From 9f5c508e3326344b08ab8c96ecb7dfd82f825d9b Mon Sep 17 00:00:00 2001
From: Teknium <127238744+teknium1@users.noreply.github.com>
Date: Wed, 2 Sep 2026 22:49:12 -0700
Subject: [PATCH] refactor(hermes_cli): one _plugin_settings_entry helper for
 plugins.entries.<id> reads

---
 hermes_cli/plugins.py        | 15 ++++++---------
 hermes_cli/plugins_loader.py |  9 ++++-----
 hermes_cli/plugins_state.py  |  6 ++++++
 3 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/hermes_cli/plugins.py b/hermes_cli/plugins.py
index 29a1292e18..608a10085e 100644
--- a/hermes_cli/plugins.py
+++ b/hermes_cli/plugins.py
@@ -60,7 +60,7 @@ from hermes_cli.plugins_dispatch import (  # noqa: F401 — re-exported
 from hermes_cli.plugins_ledger import PluginLedgerMixin, PluginRegistration
 from hermes_cli.plugins_state import (
     PluginState, _locked_plugin_state, _nested_plugin_mapping, _nested_plugin_value,
-    _plugin_relative_segments,
+    _plugin_relative_segments, _plugin_settings_entry,
 )
 
 
@@ -228,10 +228,8 @@ class PluginContext:
         legacy ``config`` subtree for migration compatibility)."""
         segments = self._segments(key)
         from hermes_cli.config import load_config_readonly
-        entry = _nested_plugin_value(
-            load_config_readonly() or {}, ("plugins", "entries", self.plugin_id), None
-        )
-        if not isinstance(entry, Mapping):
+        entry = _plugin_settings_entry(load_config_readonly() or {}, self.plugin_id)
+        if entry is None:
             return default
         missing = object()
         value = _nested_plugin_value(entry.get("settings"), segments, missing)
@@ -544,8 +542,7 @@ class PluginContext:
             cfg = load_config() or {}
         except Exception:
             return []
-        allowlist = ((cfg.get("plugins") or {}).get("entries") or {}).get(plugin_id) or {}
-        allowlist = allowlist.get("mcp_allowlist")
+        allowlist = (_plugin_settings_entry(cfg, plugin_id) or {}).get("mcp_allowlist")
         return [str(item) for item in allowlist] if isinstance(allowlist, list) else []
 
     def _tool_override_allowed(self, tool_name: str) -> bool:
@@ -607,8 +604,8 @@ class PluginContext:
             cfg = load_config_readonly() or {}
         except Exception:
             return False
-        return _nested_plugin_value(
-            cfg, ("plugins", "entries", self.plugin_id, "allow_gateway_injection"), False
+        return (_plugin_settings_entry(cfg, self.plugin_id) or {}).get(
+            "allow_gateway_injection"
         ) is True
 
     @_serialized_replacement
diff --git a/hermes_cli/plugins_loader.py b/hermes_cli/plugins_loader.py
index 46ae1500c7..1abf7c8887 100644
--- a/hermes_cli/plugins_loader.py
+++ b/hermes_cli/plugins_loader.py
@@ -25,6 +25,7 @@ from hermes_constants import get_hermes_home, reset_hermes_home_override, set_he
 from registration_lifecycle import replacement_coordinator
 from hermes_cli.plugins_discovery import ENTRY_POINTS_GROUP, _select_entry_point_group
 from hermes_cli.plugins_manifest import PluginManifest, manifest_key, validate_config_schema
+from hermes_cli.plugins_state import _plugin_settings_entry
 
 if TYPE_CHECKING:  # pragma: no cover
     from hermes_cli.plugins import LoadedPlugin
@@ -224,12 +225,10 @@ class PluginLoaderMixin:
         settings: Mapping[str, Any] = {}
         try:
             from hermes_cli.config import load_config
-            entries = ((load_config() or {}).get("plugins") or {}).get("entries") or {}
-            entry = entries.get(plugin_id) if isinstance(entries, Mapping) else None
-            raw = entry.get("settings") if isinstance(entry, Mapping) else None
+            entry = _plugin_settings_entry(load_config() or {}, plugin_id) or {}
+            raw = entry.get("settings")
             if not isinstance(raw, Mapping):
-                # Migration fallback mirroring ctx.get_config.
-                raw = entry.get("config") if isinstance(entry, Mapping) else None
+                raw = entry.get("config")  # migration fallback mirroring ctx.get_config
             settings = raw if isinstance(raw, Mapping) else {}
         except Exception:
             settings = {}
diff --git a/hermes_cli/plugins_state.py b/hermes_cli/plugins_state.py
index c0afd31898..1699f7009a 100644
--- a/hermes_cli/plugins_state.py
+++ b/hermes_cli/plugins_state.py
@@ -57,6 +57,12 @@ def _nested_plugin_mapping(segments: tuple[str, ...], value: Any) -> dict[str, A
     return nested
 
 
+def _plugin_settings_entry(config: object, plugin_id: str) -> Mapping[str, Any] | None:
+    """``plugins.entries.<plugin_id>`` as a mapping, else ``None``."""
+    entry = _nested_plugin_value(config, ("plugins", "entries", plugin_id), None)
+    return entry if isinstance(entry, Mapping) else None
+
+
 def _plugin_data_namespace(plugin_id: str, skill_namespace: str) -> str:
     """Return one Windows-safe directory component for plugin-owned data."""
     candidate = skill_namespace or plugin_id