mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-31 19:16:29 +00:00
39975613b1
Second, deeper pass over tools/gateway/hermes_cli plus first pass over the trees wave 1 missed (acp, acp_adapter, skills, computer_use, docker, dashboard, conformance, monitoring, secret_sources, hermes_state, providers). Same rubric as wave 1 (AGENTS.md test policy); security, alternation/caching invariants, issue-number regressions, and E2E kept. Real test-quality fixes found and rooted out along the way: - tests/tools/test_command_guards.py made real auxiliary-LLM HTTPS calls (DEFAULT_CONFIG smart-approval leaked in) — pinned approval mode=manual via autouse fixture: 17.4s → 0.4s. - test_model_switch_custom_providers.py / test_user_providers_model_switch.py silently probed live provider catalogs (~2s/test) — stubbed cached_provider_model_ids/provider_model_ids/fetch_api_models. - test_telegram_noise_filter.py: 15-platform copy-paste matrix over shared gateway.run logic → 3 representative platforms (55s → 3.9s). - test_gateway_shutdown.py: stop()'s 5s interrupt-deadline loop spun on MagicMock agents — interrupt.side_effect now clears _running_agents (22s → 1.0s). - test_gateway_inactivity_timeout.py poll-harness timings shrunk 3-5x (24s → 1.1s); test_mcp_stability.py backoff/SIGTERM-grace sleeps patched (15.4s → 2.5s); test_async_delegation.py negative-drain wait 5s → 0.5s. - test_telegram_init_deadline.py: loop-block margin restored to 1.0s with rationale comment — the watchdog-dump assertion needs the loop blocked well past deadline+grace under parallel load (flaked once in the 40-worker verification run at a 0.2s margin). Verification: full hermetic suite via scripts/run_tests.sh — 2,438 files, 21,718 tests passed, 0 failed, 293.9s wall. Suite totals vs original baseline: 46,820 → 19,757 test functions (−57.8%), wall 583.5s → 293.9s (−50%), subprocess CPU 13,564s → 11,623s.
90 lines
3.5 KiB
Python
90 lines
3.5 KiB
Python
"""Regression tests for xAI OAuth refresh write-through to the global root.
|
|
|
|
Companion to ``test_xai_oauth_profile_auth.py``. That file covers the READ
|
|
fallback (profile -> credential pool -> global root). These cover the WRITE
|
|
side: when a profile that has no own ``providers.xai-oauth`` block refreshes
|
|
the (rotating) grant it resolved from the root fallback, the rotated tokens
|
|
must be written back to the global root too. Otherwise root keeps a revoked
|
|
refresh token and every other profile reading root's stale grant dies with
|
|
``invalid_grant`` once its access token expires (issue #43589).
|
|
|
|
The tests drive the real ``_save_xai_oauth_tokens`` against real on-disk auth
|
|
stores (profile + root under ``tmp_path``) rather than mocking the save
|
|
boundary, so they exercise the actual atomic write path.
|
|
"""
|
|
|
|
import json
|
|
|
|
import pytest
|
|
|
|
from hermes_cli import auth
|
|
|
|
|
|
def _write_store(path, store):
|
|
path.parent.mkdir(parents=True, exist_ok=True)
|
|
path.write_text(json.dumps(store), encoding="utf-8")
|
|
|
|
|
|
def _read_store(path):
|
|
return json.loads(path.read_text(encoding="utf-8"))
|
|
|
|
|
|
@pytest.fixture
|
|
def profile_and_root(tmp_path, monkeypatch):
|
|
"""Wire a profile auth store + a distinct global-root auth store on disk.
|
|
|
|
Returns (profile_path, root_path). The pytest seat belt in
|
|
``_write_through_xai_oauth_to_global_root`` only refuses the *real* user's
|
|
``$HOME/.hermes/auth.json``; a tmp_path root is allowed, so we point HOME
|
|
away from the tmp root to keep the guard from tripping on these fixtures.
|
|
"""
|
|
profile_path = tmp_path / "profiles" / "work" / "auth.json"
|
|
root_path = tmp_path / "root" / "auth.json"
|
|
|
|
monkeypatch.setattr(auth, "_auth_file_path", lambda: profile_path)
|
|
monkeypatch.setattr(auth, "_global_auth_file_path", lambda: root_path)
|
|
# Keep the pytest write seat belt from matching our tmp root.
|
|
monkeypatch.setenv("HOME", str(tmp_path / "not-the-root"))
|
|
return profile_path, root_path
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_write_through_is_noop_in_classic_mode(tmp_path, monkeypatch):
|
|
"""Classic mode (profile == root) already saves to root; no double write."""
|
|
profile_path = tmp_path / "auth.json"
|
|
monkeypatch.setattr(auth, "_auth_file_path", lambda: profile_path)
|
|
# Classic mode: _global_auth_file_path returns None.
|
|
monkeypatch.setattr(auth, "_global_auth_file_path", lambda: None)
|
|
_write_store(profile_path, {"version": 1, "providers": {}})
|
|
|
|
# Should not raise and should persist to the single store.
|
|
auth._save_xai_oauth_tokens(
|
|
{"access_token": "a", "refresh_token": "r"}
|
|
)
|
|
store = _read_store(profile_path)
|
|
assert store["providers"]["xai-oauth"]["tokens"]["refresh_token"] == "r"
|
|
|
|
|
|
def test_write_through_failure_does_not_break_profile_save(profile_and_root, monkeypatch):
|
|
"""A failed root write-through must not break the profile's own save."""
|
|
profile_path, root_path = profile_and_root
|
|
_write_store(profile_path, {"version": 1, "providers": {}})
|
|
_write_store(root_path, {"version": 1, "providers": {}})
|
|
|
|
# Make the root write blow up; the profile save must still succeed.
|
|
real_save = auth._save_auth_store
|
|
|
|
def _exploding_save(store, target_path=None):
|
|
if target_path is not None and target_path == root_path:
|
|
raise OSError("simulated root write failure")
|
|
return real_save(store, target_path)
|
|
|
|
monkeypatch.setattr(auth, "_save_auth_store", _exploding_save)
|
|
|
|
auth._save_xai_oauth_tokens({"access_token": "a", "refresh_token": "r"})
|
|
|
|
profile = _read_store(profile_path)
|
|
assert profile["providers"]["xai-oauth"]["tokens"]["refresh_token"] == "r"
|