import codecs import os from hermes_cli.env_loader import load_hermes_dotenv def test_recovered_update_retry_skips_external_secret_sources(tmp_path, monkeypatch): """The post-recovery updater must not remap native vault dependencies.""" import hermes_cli.env_loader as env_loader from hermes_cli import _early_recovery home = tmp_path / "hermes" home.mkdir() env_file = home / ".env" env_file.write_text("UPDATE_RETRY_DOTENV=loaded\n", encoding="utf-8") monkeypatch.delenv("UPDATE_RETRY_DOTENV", raising=False) monkeypatch.setattr(_early_recovery, "_UPDATE_RETRY_RECOVERED", True) external_calls = [] monkeypatch.setattr( env_loader, "_apply_external_secret_sources", lambda path: external_calls.append(path), ) loaded = load_hermes_dotenv(hermes_home=home) assert loaded == [env_file] assert os.environ["UPDATE_RETRY_DOTENV"] == "loaded" assert external_calls == [] def test_utf8_bom_does_not_mangle_first_key(tmp_path, monkeypatch): """A leading UTF-8 BOM must not prefix the first key name in os.environ. PowerShell 5.1 ``Set-Content -Encoding UTF8`` and Windows Notepad write a BOM (EF BB BF). With encoding=utf-8, python-dotenv keeps U+FEFF on the first key so the canonical name is absent and callers see "not configured". """ home = tmp_path / "hermes" home.mkdir() env_file = home / ".env" env_file.write_bytes( b"\xef\xbb\xbfFIRST_KEY=first-value\nSECOND_KEY=second-value\n" ) monkeypatch.delenv("FIRST_KEY", raising=False) monkeypatch.delenv("SECOND_KEY", raising=False) monkeypatch.delenv("\ufeffFIRST_KEY", raising=False) loaded = load_hermes_dotenv(hermes_home=home) assert loaded == [env_file] assert os.getenv("FIRST_KEY") == "first-value" assert os.getenv("SECOND_KEY") == "second-value" assert os.environ.get("\ufeffFIRST_KEY") is None def test_bom_first_key_is_seen_by_installer_and_scrub_alike(tmp_path, monkeypatch): """Invariant: the key set the dashboard/profile scrub computes (``_env_keys_defined_in_dotenv``) equals the key set the installers define (``load_hermes_dotenv`` into os.environ, ``load_env_file`` into a profile scope). A BOM'd first line, ``export``, quotes and inline comments must not split them — a key one side sees and the other doesn't is a scrub miss.""" from hermes_cli.env_loader import _env_keys_defined_in_dotenv from agent.secret_scope import load_env_file home = tmp_path / "hermes" home.mkdir() env_file = home / ".env" env_file.write_bytes( b"\xef\xbb\xbfFIRST_KEY=first-value\n" b"export EXPORTED_KEY='quoted # not a comment'\n" b"COMMENTED_KEY=value # trailing comment\n" b"EMPTY_KEY=\n" ) for key in ("FIRST_KEY", "EXPORTED_KEY", "COMMENTED_KEY", "EMPTY_KEY", "\ufeffFIRST_KEY"): monkeypatch.delenv(key, raising=False) load_hermes_dotenv(hermes_home=home) installed = {k for k in ("FIRST_KEY", "EXPORTED_KEY", "COMMENTED_KEY", "EMPTY_KEY") if k in os.environ} scoped = load_env_file(env_file) assert _env_keys_defined_in_dotenv(env_file) == installed == set(scoped) assert "\ufeffFIRST_KEY" not in _env_keys_defined_in_dotenv(env_file) assert scoped["EXPORTED_KEY"] == os.environ["EXPORTED_KEY"] == "quoted # not a comment" assert scoped["COMMENTED_KEY"] == os.environ["COMMENTED_KEY"] == "value" def test_utf8_bom_plus_invalid_utf8_preserves_first_key(tmp_path, monkeypatch): """BOM + non-UTF-8 body must load via latin-1 without mangling the first key. utf-8-sig only applies on the primary path. When invalid UTF-8 forces the latin-1 fallback, a leading EF BB BF would otherwise become part of the first key name under latin-1 and drop the canonical name. """ home = tmp_path / "hermes" home.mkdir() env_file = home / ".env" # BOM + valid first key + latin-1 é (0xE9) in a later value. env_file.write_bytes( b"\xef\xbb\xbfANTHROPIC_API_KEY=sk-test-123\nBAD=caf\xe9\n" ) monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False) monkeypatch.delenv("BAD", raising=False) monkeypatch.delenv("\ufeffANTHROPIC_API_KEY", raising=False) loaded = load_hermes_dotenv(hermes_home=home) assert loaded == [env_file] assert os.getenv("ANTHROPIC_API_KEY") == "sk-test-123" assert os.getenv("BAD") == "café" assert os.environ.get("\ufeffANTHROPIC_API_KEY") is None def test_latin1_fallback_stream_honors_override(tmp_path, monkeypatch): """Stream-based latin-1 fallback must honor override= identically to dotenv_path.""" from hermes_cli.env_loader import _load_dotenv_with_fallback home = tmp_path / "hermes" home.mkdir() env_file = home / ".env" # Invalid UTF-8 forces the stream/latin-1 path. env_file.write_bytes(b"OVERRIDE_PROBE=from-file\nLATIN1_VALUE=caf\xe9\n") monkeypatch.setenv("OVERRIDE_PROBE", "from-shell") monkeypatch.delenv("LATIN1_VALUE", raising=False) # override=False: shell value must win (same as dotenv_path form). _load_dotenv_with_fallback(env_file, override=False) assert os.getenv("OVERRIDE_PROBE") == "from-shell" assert os.getenv("LATIN1_VALUE") == "café" # override=True: file value must win (user-env path). _load_dotenv_with_fallback(env_file, override=True) assert os.getenv("OVERRIDE_PROBE") == "from-file" assert os.getenv("LATIN1_VALUE") == "café" def test_latin1_fallback_stream_preserves_interpolation(tmp_path, monkeypatch): """Stream/latin-1 path must still expand ${VAR} like the dotenv_path form.""" home = tmp_path / "hermes" home.mkdir() env_file = home / ".env" # 0xE9 forces latin-1 fallback; ${FOO} must still expand. env_file.write_bytes(b"FOO=bar\nBAR=${FOO}\nLATIN1_VALUE=caf\xe9\n") monkeypatch.delenv("FOO", raising=False) monkeypatch.delenv("BAR", raising=False) monkeypatch.delenv("LATIN1_VALUE", raising=False) loaded = load_hermes_dotenv(hermes_home=home) assert loaded == [env_file] assert os.getenv("FOO") == "bar" assert os.getenv("BAR") == "bar" assert os.getenv("LATIN1_VALUE") == "café" # --------------------------------------------------------------------------- # UTF-16 / UTF-32 .env sanitizer coverage # # UTF-8 BOM handling for _load_dotenv_with_fallback is covered above (#65124). # This section covers the sanitizer rewrite path for UTF-16/32 (and UTF-8 / # cp1252 regression guards for that path). # --------------------------------------------------------------------------- def _assert_clean_utf8_env_on_disk(env_file, *, first_key: str) -> None: """On-disk file must be clean UTF-8: no BOM, no U+FFFD, canonical key.""" after = env_file.read_bytes() assert not after.startswith(codecs.BOM_UTF8) assert not after.startswith(codecs.BOM_UTF16_LE) assert not after.startswith(codecs.BOM_UTF16_BE) text = after.decode("utf-8") # strict — raises if not clean UTF-8 assert "\ufffd" not in text assert text.startswith(f"{first_key}=") or f"\n{first_key}=" in text assert first_key.encode("ascii") in after def test_utf16_le_bom_preserves_non_ascii_values(tmp_path, monkeypatch): """UTF-16-LE+BOM rewrite must preserve non-ASCII values (not just ASCII keys). Uses non-credential var names so _sanitize_loaded_credentials does not strip non-ASCII from values (that path only targets *_KEY/*_TOKEN/etc.). """ home = tmp_path / "hermes" home.mkdir() env_file = home / ".env" content = "GREETING=café\nCJK_LABEL=日本語\n" env_file.write_bytes(codecs.BOM_UTF16_LE + content.encode("utf-16-le")) monkeypatch.delenv("GREETING", raising=False) monkeypatch.delenv("CJK_LABEL", raising=False) loaded = load_hermes_dotenv(hermes_home=home) assert loaded == [env_file] assert os.getenv("GREETING") == "café" assert os.getenv("CJK_LABEL") == "日本語" after = env_file.read_bytes() assert after.decode("utf-8") # strict assert "café".encode("utf-8") in after assert "日本語".encode("utf-8") in after assert b"\xef\xbf\xbd" not in after def test_utf32_le_bom_leaves_file_untouched(tmp_path, caplog): """UTF-32-LE BOM: refuse-to-mangle (leave bytes untouched + warning). UTF-32-LE's