feat: add Claude Code CLI provider

[canderson26]

Summary

Adds a new claude-cli provider that routes Hermes turns through the locally-installed claude CLI, letting users with an existing Claude Code login drive Hermes with their Claude subscription — no API key required.

Hermes keeps orchestration, tools, MCP, session storage, compression, and multi-step reasoning. Claude Code is treated as a local external-process transport behind an OpenAI-compatible facade.

How it works

• agent/claude_cli_client.py — OpenAI-style chat.completions facade around claude -p. Manages session id hydration/resume, streams responses live, and marshals Hermes tool calls through <tool_call>{...}</tool_call> blocks in Claude's text output.
• Wired into the provider registry, overlay map, auth resolver, auxiliary client, runtime provider, and model-normalizer.
• hermes model adds a dedicated Claude Code CLI flow that detects claude auth status, picks a model, and sets a runtime mode.

Runtime modes

• standard — keeps Claude Code's default runtime behavior.
• stripped — disables Claude Code's MDS loader, auto-memory, git instructions, and Claude.ai MCP servers where possible, then bootstraps the Hermes system prompt into the Claude session before the first real turn. Recommended for Hermes.

model:
  provider: "claude-cli"
  default: "claude-opus-4-7"
  claude_cli_runtime: "stripped"   # or "standard"

Usage

hermes chat --provider claude-cli --model claude-opus-4-7

Requires:

• Claude Code CLI on PATH (or HERMES_CLAUDE_CLI_COMMAND / CLAUDE_CLI_PATH)
• An active claude auth login session

New env vars

Variable	Description
HERMES_CLAUDE_CLI_COMMAND	Override the Claude CLI binary (default: claude)
HERMES_CLAUDE_CLI_ARGS	Extra arguments prepended to every invocation
HERMES_CLAUDE_CLI_CWD	Working directory for Claude Code subprocess calls
HERMES_CLAUDE_CLI_RESUME	Enable/disable Claude session reuse (default: true)
HERMES_CLAUDE_CLI_STRIP_RUNTIME	Force stripped runtime behavior
HERMES_CLAUDE_CLI_USE_PROCESS_CWD	Use current process cwd instead of Hermes' neutral dir
HERMES_CLAUDE_CLI_DEBUG_LOG	Write verbose transport logs to file

Also added to the HERMES_INFERENCE_PROVIDER and fallback-provider allow-lists.

Tests

• tests/agent/test_claude_cli_client.py — tool-call parsing, missing-binary error, session hydration reuse
• tests/agent/test_model_metadata.py, test_models_dev.py — context-window resolution for claude-cli
• tests/agent/test_title_generator.py — delayed auto-title for Claude CLI sessions (avoids the bootstrap turn)
• tests/run_agent/test_compression_feasibility.py — compression threshold handling for the external-process backend

All 141 tests in the affected suite pass locally.

Docs

• website/docs/integrations/providers.md — new provider section with runtime-mode guidance
• website/docs/reference/environment-variables.md — all seven new env vars

Notes for reviewers

• Because Claude Code CLI is a stateful local subprocess rather than a pooled HTTP client, the primary OpenAI client is shared across tool turns so Claude session ids survive.
• Tool calls are marshalled through Claude's text output. This is best thought of as an external-process transport, not a native chat API.
• The stripped runtime relies on Claude Code environment toggles (CLAUDE_CODE_DISABLE_*, ENABLE_CLAUDEAI_MCP_SERVERS). If Anthropic renames them, stripped mode will silently degrade to standard.

[alt-glitch]

Related to #6427 (Claude CLI subprocess transport PR, still open). This appears to be a more complete implementation.

[alt-glitch]

Related to #6427.

[canderson26]

Superseded by #15137: the replacement branch carries the Claude CLI provider plus the persistent/broker transport and privacy-scrubbed upstream-ready diff.