Import AITURK IDE 1.0.0-beta.1 from Hermes 63279301; preserve MIT license

tests/agent/test_openrouter_silent_default_purge.py

@@ -0,0 +1,105 @@
+"""Regression tests for issue #81952 — aux free default + env-ingestion WARNING.
+
+KILL 2: the auxiliary lane's BUILT-IN OpenRouter fallback model (used only
+when the user never set ``auxiliary.openrouter_model``) must be a ``:free``
+SKU — the paid ``google/gemini-3.6-flash`` default meant silent real spend on
+a lane the user never opted into.
+
+KILL 3: auto-ingesting OPENROUTER_API_KEY from the environment into the
+credential pool arms silent spend; it must log a WARNING naming the provider
+and env var when a credential is newly ingested.
+"""
+
+import logging
+import uuid
+
+import pytest
+
+
+class TestAuxiliaryOpenrouterDefaultIsFree:
+    def test_builtin_openrouter_default_is_free_sku(self):
+        from agent import auxiliary_client as ac
+
+        assert ac._is_free_model(ac._OPENROUTER_MODEL), (
+            "the built-in auxiliary OpenRouter fallback model must be a :free "
+            "SKU — a paid built-in default is silent real spend (#81952)"
+        )
+
+    def test_builtin_default_matches_free_only_warning_recommendation(self):
+        """The default is the same SKU the free_only warning tells users to set."""
+        from agent import auxiliary_client as ac
+
+        assert ac._OPENROUTER_MODEL == "nvidia/nemotron-3-ultra-550b-a55b:free"
+
+    def test_user_configured_model_still_honored(self, monkeypatch):
+        """auxiliary.openrouter_model from config wins over the built-in default."""
+        from agent import auxiliary_client as ac
+
+        monkeypatch.setattr(
+            "hermes_cli.config.load_config_readonly",
+            lambda: {"auxiliary": {"openrouter_model": "google/gemini-3.6-flash"}},
+        )
+        free_only, model = ac._aux_openrouter_settings()
+        assert model == "google/gemini-3.6-flash"
+
+
+class TestEnvIngestionWarning:
+    def _fresh_home(self, tmp_path, monkeypatch, token="sk-or-FAKEINGEST123"):
+        home = tmp_path / "hermes"
+        home.mkdir(parents=True, exist_ok=True)
+        monkeypatch.setenv("HERMES_HOME", str(home))
+        monkeypatch.setenv("OPENROUTER_API_KEY", token)
+        return home
+
+    def test_warns_on_new_openrouter_env_ingestion(self, tmp_path, monkeypatch, caplog):
+        self._fresh_home(tmp_path, monkeypatch)
+        from agent import credential_pool as cp
+
+        monkeypatch.setattr(cp, "_ENV_INGESTION_WARNED", set())
+        entries = []
+        with caplog.at_level(logging.WARNING, logger=cp.logger.name):
+            changed, sources = cp._seed_from_env("openrouter", entries)
+
+        assert changed is True
+        assert "env:OPENROUTER_API_KEY" in sources
+        warnings = [
+            r.getMessage()
+            for r in caplog.records
+            if r.levelno == logging.WARNING and "Ingested OPENROUTER_API_KEY" in r.getMessage()
+        ]
+        assert warnings, "expected a WARNING for env->pool openrouter ingestion"
+        assert "OpenRouter spend" in warnings[0]
+        assert "hermes auth remove openrouter" in warnings[0]
+
+    def test_warning_once_per_process(self, tmp_path, monkeypatch, caplog):
+        self._fresh_home(tmp_path, monkeypatch)
+        from agent import credential_pool as cp
+
+        monkeypatch.setattr(cp, "_ENV_INGESTION_WARNED", set())
+        with caplog.at_level(logging.WARNING, logger=cp.logger.name):
+            cp._warn_env_ingestion_once("openrouter", "OPENROUTER_API_KEY")
+            cp._warn_env_ingestion_once("openrouter", "OPENROUTER_API_KEY")
+        warnings = [
+            r
+            for r in caplog.records
+            if r.levelno == logging.WARNING and "Ingested OPENROUTER_API_KEY" in r.getMessage()
+        ]
+        assert len(warnings) == 1
+
+    def test_no_warning_when_entry_unchanged(self, tmp_path, monkeypatch, caplog):
+        """Re-seeding an already-present, identical credential stays silent."""
+        self._fresh_home(tmp_path, monkeypatch)
+        from agent import credential_pool as cp
+
+        entries = []
+        changed, _ = cp._seed_from_env("openrouter", entries)
+        assert changed is True
+
+        monkeypatch.setattr(cp, "_ENV_INGESTION_WARNED", set())
+        caplog.clear()
+        with caplog.at_level(logging.WARNING, logger=cp.logger.name):
+            changed_again, _ = cp._seed_from_env("openrouter", entries)
+        assert changed_again is False
+        assert not [
+            r for r in caplog.records if "Ingested OPENROUTER_API_KEY" in r.getMessage()
+        ]