security(gateway): re-resolve hooks directory per call to fix profile isolation

[srojk34]

Summary

gateway/hooks.py::HOOKS_DIR is resolved once at import time via get_hermes_home(), which reads a context-local ContextVar (_HERMES_HOME_OVERRIDE) set per-request under the multiplexed gateway (multiple profiles served from one process, e.g. the desktop tui_gateway). Freezing the resolved path at import time pins every later HookRegistry.discover_and_load() call to whichever profile's HERMES_HOME happened to be active the first time this module was imported in the process.

This is more serious than the typical instance of this bug class (already fixed for cache dirs, skills_hub.py, rich_sent_store.py, and — from this same audit — the Anthropic OAuth file, Nous auth.json, sessions.json index, checkpoint store, and sticker cache): the hooks system loads and executes arbitrary Python (handler.py, dynamically imported via importlib.util) in response to live agent events. Under the multiplexed gateway, each profile owns its own Gateway/HookRegistry instance, but they all read the same frozen module constant — so a later-starting profile's HookRegistry discovers and executes the FIRST profile's hook handlers against its own live event context (session_id, chat_id, message, response text truncated to 500 chars, per the module's own docstring), not the profile's own hooks. This is both a cross-profile data leak and an isolation-boundary violation (profile B's process runs profile A's hook code).

Changes

• gateway/hooks.py: added _resolve_hooks_dir(), called from discover_and_load() instead of reading HOOKS_DIR directly. Keeps the module constant for backward compat and to preserve the existing test seam (tests/gateway/test_hooks.py has many call sites that patch("gateway.hooks.HOOKS_DIR", tmp_path)) — the resolver honors a monkeypatched value away from its import-time default, otherwise re-resolves fresh, mirroring gateway/platforms/base.py::_resolve_cache_dir's established pattern.
• tests/test_profile_isolation_runtime.py (the existing profile-isolation regression suite): added TestGatewayHooksDirResolution with three tests — the resolved path actually differs between two distinct profile overrides, an end-to-end test proving a hook that only exists under profile B's hooks dir is NOT discovered when profile A's override is active (and vice versa), and a "monkeypatched constant still wins" regression test for the test-seam-preserving resolver.

Test plan

• pytest tests/gateway/test_hooks.py tests/gateway/test_background_command.py -q — 42 passed, 1 pre-existing unrelated failure (confirmed via git stash: a macOS /private/var vs /var symlink path-comparison quirk in test_media_files_routed_by_type, present identically before this change)
• pytest tests/test_profile_isolation_runtime.py -q — 13 passed (10 pre-existing + 3 new)
• ruff check on all changed files — clean

[teknium1]

Thanks for tracing the import-time path pattern and preserving the existing HOOKS_DIR monkeypatch seam. The resolver itself matches the established cache-directory pattern, but it is not wired into the actual multiplex hook lifecycle.

Problems

• Gateway.start() calls self.hooks.discover_and_load() only once at gateway/run.py:7079, before secondary adapters start at gateway/run.py:7271. Therefore the new resolver at gateway/hooks.py:123 only discovers the startup profile's hooks.
• Secondary adapters route into shared _handle_message (gateway/run.py:8588-8592), and agent events emit through shared self.hooks (gateway/run.py:11752). The startup profile's handlers would still receive secondary-profile contexts.
• The new tests construct HookRegistry instances directly under overrides, so they do not cover this startup-and-dispatch path.

Suggested changes

• Make hook registries profile-aware in the real multiplex lifecycle: load them under each profile scope and route emits by source.profile.
• Add a gateway-level multiplex regression proving a secondary profile invokes only its own hook.

Automated hermes-sweeper review.

[teknium1]

This resolver is only effective if discovery occurs under each profile scope. On current main, Gateway.start() calls self.hooks.discover_and_load() once at gateway/run.py:7079, before _start_secondary_profile_adapters() at line 7271, so this still resolves only the startup profile's directory in the real multiplex path.