BOM starts with UTF-16-LE's FF FE; sniff order must check UTF-32 first so we never misdetect and corrupt. Exercises ``_sanitize_env_file_if_needed`` only: the dotenv load path is out of scope here (#65124's surface) and still cannot ingest UTF-32. """ import logging from hermes_cli.env_loader import _sanitize_env_file_if_needed env_file = tmp_path / ".env" content = "HERMES_TEST_KEY=hello_utf32\nSECOND_KEY=world\n" raw = codecs.BOM_UTF32_LE + content.encode("utf-32-le") env_file.write_bytes(raw) with caplog.at_level(logging.WARNING, logger="hermes_cli.env_loader"): _sanitize_env_file_if_needed(env_file) assert env_file.read_bytes() == raw # untouched assert any("UTF-32" in r.message for r in caplog.records) def test_utf32_warning_fires_once_per_path(tmp_path, caplog, monkeypatch): """Three sanitize calls on the same UTF-32 file → exactly one warning. Matches house style for warn-once (module-level seen-set, same class as ``_WARNED_KEYS``): hot-reload / multi-entry load must not spam logs. """ import logging import hermes_cli.env_loader as env_loader from hermes_cli.env_loader import _sanitize_env_file_if_needed # Isolate process-level seen-set so other tests' paths don't leak in. monkeypatch.setattr(env_loader, "_WARNED_UTF32_PATHS", set()) env_file = tmp_path / ".env" content = "HERMES_TEST_KEY=hello_utf32\nSECOND_KEY=world\n" raw = codecs.BOM_UTF32_LE + content.encode("utf-32-le") env_file.write_bytes(raw) with caplog.at_level(logging.WARNING, logger="hermes_cli.env_loader"): _sanitize_env_file_if_needed(env_file) _sanitize_env_file_if_needed(env_file) _sanitize_env_file_if_needed(env_file) utf32_warnings = [r for r in caplog.records if "UTF-32" in r.message] assert len(utf32_warnings) == 1 assert env_file.read_bytes() == raw def test_plain_utf8_env_regression(tmp_path, monkeypatch): """Plain UTF-8 .env must keep loading after the UTF-16 sanitize changes.""" home = tmp_path / "hermes" home.mkdir() env_file = home / ".env" before = b"OPENAI_API_KEY=sk-plain\nSECOND_KEY=ok\n" env_file.write_bytes(before) monkeypatch.delenv("OPENAI_API_KEY", raising=False) monkeypatch.delenv("SECOND_KEY", raising=False) loaded = load_hermes_dotenv(hermes_home=home) assert loaded == [env_file] assert os.getenv("OPENAI_API_KEY") == "sk-plain" assert os.getenv("SECOND_KEY") == "ok" # No spurious rewrite of an already-clean file. assert env_file.read_bytes() == before def test_cp1252_env_regression_does_not_crash(tmp_path, monkeypatch): """cp1252/latin-1 body must not crash sanitize; ASCII keys still usable. 0xE9 is 'é' in cp1252 and incomplete as UTF-8. First line does not begin with U+FFFD, so the FFFD guard must not refuse the whole file. Sanitize leaves the file bytes alone when the only "change" is errors=replace on values (original already replace-decoded equals sanitized), so _load_dotenv_with_fallback's latin-1 path recovers café. """ home = tmp_path / "hermes" home.mkdir() env_file = home / ".env" before = b"ASCII_KEY=ok\nLATIN1_VALUE=caf\xe9\n" env_file.write_bytes(before) monkeypatch.delenv("ASCII_KEY", raising=False) monkeypatch.delenv("LATIN1_VALUE", raising=False) loaded = load_hermes_dotenv(hermes_home=home) assert loaded == [env_file] assert os.getenv("ASCII_KEY") == "ok" assert os.getenv("LATIN1_VALUE") == "café" # Sanitize must not have rewritten (would have persisted U+FFFD). assert env_file.read_bytes() == before # --------------------------------------------------------------------------- # Profile .env isolation: inherited known-key cleanup # --------------------------------------------------------------------------- def test_known_keys_absent_from_user_env_are_cleared(tmp_path, monkeypatch): """Known Hermes keys inherited from parent process are removed when absent from the profile's .env. This is the startup equivalent of ``reload_env()``'s known-key cleanup