feat(providers): cli-shim — shell out to claude/codex/gemini CLIs via OAuth (RFC)

[Gradata]

DRAFT/RFC. Adds a new provider that shells out to local CLI installs (claude, codex, gemini) using OAuth subscriptions instead of API keys.

Proposal doc: agent/CLI_SHIM_PROPOSAL.md

Motivation: subscription users (Claude Max, ChatGPT Pro, Gemini Advanced) have no API keys but want to run hermes-agent / fleets. Currently impossible without paying twice.

Not ready to merge — looking for upstream guidance on:

• Should OAuth-detection be hermes-core?
• Is streaming-chunk synthesis acceptable when CLIs return single-shot output?
• Manifest convention for 'no API key required' providers?

[memozac-gbz]

This is great news! Any chance you can prioritize this feature? I'm sure not only me but a lot of people in the community would benefit from this as this features reduces the infrastructure cost.

[teknium1]

Thanks for the detailed RFC and the work on the subprocess facade.

This automated hermes-sweeper review is closing this under the standing in-tree-provider-integration policy:

• The PR adds plugins/model-providers/cli-shim/ plus core routing changes in run_agent.py, hermes_cli/auth.py, and agent/auxiliary_client.py for third-party CLI products.
• AGENTS.md:126-136 requires such integrations to ship as standalone plugins rather than as new in-tree provider integrations.
• Current main already supports the adjacent supported routes: Claude Code credential reuse (website/docs/integrations/providers.md:123-135) and the Codex app-server runtime (website/docs/user-guide/features/codex-app-server-runtime.md:160-170).
• Gemini CLI OAuth inference was deliberately removed in 7130d608 because of upstream account-ban risk.

Please consider publishing this as a standalone plugin repository using the existing provider/plugin surface. If a generic framework capability is genuinely missing, a narrow proposal for that reusable surface can be discussed separately. The related overlap noted on #26960 and the resolver gap documented by #36084 are useful context for any re-scoped work.

---

Closed as not-planned per standing maintainer policy (in-tree-provider-integration). This is a design-direction decision, not a code-quality judgment — see the Contribution Rubric in AGENTS.md for what the project is looking for. If you believe this policy was misapplied to your change, comment here and a maintainer will take a look.