test(8/N): fix all 13 remaining failures — clean up 3 stubborn + 5 new regressions

[Bartok9]

Context

7 PRs (#6 through #12) landed earlier tonight and reduced the Tests-workflow failure count from 41 → 13. But 13 failures remained on main (run 26677651968, sha 6b2b3d4). This PR closes the gap by fixing the root cause of every one — including the 3 stubborn pre-existing failures the earlier PRs claimed to fix but didn't, and the regressions the earlier PRs themselves introduced.

The earlier PRs merged on local-pass alone. This PR waits for the full Tests CI to go green before merging.

The 13 failures

#	Test	Prior PR	Status
1–6	test_google_chat.py::TestEnvConfigLoading::* (6)	#12 should-fix	pre-existing, not fixed
7	test_agent_cache.py::...::test_concurrent_inserts_settle_at_cap	#12 should-fix	pre-existing, not fixed
8	test_skill_provenance.py::test_default_origin_is_foreground	#10 should-fix	pre-existing, never touched
9	test_credential_pool.py::test_load_pool_prefers_dotenv_over_stale_os_environ	#10 introduced	new regression
10	test_restart_drain.py::test_restart_command_while_busy_requests_drain_without_interrupt	#12 introduced	new regression
11	test_update_yes_flag.py::...::test_yes_restores_stash_without_prompting	#11 introduced	new regression
12–13	test_goal_command.py::test_goal_status_alias_shows_status / test_goal_bare_shows_status_when_none_set	#11 introduced	new regression

Root causes (one per group)

• GOOGLE_CHAT (1–6): _check_for_registry() gated platform enablement on the optional google-cloud-pubsub SDK. The plugin loader imports the adapter under a different module name than tests patch, so under parallel execution the loaded copy's GOOGLE_CHAT_AVAILABLE stayed False and a configured platform was silently dropped. Enablement now reflects configuration intent (Pub/Sub project + subscription env vars); missing deps are still surfaced clearly at connect().
• agent_cache (7): 160 real AIAgent builds (~0.5s each) happened inside the worker threads, so the per-thread join(timeout=30) window exceeded 30s on shared CI. Agents are now pre-built before the timed section; the concurrency under test is unchanged.
• skill_provenance (8): run_agent.process_message() binds the write-origin ContextVar to "assistant_tool" and never resets it, leaking into copy_context(). conftest now resets it to the fresh-process default.
• credential_pool (9): Two sibling tests demand opposite precedence. Resolved per-provider — OpenRouter resolves .env-first (regression [Bug]: auth.json credential cache ignores .env changes — stale key persists NousResearch/hermes-agent#18254), all other providers keep os.environ-first. Both files pass.
• restart_drain (10): t("gateway.draining") returned the raw key because an i18n test leaves a fake catalog in the process-global _catalog_cache. conftest now calls reset_language_cache() between tests.
• goal_command (12–13): hermes_state.DEFAULT_DB_PATH is frozen at import time, so bare SessionDB() ignored the per-test tmp HERMES_HOME and leaked goal state. GoalManager now resolves the DB path from the live HERMES_HOME.
• update_yes_flag (11): resolved by the shared isolation fixes above.

Validation

• Targeted 13: all pass (-n0 and -n auto).
• Full suite re-run under -n auto: the original 13 are gone; the only remaining failures are macOS-host-specific (WSL/systemd detection, ripgrep find, Claude-Code creds path, timing-based subprocess detection) that pass on Linux CI and were green in the baseline run.
• Tests CI on this PR is the authoritative gate — see the run linked on this PR. Will merge only on success.

Lesson

The prior PRs merged without waiting for full-suite CI. This PR enforces the wait.

---

Note

Medium Risk
OpenRouter env resolution order changed for one provider (intentional regression fix); Google Chat may appear enabled when only env is set without the Pub/Sub SDK until connect fails clearly.

Overview
This PR clears the last 13 Tests-workflow failures by fixing root causes and tightening test isolation—not by masking symptoms.

Runtime behavior: OpenRouter credential seeding now prefers ~/.hermes/.env over a stale OPENROUTER_API_KEY in os.environ (other providers still use env-first). Google Chat registry enablement depends only on Pub/Sub project/subscription env vars, not optional google-cloud-pubsub import state. GoalManager opens SessionDB at the live HERMES_HOME path instead of import-time DEFAULT_DB_PATH.

Test harness: conftest resets agent.i18n catalog cache and tools.skill_provenance write-origin between tests. test_agent_cache pre-builds agents before the concurrent insert stress window. test_update_yes_flag rebinds cmd_update after other tests reload hermes_cli.main.

