chore: ruff auto-fix PLR6201 resweep — tuple → set in membership tests (#27355)

Six days after #23937 (608 fixes) the codebase had accumulated 241 new
PLR6201 violations. Same mechanical `x in (...)` → `x in {...}` fix,
same zero-risk profile: set lookup is O(1) vs O(n) for tuple and the
two are semantically equivalent for hashable scalar membership tests.

All 241 instances fixed via `ruff check --select PLR6201 --fix
--unsafe-fixes`, zero remaining. Every changed value is a hashable
scalar (str/int/None/enum/signal); no risk of unhashable runtime
errors. No behavior change.

Test plan:
- 119 files changed, +244/-244 (net zero) — exactly one-line edits
- `ruff check` clean afterward
- Compile checks pass on the largest touched files (cli.py, run_agent.py,
  gateway/run.py, gateway/platforms/discord.py, model_tools.py)
- Subset broad test run on tests/gateway/ tests/hermes_cli/ tests/agent/
  tests/tools/: 18187 passed, 59 pre-existing failures (verified against
  origin/main with the same shape — identical failure count, identical
  category — all xdist test-order flakes unrelated to this change)

Follows the same template as PR #23937 ([tracker: #23972](https://github.com/NousResearch/hermes-agent/issues/23972)).

tests/hermes_cli/test_auth_nous_provider.py

@@ -555,7 +555,7 @@ class TestLoginNousSkipKeepsCurrent:
         auth_path = hermes_home / "auth.json"
         auth_after = json.loads(auth_path.read_text())
         # active_provider should NOT be set to "nous" after Skip
-        assert auth_after.get("active_provider") in (None, "")
+        assert auth_after.get("active_provider") in {None, ""}
         # But Nous creds are still saved
         assert "nous" in auth_after.get("providers", {})
 

tests/hermes_cli/test_cmd_update.py

@@ -162,7 +162,7 @@ class TestCmdUpdateBranchFallback:
             if call.args
             and call.args[0][0] == "/usr/bin/npm"
             and call.args[0][1] == "ci"
-            and call.kwargs.get("cwd") in (PROJECT_ROOT, PROJECT_ROOT / "ui-tui")
+            and call.kwargs.get("cwd") in {PROJECT_ROOT, PROJECT_ROOT / "ui-tui"}
         ]
         assert len(repo_and_tui_calls) == 2
         for call in repo_and_tui_calls:

tests/hermes_cli/test_codex_runtime_switch.py

@@ -105,7 +105,7 @@ class TestApply:
         assert "Cannot enable" in r.message
         assert "npm i -g @openai/codex" in r.message
         # Config NOT mutated on failure
-        assert cfg.get("model", {}).get("openai_runtime") in (None, "")
+        assert cfg.get("model", {}).get("openai_runtime") in {None, ""}
 
     def test_enable_succeeds_when_codex_present(self):
         cfg = {}

tests/hermes_cli/test_install_cua_driver.py

@@ -48,7 +48,7 @@ class TestInstallCuaDriverUpgrade:
         with patch("platform.system", return_value="Darwin"), \
              patch.object(tools_config.shutil, "which",
                           side_effect=lambda n: "/usr/local/bin/" + n
-                                                 if n in ("cua-driver", "curl") else None), \
+                                                 if n in {"cua-driver", "curl"} else None), \
              patch.object(tools_config, "_run_cua_driver_installer",
                           return_value=True) as runner, \
              patch("subprocess.run"):
@@ -82,7 +82,7 @@ class TestInstallCuaDriverUpgrade:
         with patch("platform.system", return_value="Darwin"), \
              patch.object(tools_config.shutil, "which",
                           side_effect=lambda n: "/usr/local/bin/" + n
-                                                 if n in ("cua-driver", "curl") else None), \
+                                                 if n in {"cua-driver", "curl"} else None), \
              patch.object(tools_config, "_run_cua_driver_installer") as runner, \
              patch("subprocess.run"):
             assert tools_config.install_cua_driver(upgrade=False) is True

tests/hermes_cli/test_kanban_core_functionality.py

@@ -1046,7 +1046,7 @@ def test_enforce_max_runtime_integrates_with_dispatch(kanban_home, monkeypatch):
         task = kb.get_task(conn, tid)
         # After timeout, task is back in 'ready' and will be re-spawned
         # by the same pass. That's the intended behaviour.
-        assert task.status in ("ready", "running")
+        assert task.status in {"ready", "running"}
     finally:
         conn.close()
 

tests/hermes_cli/test_memory_reset.py

@@ -43,9 +43,9 @@ def _run_memory_reset(target="all", yes=False, monkeypatch=None, confirm_input="
 
