mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-31 19:16:29 +00:00
39975613b1
Second, deeper pass over tools/gateway/hermes_cli plus first pass over the trees wave 1 missed (acp, acp_adapter, skills, computer_use, docker, dashboard, conformance, monitoring, secret_sources, hermes_state, providers). Same rubric as wave 1 (AGENTS.md test policy); security, alternation/caching invariants, issue-number regressions, and E2E kept. Real test-quality fixes found and rooted out along the way: - tests/tools/test_command_guards.py made real auxiliary-LLM HTTPS calls (DEFAULT_CONFIG smart-approval leaked in) — pinned approval mode=manual via autouse fixture: 17.4s → 0.4s. - test_model_switch_custom_providers.py / test_user_providers_model_switch.py silently probed live provider catalogs (~2s/test) — stubbed cached_provider_model_ids/provider_model_ids/fetch_api_models. - test_telegram_noise_filter.py: 15-platform copy-paste matrix over shared gateway.run logic → 3 representative platforms (55s → 3.9s). - test_gateway_shutdown.py: stop()'s 5s interrupt-deadline loop spun on MagicMock agents — interrupt.side_effect now clears _running_agents (22s → 1.0s). - test_gateway_inactivity_timeout.py poll-harness timings shrunk 3-5x (24s → 1.1s); test_mcp_stability.py backoff/SIGTERM-grace sleeps patched (15.4s → 2.5s); test_async_delegation.py negative-drain wait 5s → 0.5s. - test_telegram_init_deadline.py: loop-block margin restored to 1.0s with rationale comment — the watchdog-dump assertion needs the loop blocked well past deadline+grace under parallel load (flaked once in the 40-worker verification run at a 0.2s margin). Verification: full hermetic suite via scripts/run_tests.sh — 2,438 files, 21,718 tests passed, 0 failed, 293.9s wall. Suite totals vs original baseline: 46,820 → 19,757 test functions (−57.8%), wall 583.5s → 293.9s (−50%), subprocess CPU 13,564s → 11,623s.
73 lines
2.7 KiB
Python
73 lines
2.7 KiB
Python
"""Redaction-safe forensic logging at the Nous OAuth quarantine path.
|
|
|
|
A NAS-hosted Fly agent's Nous bootstrap session can take a terminal
|
|
``invalid_grant`` and get quarantined (dead tokens cleared from auth.json).
|
|
Historically this was completely silent — no WARNING+ record at the terminal
|
|
rejection, only a downstream "No access token found" warning once the pool was
|
|
already empty. The Fly log drain is WARNING-only, so nothing about the terminal
|
|
death reached centralized logging. These tests lock in that
|
|
``_quarantine_nous_oauth_state`` now emits a WARNING+ forensic record, and — the
|
|
load-bearing assertion — that the raw refresh token never appears in that output.
|
|
"""
|
|
|
|
import hashlib
|
|
import logging
|
|
|
|
from hermes_cli.auth import AuthError, _quarantine_nous_oauth_state
|
|
|
|
|
|
# A distinctive, obviously-fake refresh token so the redaction assertion is
|
|
# unambiguous if it ever leaks.
|
|
_FAKE_RT = "nous_rt_LEAK_CANARY_do_not_log_raw_0123456789abcdef"
|
|
_EXPECTED_FP = hashlib.sha256(_FAKE_RT.encode("utf-8")).hexdigest()[:12]
|
|
|
|
|
|
def _make_state(**overrides):
|
|
state = {
|
|
"portal_base_url": "https://portal.example.com",
|
|
"client_id": "test-client-id",
|
|
"access_token": "nous_at_SECRET_access_token_material",
|
|
"refresh_token": _FAKE_RT,
|
|
"agent_key": "nous_agent_key_SECRET_material",
|
|
"agent_key_id": "ak-12345",
|
|
"expires_at": "2020-01-01T00:00:00+00:00", # in the past
|
|
"obtained_at": "2019-12-31T00:00:00+00:00",
|
|
}
|
|
state.update(overrides)
|
|
return state
|
|
|
|
|
|
def _error():
|
|
return AuthError(
|
|
"invalid_grant: token expired or revoked",
|
|
provider="nous",
|
|
code="invalid_grant",
|
|
relogin_required=True,
|
|
)
|
|
|
|
|
|
def test_quarantine_emits_warning(caplog):
|
|
state = _make_state()
|
|
with caplog.at_level(logging.WARNING, logger="hermes_cli.auth"):
|
|
_quarantine_nous_oauth_state(state, _error(), reason="unit_test_quarantine")
|
|
|
|
warnings = [r for r in caplog.records if r.levelno >= logging.WARNING]
|
|
assert warnings, "expected at least one WARNING+ record from quarantine"
|
|
assert any("quarantined" in r.getMessage() for r in warnings)
|
|
|
|
|
|
|
|
|
|
def test_raw_refresh_token_never_logged(caplog):
|
|
"""Load-bearing redaction-safety test: the raw secret must never appear."""
|
|
state = _make_state()
|
|
with caplog.at_level(logging.DEBUG, logger="hermes_cli.auth"):
|
|
_quarantine_nous_oauth_state(state, _error(), reason="unit_test_quarantine")
|
|
|
|
text = caplog.text
|
|
assert _FAKE_RT not in text, "RAW refresh token leaked into log output!"
|
|
# Belt-and-suspenders: the access token and agent key must not leak either.
|
|
assert "nous_at_SECRET_access_token_material" not in text
|
|
assert "nous_agent_key_SECRET_material" not in text
|
|
|
|
|