wehub-resource-sync
b4fbd6fe9f
Deploy Site / deploy-vercel (push) Has been skipped
Deploy Site / deploy-docs (push) Has been skipped
Build Skills Index / build-index (push) Has been skipped
CI / Deny unrelated histories (push) Has been skipped
CI / Detect affected areas (push) Successful in 27m35s
CI / OSV scan (push) Failing after 4s
CI / Build&Test Docker image (push) Successful in 9s
CI / Supply-chain scan (push) Has been skipped
CI / Lint Docker scripts (push) Failing after 5m13s
CI / Check contributors (push) Failing after 12m8s
CI / Docs Site (push) Failing after 12m8s
CI / TypeScript (push) Failing after 12m8s
CI / Python lints (push) Failing after 12m9s
CI / Python tests (push) Failing after 12m9s
CI / Check uv.lock (push) Failing after 23m22s
CI / CI timing report (push) Has been cancelled
Build Skills Index / trigger-deploy (push) Has been cancelled
CI / All required checks pass (push) Has been cancelled
78 lines
2.8 KiB
Python
78 lines
2.8 KiB
Python
"""`hermes debug` must not report a shell-only API key as plainly "set".
|
|
|
|
The dump reads ``os.getenv`` — the invoking terminal's environment — but the
|
|
managed backends (launchd / systemd / the desktop-spawned ``serve`` process)
|
|
load credentials from ``~/.hermes/.env``, not the login shell. A key exported
|
|
in the shell but absent from ``.env`` is invisible to the backend, yet the dump
|
|
used to print a bare "set", sending support down a phantom "the key is
|
|
configured" path (the real cause behind gated tools like ``web_search`` going
|
|
missing on Desktop). The dump now flags that mismatch.
|
|
"""
|
|
|
|
from pathlib import Path
|
|
from types import SimpleNamespace
|
|
|
|
|
|
def _api_key_line(out: str, label: str) -> str:
|
|
for line in out.splitlines():
|
|
if line.strip().startswith(f"{label} "):
|
|
return line
|
|
raise AssertionError(f"no '{label}' api_keys line in dump output:\n{out}")
|
|
|
|
|
|
def test_dump_flags_shell_only_key_not_in_dotenv(monkeypatch, capsys, tmp_path):
|
|
from hermes_cli import dump
|
|
from hermes_cli.config import get_hermes_home
|
|
|
|
monkeypatch.setattr(dump, "get_project_root", lambda: tmp_path / "noproject")
|
|
|
|
home = get_hermes_home()
|
|
home.mkdir(parents=True, exist_ok=True)
|
|
# .env has some OTHER key but NOT firecrawl.
|
|
(home / ".env").write_text("OPENROUTER_API_KEY=sk-or-xxxx\n")
|
|
# firecrawl is exported in the (test) shell only.
|
|
monkeypatch.setenv("FIRECRAWL_API_KEY", "fc-shell-only")
|
|
|
|
dump.run_dump(SimpleNamespace(show_keys=False))
|
|
|
|
line = _api_key_line(capsys.readouterr().out, "firecrawl")
|
|
assert "set" in line
|
|
assert "shell only" in line
|
|
assert ".env" in line
|
|
|
|
|
|
def test_dump_does_not_flag_key_present_in_dotenv(monkeypatch, capsys, tmp_path):
|
|
from hermes_cli import dump
|
|
from hermes_cli.config import get_hermes_home
|
|
|
|
monkeypatch.setattr(dump, "get_project_root", lambda: tmp_path / "noproject")
|
|
|
|
home = get_hermes_home()
|
|
home.mkdir(parents=True, exist_ok=True)
|
|
(home / ".env").write_text("FIRECRAWL_API_KEY=fc-in-dotenv\n")
|
|
monkeypatch.setenv("FIRECRAWL_API_KEY", "fc-in-dotenv")
|
|
|
|
dump.run_dump(SimpleNamespace(show_keys=False))
|
|
|
|
line = _api_key_line(capsys.readouterr().out, "firecrawl")
|
|
assert "set" in line
|
|
assert "shell only" not in line
|
|
|
|
|
|
def test_dump_leaves_unset_key_untouched(monkeypatch, capsys, tmp_path):
|
|
from hermes_cli import dump
|
|
from hermes_cli.config import get_hermes_home
|
|
|
|
monkeypatch.setattr(dump, "get_project_root", lambda: tmp_path / "noproject")
|
|
monkeypatch.delenv("TAVILY_API_KEY", raising=False)
|
|
|
|
home = get_hermes_home()
|
|
home.mkdir(parents=True, exist_ok=True)
|
|
(home / ".env").write_text("OPENROUTER_API_KEY=sk-or-xxxx\n")
|
|
|
|
dump.run_dump(SimpleNamespace(show_keys=False))
|
|
|
|
line = _api_key_line(capsys.readouterr().out, "tavily")
|
|
assert "not set" in line
|
|
assert "shell only" not in line
|