fix(toolsets): make zero tools expressible, fail closed on an empty -t

[suhas-svg]

What does this PR do?

Refresh of #127881 (closed stale) onto current main.

hermes -z '<prompt>' -t '' is the idiom people reach for when they want a tool-less liveness probe or classifier. It did the opposite: the empty value was indistinguishable from "flag not passed", so the one-shot fell back to the user's configured toolsets and ran with terminal, file writes and everything else — with nothing in the output saying so.

This makes zero tools expressible, and makes the ambiguous empty value fail closed instead of silently granting full access.

hermes -z '<prompt>' -t ''
  _normalize_toolsets("")  →  None
  None  →  use_config_toolsets = True   →  ALL configured tools

 TOOLSETS = {
+    ZERO_TOOLSET: _ts("No tools at all — an explicitly tool-less session ..."),

 _validate_explicit_toolsets(toolsets):
-    normalized = _normalize_toolsets(toolsets)
-    if normalized is None:
-        return None, None          # "" and None both land here
+    if toolsets is not None and not _normalize_toolsets(toolsets):
+        return None, "... pass a toolset name, or 'none' ..."
+    normalized = _normalize_toolsets(toolsets)
+    if normalized is None:
+        return None, None          # only the ABSENT flag reaches this now
+    if ZERO_TOOLSET in normalized:
+        if len(normalized) > 1:
+            return None, "'none' means zero tools and cannot be combined with ..."
+        return [ZERO_TOOLSET], None

 _select_tool_names(enabled_toolsets, ...):
     # dispatcher-owned workers always get the kanban lifecycle tools
-    if (... and "kanban" not in enabled):
+    if (... and "kanban" not in enabled and ZERO_TOOLSET not in enabled):
         enabled.append("kanban")

none is registered in the registry rather than special-cased downstream, so it passes the same validate_toolset() / resolve_toolset() path as every other name and needs no branch at each call site.

The second commit applies the same empty-vs-absent rule to hermes chat -q (cli.py::_build_cli_from_args), where an empty -t silently received the coding posture or the platform default — the same footgun, surfaced on the other entry point.

Evidence

Same probe, base main vs this branch:

$ python -c "from hermes_cli.oneshot import _validate_explicit_toolsets, _normalize_toolsets; ..."
base main:  validate('') -> (None, None)                      use_config_toolsets = True
branch:     validate('') -> (None, 'hermes -z: --toolsets was passed an empty value, ...')

scripts/run_tests.sh tests/test_toolsets_zero_selection.py tests/hermes_cli/test_toolset_validation.py tests/hermes_cli/test_oneshot_exit_contract.py
→ 31 passed, 0 failed

Two unrelated files (test_cli_profile_toolsets.py, test_kanban_worker_spawn_toolsets.py) fail 6 tests identically on base main on this host — a home-I/O guard artifact of my local test environment, not this change.

Related Issue

Fixes #126122

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)

Changes Made

• toolsets.py — ZERO_TOOLSET = "none" and a TOOLSETS entry for it, so an explicitly tool-less selection is a real, resolvable toolset like any other.
• hermes_cli/oneshot.py — _validate_explicit_toolsets() distinguishes the three cases the parser already distinguishes (default=None): absent → config default (unchanged); passed but empty → error, no provider request; none → ["none"]. none combined with any other name is rejected.
• cli.py — _build_cli_from_args() applies the same rule to hermes chat -q.
• model_tools.py — the dispatcher-owned kanban worker injection skips an explicit zero-tool request.
• tests/test_toolsets_zero_selection.py — new; the three cases plus the kanban exception and the -q path.

How to Test

1. hermes -z 'say ok' -t '' → exits 2 with the "empty value" diagnostic instead of running with every configured tool.
2. hermes -z 'say ok' -t none → runs with zero tools; hermes -z 'say ok' -t none,web → rejected.
3. scripts/run_tests.sh tests/test_toolsets_zero_selection.py

[suhas-svg]

Closing — not pursuing this batch.