From 8482aa07165d59ff1e0953fe12af6aea5e27d338 Mon Sep 17 00:00:00 2001
From: KoNit-K <konit.block@protonmail.com>
Date: Wed, 23 Sep 2026 10:39:03 +0800
Subject: [PATCH] fix(gateway): bridge webhook env settings for config
 enablement

---
 gateway/config_env.py        | 12 +++++++++---
 tests/gateway/test_config.py | 21 +++++++++++++++++++++
 2 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/gateway/config_env.py b/gateway/config_env.py
index 9096a5c8b0..9f171ca2ee 100644
--- a/gateway/config_env.py
+++ b/gateway/config_env.py
@@ -316,9 +316,15 @@ def _api_server(config: GatewayConfig) -> None:
 
 
 def _webhook(config: GatewayConfig) -> None:
-    if is_truthy_value(getenv("WEBHOOK_ENABLED")):
-        extra = _enable_from_env(config, Platform.WEBHOOK, pop_marker=True, warn=False).extra
-        _env_extras(extra, (("port", "WEBHOOK_PORT", _INT), ("secret", "WEBHOOK_SECRET")))
+    enabled = is_truthy_value(getenv("WEBHOOK_ENABLED"))
+    if not (enabled or Platform.WEBHOOK in config.platforms):
+        return
+    webhook_config = (
+        _enable_from_env(config, Platform.WEBHOOK, pop_marker=True, warn=False)
+        if enabled
+        else config.platforms[Platform.WEBHOOK]
+    )
+    _env_extras(webhook_config.extra, (("port", "WEBHOOK_PORT", _INT), ("secret", "WEBHOOK_SECRET")))
 
 
 def _msgraph_webhook(config: GatewayConfig) -> None:
diff --git a/tests/gateway/test_config.py b/tests/gateway/test_config.py
index 923aaa8962..08a329f699 100644
--- a/tests/gateway/test_config.py
+++ b/tests/gateway/test_config.py
@@ -1479,6 +1479,27 @@ class TestApiServerEnvOverride:
 
 
 class TestWebhookEnvOverride:
+    def test_config_enabled_webhook_reads_env_port_and_secret(self, tmp_path, monkeypatch):
+        """A config.yaml-enabled webhook still receives its .env listener settings."""
+        hermes_home = tmp_path / ".hermes"
+        hermes_home.mkdir()
+        (hermes_home / "config.yaml").write_text(
+            "platforms:\n"
+            "  webhook:\n"
+            "    enabled: true\n",
+            encoding="utf-8",
+        )
+        monkeypatch.setenv("HERMES_HOME", str(hermes_home))
+        monkeypatch.delenv("WEBHOOK_ENABLED", raising=False)
+        monkeypatch.setenv("WEBHOOK_PORT", "9012")
+        monkeypatch.setenv("WEBHOOK_SECRET", "webhook-env-secret")
+
+        webhook = load_gateway_config().platforms[Platform.WEBHOOK]
+
+        assert webhook.enabled is True
+        assert webhook.extra["port"] == 9012
+        assert webhook.extra["secret"] == "webhook-env-secret"
+
     def test_env_key_does_not_reenable_explicitly_disabled_webhook(self):
         """An explicit ``platforms.webhook.enabled: false`` must survive
         _apply_env_overrides() even when WEBHOOK_ENABLED is truthy in the env.