and fixes the isolation gap where one profile's ACP/provider settings silently leak into another profile's runtime via ``os.environ`` inheritance. """ home = tmp_path / "hermes" home.mkdir() (home / ".env").write_text( "OPENAI_BASE_URL=https://profile.example/v1\n", encoding="utf-8" ) # Inherited known keys from parent process / other profile monkeypatch.setenv("OPENAI_BASE_URL", "https://stale.example/v1") monkeypatch.setenv("HERMES_ACP_AUTH_METHOD", "cursor_login") monkeypatch.setenv("COPILOT_CLI_PATH", "/usr/bin/claude-code") # Unrelated shell var must NOT be touched monkeypatch.setenv("MY_SHELL_ONLY_VAR", "keep-me") load_hermes_dotenv(hermes_home=home) # OPENAI_BASE_URL is defined in the profile .env → overridden to the new value assert os.getenv("OPENAI_BASE_URL") == "https://profile.example/v1" # HERMES_ACP_AUTH_METHOD and COPILOT_CLI_PATH are NOT in the profile .env → cleared assert "HERMES_ACP_AUTH_METHOD" not in os.environ assert "COPILOT_CLI_PATH" not in os.environ # Unrelated shell vars must survive assert os.getenv("MY_SHELL_ONLY_VAR") == "keep-me" def test_empty_assignment_in_user_env_is_preserved(tmp_path, monkeypatch): """An explicit ``KEY=`` (empty value) in the profile .env keeps the key in ``os.environ`` — distinct from a key absent from .env entirely. Empty ``HERMES_ACP_AUTH_METHOD=`` tells the ACP adapter to skip ``authenticate`` (the key exists, its value is just empty). This is the documented workaround for the leak and must still work after the cleanup. """ home = tmp_path / "hermes" home.mkdir() (home / ".env").write_text("HERMES_ACP_AUTH_METHOD=\n", encoding="utf-8") monkeypatch.setenv("HERMES_ACP_AUTH_METHOD", "cursor_login") monkeypatch.setenv("COPILOT_CLI_PATH", "/usr/bin/sneaky") # NOT in .env → cleared load_hermes_dotenv(hermes_home=home) # KEY= in .env keeps the key (now empty string) assert "HERMES_ACP_AUTH_METHOD" in os.environ assert os.environ["HERMES_ACP_AUTH_METHOD"] == "" # COPILOT_CLI_PATH is absent from .env → cleared assert "COPILOT_CLI_PATH" not in os.environ def test_no_user_env_does_not_clear_anything(tmp_path, monkeypatch): """When no profile .env exists (bare profile), load_hermes_dotenv must not wipe inherited known keys — the bare-profile case follows #66930 / #67027 semantics and the user's shell environment should not be mutilated. """ home = tmp_path / "hermes" home.mkdir() # No .env in home — bare profile monkeypatch.setenv("HERMES_ACP_AUTH_METHOD", "cursor_login") monkeypatch.setenv("PATH", "/usr/bin:/bin") load_hermes_dotenv(hermes_home=home) assert os.getenv("HERMES_ACP_AUTH_METHOD") == "cursor_login" assert os.getenv("PATH") == "/usr/bin:/bin" def test_known_key_explicitly_set_in_user_env_is_kept(tmp_path, monkeypatch): """A known Hermes key that IS explicitly set in the profile .env survives the cleanup (overrides the inherited value). """ home = tmp_path / "hermes" home.mkdir() (home / ".env").write_text( "HERMES_ACP_AUTH_METHOD=claude_code_cli\n", encoding="utf-8" ) monkeypatch.setenv("HERMES_ACP_AUTH_METHOD", "cursor_login") load_hermes_dotenv(hermes_home=home) assert os.getenv("HERMES_ACP_AUTH_METHOD") == "claude_code_cli" def test_export_prefixed_known_key_in_user_env_is_kept(tmp_path, monkeypatch): """A known Hermes key defined with the bash-compatible ``export KEY=value`` form in the profile .env must be recognized as defined and survive the cleanup - mirrors the ``export `` stripping in config.py's load_env() (#6659). """ home = tmp_path / "hermes" home.mkdir() (home / ".env").write_text( "export HERMES_ACP_AUTH_METHOD=claude_code_cli\n", encoding="utf-8" ) monkeypatch.setenv("HERMES_ACP_AUTH_METHOD", "cursor_login") load_hermes_dotenv(hermes_home=home) assert os.getenv("HERMES_ACP_AUTH_METHOD") == "claude_code_cli" def test_shell_exported_credentials_survive_cleanup(tmp_path, monkeypatch): """User-shell-exported