95 lines
3.1 KiB
Python
95 lines
3.1 KiB
Python
"""Tests for hermes_cli/_scan_venv_blockers.py.
|
|
|
|
Tests call the real production functions (``main``, ``_redact_sensitive_cmdline``).
|
|
The detector is patched directly so no real process table interaction occurs.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import builtins
|
|
import json
|
|
import sys
|
|
import types
|
|
from pathlib import Path
|
|
from unittest.mock import MagicMock, patch
|
|
|
|
import pytest
|
|
|
|
import agent.redact as redact_module
|
|
from hermes_cli._scan_venv_blockers import (
|
|
_redact_sensitive_cmdline,
|
|
main,
|
|
)
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# main() — stdout, stderr, exit code (with patched detector)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
def _psutil_fake() -> dict:
|
|
"""Return a sys.modules dict entry that makes psutil appear available."""
|
|
return {"psutil": types.SimpleNamespace(Process=lambda *a: MagicMock())}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# _redact_sensitive_cmdline
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
def test_redact_long_flag_value_space_separated() -> None:
|
|
"""--token SECRET must preserve --token and emit --token <redacted>."""
|
|
raw = "python.exe -m hermes_cli.main serve --token ghp_abc123 --host 10.0.0.1"
|
|
result = _redact_sensitive_cmdline(raw)
|
|
assert result == "python.exe -m hermes_cli.main serve --token <redacted>"
|
|
assert "ghp_abc123" not in result
|
|
|
|
|
|
|
|
|
|
def test_redact_sensitive_text_failure_returns_fully_redacted() -> None:
|
|
"""When agent.redact.redact_sensitive_text raises, the entire result
|
|
must equal '<redacted>' so PID and name still provide diagnostics."""
|
|
with patch.object(
|
|
redact_module,
|
|
"redact_sensitive_text",
|
|
side_effect=RuntimeError("no redactor"),
|
|
):
|
|
result = _redact_sensitive_cmdline("python.exe --token abc123")
|
|
|
|
assert result == "<redacted>"
|
|
|
|
|
|
def test_redact_session_key() -> None:
|
|
"""--session-key <identifier> must redact the value and everything after."""
|
|
raw = "python.exe -m tui_gateway.slash_worker --session-key 20260712-abcdef --model test"
|
|
result = _redact_sensitive_cmdline(raw)
|
|
assert result == "python.exe -m tui_gateway.slash_worker --session-key <redacted>"
|
|
|
|
|
|
def test_redact_normal_host_port_profile_remain() -> None:
|
|
raw = "python.exe -m hermes_cli.main serve --host 10.0.0.1 --port 9119 --profile work"
|
|
result = _redact_sensitive_cmdline(raw)
|
|
assert "10.0.0.1" in result
|
|
assert "9119" in result
|
|
assert "work" in result
|
|
|
|
|
|
def test_redact_no_sensitive_flags_is_noop() -> None:
|
|
raw = "python.exe -m hermes_cli.main serve --host 127.0.0.1"
|
|
assert _redact_sensitive_cmdline(raw) == raw
|
|
|
|
|
|
def test_redact_empty_string() -> None:
|
|
assert _redact_sensitive_cmdline("") == ""
|
|
|
|
|
|
def test_redact_short_flags_not_redacted() -> None:
|
|
"""Short flags -t (toolset), -p (profile), -k are NOT redacted."""
|
|
raw = "python.exe -m hermes_cli.main serve -t web -p default -k somearg"
|
|
result = _redact_sensitive_cmdline(raw)
|
|
assert result == raw # short flags pass through unchanged |