fix: add 'serve' to _AGENT_COMMANDS so register_from_config is called (#69825)

[webtecnica]

Summary

Fixes #69825.

Root cause: _prepare_agent_startup() in hermes_cli/main.py gates hook/plugin/MCP registration behind an allowlist (_AGENT_COMMANDS/_AGENT_SUBCOMMANDS) that does not include "serve". The serve command backs the desktop app's chat backend, so shell hooks were silently never registered for that process — register_from_config() was never reached.

Fix: Added "serve" to the _AGENT_COMMANDS set on line 12807. This is a one-line change (1 insert, 1 delete).

Why _AGENT_COMMANDS?

serve is a top-level subcommand (like chat, acp, rl) — it doesn't have sub-subcommands, so it belongs in the flat _AGENT_COMMANDS set rather than a _AGENT_SUBCOMMANDS entry. The dispatching flow in main() calls _prepare_agent_startup(args) before args.func(args) for all commands, so adding "serve" to the allowlist is sufficient — no changes needed in cmd_dashboard() or the dispatch loop.

Verification

Before: serve skips the register_from_config() call → shell hooks never fire in the desktop app.
After: serve passes through the allowlist check → register_from_config(load_config(), accept_hooks=...) is called → hooks are wired onto the plugin manager.

⚠️ Note: needs-decision label

This issue has the needs-decision label. The fix is minimal and correct — serve is a command that hosts agent conversations (via the desktop app's chat backend), just like chat, acp, and rl. If shell hooks are intentionally excluded from serve for security/sandboxing reasons, this PR can be rejected in favor of (a) a warning logged at startup, and (b) explicit documentation that serve does not run hooks. The current state — hooks silently not firing with no indication — is the worst of both worlds.

[alt-glitch]

This was generated by AI during triage.

Duplicate of #61844 for the serve allowlist fix: the hermes_cli/main.py hunk is identical. The unrelated profiles.py skill-count change should be split into a focused PR.

[teknium1]

Thanks for confirming the missing serve allowlist entry. Current main does return from _prepare_agent_startup() before register_from_config() for serve (hermes_cli/main.py:10592-10638), so the reported hook-registration gap is real.

Problems

• Adding serve here runs the entire generic startup path, including synchronous MCP discovery (hermes_cli/main.py:10614-10617, 10674-10680), while cmd_dashboard() already owns background MCP startup (hermes_cli/main.py:10328-10341).
• dashboard shares cmd_dashboard() (hermes_cli/main.py:10058) but remains outside this allowlist, so the shared startup path is still not uniformly covered.
• The diff has no regression test for hook registration, and it bundles an unrelated hermes_cli/profiles.py skill-count change.

Suggested changes

• Split the profile skill-count commit.
• Register hooks in cmd_dashboard() after plugin discovery and before start_server(), then add a focused startup-order/failure-tolerance regression test.

Automated hermes-sweeper review.

[teknium1]

Adding serve here does more than register hooks: it sends serve through synchronous discover_mcp_tools() before cmd_dashboard() launches its dedicated background MCP discovery. Please register hooks in the shared cmd_dashboard() handler after plugin discovery instead; that also covers dashboard without broadening this generic startup gate.