^{Reviewed by Cursor Bugbot for commit 34eaa38. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🔎 Lint report: fix/test-suite-green-8n-final vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 7750 on HEAD, 7749 on base (🆕 +1)

🆕 New issues (4):

Rule	Count
invalid-argument-type	3
unresolved-import	1

First entries

run_agent.py:12539: [invalid-argument-type] invalid-argument-type: Argument to function `_is_oauth_token` is incorrect: Expected `str`, found `str | dict[Unknown, Unknown] | Any | ... omitted 3 union elements`
run_agent.py:6649: [invalid-argument-type] invalid-argument-type: Argument to function `build_anthropic_client` is incorrect: Expected `str`, found `str | dict[Unknown, Unknown] | Any | ... omitted 3 union elements`
run_agent.py:12542: [invalid-argument-type] invalid-argument-type: Argument to function `len` is incorrect: Expected `Sized`, found `(str & ~AlwaysFalsy) | (dict[Unknown, Unknown] & ~AlwaysFalsy) | (Any & ~AlwaysFalsy) | ... omitted 3 union elements`
tests/hermes_cli/test_update_yes_flag.py:17: [unresolved-import] unresolved-import: Cannot resolve imported module `pytest`

✅ Fixed issues (3):

Rule	Count
invalid-argument-type	3

First entries

run_agent.py:12542: [invalid-argument-type] invalid-argument-type: Argument to function `len` is incorrect: Expected `Sized`, found `(str & ~AlwaysFalsy) | (dict[Unknown | str, Unknown | str | dict[str, str]] & ~AlwaysFalsy) | (Any & ~AlwaysFalsy) | ... omitted 3 union elements`
run_agent.py:12539: [invalid-argument-type] invalid-argument-type: Argument to function `_is_oauth_token` is incorrect: Expected `str`, found `str | dict[Unknown | str, Unknown | str | dict[str, str]] | Any | ... omitted 3 union elements`
run_agent.py:6649: [invalid-argument-type] invalid-argument-type: Argument to function `build_anthropic_client` is incorrect: Expected `str`, found `str | dict[Unknown | str, Unknown | str | dict[str, str]] | Any | ... omitted 3 union elements`

Unchanged: 4075 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Hardcoded "state.db" duplicates source-of-truth constant
  • Updated goals DB path construction to use DEFAULT_DB_PATH.name from hermes_state while still combining it with the live HERMES_HOME.

Or push these changes by commenting:

@cursor push 3232dc8fb8

Preview (3232dc8fb8)

diff --git a/hermes_cli/goals.py b/hermes_cli/goals.py
--- a/hermes_cli/goals.py
+++ b/hermes_cli/goals.py
@@ -152,7 +152,7 @@
     """
     try:
         from hermes_constants import get_hermes_home
-        from hermes_state import SessionDB
+        from hermes_state import DEFAULT_DB_PATH, SessionDB
 
         home = str(get_hermes_home())
     except Exception as exc:  # pragma: no cover
@@ -165,14 +165,14 @@
     try:
         # Resolve the DB path from the *live* HERMES_HOME rather than relying
         # on SessionDB's import-time DEFAULT_DB_PATH. hermes_state computes
-        # DEFAULT_DB_PATH = get_hermes_home() / "state.db" at module import,
+        # DEFAULT_DB_PATH with the active HERMES_HOME at module import,
         # so a bare SessionDB() is permanently pinned to whatever HERMES_HOME
         # was set when hermes_state first imported. That made the GoalManager
         # ignore profile/HERMES_HOME switches at runtime and (in tests) leak
         # goal state across cases that point HERMES_HOME at fresh temp dirs.
         # Passing the path explicitly keeps the per-home cache correct.
         from pathlib import Path as _Path
-        db = SessionDB(db_path=_Path(home) / "state.db")
+        db = SessionDB(db_path=_Path(home) / DEFAULT_DB_PATH.name)
     except Exception as exc:  # pragma: no cover
         logger.debug("GoalManager: SessionDB() raised (%s)", exc)
         return None

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 9fdca65. Configure here.}

[cursor]

Hardcoded "state.db" duplicates source-of-truth constant

Low Severity

The filename "state.db" is hardcoded here, duplicating the value already defined via DEFAULT_DB_PATH = get_hermes_home() / "state.db" in hermes_state.py. If the DB filename is ever changed in hermes_state, this location would silently diverge. Since DEFAULT_DB_PATH.name always yields the filename component regardless of the prefix path that was frozen at import time, using that would keep a single source of truth while still achieving the goal of combining the live home with the correct filename.

 

^{Reviewed by Cursor Bugbot for commit 9fdca65. Configure here.}