From 21347f7839a0ef133ebd97b5dec6d3841a8f2d8e Mon Sep 17 00:00:00 2001
From: AhmetArif0 <147827411+AhmetArif0@users.noreply.github.com>
Date: Wed, 3 Jun 2026 00:16:28 +0300
Subject: [PATCH] fix(web): return effective enabled state from toolset toggle
 endpoint

PUT /api/tools/toolsets/{name} always responded with enabled=body.enabled
even when _save_platform_tools() silently dropped the write because the
toolset is restricted to a different platform (e.g. discord_admin is
restricted to platform='discord', so cli writes are filtered out by
_toolset_allowed_for_platform). The optimistic response caused the desktop
Skills & Tools toggle to flash enabled briefly then revert on the next GET.

After saving, re-read the config and return name in effective so the
response always reflects what was actually persisted.

Fixes #37609.
---
 hermes_cli/web_server.py            |  4 +++-
 tests/hermes_cli/test_web_server.py | 18 ++++++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/hermes_cli/web_server.py b/hermes_cli/web_server.py
index fc868227a39c9..5650aceeb0907 100644
--- a/hermes_cli/web_server.py
+++ b/hermes_cli/web_server.py
@@ -5881,7 +5881,9 @@ async def toggle_toolset(name: str, body: ToolsetToggle):
     else:
         enabled.discard(name)
     _save_platform_tools(config, "cli", enabled)
-    return {"ok": True, "name": name, "enabled": body.enabled}
+    config_after = load_config()
+    effective = set(_get_platform_tools(config_after, "cli", include_default_mcp_servers=False))
+    return {"ok": True, "name": name, "enabled": name in effective}
 
 
 @app.get("/api/tools/toolsets/{name}/config")
diff --git a/tests/hermes_cli/test_web_server.py b/tests/hermes_cli/test_web_server.py
index 06079aed37195..7f00bd4203258 100644
--- a/tests/hermes_cli/test_web_server.py
+++ b/tests/hermes_cli/test_web_server.py
@@ -1748,6 +1748,24 @@ def test_select_toolset_provider_unknown_toolset_returns_400(self):
         )
         assert resp.status_code == 400
 
+    def test_toggle_toolset_platform_restricted_returns_actual_state(self):
+        """PUT for a platform-restricted toolset must return enabled=false.
+
+        discord_admin is restricted to the 'discord' platform.
+        _save_platform_tools silently drops it for the 'cli' platform, so the
+        response must reflect what was actually persisted — not the requested state.
+        Closes #37609.
+        """
+        resp = self.client.put("/api/tools/toolsets/discord_admin", json={"enabled": True})
+        assert resp.status_code == 200
+        body = resp.json()
+        assert body["ok"] is True
+        assert body["name"] == "discord_admin"
+        assert body["enabled"] is False
+
+        listing = {t["name"]: t for t in self.client.get("/api/tools/toolsets").json()}
+        assert listing["discord_admin"]["enabled"] is False
+
     def test_config_raw_get(self):
         resp = self.client.get("/api/config/raw")
         assert resp.status_code == 200