Import AITURK IDE 1.0.0-beta.1 from Hermes 63279301; preserve MIT license

tests/test_hermetic_side_effect_guards.py

@@ -0,0 +1,69 @@
+"""Regression tests for hermetic guards around local desktop side effects."""
+
+from __future__ import annotations
+
+import webbrowser
+
+
+def test_webbrowser_open_calls_are_neutralized(monkeypatch):
+    """OAuth/browser tests should never reach the real browser registry."""
+
+    def _real_browser_lookup_reached(*_args, **_kwargs):
+        raise AssertionError("test reached the real webbrowser registry")
+
+    monkeypatch.setattr(webbrowser, "get", _real_browser_lookup_reached)
+
+    url = "https://provider.example.invalid/oauth/authorize"
+
+    assert webbrowser.open(url) is True
+    assert webbrowser.open_new(url) is True
+    assert webbrowser.open_new_tab(url) is True
+
+
+def test_webbrowser_get_controller_is_neutralized(_neutralize_webbrowser):
+    """Direct controller access should still stay inside the test recorder."""
+    url = "https://provider.example.invalid/oauth/authorize"
+
+    controller = webbrowser.get("hermes-test-browser")
+
+    assert controller.open(url) is True
+    assert controller.open_new(url) is True
+    assert controller.open_new_tab(url) is True
+    assert _neutralize_webbrowser == [url, url, url]
+
+
+def _isolate_anthropic_credentials(monkeypatch, tmp_path):
+    from agent import anthropic_adapter as aa
+    from agent import anthropic_credentials as ac
+
+    monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False)
+    monkeypatch.delenv("ANTHROPIC_TOKEN", raising=False)
+    monkeypatch.delenv("CLAUDE_CODE_OAUTH_TOKEN", raising=False)
+    # Patch the implementation owner (anthropic_credentials); the adapter
+    # merely re-exports these functions after the godfile split.
+    monkeypatch.setattr(ac.Path, "home", lambda: tmp_path)
+    monkeypatch.setattr(ac.platform, "system", lambda: "Darwin")
+
+    def _real_keychain_reached(*_args, **_kwargs):
+        raise AssertionError("test reached the real macOS Keychain command")
+
+    monkeypatch.setattr(ac.subprocess, "run", _real_keychain_reached)
+    return aa
+
+
+def test_claude_code_credential_read_does_not_touch_macos_keychain(
+    monkeypatch, tmp_path
+):
+    """The real credential reader should be safe under the suite guard."""
+    aa = _isolate_anthropic_credentials(monkeypatch, tmp_path)
+
+    assert aa.read_claude_code_credentials() is None
+
+
+def test_anthropic_token_resolution_does_not_touch_macos_keychain(
+    monkeypatch, tmp_path
+):
+    """Token resolution should be safe under the same suite guard."""
+    aa = _isolate_anthropic_credentials(monkeypatch, tmp_path)
+
+    assert aa.resolve_anthropic_token() is None