     mem_dir = get_hermes_home() / "memories"
     files_to_reset = []
-    if target in ("all", "memory"):
+    if target in {"all", "memory"}:
         files_to_reset.append(("MEMORY.md", "agent notes"))
-    if target in ("all", "user"):
+    if target in {"all", "user"}:
         files_to_reset.append(("USER.md", "user profile"))
 
     existing = [(f, desc) for f, desc in files_to_reset if (mem_dir / f).exists()]

tests/hermes_cli/test_models.py

@@ -252,7 +252,7 @@ class TestDetectProviderForModel:
         result = detect_provider_for_model("deepseek-chat", "openai-codex")
         assert result is not None
         # Provider is deepseek (direct) or openrouter (fallback) depending on creds
-        assert result[0] in ("deepseek", "openrouter")
+        assert result[0] in {"deepseek", "openrouter"}
 
     def test_current_provider_model_returns_none(self):
         """Models belonging to the current provider should not trigger a switch."""
@@ -302,7 +302,7 @@ class TestDetectProviderForModel:
         with patch("hermes_cli.models.fetch_openrouter_models", return_value=LIVE_OPENROUTER_MODELS):
             result = detect_provider_for_model("claude-opus-4-6", "openai-codex")
         assert result is not None
-        assert result[0] not in ("nous",)  # nous has claude models but shouldn't be suggested
+        assert result[0] not in {"nous",}  # nous has claude models but shouldn't be suggested
 
 
 class TestIsNousFreeTier:

tests/hermes_cli/test_opencode_go_in_model_list.py

@@ -44,7 +44,7 @@ def test_opencode_go_appears_when_api_key_set():
     # opencode-go can appear as "built-in" (from PROVIDER_TO_MODELS_DEV when
     # models.dev is reachable) or "hermes" (from HERMES_OVERLAYS fallback when
     # the API is unavailable, e.g. in CI).
-    assert opencode_go["source"] in ("built-in", "hermes")
+    assert opencode_go["source"] in {"built-in", "hermes"}
 
 
 def test_opencode_go_not_appears_when_no_creds():

tests/hermes_cli/test_update_stale_dashboard.py

@@ -237,7 +237,7 @@ class TestKillStaleDashboardPosix:
             sent.append((pid, sig))
             # Simulate stubborn process: probe (sig 0) always succeeds,
             # SIGTERM does nothing, SIGKILL is where it "dies".
-            if sig in (_signal.SIGTERM, 0, _signal.SIGKILL):
+            if sig in {_signal.SIGTERM, 0, _signal.SIGKILL}:
                 return
             # Any other signal — also fine.
 

tests/hermes_cli/test_web_server.py

@@ -306,7 +306,7 @@ class TestWebServerEndpoints:
         resp = self.client.get("/api/auth/session-token")
         # The endpoint is gone — the catch-all SPA route serves index.html
         # or the middleware returns 401 for unauthenticated /api/ paths.
-        assert resp.status_code in (200, 404)
+        assert resp.status_code in {200, 404}
         # Either way, it must NOT return the token as JSON
         try:
             data = resp.json()
@@ -333,7 +333,7 @@ class TestWebServerEndpoints:
         # %2e%2e = ..
         resp = self.client.get("/%2e%2e/%2e%2e/etc/passwd")
         # Should return 200 with index.html (SPA fallback), not the actual file
-        assert resp.status_code in (200, 404)
+        assert resp.status_code in {200, 404}
         if resp.status_code == 200:
             # Should be the SPA fallback, not the system file
             assert "root:" not in resp.text
@@ -341,7 +341,7 @@ class TestWebServerEndpoints:
     def test_path_traversal_dotdot_blocked(self):
         """Direct .. path traversal via encoded sequences."""
         resp = self.client.get("/%2e%2e/hermes_cli/web_server.py")
-        assert resp.status_code in (200, 404)
+        assert resp.status_code in {200, 404}
         if resp.status_code == 200:
             assert "FastAPI" not in resp.text  # Should not serve the actual source
 
@@ -535,7 +535,7 @@ class TestConfigRoundTrip:
             if val is None:
                 continue  # not set in user config — fine
             expected = entry["type"]
-            if expected in ("string", "select") and not isinstance(val, str):
+            if expected in {"string", "select"} and not isinstance(val, str):
                 mismatches.append(f"{key}: expected str, got {type(val).__name__}")
             elif expected == "number" and not isinstance(val, (int, float)):
                 mismatches.append(f"{key}: expected number, got {type(val).__name__}")
@@ -1032,7 +1032,7 @@ class TestNewEndpoints:
         """GET /api/auth/session-token no longer exists."""
         resp = self.client.get("/api/auth/session-token")
         # Should not return a JSON token object
-        assert resp.status_code in (200, 404)
+        assert resp.status_code in {200, 404}
         try:
             data = resp.json()
             assert "token" not in data