hermes - 💡(How to fix) Fix Gateway restricted toolset filtering can leak via quiet-mode tool schema cache

Title: Gateway restricted toolset filtering can leak via quiet-mode tool schema cache

Summary

In long-lived gateway processes, tool schemas are built with get_tool_definitions(..., quiet_mode=True) and cached. If enabled/restricted toolsets depend on the active gateway sender identity, the quiet-mode cache must be scoped by that identity. Otherwise an authorized sender can populate a cached schema containing restricted tools, and a later unauthorized sender in the same gateway process can receive those restricted schemas.

Why this matters

Deployments that expose Hermes through messaging platforms often restrict powerful toolsets such as terminal, file, browser, cronjob, and delegation to owner identities. A process-global quiet-mode cache can turn that policy into first-user-wins behavior.

Observed behavior

A WhatsApp sender that was not in the allowed identities received restricted tools after the gateway process had cached schemas.

Examples of tools that must not be exposed to unauthorized gateway senders:

• terminal
• read_file / write_file / patch
• browser_navigate
• cronjob
• delegate_task

Expected behavior

Tool schema cache entries should include the active gateway identity/access-control fingerprint, or restricted-tool filtering should be applied after cache lookup. Unauthorized gateway identities should never receive restricted tool schemas from another sender's cached result.

Suggested fix

• Compute a gateway identity/access-control fingerprint from the session context.
• Filter configured restricted toolsets for unauthorized live gateway identities.
• Include the fingerprint in the quiet-mode cache key.
• Keep CLI/internal contexts unaffected when no live gateway identity is active.

Regression tests

Add tests that verify:

1. unauthorized gateway identity does not see restricted toolsets;
2. authorized owner identity does see them;
3. quiet-mode cache populated by one identity is not reused for another identity.