mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-31 19:16:29 +00:00
39975613b1
Second, deeper pass over tools/gateway/hermes_cli plus first pass over the trees wave 1 missed (acp, acp_adapter, skills, computer_use, docker, dashboard, conformance, monitoring, secret_sources, hermes_state, providers). Same rubric as wave 1 (AGENTS.md test policy); security, alternation/caching invariants, issue-number regressions, and E2E kept. Real test-quality fixes found and rooted out along the way: - tests/tools/test_command_guards.py made real auxiliary-LLM HTTPS calls (DEFAULT_CONFIG smart-approval leaked in) — pinned approval mode=manual via autouse fixture: 17.4s → 0.4s. - test_model_switch_custom_providers.py / test_user_providers_model_switch.py silently probed live provider catalogs (~2s/test) — stubbed cached_provider_model_ids/provider_model_ids/fetch_api_models. - test_telegram_noise_filter.py: 15-platform copy-paste matrix over shared gateway.run logic → 3 representative platforms (55s → 3.9s). - test_gateway_shutdown.py: stop()'s 5s interrupt-deadline loop spun on MagicMock agents — interrupt.side_effect now clears _running_agents (22s → 1.0s). - test_gateway_inactivity_timeout.py poll-harness timings shrunk 3-5x (24s → 1.1s); test_mcp_stability.py backoff/SIGTERM-grace sleeps patched (15.4s → 2.5s); test_async_delegation.py negative-drain wait 5s → 0.5s. - test_telegram_init_deadline.py: loop-block margin restored to 1.0s with rationale comment — the watchdog-dump assertion needs the loop blocked well past deadline+grace under parallel load (flaked once in the 40-worker verification run at a 0.2s margin). Verification: full hermetic suite via scripts/run_tests.sh — 2,438 files, 21,718 tests passed, 0 failed, 293.9s wall. Suite totals vs original baseline: 46,820 → 19,757 test functions (−57.8%), wall 583.5s → 293.9s (−50%), subprocess CPU 13,564s → 11,623s.
127 lines
3.6 KiB
Python
127 lines
3.6 KiB
Python
"""Orchestrator-level profile secret handling.
|
|
|
|
Covers the two halves of the profile-clobber bug cluster:
|
|
|
|
- ``secrets.preserve_existing`` (#58073): named env vars keep their existing
|
|
value even against a source with ``override_existing: true``.
|
|
- Profile aliasing (#51447): under a named profile, an applied
|
|
``FOO_<PROFILE>`` var also hydrates the canonical ``FOO`` so adapters and
|
|
plugins that read fixed env names see the profile's value.
|
|
|
|
Both are implemented ONCE in ``apply_all()`` so every backend — bundled or
|
|
plugin — gets them for free.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from agent.secret_sources import registry
|
|
from agent.secret_sources.base import ErrorKind, FetchResult, SecretSource
|
|
|
|
|
|
class _FakeBulk(SecretSource):
|
|
name = "fakebulk"
|
|
label = "Fake Bulk"
|
|
shape = "bulk"
|
|
|
|
def __init__(self, secrets):
|
|
self._secrets = secrets
|
|
|
|
def override_existing(self, cfg):
|
|
return bool(cfg.get("override_existing", True))
|
|
|
|
def fetch(self, cfg, home_path):
|
|
res = FetchResult()
|
|
res.secrets = dict(self._secrets)
|
|
return res
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def _clean_registry():
|
|
registry._reset_registry_for_tests()
|
|
registry._BUILTINS_LOADED = True # keep real builtins out
|
|
yield
|
|
registry._reset_registry_for_tests()
|
|
|
|
|
|
def _apply(secrets, cfg_extra=None, home=Path("/tmp/x/.hermes"), env=None):
|
|
registry.register_source(_FakeBulk(secrets), replace=True)
|
|
cfg = {"fakebulk": {"enabled": True}}
|
|
cfg.update(cfg_extra or {})
|
|
env = env if env is not None else {}
|
|
report = registry.apply_all(cfg, home, environ=env)
|
|
return report, env
|
|
|
|
|
|
PROFILE_HOME = Path("/home/u/.hermes/profiles/milla")
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# preserve_existing
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
def test_preserve_existing_beats_override():
|
|
report, env = _apply(
|
|
{"FEISHU_APP_SECRET": "shared", "OPENAI_API_KEY": "fresh"},
|
|
cfg_extra={"preserve_existing": ["FEISHU_APP_SECRET"]},
|
|
env={"FEISHU_APP_SECRET": "profile-local", "OPENAI_API_KEY": "stale"},
|
|
)
|
|
assert env["FEISHU_APP_SECRET"] == "profile-local" # preserved
|
|
assert env["OPENAI_API_KEY"] == "fresh" # override still works
|
|
sr = report.sources[0]
|
|
assert "FEISHU_APP_SECRET" in sr.skipped_existing
|
|
assert "OPENAI_API_KEY" in sr.applied
|
|
|
|
|
|
def test_preserve_existing_only_guards_set_vars():
|
|
"""A preserve-listed var with NO existing value still gets applied."""
|
|
_, env = _apply(
|
|
{"FEISHU_APP_SECRET": "shared"},
|
|
cfg_extra={"preserve_existing": ["FEISHU_APP_SECRET"]},
|
|
env={},
|
|
)
|
|
assert env["FEISHU_APP_SECRET"] == "shared"
|
|
|
|
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# profile aliasing
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
def test_profile_suffixed_var_hydrates_canonical():
|
|
report, env = _apply(
|
|
{"TELEGRAM_BOT_TOKEN_MILLA": "123:tok"},
|
|
home=PROFILE_HOME,
|
|
)
|
|
assert env["TELEGRAM_BOT_TOKEN_MILLA"] == "123:tok"
|
|
assert env["TELEGRAM_BOT_TOKEN"] == "123:tok"
|
|
assert "TELEGRAM_BOT_TOKEN" in report.provenance
|
|
assert any("applied profile-scoped" in w
|
|
for w in report.sources[0].result.warnings)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_hyphenated_profile_name_matches_underscore_suffix():
|
|
_, env = _apply(
|
|
{"SLACK_APP_TOKEN_MY_BOT": "xapp-1"},
|
|
home=Path("/home/u/.hermes/profiles/my-bot"),
|
|
)
|
|
assert env["SLACK_APP_TOKEN"] == "xapp-1"
|
|
|
|
|
|
|
|
|