mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-06-21 10:22:18 +00:00
b0e47a98f9
The skin bug was one instance of a class: several subsystems build their
config dict directly from config.yaml instead of routing through
hermes_cli.config.load_config (which carries the managed merge), so they
silently ignored administrator-pinned values. Audited every config.yaml
reader and fixed the behavioral-read bypasses:
- gateway/config.py load_gateway_config (messaging gateway: session_reset,
quick_commands, stt, model, ...)
- gateway/run.py _load_gateway_config (its read_raw_config fast path also
skipped the merge — read_raw_config returns raw user YAML)
- tui_gateway/server.py _load_cfg (new TUI + desktop backend: skin,
reasoning_effort, service_tier, provider_routing)
- cron/scheduler.py (scheduled-job model/reasoning/toolsets/provider_routing)
- hermes_logging.py (logging.level/max_size_mb/backup_count)
- hermes_time.py (timezone)
- hermes_cli/doctor.py (memory-provider diagnostic reads effective config)
All route through a new shared managed_scope.apply_managed_overlay() helper
that mirrors _load_config_impl (env-only expansion so a user ${VAR} can't
shadow a managed literal, root-model-string normalization, leaf-merge) and is
fail-open. cli.py's earlier inline fix is refactored onto the same helper.
Write-back paths (slash_commands, telegram/yuanbao dm_topics, profile
distribution) are deliberately left reading raw user YAML — overlaying managed
values there would persist them into the user file. The dashboard
(web_server.py) already routes through load_config and needed no change.
TUI loader caches the RAW config so _save_cfg never writes managed values to
disk. Adds test_managed_scope_overlay.py (helper) and
test_managed_scope_loaders.py (per-surface integration); mutation-checked.
69 lines
2.3 KiB
Python
69 lines
2.3 KiB
Python
"""apply_managed_overlay() — the shared helper used by every standalone loader."""
|
|
import textwrap
|
|
|
|
import pytest
|
|
|
|
|
|
@pytest.fixture
|
|
def managed(tmp_path, monkeypatch):
|
|
md = tmp_path / "managed"
|
|
md.mkdir()
|
|
monkeypatch.setenv("HERMES_MANAGED_DIR", str(md))
|
|
from hermes_cli import managed_scope
|
|
|
|
managed_scope.invalidate_managed_cache()
|
|
return md
|
|
|
|
|
|
def _write(md, body):
|
|
(md / "config.yaml").write_text(textwrap.dedent(body), encoding="utf-8")
|
|
from hermes_cli import managed_scope
|
|
|
|
managed_scope.invalidate_managed_cache()
|
|
|
|
|
|
def test_overlay_noop_without_scope(tmp_path, monkeypatch):
|
|
from hermes_cli import managed_scope
|
|
|
|
monkeypatch.setenv("HERMES_MANAGED_DIR", str(tmp_path / "nope"))
|
|
managed_scope.invalidate_managed_cache()
|
|
src = {"display": {"skin": "user"}}
|
|
assert managed_scope.apply_managed_overlay(src) == {"display": {"skin": "user"}}
|
|
|
|
|
|
def test_overlay_managed_wins(managed):
|
|
from hermes_cli import managed_scope
|
|
|
|
_write(managed, "display:\n skin: charizard\n")
|
|
out = managed_scope.apply_managed_overlay({"display": {"skin": "user"}})
|
|
assert out["display"]["skin"] == "charizard"
|
|
|
|
|
|
def test_overlay_preserves_user_siblings(managed):
|
|
from hermes_cli import managed_scope
|
|
|
|
_write(managed, "display:\n skin: charizard\n")
|
|
out = managed_scope.apply_managed_overlay(
|
|
{"display": {"skin": "user", "show_reasoning": True}}
|
|
)
|
|
assert out["display"]["skin"] == "charizard"
|
|
assert out["display"]["show_reasoning"] is True
|
|
|
|
|
|
def test_overlay_normalizes_root_model_string(managed):
|
|
"""A managed bare `model: x/y` must promote to model.default, not clobber the dict."""
|
|
from hermes_cli import managed_scope
|
|
|
|
_write(managed, "model: org/locked\n")
|
|
out = managed_scope.apply_managed_overlay({"model": {"default": "user/m", "fallback": "u/fb"}})
|
|
assert out["model"]["default"] == "org/locked" # managed wins
|
|
assert out["model"]["fallback"] == "u/fb" # user sibling preserved (dict shape intact)
|
|
|
|
|
|
def test_overlay_user_envref_cannot_shadow_managed_literal(managed, monkeypatch):
|
|
from hermes_cli import managed_scope
|
|
|
|
monkeypatch.setenv("EVIL", "user/override")
|
|
_write(managed, "model:\n default: managed/locked\n")
|
|
out = managed_scope.apply_managed_overlay({"model": {"default": "${EVIL}"}})
|
|
assert out["model"]["default"] == "managed/locked"
|