Thinking Path

tests/test_sprint46.py imports api.config.SESSION_DIR at collection time and then calls Session.save() directly from the pytest main process. Before this change, tests/conftest.py only passed HERMES_WEBUI_STATE_DIR to the test server subprocess, so api.config.STATE_DIR could fall back to the real ~/.hermes/webui path in pytest itself.

What Changed

• Publish pytest isolation env vars from tests/conftest.py at module import time, before test modules import api.config or api.models.
• Use direct assignment for production-risk paths so an inherited shell environment cannot leave pytest pointed at the real WebUI state directory.
• Add tests/test_pytest_state_isolation.py to lock the invariant that api.config.STATE_DIR and SESSION_DIR resolve under the isolated test state directory, not ~/.hermes/webui.
• Update adjacent tests that intentionally exercise env-less workspace fallback or onboarding cleanup so they explicitly reset the pytest-level isolation state they depend on.

Why It Matters

Tests that save sessions directly in-process can no longer create or update files in the real WebUI session store. The server subprocess isolation and pytest main-process isolation now agree on the same test state root.

Verification

• pytest tests/test_pytest_state_isolation.py tests/test_sprint46.py -q
• pytest tests/test_default_workspace_fallback.py -q
• pytest tests/test_onboarding_existing_config.py -q
• pytest tests/test_pytest_state_isolation.py tests/test_sprint46.py tests/test_default_workspace_fallback.py tests/test_onboarding_existing_config.py -q
• Checked the existing ~/.hermes/webui/sessions/compress_test_001.json sentinel before and after the run; size and mtime were unchanged.

Risks / Follow-ups

• Low risk. The change is scoped to pytest configuration and a regression test.
• Some tests that intentionally override these env vars still need to use monkeypatch or module reload patterns, as they already do today.

Model Used

GPT-5 Codex