From dfaaf5b43bc553f028db185213a94116d8151b32 Mon Sep 17 00:00:00 2001
From: Teknium <127238744+teknium1@users.noreply.github.com>
Date: Thu, 10 Sep 2026 22:46:21 -0700
Subject: [PATCH] fix(tests): make banner + anon-auth tests hermetic against CI
 network egress
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two main-tip CI failures (red on main push run 34550073898 and on every PR
since, e.g. #107947):

- tests/hermes_cli/test_banner_git_state.py: the three SSH-fastpath tests
  patched banner._upstream_main_sha, but _check_via_local_git resolves the
  GitHub-origin tip via banner._github_branch_tip — the patch intercepted
  nothing and the tests only stayed green when the live GitHub API call
  succeeded. On runners where api.github.com is unreachable/rate-limited the
  real call returns None and the tests fail (assert None == 0 / -1). Patch
  the seam production actually reads.

- tests/hermes_cli/test_anon_auth_core.py: the portal fixture reset the
  resolve_nous_access_token memo with None, but 173105ce6f4 changed
  _RESOLVE_TOKEN_CACHE from a single Optional slot to a dict keyed by
  hermes_home_key(); .get() on None raises AttributeError and the stale-token
  path never re-exchanges. Reset with {} to match the new shape.

A/B (sockets blocked in-process): base 5 failed — the exact CI set — fixed
40/40 green; both files green with network too.
---
 tests/hermes_cli/test_anon_auth_core.py   | 2 +-
 tests/hermes_cli/test_banner_git_state.py | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/hermes_cli/test_anon_auth_core.py b/tests/hermes_cli/test_anon_auth_core.py
index 390c9a36a695b..dab2eb2e02611 100644
--- a/tests/hermes_cli/test_anon_auth_core.py
+++ b/tests/hermes_cli/test_anon_auth_core.py
@@ -94,7 +94,7 @@ def __init__(self, *a, **kw):
     # resolve_nous_access_token memoises the last token for 5 s across the process; a token minted
     # by an earlier test must not be served to this one.
     from hermes_cli import auth as auth_mod
-    monkeypatch.setattr(auth_mod, "_RESOLVE_TOKEN_CACHE", None)
+    monkeypatch.setattr(auth_mod, "_RESOLVE_TOKEN_CACHE", {})
     return fake
 
 
diff --git a/tests/hermes_cli/test_banner_git_state.py b/tests/hermes_cli/test_banner_git_state.py
index e5bd64e5d03ab..816842ccd1d05 100644
--- a/tests/hermes_cli/test_banner_git_state.py
+++ b/tests/hermes_cli/test_banner_git_state.py
@@ -64,7 +64,7 @@ def fake_git_stdout(args, *, cwd, timeout=5, network=False):
 
     with (
         patch.object(banner, "_git_stdout", side_effect=fake_git_stdout),
-        patch.object(banner, "_upstream_main_sha", return_value="a" * 40),
+        patch.object(banner, "_github_branch_tip", return_value="a" * 40),
         # merge-base --is-ancestor exits 0: upstream tip IS an ancestor of HEAD
         patch.object(banner.subprocess, "run", return_value=MagicMock(returncode=0)),
     ):
@@ -91,7 +91,7 @@ def fake_git_stdout(args, *, cwd, timeout=5, network=False):
 
     with (
         patch.object(banner, "_git_stdout", side_effect=fake_git_stdout),
-        patch.object(banner, "_upstream_main_sha", return_value="a" * 40),
+        patch.object(banner, "_github_branch_tip", return_value="a" * 40),
         # merge-base --is-ancestor exits 1: not an ancestor -> genuinely behind
         patch.object(banner.subprocess, "run", return_value=MagicMock(returncode=1)),
         patch.object(banner, "_github_compare_behind", return_value=3),
@@ -119,7 +119,7 @@ def fake_git_stdout(args, *, cwd, timeout=5, network=False):
 
     with (
         patch.object(banner, "_git_stdout", side_effect=fake_git_stdout),
-        patch.object(banner, "_upstream_main_sha", return_value="a" * 40),
+        patch.object(banner, "_github_branch_tip", return_value="a" * 40),
         patch.object(banner.subprocess, "run", return_value=MagicMock(returncode=1)),
         patch.object(banner, "_github_compare_behind", return_value=None),
     ):