Import AITURK IDE 1.0.0-beta.1 from Hermes 63279301; preserve MIT license

tests/hermes_cli/test_dump_env_visibility.py

@@ -0,0 +1,60 @@
+"""`hermes debug` must not report a shell-only API key as plainly "set".
+
+The dump reads ``os.getenv`` — the invoking terminal's environment — but the
+managed backends (launchd / systemd / the desktop-spawned ``serve`` process)
+load credentials from ``~/.hermes/.env``, not the login shell. A key exported
+in the shell but absent from ``.env`` is invisible to the backend, yet the dump
+used to print a bare "set", sending support down a phantom "the key is
+configured" path (the real cause behind gated tools like ``web_search`` going
+missing on Desktop). The dump now flags that mismatch.
+"""
+
+from pathlib import Path
+from types import SimpleNamespace
+
+
+def _api_key_line(out: str, label: str) -> str:
+    for line in out.splitlines():
+        if line.strip().startswith(f"{label} "):
+            return line
+    raise AssertionError(f"no '{label}' api_keys line in dump output:\n{out}")
+
+
+def test_dump_flags_shell_only_key_not_in_dotenv(monkeypatch, capsys, tmp_path):
+    from hermes_cli import dump
+    from hermes_cli.config import get_hermes_home
+
+    monkeypatch.setattr(dump, "get_project_root", lambda: tmp_path / "noproject")
+
+    home = get_hermes_home()
+    home.mkdir(parents=True, exist_ok=True)
+    # .env has some OTHER key but NOT firecrawl.
+    (home / ".env").write_text("OPENROUTER_API_KEY=sk-or-xxxx\n")
+    # firecrawl is exported in the (test) shell only.
+    monkeypatch.setenv("FIRECRAWL_API_KEY", "fc-shell-only")
+
+    dump.run_dump(SimpleNamespace(show_keys=False))
+
+    line = _api_key_line(capsys.readouterr().out, "firecrawl")
+    assert "set" in line
+    assert "shell only" in line
+    assert ".env" in line
+
+
+def test_dump_leaves_unset_key_untouched(monkeypatch, capsys, tmp_path):
+    from hermes_cli import dump
+    from hermes_cli.config import get_hermes_home
+
+    monkeypatch.setattr(dump, "get_project_root", lambda: tmp_path / "noproject")
+    monkeypatch.delenv("KEENABLE_API_KEY", raising=False)
+    monkeypatch.delenv("TAVILY_API_KEY", raising=False)
+
+    home = get_hermes_home()
+    home.mkdir(parents=True, exist_ok=True)
+    (home / ".env").write_text("OPENROUTER_API_KEY=sk-or-xxxx\n")
+
+    dump.run_dump(SimpleNamespace(show_keys=False))
+
+    line = _api_key_line(capsys.readouterr().out, "keenable")
+    assert "not set" in line
+    assert "shell only" not in line