fix(tests): stabilize main full-suite baseline

[nocturnum91]

What does this PR do?

Fixes macOS/full-suite baseline failures and test isolation problems that made the broad Hermes test suite order-dependent. The changes harden Discord/Telegram test doubles, gateway fixture normalization, provider/config test cleanup, and a few runtime cleanup paths that were exposed while stabilizing the suite.

Related Issue

N/A — baseline/test-suite stabilization PR.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• Normalize Discord and Telegram gateway test doubles so xdist collection order does not leak MagicMock stubs into adapter globals.
• Clear tool-definition and terminal availability caches in tests that monkeypatch provider/backend checks.
• Make xAI env lookup and auxiliary client timeout cleanup resilient to test/runtime state changes.
• Harden gateway, web, Google Chat, shutdown-forensics, and Kanban diagnostic paths encountered by the full-suite baseline.
• Restore Kanban diagnostics severity filtering to threshold semantics (severity_at_or_above) instead of exact matching.
• Update regression coverage across gateway fixtures, provider config tests, terminal tool tests, and baseline failure cases.

How to Test

1. Run focused regression tests for the changed baseline areas, including gateway fixture/provider/terminal/Kanban coverage.
2. Run the PR-specific focused test for the Kanban severity fix.
3. Confirm GitHub checks for ruff, attribution, common ancestor, Windows footguns, e2e, and lockfile/dependency scans.
4. Run a read-only Codex review of the final branch delta.

Verification performed during refresh:

• Focused PR checks passed locally, including the new Kanban severity regression.
• Read-only Codex review: first BLOCKED → fixes applied → fresh final review VERDICT: CLEAN.
• Branch was rebased onto current main; conflicts were resolved and the fork branch was updated with --force-with-lease.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS

Note: During refresh I ran the full local suite via the CONTRIBUTING-recommended wrapper TMPDIR=/tmp ./scripts/run_tests.sh tests (24472 passed, 120 skipped, 231 warnings), plus focused/regression checks for the changed areas. GitHub Actions is still the source of truth for the hosted matrix.

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

For New Skills

N/A — this PR does not add a skill.

Screenshots / Logs

N/A. Relevant verification is in local focused test output, Codex review logs, and GitHub Actions checks.

[austinpickett]

Please fix merge conflicts, use .github/PULL_REQUEST_TEMPLATE.md and resolve Copilot comments

[Copilot]

Pull request overview

This PR focuses on eliminating full-suite baseline failures (notably on macOS) by hardening test isolation/collection behavior (especially around Discord/Telegram stubs), making a few runtime paths more resilient to missing OS utilities, and tightening some gateway/web/kanban edge cases that were sensitive to environment state.

Changes:

• Normalize Discord/Telegram/Google Chat test doubles and cache invalidation to avoid xdist collection-order leakage and stale availability checks.
• Make several runtime/utilities more resilient (e.g., auxiliary client timeout cleanup, systemctl/timeout presence, dynamic env lookup for xAI helpers).
• Improve Kanban dashboard UX/API behavior by surfacing actionable 409 dependency-block details and displaying parsed API error messages in the UI.

