mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-31 19:16:29 +00:00
39975613b1
Second, deeper pass over tools/gateway/hermes_cli plus first pass over the trees wave 1 missed (acp, acp_adapter, skills, computer_use, docker, dashboard, conformance, monitoring, secret_sources, hermes_state, providers). Same rubric as wave 1 (AGENTS.md test policy); security, alternation/caching invariants, issue-number regressions, and E2E kept. Real test-quality fixes found and rooted out along the way: - tests/tools/test_command_guards.py made real auxiliary-LLM HTTPS calls (DEFAULT_CONFIG smart-approval leaked in) — pinned approval mode=manual via autouse fixture: 17.4s → 0.4s. - test_model_switch_custom_providers.py / test_user_providers_model_switch.py silently probed live provider catalogs (~2s/test) — stubbed cached_provider_model_ids/provider_model_ids/fetch_api_models. - test_telegram_noise_filter.py: 15-platform copy-paste matrix over shared gateway.run logic → 3 representative platforms (55s → 3.9s). - test_gateway_shutdown.py: stop()'s 5s interrupt-deadline loop spun on MagicMock agents — interrupt.side_effect now clears _running_agents (22s → 1.0s). - test_gateway_inactivity_timeout.py poll-harness timings shrunk 3-5x (24s → 1.1s); test_mcp_stability.py backoff/SIGTERM-grace sleeps patched (15.4s → 2.5s); test_async_delegation.py negative-drain wait 5s → 0.5s. - test_telegram_init_deadline.py: loop-block margin restored to 1.0s with rationale comment — the watchdog-dump assertion needs the loop blocked well past deadline+grace under parallel load (flaked once in the 40-worker verification run at a 0.2s margin). Verification: full hermetic suite via scripts/run_tests.sh — 2,438 files, 21,718 tests passed, 0 failed, 293.9s wall. Suite totals vs original baseline: 46,820 → 19,757 test functions (−57.8%), wall 583.5s → 293.9s (−50%), subprocess CPU 13,564s → 11,623s.
95 lines
No EOL
3.1 KiB
Python
95 lines
No EOL
3.1 KiB
Python
"""Tests for hermes_cli/_scan_venv_blockers.py.
|
|
|
|
Tests call the real production functions (``main``, ``_redact_sensitive_cmdline``).
|
|
The detector is patched directly so no real process table interaction occurs.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import builtins
|
|
import json
|
|
import sys
|
|
import types
|
|
from pathlib import Path
|
|
from unittest.mock import MagicMock, patch
|
|
|
|
import pytest
|
|
|
|
import agent.redact as redact_module
|
|
from hermes_cli._scan_venv_blockers import (
|
|
_redact_sensitive_cmdline,
|
|
main,
|
|
)
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# main() — stdout, stderr, exit code (with patched detector)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
def _psutil_fake() -> dict:
|
|
"""Return a sys.modules dict entry that makes psutil appear available."""
|
|
return {"psutil": types.SimpleNamespace(Process=lambda *a: MagicMock())}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# _redact_sensitive_cmdline
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
def test_redact_long_flag_value_space_separated() -> None:
|
|
"""--token SECRET must preserve --token and emit --token <redacted>."""
|
|
raw = "python.exe -m hermes_cli.main serve --token ghp_abc123 --host 10.0.0.1"
|
|
result = _redact_sensitive_cmdline(raw)
|
|
assert result == "python.exe -m hermes_cli.main serve --token <redacted>"
|
|
assert "ghp_abc123" not in result
|
|
|
|
|
|
|
|
|
|
def test_redact_sensitive_text_failure_returns_fully_redacted() -> None:
|
|
"""When agent.redact.redact_sensitive_text raises, the entire result
|
|
must equal '<redacted>' so PID and name still provide diagnostics."""
|
|
with patch.object(
|
|
redact_module,
|
|
"redact_sensitive_text",
|
|
side_effect=RuntimeError("no redactor"),
|
|
):
|
|
result = _redact_sensitive_cmdline("python.exe --token abc123")
|
|
|
|
assert result == "<redacted>"
|
|
|
|
|
|
def test_redact_session_key() -> None:
|
|
"""--session-key <identifier> must redact the value and everything after."""
|
|
raw = "python.exe -m tui_gateway.slash_worker --session-key 20260712-abcdef --model test"
|
|
result = _redact_sensitive_cmdline(raw)
|
|
assert result == "python.exe -m tui_gateway.slash_worker --session-key <redacted>"
|
|
|
|
|
|
def test_redact_normal_host_port_profile_remain() -> None:
|
|
raw = "python.exe -m hermes_cli.main serve --host 10.0.0.1 --port 9119 --profile work"
|
|
result = _redact_sensitive_cmdline(raw)
|
|
assert "10.0.0.1" in result
|
|
assert "9119" in result
|
|
assert "work" in result
|
|
|
|
|
|
def test_redact_no_sensitive_flags_is_noop() -> None:
|
|
raw = "python.exe -m hermes_cli.main serve --host 127.0.0.1"
|
|
assert _redact_sensitive_cmdline(raw) == raw
|
|
|
|
|
|
def test_redact_empty_string() -> None:
|
|
assert _redact_sensitive_cmdline("") == ""
|
|
|
|
|
|
def test_redact_short_flags_not_redacted() -> None:
|
|
"""Short flags -t (toolset), -p (profile), -k are NOT redacted."""
|
|
raw = "python.exe -m hermes_cli.main serve -t web -p default -k somearg"
|
|
result = _redact_sensitive_cmdline(raw)
|
|
assert result == raw # short flags pass through unchanged |