hermes-agent/tests/hermes_cli/test_kanban_write_guard.py
Jasmine Naderi 7ba456e98d fix(test): fail-closed kanban write guard prevents real HERMES_HOME pollution (#69283)
Autouse conftest fixture patches kanban_db.connect to refuse writes whose
resolved DB path lands under the REAL kanban root (captured at conftest
import time, before fixtures rewire the environment). Deny-list, not
allow-list, so hermetic tests moving HERMES_HOME to sibling tempdirs are
unaffected. Lazily attaches only when hermes_cli.kanban_db is already in
sys.modules.

Salvaged from PR #69385 by @smfworks; rebased by hand onto the pruned
conftest and adapted to guard on the resolved DB path (explicit db_path
or kanban_db_path()) rather than kanban_home() alone.

Co-authored-by: Jasmine Naderi <jasmine@smfworks.com>
2026-07-29 18:55:10 -07:00

43 lines
1.4 KiB
Python

"""#69283: kanban write guard prevents tests from writing to real ~/.hermes."""
from __future__ import annotations
import pytest
from hermes_cli import kanban_db
def test_connect_succeeds_under_test_home(tmp_path, monkeypatch):
"""When HERMES_HOME is a temp dir, kanban connect succeeds normally."""
home = tmp_path / "hermes_home"
home.mkdir()
monkeypatch.setenv("HERMES_HOME", str(home))
conn = kanban_db.connect()
try:
assert str(kanban_db.kanban_db_path()).startswith(str(home))
finally:
conn.close()
def test_connect_raises_when_kanban_home_is_real_root(monkeypatch):
"""When kanban paths resolve to the REAL root, connect raises RuntimeError."""
import tests.conftest as _conftest
monkeypatch.setattr(
kanban_db, "kanban_home", lambda: _conftest._REAL_KANBAN_ROOT
)
monkeypatch.setattr(
kanban_db,
"kanban_db_path",
lambda board=None: _conftest._REAL_KANBAN_ROOT / "kanban.db",
)
with pytest.raises(RuntimeError, match="kanban_write_guard"):
kanban_db.connect()
def test_connect_raises_for_explicit_db_path_under_real_root():
"""Explicit db_path pointing under the real root is also refused."""
import tests.conftest as _conftest
with pytest.raises(RuntimeError, match="kanban_write_guard"):
kanban_db.connect(_conftest._REAL_KANBAN_ROOT / "kanban.db")