fix(acp): pass agent.disabled_toolsets to AIAgent — config-disabled tools stay executable over ACP

[5uck1ess]

Problem

agent.disabled_toolsets in config.yaml is honored by the CLI (cli.py: CLI_CONFIG['agent'].get('disabled_toolsets')) and the gateway (gateway/run.py:12782) — both pass it to AIAgent. The ACP adapter's _make_agent never does.

Consequence: state.agent.disabled_toolsets is always None on the ACP path, so the tool-registry rebuild in acp_adapter/server.py calls get_tool_definitions(enabled_toolsets=..., disabled_toolsets=None) and every tool in the enabled toolsets stays registered and executable — including toolsets the user explicitly disabled in config.

Observed live driving hermes over ACP: a todo tool call executed from a profile whose config lists todo in agent.disabled_toolsets.

Related family of reports on other surfaces: #36729 (WebUI), #54433 (desktop). This PR fixes the ACP surface. Sibling PR #57418 fixes the same construction gap for fallback_model (#18452) — _make_agent builds its kwargs from scratch and has drifted from what the CLI/gateway pass.

Fix

Read agent.disabled_toolsets from the loaded config in _make_agent and pass it to AIAgent, mirroring the CLI and gateway. Guarded by an isinstance check consistent with the surrounding config handling.

Verification

Two new tests in tests/acp/test_session.py (chain passes through when configured; key absent otherwise). Full file: 47 passed.

https://claude.ai/code/session_01YNvCUipheR7yx4VorUL2jW

[teknium1]

Thanks for tracing this ACP-specific construction gap. The premise is confirmed on current main: acp_adapter/session.py:601-645 loads config and builds AIAgent kwargs without agent.disabled_toolsets; agent/agent_init.py:625-626 stores that value, and model_tools.py:395-427 enforces it when supplied.

Problems

• acp_adapter/server.py:1793-1796 still rebuilds ACP /tools output without state.agent.disabled_toolsets. After this patch, execution is filtered, but /tools can still advertise disabled tools.
• The new tests assert only fake-agent kwargs, not the filtered tool surface.

Suggested changes

• Pass getattr(state.agent, "disabled_toolsets", None) to the /tools get_tool_definitions call, matching acp_adapter/server.py:838-842.
• Add a behavioral assertion that a configured disabled toolset is absent from ACP-generated definitions.

This is an automated hermes-sweeper review.

[5uck1ess]

Both points addressed in 040b08c:

• _cmd_tools now passes getattr(state.agent, "disabled_toolsets", None) to its get_tool_definitions call, matching the session tool-surface rebuild, so /tools no longer advertises config-disabled tools it won't execute.
• Added behavioral coverage that runs the real get_tool_definitions (no patching): one test asserts a disabled toolset is absent from the /tools listing, one asserts it is absent from the rebuilt valid_tool_names after MCP registration. The /tools test includes a baseline assertion that the toolset IS present when nothing is disabled, so it can't pass vacuously — and it fails when the server.py change is reverted.

tests/acp/test_server.py + tests/acp/test_session.py: 129 passed.

[ScaleLeanChris]

Independent current-main validation supports keeping this original PR rather than the newer duplicate #74617.

• On main at ba7d214, a constructor-boundary regression test fails because agent.disabled_toolsets never reaches AIAgent.
• Applying the session pass-through makes 54 focused ACP tests pass across the command, session, server, and MCP paths.
• A real SessionManager built from a temporary HERMES_HOME config retained terminal, browser, computer_use, and code_execution as disabled. Its generated tool surface exposed none of those toolsets.
• Ruff, the Windows-footgun scan, and git diff --check pass.

This PR is broader than #74617 because it also filters the ACP /tools listing and already has non-vacuous behavioral coverage for both advertised and executable tools. GitHub currently reports it mergeable and rebaseable. I recommend refreshing its base and closing the duplicate.

In short, this is the original branch worth “Stayin' Alive.”