From a08dee94c13ec920a55b61b4ca8f3aa8bf155c06 Mon Sep 17 00:00:00 2001
From: teknium1 <127238744+teknium1@users.noreply.github.com>
Date: Wed, 16 Sep 2026 23:10:34 -0700
Subject: [PATCH] fix: read plugin-home config through the loader; register
 update export

The config-read guard forbids raw yaml loads of config.yaml outside owner
modules, and hermes_cli.main's frozen lazy-export surface must list every
update_cmd symbol it proxies.
---
 hermes_cli/main.py               |  2 +-
 hermes_cli/plugin_python_deps.py | 13 ++++++++-----
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/hermes_cli/main.py b/hermes_cli/main.py
index a6f677dd11..8d5dbed030 100644
--- a/hermes_cli/main.py
+++ b/hermes_cli/main.py
@@ -2136,7 +2136,7 @@ _FROZEN_UPDATER_SURFACE: dict[str, tuple[str, ...]] = {
         "_ledger_reapable_backend_pids", "_leftover_pausable_gateway_pids", "_npm_lockfile_changed",
         "_orphaned_desktop_backend_pids", "_park_stashed_changes",
         "_pause_windows_gateways_for_update", "_print_parked_branch_kept_notice",
-        "_print_parked_branch_skip_warning",
+        "_print_parked_branch_skip_warning", "_reapply_plugin_python_dependencies",
         "_refresh_active_lazy_features", "_refresh_active_memory_provider_dependencies",
         "_refresh_bootstrap_cache_scripts", "_refresh_windows_gateway_launchers",
         "_relaunch_stopped_serves",
diff --git a/hermes_cli/plugin_python_deps.py b/hermes_cli/plugin_python_deps.py
index 9cbfb152f4..ebe1c2f3e8 100644
--- a/hermes_cli/plugin_python_deps.py
+++ b/hermes_cli/plugin_python_deps.py
@@ -200,11 +200,14 @@ def _plugin_enabled(decl: PythonDeclaration, enabled: set[str], disabled: set[st
 
 
 def _read_home_config(home: Path) -> dict:
-    path = home / "config.yaml"
-    if not path.is_file():
-        return {}
-    data = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
-    return data if isinstance(data, dict) else {}
+    """*home*'s effective config through the real loader, scoped to that home for the duration."""
+    from hermes_cli.config import load_config_readonly
+    from hermes_constants import reset_hermes_home_override, set_hermes_home_override
+    token = set_hermes_home_override(home)
+    try:
+        return load_config_readonly()
+    finally:
+        reset_hermes_home_override(token)
 
 
 def enabled_declarations(home: Path) -> list[PythonDeclaration]: