hermes config check reports stale toolset names and disabled platforms the way the runtime sees them (salvage #127392)

[kshitijk4poor]

hermes config check now reports saved platform_toolsets names that no longer resolve, and bundled platform plugins that are disabled while their required credentials are configured. It judges both the way the runtime does.

Salvage of #127392 by @helix4u. Their commit is cherry-picked, so authorship is preserved. Two follow-up commits fix what review found before landing.

Changes

• Stale toolset names: config check and hermes config migrate now share one resolver, toolset_validation.saved_toolset_resolver. Before this, migrate warned about MCP server names and plugin-platform bundles (it even suggested 'hermes-teams' for 'hermes-teams'). The new check accepts them.
  • A configured MCP server counts as known even when it has enabled: false. It is inactive, not a typo.
  • known_plugin_toolsets no longer counts as proof that a toolset exists. It records what a platform was offered at save time, so it hid toolsets from uninstalled plugins, which is exactly the stale case this check exists for.
  • Plugin-provided names and the platform-manifest scan are only consulted for names the cheaper checks cannot place. A clean config never runs plugin discovery.
• Disabled platforms: plugins.disabled is read through the runtime's own reader. A non-list value, which the runtime ignores, is no longer reported as disabling a platform. Required credentials come from _platform_manifest_env_entries(optional=False), so optional vars never count.
• Crash fix: a malformed mcp_servers (for example a list) no longer crashes the command.
• Dropped check: the original PR also checked the top-level toolsets key. The CLI resolves toolsets from --toolsets or platform_toolsets and reads the top-level key only for the legacy kanban opt-in, so that check is gone.
• Not included: the original PR's Desktop fixture-shebang commit. It is byte-identical to Python lints lane green again: portable bash shebang in the remote-lifecycle test fixture #127265, which is still open.

Validation

Case (real hermes config check, temp HERMES_HOME)	Original #127392	This PR
platform_toolsets.cli lists a removed name	reported	reported
toolset of an uninstalled plugin, remembered in known_plugin_toolsets	silent	reported
MCP server with enabled: false listed in platform_toolsets	"unknown toolset … did you mean 'hermes-cli'?"	silent
mcp_servers: [a]	AttributeError traceback	runs
plugins.disabled: platforms/telegram (string) with token	"disabled" (runtime still loads it)	silent
plugins.disabled: [platforms/telegram] with token	reported	reported
fresh config	silent	silent, no plugin discovery

• Tests: 2 invariant tests in tests/hermes_cli/test_config_check_diagnostics.py, red on the original commit and green here.
  • Test 1 asserts that config check and migrate report the same names across A→B→A homes. Mutating migrate back to bare validate_toolset turns it red.
  • Test 2 uses a synthetic platform manifest rather than Telegram's.
• The 34 test files that reference platform_toolsets, _platform_manifest_env_entries or migrate_config give identical results on this branch and on origin/main: 852 passed, 17 failed and 8 errors on both, and the failures are the same set.
• ruff check on the touched files, and the Windows footgun checker, are clean.

Known limits

• platform_toolsets.cli: [no_mcp] on its own is still not reported. validate_platform_toolsets counts no_mcp as a valid toolset.
• When the config names something the cheaper checks cannot place, migrate now runs plugin discovery. It stays inside the existing best-effort try/except and under the profile's own plugin scope.

Credit (post-merge sweep)

Earlier PRs fixed parts of the migrate-side false positives that this resolver now covers. They were closed as resolved, with credit:

• fix(cli): accept plugin platform bundle entries in platform_toolsets validation #107104 (@kokhlo): plugin-platform hermes-<platform> bundles. This was the first submitted fix.
• fix(config): stop flagging declared plugin toolsets as unknown #109844 (@prasta1): plugin toolsets judged before plugin discovery.
• fix(cli): accept a plugin platform's own toolset name #126333 (@686f6c61): the self-referential hint.
• fix(config): make platform_toolsets validation MCP-aware (#78102) #106715 (@a692570): MCP server names. The mcp-<server> half lands as a follow-up.

[whyyagswhy]

Independent verification on the PR head (f64add8): config-check-diagnostics suite 2/2 green on Linux. No findings.

[francip]

@kshitijk4poor does this supersede #86233 or was that left open for other reasons?