fix: resolve pre-existing test failures, stale type ignores, and warnings (#197)

- TLS: suppress no-any-return + unused-ignore on lacme mtls helpers
  (lacme stubs typed locally but not in CI)
- TLS: catch duplicate Prometheus metric registration specifically
  (not blanket ValueError) so real setup errors still propagate
- Discord: add missing storage=None to _make_bot mock (policy evaluation
  path accesses self.storage)
- Web search: patch _ddg_available in gating test so ddgs availability
  doesn't mask the Tavily-only test path
- Bridge stress: close real httpx client before replacing with mock so
  daemon threads don't make real HTTP calls or leak connections
- README: comment out tavily_key placeholder in example config

README.md

@@ -290,7 +290,7 @@ All entry points read `~/.config/turnstone/config.toml`. CLI flags override conf
 [api]
 base_url = "http://localhost:8000/v1"
 api_key = ""
-tavily_key = ""        # only needed for local/vLLM models without native search
+# tavily_key = ""      # only needed for local/vLLM models without native search
 
 [model]
 name = ""              # empty = auto-detect

tests/test_bridge_stress.py

@@ -39,7 +39,13 @@ def _make_bridge(**overrides) -> Bridge:
         approval_timeout=1,
     )
     defaults.update(overrides)
-    return Bridge(**defaults)
+    bridge = Bridge(**defaults)
+    # Replace real httpx client with a mock so daemon threads spawned by
+    # _handle_approval / _handle_plan_review don't make real HTTP calls
+    # after the test's patch context exits.
+    bridge._http.close()
+    bridge._http = MagicMock()
+    return bridge
 
 
 def _approval_items(tool_name: str = "bash") -> list[dict]:

tests/test_channel_discord.py

@@ -390,6 +390,7 @@ class TestApprovalVerdictDisplay:
         bot.config.streaming_edit_interval = 1.5
         bot.config.auto_approve = False
         bot.config.auto_approve_tools = []
+        bot.storage = None
         bot._streaming = {}
         bot._pending_approval_msgs = {}
         bot._notify_reply_channels = {}

tests/test_sessions.py

@@ -699,6 +699,7 @@ class TestWebSearchGating:
         with (
             patch.object(session, "_get_capabilities", return_value=caps),
             patch("turnstone.core.session.get_tavily_key", return_value=None),
+            patch("turnstone.core.web_search._ddg_available", return_value=False),
         ):
             tools = session._get_active_tools()
 

turnstone/console/tls.py

@@ -80,7 +80,12 @@ class TLSManager:
 
             setup_metrics(self._event_dispatcher)
         except ImportError:
-            pass  # prometheus_client not installed
+            pass  # prometheus_client or lacme.metrics missing
+        except ValueError as exc:
+            if "Duplicated timeseries" in str(exc):
+                log.debug("tls_metrics_already_registered")
+            else:
+                raise
 
     def _subscribe_events(self) -> None:
         """Subscribe structlog handlers to lacme lifecycle events."""
@@ -322,7 +327,7 @@ class TLSManager:
         _require_lacme()
         from lacme.mtls import server_ssl_context
 
-        return server_ssl_context(  # type: ignore[no-any-return]
+        return server_ssl_context(  # type: ignore[no-any-return,unused-ignore]
             cert_pem=self._frontend_bundle.fullchain_pem,
             key_pem=self._frontend_bundle.key_pem,
             ca_cert_pem=self.get_root_cert_pem(),
@@ -339,7 +344,7 @@ class TLSManager:
         _require_lacme()
         from lacme.mtls import client_ssl_context
 
-        return client_ssl_context(  # type: ignore[no-any-return]
+        return client_ssl_context(  # type: ignore[no-any-return,unused-ignore]
             cert_pem=self._internal_bundle.cert_pem,
             key_pem=self._internal_bundle.key_pem,
             ca_cert_pem=self.get_root_cert_pem(),

turnstone/core/tls.py

@@ -79,7 +79,12 @@ class TLSClient:
 
             setup_metrics(self._event_dispatcher)
         except ImportError:
-            pass
+            pass  # prometheus_client or lacme.metrics missing
+        except ValueError as exc:
+            if "Duplicated timeseries" in str(exc):
+                log.debug("tls_metrics_already_registered")
+            else:
+                raise
 
     async def init(self) -> None:
         """Fetch CA root cert and request a service certificate.
@@ -220,7 +225,7 @@ class TLSClient:
         _require_lacme()
         from lacme.mtls import server_ssl_context
 
-        return server_ssl_context(  # type: ignore[no-any-return]
+        return server_ssl_context(  # type: ignore[no-any-return,unused-ignore]
             cert_pem=self._bundle.fullchain_pem,
             key_pem=self._bundle.key_pem,
             ca_cert_pem=self._ca_pem,
@@ -233,7 +238,7 @@ class TLSClient:
         _require_lacme()
         from lacme.mtls import client_ssl_context
 
-        return client_ssl_context(  # type: ignore[no-any-return]
+        return client_ssl_context(  # type: ignore[no-any-return,unused-ignore]
             cert_pem=self._bundle.cert_pem,
             key_pem=self._bundle.key_pem,
             ca_cert_pem=self._ca_pem,