mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-30 19:09:28 +00:00
6b81590c55
Systematic prune per AGENTS.md test policy, one pass over every major test tree (gateway, hermes_cli, tools, agent, run_agent, plugins, cli, cron, tui_gateway, honcho/openviking, root-level): - DELETE: source-reading tests (read_text/getsource on prod files), change-detector tests (exact catalog counts, model-name snapshots, config version literals), mock-echo tests (assert a mock returns what it was told), assertion-free/trivial tests, near-duplicate parametrizations (boundaries + one representative kept), async/sync twin duplicates, cosmetic within-file variations. - KEEP (mandatory): security/redaction/approval guards, message-role alternation invariants, prompt-caching/deterministic-call-id invariants, issue-number regression tests (deduped), E2E tests. - 6 test files deleted outright (script-style/no-assert or fully redundant); conftest.py, fakes/, fixtures/ untouched. - tests/acp/conftest.py added: autouse fixture stubs the live models.dev/GitHub/Copilot/Anthropic inventory fetches that ACP server tests performed on every session create — test_server.py 147s → 3.4s, and the tests are now genuinely hermetic. - Sleep-based slowness shrunk where safe (codex_ttfb_watchdog, compression_concurrent_fork, etc.); no wall-clock assertion tightened. Verification: full hermetic suite via scripts/run_tests.sh — 2439 files, 31,130 tests passed, 0 failed, 0 flaky retries, 315s wall (baseline: 583s wall, 13,564s subprocess CPU).
154 lines
4.3 KiB
Python
154 lines
4.3 KiB
Python
"""Regression coverage for implicit live-runtime auxiliary cache keys.
|
|
|
|
#49151/#49156 is specifically the ``provider='auto'`` path where callers omit
|
|
``main_runtime`` after a mid-session model switch. This is distinct from
|
|
#56889, which isolates callers that pass different explicit ``model=`` values.
|
|
"""
|
|
|
|
import asyncio
|
|
from concurrent.futures import ThreadPoolExecutor
|
|
from threading import Barrier
|
|
from types import SimpleNamespace
|
|
from unittest.mock import AsyncMock, MagicMock, patch
|
|
|
|
import pytest
|
|
|
|
import agent.auxiliary_client as aux
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def _clean_aux_state():
|
|
aux.shutdown_cached_clients()
|
|
aux.clear_runtime_main()
|
|
yield
|
|
aux.shutdown_cached_clients()
|
|
aux.clear_runtime_main()
|
|
|
|
|
|
def _runtime(model: str, *, provider: str = "custom:llama-swap") -> dict:
|
|
return {
|
|
"provider": provider,
|
|
"model": model,
|
|
"base_url": "http://llama-swap.test/v1",
|
|
"api_key": "local-key",
|
|
"api_mode": "chat_completions",
|
|
"auth_mode": "api_key",
|
|
}
|
|
|
|
|
|
|
|
|
|
def test_implicit_runtime_cache_key_covers_full_connection_and_auth_surface():
|
|
"""Provider/endpoint/credential/wire/auth changes all isolate auto clients."""
|
|
base = _runtime("same-model")
|
|
variants = [
|
|
{**base, "provider": "custom:other"},
|
|
{**base, "base_url": "https://other.test/v1"},
|
|
{**base, "api_key": "other-key"},
|
|
{**base, "api_mode": "codex_responses"},
|
|
{**base, "auth_mode": "entra_id", "api_key": lambda: "token"},
|
|
]
|
|
|
|
aux.set_runtime_main(**base)
|
|
baseline = aux._client_cache_key("auto", async_mode=False)
|
|
keys = []
|
|
for variant in variants:
|
|
aux.set_runtime_main(**variant)
|
|
keys.append(aux._client_cache_key("auto", async_mode=False))
|
|
|
|
assert all(key != baseline for key in keys)
|
|
assert len(set(keys)) == len(keys)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_runtime_context_token_restores_previous_value_after_turn():
|
|
"""Turn-scoped runtime binding must not leak into later work in the same context."""
|
|
token = aux.set_runtime_main(**_runtime("turn-model"))
|
|
assert aux._normalize_main_runtime(None)["model"] == "turn-model"
|
|
|
|
aux.reset_runtime_main(token)
|
|
|
|
assert aux._normalize_main_runtime(None) == {}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_explicit_model_cache_isolation_remains_independent_of_runtime_key():
|
|
"""#56889 remains covered: explicit model values isolate non-auto clients."""
|
|
first = aux._client_cache_key(
|
|
"openrouter", async_mode=False, model="anthropic/claude-opus-4.8"
|
|
)
|
|
second = aux._client_cache_key(
|
|
"openrouter", async_mode=False, model="openai/gpt-5.5"
|
|
)
|
|
|
|
assert first != second
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_unhashable_callable_runtime_api_keys_are_safe_secret_free_discriminators():
|
|
"""Callable token providers remain cacheable without leaking returned tokens."""
|
|
|
|
class TokenProvider(list):
|
|
def __init__(self, token: str):
|
|
super().__init__()
|
|
self.token = token
|
|
|
|
def __call__(self) -> str:
|
|
return self.token
|
|
|
|
first_provider = TokenProvider("first-super-secret-token")
|
|
second_provider = TokenProvider("second-super-secret-token")
|
|
|
|
first = aux._client_cache_key(
|
|
"auto", async_mode=False, main_runtime={**_runtime("same"), "api_key": first_provider}
|
|
)
|
|
second = aux._client_cache_key(
|
|
"auto", async_mode=False, main_runtime={**_runtime("same"), "api_key": second_provider}
|
|
)
|
|
|
|
hash(first)
|
|
hash(second)
|
|
assert first != second
|
|
rendered = repr((first, second))
|
|
assert "first-super-secret-token" not in rendered
|
|
assert "second-super-secret-token" not in rendered
|
|
|
|
|
|
def test_string_api_keys_are_not_retained_in_cache_key_repr():
|
|
"""String credentials discriminate clients without living in cache-key memory."""
|
|
first_secret = "first-literal-super-secret"
|
|
second_secret = "second-literal-super-secret"
|
|
first = aux._client_cache_key(
|
|
"auto",
|
|
async_mode=False,
|
|
api_key=first_secret,
|
|
main_runtime={**_runtime("same"), "api_key": first_secret},
|
|
)
|
|
second = aux._client_cache_key(
|
|
"auto",
|
|
async_mode=False,
|
|
api_key=second_secret,
|
|
main_runtime={**_runtime("same"), "api_key": second_secret},
|
|
)
|
|
|
|
assert first != second
|
|
rendered = repr((first, second))
|
|
assert first_secret not in rendered
|
|
assert second_secret not in rendered
|
|
|
|
|