provider credentials must NOT be scrubbed. ``export OPENAI_API_KEY=…`` in the shell with a ``.env`` that doesn't contain the key is a documented, legitimate flow (see test_dump_env_visibility.py). The startup cleanup is scoped to _PROFILE_MANAGED_ENV_KEYS (ACP routing keys) precisely so it can never delete shell-supplied credentials — a process cannot distinguish a shell export from parent-process leakage, so credential isolation is owned by read-time secret scoping instead. """ home = tmp_path / "hermes" home.mkdir() (home / ".env").write_text("SOME_OTHER_KEY=x\n", encoding="utf-8") monkeypatch.setenv("OPENAI_API_KEY", "sk-from-shell") monkeypatch.setenv("ANTHROPIC_API_KEY", "sk-ant-from-shell") monkeypatch.setenv("TELEGRAM_BOT_TOKEN", "12345:token-from-shell") # A profile-managed routing key inherited alongside them IS cleared. monkeypatch.setenv("HERMES_ACP_AUTH_METHOD", "cursor_login") load_hermes_dotenv(hermes_home=home) assert os.getenv("OPENAI_API_KEY") == "sk-from-shell" assert os.getenv("ANTHROPIC_API_KEY") == "sk-ant-from-shell" assert os.getenv("TELEGRAM_BOT_TOKEN") == "12345:token-from-shell" assert "HERMES_ACP_AUTH_METHOD" not in os.environ def test_cleanup_scope_is_the_profile_managed_set(): """Lock the invariant: the startup scrub set contains only behavioral ACP/routing keys — never credential-shaped keys. If this fails, someone widened _PROFILE_MANAGED_ENV_KEYS toward the full known-key set, which re-introduces the shell-export deletion bug. """ from hermes_cli.env_loader import _PROFILE_MANAGED_ENV_KEYS for key in _PROFILE_MANAGED_ENV_KEYS: assert not key.endswith(("_API_KEY", "_TOKEN", "_SECRET")), ( f"{key} looks credential-shaped; startup scrub must not " "cover credentials — read-time secret scoping owns those" ) # --------------------------------------------------------------------------- # config.yaml terminal.* re-apply after dotenv loads (#29186 / #67323) # # load_hermes_dotenv loads .env with override=True, so a stale # TERMINAL_ENV=docker in .env used to silently beat config.yaml's # terminal.backend on every reload (gateway per-turn reload, cron standalone # runs). The bridge re-applies config.yaml's EXPLICIT terminal keys last via # the shared hermes_cli.config.apply_terminal_config_to_env helper. # --------------------------------------------------------------------------- def _seed_terminal_home(tmp_path, monkeypatch, *, config_yaml=None, env_text=None): home = tmp_path / "hermes" home.mkdir() if config_yaml is not None: (home / "config.yaml").write_text(config_yaml, encoding="utf-8") if env_text is not None: (home / ".env").write_text(env_text, encoding="utf-8") # The bridge is scoped to the process HERMES_HOME (a different profile's # load must not bridge this process's config), so point the process at # the seeded home like a real gateway/cron process would be. monkeypatch.setenv("HERMES_HOME", str(home)) return home def test_config_yaml_terminal_backend_overrides_stale_env(tmp_path, monkeypatch): """Regression for #29186: a leftover TERMINAL_ENV=docker in ~/.hermes/.env must not silently override the user's choice in config.yaml. config.yaml is the documented source of truth, so its value must win after load.""" home = _seed_terminal_home( tmp_path, monkeypatch, config_yaml="terminal:\n backend: local\n", env_text="TERMINAL_ENV=docker\n", ) monkeypatch.delenv("TERMINAL_ENV", raising=False) load_hermes_dotenv(hermes_home=home) assert os.getenv("TERMINAL_ENV") == "local" def test_config_yaml_terminal_backend_overrides_stale_shell(tmp_path, monkeypatch): """config.yaml must also beat a stale TERMINAL_ENV exported in the shell (e.g. set in ~/.zshrc when the user was experimenting with docker).""" home = _seed_terminal_home( tmp_path, monkeypatch, config_yaml="terminal:\n backend: