "description": "rm -rf x"}, ) sentinel = tmp_path / "cmd_started_d" holder = {} def worker(): holder["result"] = tt.terminal_tool(command=f"touch {sentinel}; sleep 5; echo DONE") t = threading.Thread(target=worker, daemon=True) t.start() assert _wait_for_sentinel(sentinel), "command did not start" set_interrupt(True, thread_id=t.ident) t.join(timeout=15) assert not t.is_alive() result = json.loads(holder["result"]) assert result["exit_code"] == 130, result note = result.get("approval", "") assert note.endswith("then interrupted."), note assert "approved by the user, then interrupted." in note assert "approved by the user." not in note # success-implying string is gone set_interrupt(False, thread_id=t.ident) def test_natural_exit_130_not_mislabeled_as_interrupt(monkeypatch): """A command that legitimately exits 130 on its own (no interrupt) must NOT get its approval note rewritten to '...then interrupted.'.""" monkeypatch.setattr( tt, "_check_all_guards", lambda *a, **k: {"approved": True, "user_approved": True, "description": "x"}, ) # Clean slate: no interrupt at all. result = json.loads(tt.terminal_tool(command="bash -c 'exit 130'")) assert result["exit_code"] == 130, result note = result.get("approval", "") assert note == "Command required approval (x) and was approved by the user.", note assert "then interrupted" not in note assert "[Command interrupted]" not in result["output"] def test_retry_backoff_does_not_clear_genuine_interrupt(monkeypatch): """A genuine interrupt that lands during the retry backoff must survive (the clear runs ONCE before the loop, never re-clearing on retries).""" from tools.environments.local import LocalEnvironment calls = {"n": 0, "interrupted_at_retry": None} def fake_execute(self, command, **kw): if "sleep 1" not in command: # ignore any incidental execute calls return {"output": "", "returncode": 0} calls["n"] += 1 if calls["n"] == 1: set_interrupt(True) # Stop lands during the first attempt / backoff raise RuntimeError("transient backend error") # Second attempt: the bit set during the backoff must NOT be re-cleared. calls["interrupted_at_retry"] = is_interrupted() return {"output": "partial\n[Command interrupted]", "returncode": 130} monkeypatch.setattr(LocalEnvironment, "execute", fake_execute) monkeypatch.setattr("tools.terminal_tool.time.sleep", lambda *a, **k: None) set_interrupt(False) result = json.loads(tt.terminal_tool(command="sleep 1", force=True, task_id="retry-test")) assert calls["n"] == 2, calls assert calls["interrupted_at_retry"] is True, "retry must NOT re-clear a genuine interrupt" assert result["exit_code"] == 130, result # --------------------------------------------------------------------------- # execute_code (same root cause, its own approval-wait + spawn/poll loop) # --------------------------------------------------------------------------- def test_execute_code_approved_clears_stale_interrupt_bit(monkeypatch): """An approved execute_code script (local path) runs from a clean slate.""" from tools.code_execution_tool import execute_code monkeypatch.setattr( "tools.approval.check_execute_code_guard", lambda *a, **k: {"approved": True, "user_approved": True}, ) set_interrupt(True) assert is_interrupted() result = json.loads(execute_code( code='import time; time.sleep(0.5); print("CODE_DONE")', task_id="test-clean-slate", )) assert result["status"] == "success", result assert "CODE_DONE" in result["output"] assert "execution interrupted" not in result["output"] def test_execute_code_non_approved_still_interrupts_on_stale_bit(monkeypatch): """Non-user-approved execute_code keeps current interrupt behavior.""" from tools.code_execution_tool import execute_code monkeypatch.setattr( "tools.approval.check_execute_code_guard", lambda *a, **k: {"approved": True}, # approved, but NOT user_approved ) set_interrupt(True) result = json.loads(execute_code( code='import time; time.sleep(0.5); print("CODE_DONE")', task_id="test-clean-slate-2", )) # Killed on the first poll before the script can print. assert "CODE_DONE" not in result["output"], result def test_execute_code_remote_clears_stale_bit(monkeypatch): """The clear sits above the local/remote split, so an approved remote (ssh) script also dispatches from a clean slate.""" from tools import code_execution_tool as cet monkeypatch.setattr( "tools.approval.check_execute_code_guard", lambda *a, **k: {"approved": True, "user_approved": True}, ) monkeypatch.setattr("tools.terminal_tool._get_env_config", lambda *a, **k: {"env_type": "ssh"}) captured = {} def fake_remote(code, task_id, enabled_tools): captured["interrupted"] = is_interrupted() return json.dumps({"status": "success", "output": ""}) monkeypatch.setattr(cet, "_execute_remote", fake_remote) set_interrupt(True) # stale bit present before dispatch cet.execute_code(code="print(1)", task_id="remote-clean-slate") assert captured["interrupted"] is False, "clear must run before the remote dispatch"