fix: plugin toolsets invisible in hermes tools and standalone processes

[teknium1]

Summary

Plugin toolsets never appeared in the hermes tools TUI or any standalone process that reads plugin state without first importing model_tools.py.

Root cause: discover_plugins() only runs as a side effect of importing model_tools.py (line 181-182). The hermes tools command and _get_platform_tools() call get_plugin_toolsets() / _get_plugin_toolset_keys() without ensuring plugins have been discovered first. The plugin manager singleton exists but has never scanned ~/.hermes/plugins/, so _plugin_tool_names is empty and all plugin queries return [].

Impact:

• hermes tools TUI never shows plugin toolsets — users can't see or toggle them
• Any standalone process that reads plugin state before model_tools.py is imported misses plugin toolsets

Fix: Call discover_plugins() (idempotent — checks _discovered flag) in both _get_plugin_toolset_keys() and _get_effective_configurable_toolsets() before accessing plugin state. In the gateway/CLI where model_tools.py is already imported, the call is a no-op.

Context

Reported by community member (pistrie) on Discord — installed two plugins (brave-search, web-extract), /plugins showed them loaded, but they never appeared in hermes tools output or in the agent's tool list.

Test plan

• python3 -m pytest tests/hermes_cli/test_tools_config.py tests/test_plugins.py -o 'addopts=' -q — 29 passed

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: Install hook files modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/setup.py

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.