fix(setup): write config for image_gen and video_gen in apply_nous_managed_defaults

[alt-glitch]

Summary

apply_nous_managed_defaults() was adding image_gen and video_gen to the changed return set without writing any config values. The caller (tools_command first-install flow) uses changed to skip the manual _configure_toolset() step, so these tools ended up in platform_toolsets but with no video_gen.provider, video_gen.use_gateway, or image_gen.use_gateway in config.yaml.

At runtime the FAL plugin's is_available() returned False because there was no FAL_KEY and no use_gateway config — the tool never loaded despite being "enabled" in the toolset list.

Why image_gen was not visibly broken

For image_gen this was a latent bug masked by the gateway offer prompt (prompt_enable_tool_gateway) running earlier in the setup flow (during model provider selection) and writing image_gen.use_gateway = True via apply_gateway_defaults(). But if the user skipped the gateway offer, image_gen would silently break the same way.

Why video_gen was always broken

For video_gen (added in PR #33259) the bug was always hit because the gateway offer ran before the user checked video_gen in the toolset checklist — by the time apply_nous_managed_defaults marked it as auto-configured, no gateway config had been written for it.

Fix

Write provider / use_gateway config values before adding to changed, matching the pattern already used by web, tts, and browser:

# Before (broken):
if "video_gen" in selected_toolsets and not fal_key_is_configured():
    changed.add("video_gen")

# After (fixed):
if "video_gen" in selected_toolsets and not fal_key_is_configured():
    video_cfg = config.get("video_gen")
    if not isinstance(video_cfg, dict):
        video_cfg = {}
        config["video_gen"] = video_cfg
    video_cfg["provider"] = "fal"
    video_cfg["use_gateway"] = True
    changed.add("video_gen")

Same fix applied to image_gen (latent bug).

Test plan

• 4 new unit tests for apply_nous_managed_defaults in test_nous_subscription.py:
  • video_gen config written correctly (provider + use_gateway)
  • image_gen config written correctly (use_gateway)
  • Both skipped when FAL_KEY is present
  • Existing video_gen config dict preserved (updated in-place)
• 1 new integration test in test_tools_config.py:
  • First-install flow with only video_gen selected → config written
• 1 existing integration test updated to assert image_gen.use_gateway

tests/hermes_cli/test_nous_subscription.py  13/13 passed
tests/hermes_cli/test_tools_config.py       (affected tests passed)

[github-actions]

🔎 Lint report: fix/managed-defaults-write-config vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 9473 on HEAD, 9466 on base (🆕 +7)

🆕 New issues (1):

Rule	Count
invalid-argument-type	1

First entries

tests/hermes_cli/test_nous_subscription.py:316: [invalid-argument-type] invalid-argument-type: Argument to function `apply_nous_managed_defaults` is incorrect: Expected `dict[str, object]`, found `dict[str, dict[str, str]]`

✅ Fixed issues: none

Unchanged: 4919 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

[alt-glitch]

@daimon-nous can you adversarially review this

[daimon-nous]

PR #35109 — @alt-glitch

What it does: Writes image_gen.use_gateway and video_gen.{provider, use_gateway} to config in apply_nous_managed_defaults(), matching the pattern already used by web, tts, and browser.

What it solves: Nous subscribers selecting image_gen or video_gen in the toolset checklist got them marked as "auto-configured" (skipping _configure_toolset), but no config was actually written — so the FAL plugin's is_available() returned False at runtime and the tools silently never loaded.

How: +11 LOC in nous_subscription.py (config dict init + key writes), +150 LOC tests across 2 files. The fix mirrors apply_gateway_defaults() exactly.

Verified: Bug confirmed on current origin/main (lines 589–595). The runtime chain is: prefers_gateway("image_gen") → reads image_gen.use_gateway from config → False (missing) → _resolve_managed_fal_gateway() returns None → check_fal_api_key() returns False → tool unavailable. Same path for video_gen via _resolve_managed_fal_video_gateway(). Tests pass (13/13 subscription, 2/2 tools_config). Clean merge against main (486 commits behind, zero conflicts).

Recommendation: Salvage + merge — correct fix, well-tested, clean apply. The image_gen asymmetry (no provider key, only use_gateway) is intentional and matches apply_gateway_defaults; image_gen resolves its provider through the plugin registry, while video_gen needs the explicit config key for get_active_provider() disambiguation.