mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-31 19:16:29 +00:00
39975613b1
Second, deeper pass over tools/gateway/hermes_cli plus first pass over the trees wave 1 missed (acp, acp_adapter, skills, computer_use, docker, dashboard, conformance, monitoring, secret_sources, hermes_state, providers). Same rubric as wave 1 (AGENTS.md test policy); security, alternation/caching invariants, issue-number regressions, and E2E kept. Real test-quality fixes found and rooted out along the way: - tests/tools/test_command_guards.py made real auxiliary-LLM HTTPS calls (DEFAULT_CONFIG smart-approval leaked in) — pinned approval mode=manual via autouse fixture: 17.4s → 0.4s. - test_model_switch_custom_providers.py / test_user_providers_model_switch.py silently probed live provider catalogs (~2s/test) — stubbed cached_provider_model_ids/provider_model_ids/fetch_api_models. - test_telegram_noise_filter.py: 15-platform copy-paste matrix over shared gateway.run logic → 3 representative platforms (55s → 3.9s). - test_gateway_shutdown.py: stop()'s 5s interrupt-deadline loop spun on MagicMock agents — interrupt.side_effect now clears _running_agents (22s → 1.0s). - test_gateway_inactivity_timeout.py poll-harness timings shrunk 3-5x (24s → 1.1s); test_mcp_stability.py backoff/SIGTERM-grace sleeps patched (15.4s → 2.5s); test_async_delegation.py negative-drain wait 5s → 0.5s. - test_telegram_init_deadline.py: loop-block margin restored to 1.0s with rationale comment — the watchdog-dump assertion needs the loop blocked well past deadline+grace under parallel load (flaked once in the 40-worker verification run at a 0.2s margin). Verification: full hermetic suite via scripts/run_tests.sh — 2,438 files, 21,718 tests passed, 0 failed, 293.9s wall. Suite totals vs original baseline: 46,820 → 19,757 test functions (−57.8%), wall 583.5s → 293.9s (−50%), subprocess CPU 13,564s → 11,623s.
106 lines
3.4 KiB
Python
106 lines
3.4 KiB
Python
"""Tests for MCP tool-handler auth-failure detection.
|
|
|
|
When a tool call raises UnauthorizedError / OAuthNonInteractiveError /
|
|
httpx.HTTPStatusError(401), the handler should:
|
|
1. Ask MCPOAuthManager.handle_401 if recovery is viable.
|
|
2. If yes, trigger MCPServerTask._reconnect_event and retry once.
|
|
3. If no, return a structured needs_reauth error so the model stops
|
|
hallucinating manual refresh attempts.
|
|
"""
|
|
import json
|
|
from unittest.mock import MagicMock
|
|
|
|
import pytest
|
|
|
|
|
|
pytest.importorskip("mcp.client.auth.oauth2")
|
|
|
|
|
|
def test_is_auth_error_detects_oauth_flow_error():
|
|
from tools.mcp_tool import _is_auth_error
|
|
from mcp.client.auth import OAuthFlowError
|
|
|
|
assert _is_auth_error(OAuthFlowError("expired")) is True
|
|
|
|
|
|
def test_call_tool_handler_returns_needs_reauth_on_unrecoverable_401(monkeypatch, tmp_path):
|
|
"""When session.call_tool raises 401 and handle_401 returns False,
|
|
handler returns a structured needs_reauth error (not a generic failure)."""
|
|
monkeypatch.setenv("HERMES_HOME", str(tmp_path))
|
|
|
|
from tools.mcp_tool import _make_tool_handler
|
|
from tools.mcp_oauth_manager import get_manager, reset_manager_for_tests
|
|
from mcp.client.auth import OAuthFlowError
|
|
|
|
reset_manager_for_tests()
|
|
|
|
# Stub server
|
|
server = MagicMock()
|
|
server.name = "srv"
|
|
session = MagicMock()
|
|
|
|
async def _call_tool_raises(*a, **kw):
|
|
raise OAuthFlowError("token expired")
|
|
|
|
session.call_tool = _call_tool_raises
|
|
server.session = session
|
|
server._reconnect_event = MagicMock()
|
|
server._ready = MagicMock()
|
|
server._ready.is_set.return_value = True
|
|
|
|
from tools import mcp_tool
|
|
mcp_tool._servers["srv"] = server
|
|
mcp_tool._server_error_counts.pop("srv", None)
|
|
|
|
# Ensure the MCP loop exists (run_on_mcp_loop needs it)
|
|
mcp_tool._ensure_mcp_loop()
|
|
|
|
# Force handle_401 to return False (no recovery available)
|
|
mgr = get_manager()
|
|
|
|
async def _h401(name, token=None):
|
|
return False
|
|
|
|
monkeypatch.setattr(mgr, "handle_401", _h401)
|
|
|
|
try:
|
|
handler = _make_tool_handler("srv", "tool1", 10.0)
|
|
result = handler({"arg": "v"})
|
|
parsed = json.loads(result)
|
|
assert parsed.get("needs_reauth") is True, f"expected needs_reauth, got: {parsed}"
|
|
assert parsed.get("server") == "srv"
|
|
assert "re-auth" in parsed.get("error", "").lower() or "reauth" in parsed.get("error", "").lower()
|
|
finally:
|
|
mcp_tool._servers.pop("srv", None)
|
|
mcp_tool._server_error_counts.pop("srv", None)
|
|
|
|
|
|
def test_call_tool_handler_non_auth_error_still_generic(monkeypatch, tmp_path):
|
|
"""Non-auth exceptions still surface via the generic error path, not needs_reauth."""
|
|
monkeypatch.setenv("HERMES_HOME", str(tmp_path))
|
|
from tools.mcp_tool import _make_tool_handler
|
|
|
|
server = MagicMock()
|
|
server.name = "srv"
|
|
session = MagicMock()
|
|
|
|
async def _raises(*a, **kw):
|
|
raise RuntimeError("unrelated")
|
|
|
|
session.call_tool = _raises
|
|
server.session = session
|
|
|
|
from tools import mcp_tool
|
|
mcp_tool._servers["srv"] = server
|
|
mcp_tool._server_error_counts.pop("srv", None)
|
|
mcp_tool._ensure_mcp_loop()
|
|
|
|
try:
|
|
handler = _make_tool_handler("srv", "tool1", 10.0)
|
|
result = handler({"arg": "v"})
|
|
parsed = json.loads(result)
|
|
assert "needs_reauth" not in parsed
|
|
assert "MCP call failed" in parsed.get("error", "")
|
|
finally:
|
|
mcp_tool._servers.pop("srv", None)
|
|
mcp_tool._server_error_counts.pop("srv", None)
|