Reviewed changes

Copilot reviewed 40 out of 42 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
uv.lock	Adds dev dependencies (FastAPI/Uvicorn) and composes dev to include web extra in the lock.
tui_gateway/server.py	Refines browser connect failure messaging by checking Chrome candidate availability.
tools/xai_http.py	Switches xAI env lookup to dynamically resolve Hermes config helper at call time.
tests/tools/test_terminal_tool_requirements.py	Clears both tool-definition and check-fn caches to avoid stale tool availability across tests.
tests/hermes_cli/test_web_server.py	Skips PTY websocket tests when optional ptyprocess isn’t installed.
tests/hermes_cli/test_tools_config.py	Uses _visible_providers() to select providers consistent with runtime visibility rules.
tests/hermes_cli/test_model_switch_custom_providers.py	Adds stub for fetch_api_models to keep provider listing tests hermetic.
tests/hermes_cli/test_gateway_wsl.py	Stubs shutil.which("systemctl") to stabilize systemd capability tests.
tests/hermes_cli/test_api_key_providers.py	Hardens auto provider resolution test by clearing env and patching auth/AWS credential probes.
tests/gateway/test_voice_command.py	Adjusts Discord module detection; updates expected Telegram DM metadata.
tests/gateway/test_telegram_thread_fallback.py	Updates expected Telegram DM metadata in busy-ack path.
tests/gateway/test_send_multiple_images.py	Adjusts Discord module detection to distinguish real installs vs mocks.
tests/gateway/test_send_image_file.py	Adjusts Discord module detection to distinguish real installs vs mocks.
tests/gateway/test_google_chat.py	Ensures service_account stub exists when google-auth isn’t installed.
tests/gateway/test_discord_slash_commands.py	Adjusts Discord module detection to prevent mock leakage across files.
tests/gateway/test_discord_slash_auth.py	Adjusts Discord module detection to prevent mock leakage across files.
tests/gateway/test_discord_send.py	Adjusts Discord module detection to prevent mock leakage across files.
tests/gateway/test_discord_reply_mode.py	Adjusts Discord module detection to prevent mock leakage across files.
tests/gateway/test_discord_reactions.py	Adjusts Discord module detection to prevent mock leakage across files.
tests/gateway/test_discord_free_response.py	Adjusts Discord module detection to prevent mock leakage across files.
tests/gateway/test_discord_document_handling.py	Adjusts Discord module detection to prevent mock leakage across files.
tests/gateway/test_discord_connect.py	Adjusts Discord module detection and keeps AllowedMentions stable across import order.
tests/gateway/test_discord_channel_prompts.py	Adjusts Discord module detection to prevent mock leakage across files.
tests/gateway/test_discord_channel_controls.py	Adjusts Discord module detection to prevent mock leakage across files.
tests/gateway/test_discord_attachment_download.py	Adjusts Discord module detection to prevent mock leakage across files.
tests/gateway/test_discord_allowed_mentions.py	Adjusts Discord module detection and keeps AllowedMentions stable across import order.
tests/gateway/test_background_command.py	Updates expected Telegram DM metadata for background completion.
tests/gateway/conftest.py	Centralizes stronger Telegram/Discord mocks and patches already-imported gateway modules for stability.
tests/e2e/conftest.py	Expands Discord mock surface area and avoids setdefault leakage by explicitly overwriting sys.modules entries.
tests/conftest.py	Improves guard behavior around subprocess calls (incl. systemctl-missing behavior) and adds annotations for Windows footguns.
tests/agent/test_bedrock_integration.py	Stabilizes bedrock region behavior by patching region resolution helper.
tests/agent/test_anthropic_adapter.py	Prevents macOS keychain Claude Code creds from leaking into hermetic auth tests.
run_agent.py	Normalizes provider casing when determining Kimi tool reasoning behavior.
pyproject.toml	Composes dev extra to include web extra dependencies.
plugins/platforms/google_chat/adapter.py	Loads google-auth modules lazily for standalone send and returns a clear error if unavailable.
plugins/kanban/dashboard/plugin_api.py	Adds detailed dependency-blocked 409 responses for “ready” moves and refines diagnostics severity filtering.
plugins/kanban/dashboard/dist/index.js	Parses API error detail from JSON-ish error strings and displays PATCH failures inline.
hermes_cli/main.py	Updates auxiliary-model comment to include approvals among tasks.
hermes_cli/gateway.py	Adds accessible-dir helper and avoids user-systemd preflight when systemctl isn’t present.
gateway/shutdown_forensics.py	Makes shutdown diagnostic spawn tolerant of missing timeout binary.
agent/auxiliary_client.py	Ensures auxiliary client close-on-timeout is idempotent and always triggered on deadline breach.
agent/anthropic_adapter.py	Treats TypeError as invalid JSON when decoding keychain payloads.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[nocturnum91]

@austinpickett addressed the requested changes from #27440 (review) in the latest commit 34f0c0ab42ba6b45963053d2c42e20661fc471d5.

• Merge conflicts: rebased on current nous/main; GitHub reports the PR as mergeable, and a local git merge-tree check found no conflict markers.
• PR template: the PR body now uses .github/PULL_REQUEST_TEMPLATE.md with all eight sections present.
• Copilot comments: replied to and fixed all five inline Copilot comments:
  • tools/xai_http.py: fallback to os.environ if the Hermes config helper raises.
  • tests/gateway/test_voice_command.py: removed duplicate direct_messages_topic_id key.
  • tests/gateway/test_telegram_thread_fallback.py: removed duplicate direct_messages_topic_id key.
  • tests/gateway/test_background_command.py: removed duplicate direct_messages_topic_id key.
  • gateway/shutdown_forensics.py: added a shell watchdog that terminates the detached diagnostic process group when the platform timeout binary is unavailable.

Verification after the fixes:

• TMPDIR=/tmp ./scripts/run_tests.sh tests → 24472 passed, 120 skipped, 231 warnings
• Focused Copilot follow-up tests → 291 passed
• Windows footguns scan on changed follow-up files → pass
• Read-only Codex review of the Copilot follow-up fixes → VERDICT: CLEAN

[teknium1]

Thanks for the broad stabilization work. There are still useful focused fixes here, but the current branch should be salvaged selectively rather than applied wholesale.

Problems

• The tests/conftest.py SIGALRM fixture is stale against current main. tests/conftest.py:446-450 explicitly documents its removal; scripts/run_tests.sh:5-9 and scripts/run_tests_parallel.py:247-295 now provide per-file subprocess isolation and timeout enforcement.
• The Kanban ready-blocker behavior and threshold semantics are already on main at plugins/kanban/dashboard/plugin_api.py:876-895 and :1293; the threshold fix shipped in a94ddd807.

Suggested changes

• Keep the Google Chat standalone-send lazy-load fix: main rejects at plugins/platforms/google_chat/adapter.py:3180 before using _load_google_modules() (:76-117).
• Keep the Kimi provider normalization: main remains case-sensitive at run_agent.py:5511-5515, while this PR's normalized provider check addresses that case.
• Adapt any retained isolation work to the current per-file runner rather than restoring SIGALRM.

This is an automated hermes-sweeper review.

[teknium1]

Thanks @nocturnum91 — closing: this stabilization pass was superseded by the suite-wide test-stability campaign (PRs #74330/#74383/#74517/#74553); the baseline now runs 0 failed / 0 flaky and the branch conflicts across 30+ files with no surviving fix to cherry-pick. Appreciate the early push on suite health.