test: parallelize test suite with pytest-xdist

~2min sequential runs were painful. Added pytest-xdist and -n auto to run across all available cores. Tests already isolate state via tmp_path fixtures so no changes needed to test code. Local: 2677 passed in ~30s. CI gets 4 vCPUs on ubuntu-latest.
fix: Docker persistent bind mounts fail with Permission denied
2026-06-21 01:20:51 +08:00 · 2026-03-09 20:47:34 -05:00 · 2026-03-09 17:52:33 -07:00 · 2026-03-09 17:45:57 -07:00 · 2026-03-09 17:42:39 -07:00 · 2026-03-05 21:12:53 +03:00
4 changed files with 11 additions and 5 deletions
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -34,7 +34,7 @@ jobs:
      - name: Run tests
        run: |
          source .venv/bin/activate
-          python -m pytest tests/ -q --ignore=tests/integration --tb=short
+          python -m pytest tests/ -q --ignore=tests/integration --tb=short -n auto
        env:
          # Ensure tests don't accidentally call real APIs
          OPENROUTER_API_KEY: ""
--- a/hermes_cli/codex_models.py
+++ b/hermes_cli/codex_models.py
@@ -47,7 +47,7 @@ def _fetch_models_from_api(access_token: str) -> List[str]:
        if item.get("supported_in_api") is False:
            continue
        visibility = item.get("visibility", "")
-        if isinstance(visibility, str) and visibility.strip().lower() == "hide":
+        if isinstance(visibility, str) and visibility.strip().lower() == "hidden":
            continue
        priority = item.get("priority")
        rank = int(priority) if isinstance(priority, (int, float)) else 10_000
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -40,7 +40,7 @@ dependencies = [
 [project.optional-dependencies]
 modal = ["swe-rex[modal]>=1.4.0"]
 daytona = ["daytona>=0.148.0"]
-dev = ["pytest", "pytest-asyncio", "mcp>=1.2.0"]
+dev = ["pytest", "pytest-asyncio", "pytest-xdist", "mcp>=1.2.0"]
 messaging = ["python-telegram-bot>=20.0", "discord.py>=2.0", "aiohttp>=3.9.0", "slack-bolt>=1.18.0", "slack-sdk>=3.27.0"]
 cron = ["croniter"]
 slack = ["slack-bolt>=1.18.0", "slack-sdk>=3.27.0"]
@@ -81,4 +81,4 @@ testpaths = ["tests"]
 markers = [
    "integration: marks tests requiring external services (API keys, Modal, etc.)",
 ]
-addopts = "-m 'not integration'"
+addopts = "-m 'not integration' -n auto"
--- a/tools/environments/docker.py
+++ b/tools/environments/docker.py
@@ -22,10 +22,16 @@ logger = logging.getLogger(__name__)

 # Security flags applied to every container.
 # The container itself is the security boundary (isolated from host).
-# We drop all capabilities, block privilege escalation, and limit PIDs.
+# We drop all capabilities then add back the minimum needed:
+#   DAC_OVERRIDE - root can write to bind-mounted dirs owned by host user
+#   CHOWN/FOWNER - package managers (pip, npm, apt) need to set file ownership
+# Block privilege escalation and limit PIDs.
 # /tmp is size-limited and nosuid but allows exec (needed by pip/npm builds).
 _SECURITY_ARGS = [
    "--cap-drop", "ALL",
+    "--cap-add", "DAC_OVERRIDE",
+    "--cap-add", "CHOWN",
+    "--cap-add", "FOWNER",
    "--security-opt", "no-new-privileges",
    "--pids-limit", "256",
    "--tmpfs", "/tmp:rw,nosuid,size=512m",
Author	SHA1	Message	Date
Brooklyn Nicholson	0d96f1991c	test: parallelize test suite with pytest-xdist ~2min sequential runs were painful. Added pytest-xdist and -n auto to run across all available cores. Tests already isolate state via tmp_path fixtures so no changes needed to test code. Local: 2677 passed in ~30s. CI gets 4 vCPUs on ubuntu-latest.	2026-03-09 20:47:34 -05:00
teknium1	172a38c344	fix: Docker persistent bind mounts fail with Permission denied cap-drop ALL removes DAC_OVERRIDE, which root needs to write to bind-mounted directories owned by the host user (uid 1000). This broke persistent Docker sandboxes — the container couldn't write to /workspace or /root. Add back the minimum capabilities needed: - DAC_OVERRIDE: root can write to bind-mounted dirs owned by host user - CHOWN: package managers (pip, npm, apt) need to set file ownership - FOWNER: needed for operations on files owned by other users Still drops all other capabilities (NET_RAW, SYS_ADMIN, etc.) and keeps no-new-privileges. Security boundary is the container itself. Verified end-to-end: create files → destroy container → new container with same task_id → files persist on host and are accessible in the new container.	2026-03-09 17:52:33 -07:00
teknium1	8bc0d4f77d	Merge: WebResearchEnv Atropos standards compliance	2026-03-09 17:45:57 -07:00
teknium1	f658af45c2	Merge PR #446 : fix(cli): use correct visibility filter string in codex API model fetch Authored by PercyDikec. Fixes #445. Changes 'hide' to 'hidden' in _fetch_models_from_api to match _read_cache_models and the actual API response format.	2026-03-09 17:42:39 -07:00
PercyDikec	36214d14db	fix(cli): use correct visibility filter string in codex API model fetch	2026-03-05 21:12:53 +03:00