test: stop 5 config.set tests writing the REAL ~/.hermes/config.yaml

[slow4cyl]

test_config_set_model_{requires_confirmation_for_expensive_model,
explicit_provider_skips_broken_default_init,does_not_leak_inference_provider_env,
records_per_session_override_not_env,switches_agent_without_touching_env}
exercised the full config.set flow with switch_model mocked but let
_persist_model_switch call the real cli.save_config_value — which resolves
the config path from cli._hermes_home captured at import. Run without
HERMES_HOME (any plain 'pytest tests/'), they clobber the live user config:
last writer left model.default=anthropic/claude-sonnet-4.6 +
base_url=https://api.anthropic.com, silently repointing every fleet worker
at an Anthropic endpoint (observed live 2026-07-08 16:38; ~2000 worker
deaths on non-retryable 400s until restored).

Mock cli.save_config_value in all five, same as
test_config_set_model_global_persists already does.

🤖 Generated with Claude Code

[alt-glitch]

This was generated by AI during triage.

Duplicate of #57182 — both patch the same 5 config.set model tests in tests/test_tui_gateway_server.py with the same monkeypatch.setattr("cli.save_config_value", ...) mock. #57182 (2026-07-02) is the earliest-open fix and additionally adds a conftest tripwire that fails any test writing the repo-root/user config. Marking this as duplicate of the earlier, more complete PR.

[teknium1]

Thanks for isolating the five model-switch tests.

Problems

• The targeted mocks are correct for the current path: tui_gateway/server.py:2795-2812 calls cli.save_config_value, whose fallback writes repo-root cli-config.yaml when cli._hermes_home/config.yaml is absent (cli.py:3644-3646). The five affected tests remain unmocked on current main, including tests/test_tui_gateway_server.py:3497-3562.
• This PR does not include a suite-wide regression guard. Earlier open PR #57182 includes the same five mocks plus an autouse tests/conftest.py tripwire for repo-root cli-config.yaml writes; current main has no equivalent guard.

Suggested changes

• Salvage this patch together with #57182's tripwire, or add equivalent protection so future real save_config_value() calls fail at the offending test.

Automated hermes-sweeper review.

[teknium1]

This mock fixes this test's real persistence path. Please pair the five targeted mocks with a suite-wide repo-root cli-config.yaml write guard (as in earlier open PR #57182), so future unmocked callers fail at the source.

[slow4cyl]

Added the suite-wide guard as an autouse tripwire in tests/conftest.py — equivalent to #57182's but extended to also cover the live user config.yaml, not just the repo-root cli-config.yaml fallback. Two layers: cli.save_config_value is wrapped process-wide (marker-tagged, reload-safe) to fail an offending test at the call site before the write lands, and a per-test before/after snapshot restores the pre-test bytes and fails the test if anything slips past (cli imported mid-test, direct writers). Both forbidden paths resolve at conftest-import time from the pre-isolation environment, so tests persisting into their own tmp homes are untouched. Verified by temporarily reverting one of the five mocks: the test fails with the tripwire message and the polluting cli-config.yaml is restored; with mocks intact the affected slice's failure set is byte-identical to main. tests/test_config_write_guard.py pins both layers permanently. Rebased onto current main.

[teknium1]

Thanks @slow4cyl — closing as resolved on main: same class as #57182 — the repo-root/real-config fallback this guards against was removed from cli.save_config_value, so the tripwire would mirror dead code. Verified empirically post-prune.