fix(hermes): discover chat extraction backend

dockerfiles/Dockerfile.hermes-agent

@@ -228,6 +228,34 @@ COPY dockerfiles/hermes-public-extract/__init__.py /opt/hermes/plugins/web/publi
 COPY dockerfiles/hermes-public-extract/plugin.yaml /opt/hermes/plugins/web/public_extract/plugin.yaml
 COPY dockerfiles/hermes-public-extract/provider.py /opt/hermes/plugins/web/public_extract/provider.py
 
+# Per-capability custom backends are resolved before upstream discovers web
+# plugins, causing extract_backend to fall through to the shared search-only
+# backend. Discover bundled plugins before checking a custom capability name.
+RUN python - <<'PY'
+from pathlib import Path
+
+path = Path("/opt/hermes/tools/web_tools.py")
+source = path.read_text()
+before = '''    cfg = _load_web_config()
+    specific = (cfg.get(f"{capability}_backend") or "").lower().strip()
+    if specific and _is_backend_available(specific):
+        return specific
+'''
+after = '''    cfg = _load_web_config()
+    specific = (cfg.get(f"{capability}_backend") or "").lower().strip()
+    if specific and specific not in _LEGACY_WEB_BACKENDS:
+        _ensure_web_plugins_loaded()
+    if specific and _is_backend_available(specific):
+        return specific
+'''
+if source.count(before) != 1:
+    raise SystemExit(
+        "Hermes custom web capability patch context changed: expected 1, "
+        f"found {source.count(before)}"
+    )
+path.write_text(source.replace(before, after, 1))
+PY
+
 COPY dockerfiles/hermes-session-migrate.py /opt/hermes/bin/hermes-session-migrate
 
 RUN cd /opt/hermes/web \
@@ -242,6 +270,7 @@ RUN cd /opt/hermes/web \
         /opt/hermes/gateway/platforms/api_server.py \
     && /opt/hermes/.venv/bin/python -m py_compile \
         /opt/hermes/gateway/platforms/api_server.py \
+        /opt/hermes/tools/web_tools.py \
         /opt/hermes/tools/python_sandbox_tool.py \
         /opt/hermes/plugins/web/public_extract/provider.py \
     && /opt/hermes/.venv/bin/python -c 'import ddgs' \

services/hermes/chat-statefulset.yaml

@@ -147,7 +147,7 @@ spec:
             requests: {cpu: 25m, memory: 32Mi}
             limits: {cpu: 100m, memory: 64Mi}
         - name: patch-auth
-          image: registry.bstein.dev/bstein/hermes-agent@sha256:2f3b8299e0b72c94e2daf1d2f313256b5bae6ed7f643d38d1ddca13ab397a85c
+          image: registry.bstein.dev/bstein/hermes-agent@sha256:10522c69676e250b5d0014d811ed9eb706d0b7c16f35cf66650f480e63ab3ab5
           imagePullPolicy: IfNotPresent
           command:
             - /opt/hermes/.venv/bin/python
@@ -168,7 +168,7 @@ spec:
             limits: {cpu: 100m, memory: 128Mi}
       containers:
         - name: hermes
-          image: registry.bstein.dev/bstein/hermes-agent@sha256:2f3b8299e0b72c94e2daf1d2f313256b5bae6ed7f643d38d1ddca13ab397a85c
+          image: registry.bstein.dev/bstein/hermes-agent@sha256:10522c69676e250b5d0014d811ed9eb706d0b7c16f35cf66650f480e63ab3ab5
           imagePullPolicy: IfNotPresent
           command: [/bin/sh, -ec]
           args:

testing/tests/test_hermes_chat_quality.py

@@ -83,6 +83,7 @@ def test_gateway_image_honors_ui_model_and_caps_reasoning():
     assert 'reasoning_effort=body.get("reasoning_effort")' in dockerfile
     assert 'reasoning_config = {"enabled": True, "effort": "xhigh"}' in dockerfile
     assert "ddgs==9.14.4" in dockerfile
+    assert "specific not in _LEGACY_WEB_BACKENDS" in dockerfile
 
 
 def test_sandbox_executes_python_with_bounded_output(tmp_path: Path, monkeypatch):