[FIX] Redirect the saved session under every test runner, not just pytest

[cfsmp3]

conftest.py exists to stop a test that reaches sp auth login from overwriting the developer's real session. It only works under pytest.

conftest.py is a pytest mechanism. This suite is also run with unittest and nose2, and under those the fixture is never loaded — the guard silently does nothing, and the first test that saves a token writes straight to ~/.config/sp/config.json.

That is not hypothetical. The conftest docstring already records one live token lost this way:

a test that omitted --no-save replaced a live session with the fake token spci_x, and because the plaintext token is returned only once at creation, the real one was unrecoverable

It has now happened a second time, running python -m unittest discover -s tests. The config came back with base_url set to http://example.test/api/v1, and the real token was gone for good.

The existing ConfigIsolationTests guard does fire — but only after the damage, since it is just another test in the same run.

Fix

Move the redirection into the tests package __init__, which pytest, nose2 and python -m unittest discover from the repository root all import before collecting anything.

One invocation still escapes that: python -m unittest discover -s tests imports test modules top-level and never imports the package. So each test module also imports SESSION_SANDBOX explicitly:

from tests import SESSION_SANDBOX  # noqa: F401  # redirects the saved session; keep first

python -m puts the working directory on sys.path, so that import resolves and pulls the package in however the suite was started. HOME is redirected as well as XDG_CONFIG_HOME, because config_path() falls back to ~/.config when the latter is unset.

conftest.py is left alone: under pytest it still narrows this to a per-test directory, and overriding an already-redirected variable is harmless.

Verification

Planted a sentinel in ~/.config/sp/config.json and ran the suite three ways:

invocation	before	after
unittest discover -s tests	sentinel overwritten	untouched
unittest discover (repo root)	untouched	untouched
pytest	untouched	untouched

210 tests pass in each case.

Why not just tell people to use pytest

The suite runs green under unittest and nose2 today, so there is nothing signalling that those runners are unsafe — and relying on everyone remembering is what failed the first time, which is the reason the fixture was made autouse rather than opt-in. This extends the same reasoning one step further: the protection should not depend on which runner someone happens to type.