fix: sweep remaining env-mutating unit tests for hermeticity

[BunsDev]

Summary

Follow-up to #440, completing the sweep: zero env_lock/EnvVarGuard/set_var/remove_var remain in coven-cli (grep -rn clean). All conversions use dependency injection; public signatures and production behavior are unchanged.

harness.rs (~45 lock-guarded tests → lock-free)

• New AdapterEnv snapshot (COVEN_HOME, COVEN_HARNESS_ADAPTER_MANIFEST, COVEN_HARNESS_ADAPTER_DIRS) taken once per resolution and threaded through external_adapter_manifest_sources / external_harness_specs / configured-spec helpers; pub fns are thin from_process() wrappers.
• Command construction split: env-free command_parts_with_specs(specs, …, codex_json, claude_bypass_enabled, resolve_program) holds the logic; the inner wrapper reads process env. Dropped the now-redundant with_claude_permission_flags variant.
• harness_available_with(executable, engine_resolves) seam; engine test injects engine::resolve_from.
• Tests inject built-in/external specs, AdapterEnv, and an identity program resolver — side benefit: program == asserts no longer depend on host PATH (notably flaky-prone on Windows).

privacy.rs

• PrivacyEnv snapshot + single apply_env_overrides, deduplicating the copy-pasted override block while preserving the original file → env → settings → env precedence. Added retention-days override coverage (positive, zero, non-numeric).

main.rs → paths.rs

• Moved the USERPROFILE fallback test onto the already-injectable coven_home_from_env seam; deleted the last env_lock/EnvVarGuard helpers from main.rs.

api.rs (latent env-dependent failure found by this sweep)

• launch_request_with_unknown_harness_returns_400_upfront_no_session_row used hermes — a real installable adapter — so on any machine with local adapter recipes (~/.coven/adapters) the launch succeeded (201 ≠ 400). Reproduced on current main; CI only passes because runners are bare. Switched to a synthetic id so the test is hermetic everywhere.

Rebase over #443/#444 (post-fork main)

• Supersedes fix: make unknown-harness tests hermetic against ambient adapter env #444's stopgap: with zero env writers left, the crate-wide test_env.rs lock is deleted and fix: make unknown-harness tests hermetic against ambient adapter env #444's guards in the api.rs unknown-harness test give way to this branch's synthetic harness id.
• Ports fix(hermes): forward models through adapter recipe #443's coverage: hermes_recipe_forwards_selected_models_before_the_shim_prompt is converted to the injected AdapterEnv + command_parts_in_specs seams (lock-free); fix(hermes): forward models through adapter recipe #443's hermes-coven recipe/manifest changes are preserved as-is.

Verification

• cargo fmt --check ✅
• cargo clippy --workspace --all-targets --locked -- -D warnings ✅ (0 warnings)
• cargo test --workspace --locked ✅ 1269 passed / 0 failed
• python scripts/check-secrets.py ✅

Readiness

• Scoped to test hermeticity; no behavior change intended. Riskiest bit is the harness.rs command-construction split — covered by the full existing test suite routed through the new seam.

[Copilot]

Pull request overview

This PR completes the coven-cli test hermeticity sweep by removing the remaining process-env mutating unit test patterns (locks/guards/set_var/remove_var) and replacing them with dependency-injected “env snapshot” seams, while keeping public signatures and production behavior intact.

Changes:

• Deleted the crate-wide test_env lock/guard module and refactored remaining env-dependent unit tests to use injected env snapshots instead of mutating process environment.
• Introduced AdapterEnv (harness adapter resolution) and PrivacyEnv (privacy config overrides) snapshots + helpers to keep resolution/override logic env-free and testable.
• Fixed an env-sensitive API test by switching from a real adapter id (hermes) to a synthetic unknown harness id.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
crates/coven-cli/src/test_env.rs	Removed shared env-mutation coordination utilities now made unnecessary by DI-based tests.
crates/coven-cli/src/privacy.rs	Added PrivacyEnv snapshot + apply_env_overrides; refactored config loading/tests to avoid process env mutation and added retention override coverage.
crates/coven-cli/src/paths.rs	Moved the USERPROFILE fallback coverage onto the injectable coven_home_from_env seam.
crates/coven-cli/src/main.rs	Dropped the last env-mutating coven_home fallback test and removed the test_env module reference.
crates/coven-cli/src/harness.rs	Added AdapterEnv snapshot + env-free command construction seam; refactored tests to inject specs/env/program resolution and removed env locks/guards.
crates/coven-cli/src/api.rs	Made the unknown-harness launch test hermetic by using a synthetic harness id rather than a real installable adapter id.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.