local\n", ) monkeypatch.setenv("TERMINAL_ENV", "docker") load_hermes_dotenv(hermes_home=home) assert os.getenv("TERMINAL_ENV") == "local" def test_no_terminal_section_leaves_env_value_alone(tmp_path, monkeypatch): """When config.yaml has no terminal section, the .env value is still the user's active setting — the bridge must NOT clobber it with merged defaults.""" home = _seed_terminal_home( tmp_path, monkeypatch, config_yaml="display:\n streaming: true\n", env_text="TERMINAL_ENV=docker\n", ) monkeypatch.delenv("TERMINAL_ENV", raising=False) load_hermes_dotenv(hermes_home=home) assert os.getenv("TERMINAL_ENV") == "docker" def test_config_yaml_terminal_omitted_key_does_not_clear_env(tmp_path, monkeypatch): """If config.yaml has a terminal block but no `backend`, the .env value must survive (only explicit config keys override env).""" home = _seed_terminal_home( tmp_path, monkeypatch, config_yaml="terminal:\n timeout: 600\n", env_text="TERMINAL_ENV=docker\n", ) monkeypatch.delenv("TERMINAL_ENV", raising=False) load_hermes_dotenv(hermes_home=home) assert os.getenv("TERMINAL_ENV") == "docker" assert os.getenv("TERMINAL_TIMEOUT") == "600" def test_other_profile_home_does_not_bridge_process_config(tmp_path, monkeypatch): """Loading a DIFFERENT profile's .env must not re-bridge this process's config.yaml — the shared bridge reads the process-global config, so applying it for another home would stamp the wrong profile's terminal settings into the env.""" process_home = tmp_path / "process-home" process_home.mkdir() (process_home / "config.yaml").write_text( "terminal:\n backend: local\n", encoding="utf-8" ) monkeypatch.setenv("HERMES_HOME", str(process_home)) other_home = tmp_path / "other-profile" other_home.mkdir() (other_home / ".env").write_text("TERMINAL_ENV=docker\n", encoding="utf-8") monkeypatch.delenv("TERMINAL_ENV", raising=False) load_hermes_dotenv(hermes_home=other_home) # The other profile's .env value stands; the process config was not applied. assert os.getenv("TERMINAL_ENV") == "docker" def test_parent_injected_dashboard_session_token_survives_dotenv(tmp_path, monkeypatch): """A parent that spawns `hermes dashboard` mints HERMES_DASHBOARD_SESSION_TOKEN and keeps it for its own /api probes; a persisted token in ~/.hermes/.env must not replace it, or the parent gets HTTP 401 from its own child (#115955). Ordinary keys keep the documented .env-wins precedence.""" home = tmp_path / "hermes" home.mkdir() (home / ".env").write_text( "HERMES_DASHBOARD_SESSION_TOKEN=persisted-token\nHERMES_DASHBOARD_PUBLIC_URL=http://127.0.0.1:1\n", encoding="utf-8", ) monkeypatch.setenv("HERMES_DASHBOARD_SESSION_TOKEN", "link-token") monkeypatch.setenv("HERMES_DASHBOARD_PUBLIC_URL", "http://127.0.0.1:43123") load_hermes_dotenv(hermes_home=home) assert os.environ["HERMES_DASHBOARD_SESSION_TOKEN"] == "link-token" assert os.environ["HERMES_DASHBOARD_PUBLIC_URL"] == "http://127.0.0.1:1" # control: .env still wins # Reload with the same injection: the injected value still holds. load_hermes_dotenv(hermes_home=home) assert os.environ["HERMES_DASHBOARD_SESSION_TOKEN"] == "link-token" def test_dotenv_published_dashboard_session_token_still_reloads(tmp_path, monkeypatch): """No injection: the .env token is published, and a later edit + reload replaces the value the earlier pass published (the guard only protects values dotenv did not put there).""" home = tmp_path / "hermes" home.mkdir() monkeypatch.delenv("HERMES_DASHBOARD_SESSION_TOKEN", raising=False) (home / ".env").write_text("HERMES_DASHBOARD_SESSION_TOKEN=first\n", encoding="utf-8") load_hermes_dotenv(hermes_home=home) assert os.environ["HERMES_DASHBOARD_SESSION_TOKEN"] == "first" (home / ".env").write_text("HERMES_DASHBOARD_SESSION_TOKEN=second\n", encoding="utf-8") load_hermes_dotenv(hermes_home=home) assert os.environ["HERMES_DASHBOARD_SESSION_TOKEN"] == "second"