mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-22 16:25:58 +00:00
d59b79fadd
Salvages #66257 by @oppih (CI attribution check blocked the external branch from merging). When a provider's credential pool has entries but all are temporarily rate-limited (exhausted), list_authenticated_providers() excluded the provider from the interactive /model picker. Rate limits are per-model for many providers (e.g. Google Gemini), so an exhausted key for model-A may still work for model-B — the user should still be able to select a different model under the same provider. Adds a for_picker flag to list_authenticated_providers() that relaxes the credential-pool availability check for the picker path only, falling back to pool.has_credentials() when the pool has entries but none are currently available. The runtime resolution path (get_authenticated_provider_slugs) is unchanged, preserving the #45759 invariant that exhausted pools do not count as authenticated. Co-authored-by: oppih <oppih@users.noreply.github.com>
116 lines
4 KiB
Python
116 lines
4 KiB
Python
"""Regression test for #45759.
|
|
|
|
An all-exhausted credential pool holds entries but no *usable* credential.
|
|
``list_authenticated_providers`` must not treat such a provider as
|
|
authenticated -- otherwise an aggregator whose quota is spent gets matched
|
|
during no-provider ``/model`` resolution, wins the model name, and sticks as
|
|
the session provider (the "sticky provider fallback pollution" bug).
|
|
"""
|
|
|
|
import pytest
|
|
|
|
|
|
class _FakePool:
|
|
def __init__(self, available: bool):
|
|
self._available = available
|
|
|
|
def has_credentials(self) -> bool:
|
|
# The pool still holds entries...
|
|
return True
|
|
|
|
def has_available(self) -> bool:
|
|
# ...but none of them are usable when exhausted/dead.
|
|
return self._available
|
|
|
|
|
|
def _patch_opencode_pool(monkeypatch, *, available: bool):
|
|
"""Make the opencode-go aggregator look configured but with a pool whose
|
|
only credential is (un)available, depending on ``available``."""
|
|
import hermes_cli.auth as auth
|
|
import agent.credential_pool as cp
|
|
|
|
monkeypatch.setattr(
|
|
auth,
|
|
"_load_auth_store",
|
|
lambda: {
|
|
"version": 1,
|
|
"providers": {},
|
|
"active_provider": None,
|
|
"credential_pool": {"opencode-go": {"entries": [{"id": "x"}]}},
|
|
},
|
|
)
|
|
monkeypatch.setattr(
|
|
cp,
|
|
"load_pool",
|
|
lambda provider: _FakePool(available if provider == "opencode-go" else True),
|
|
)
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def _strip_provider_env(monkeypatch):
|
|
"""Don't let real provider keys in the environment authenticate providers
|
|
through a different code path than the pool gate under test."""
|
|
import os
|
|
|
|
for key in list(os.environ):
|
|
if "OPENCODE" in key or key.endswith("_API_KEY"):
|
|
monkeypatch.delenv(key, raising=False)
|
|
|
|
|
|
def test_exhausted_pool_provider_is_not_authenticated(monkeypatch):
|
|
"""The fix: an exhausted pool is NOT authenticated. Fails on main, where
|
|
the gate accepted any stored pool entry regardless of usability."""
|
|
from hermes_cli.model_switch import get_authenticated_provider_slugs
|
|
|
|
_patch_opencode_pool(monkeypatch, available=False)
|
|
slugs = get_authenticated_provider_slugs(current_provider="alibaba")
|
|
assert "opencode-go" not in slugs
|
|
|
|
|
|
def test_pool_provider_with_available_credential_is_authenticated(monkeypatch):
|
|
"""Control: with a usable credential the provider IS authenticated, proving
|
|
the test drives the credential gate rather than excluding it for some other
|
|
reason."""
|
|
from hermes_cli.model_switch import get_authenticated_provider_slugs
|
|
|
|
_patch_opencode_pool(monkeypatch, available=True)
|
|
slugs = get_authenticated_provider_slugs(current_provider="alibaba")
|
|
assert "opencode-go" in slugs
|
|
|
|
|
|
def test_opaque_legacy_pool_value_stays_visible(monkeypatch):
|
|
"""Legacy token-style auth-store values have no parsed pool entries."""
|
|
from hermes_cli.model_switch import _credential_pool_is_usable
|
|
|
|
monkeypatch.setattr(
|
|
"agent.credential_pool.load_pool",
|
|
lambda _provider: type(
|
|
"EmptyPool",
|
|
(),
|
|
{
|
|
"has_credentials": lambda self: False,
|
|
"has_available": lambda self: False,
|
|
},
|
|
)(),
|
|
)
|
|
|
|
assert _credential_pool_is_usable("opencode-go", raw_pool_present=True)
|
|
|
|
|
|
def test_picker_shows_exhausted_pool_provider(monkeypatch):
|
|
"""The interactive picker must include providers whose credential pool
|
|
entries are all exhausted, so the user can still switch to a different
|
|
model under the same provider."""
|
|
from hermes_cli.model_switch import list_picker_providers
|
|
|
|
_patch_opencode_pool(monkeypatch, available=False)
|
|
providers = list_picker_providers(
|
|
current_provider="alibaba",
|
|
user_providers={},
|
|
custom_providers=[],
|
|
)
|
|
slugs = [p["slug"] for p in providers]
|
|
assert "opencode-go" in slugs, (
|
|
"Picker must show exhausted-pool providers so the user can select "
|
|
"a different model under the same provider"
|
|
)
|