feat(portal): one-shot setup, status CLI, and Nous-included markers

[teknium1]

Summary

Four small Portal-aware surfaces that drive subscription value without adding friction for users who don't subscribe.

Changes

• hermes setup --portal (hermes_cli/setup.py, main.py) — one-shot Nous OAuth + provider switch + Tool Gateway opt-in. Skips the rest of the wizard. Shareable as a single command from docs/social. Idempotent (detects existing login and skips OAuth).
• hermes portal {status,open,tools} (new hermes_cli/portal_cli.py + main.py wiring) — small surface over Portal auth + Tool Gateway routing. Defaults to status when no subcommand. open launches the subscription page; tools lists the Gateway catalog with current routing.
• Tool picker (hermes tools) (hermes_cli/tools_config.py) — when the user is logged into Nous, mark Nous-managed provider rows with ★ Included with your Nous subscription. Suppressed when not authed; non-subscribers see the picker unchanged.
• BYOK setup hint (hermes_cli/tools_config.py) — single dim line Available through Nous Portal subscription. shown when the user is being prompted for a paid API key (Firecrawl/FAL/ElevenLabs/Browserbase/etc.) AND the category has a Nous-managed sibling AND the user is not already authed to Nous. Suppressed in all other cases — paid-providers without a managed sibling never show it, and existing Portal users never see it either.

Non-impact for non-Portal users

• Status command: only registered as hermes portal, never auto-runs.
• Setup flag: opt-in via --portal; default hermes setup flow unchanged.
• Tool picker star: only renders when get_nous_subscription_features().nous_auth_present is True.
• BYOK hint: only shows on cold-start when picking a category with a managed sibling. One dim line, no banner, no dismissal flow.

Validation

	Result
hermes portal status (no auth, fresh home)	Shows not-logged-in + Tool Gateway routing per current config
hermes portal status (simulated auth + provider=nous)	Shows logged-in, portal URL, inference URL, ✓ on provider
hermes portal tools	Lists 5 Gateway partners with current routing
hermes setup --portal --help	Flag parses, help text correct
_run_portal_one_shot already-logged-in path	Skips OAuth, sets provider=nous, persists config
_run_portal_one_shot not-logged-in path	Invokes auth_add_command(provider=nous, type=oauth), sets provider
Tools picker, authed	"Nous Subscription" row shows star marker (verified via TTS category)
Tools picker, unauthed	Marker absent (verified via TTS category)
BYOK hint, authed	Suppressed (verified with ElevenLabs entry)
BYOK hint, unauthed, managed sibling	Shown (verified with ElevenLabs entry)
BYOK hint, unauthed, no managed sibling	Suppressed (verified with x_search.xAI)
Targeted suite (test_tools_config.py + test_setup.py)	97/97 passing

Test plan

• hermes setup --portal to walk through the device-code flow on a fresh install
• hermes portal status with and without a Portal sub
• hermes tools → TTS section while logged into Nous (look for star)
• hermes tools → pick ElevenLabs while NOT logged into Nous (look for hint)

[github-actions]

🚨 CRITICAL Supply Chain Risk Detected

This PR contains a pattern that has been used in real supply chain attacks. A maintainer must review the flagged code carefully before merging.

🚨 CRITICAL: Install-hook file added or modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/setup.py

---

Scanner only fires on high-signal indicators: .pth files, base64+exec/eval combos, subprocess with encoded commands, or install-hook files. Low-signal warnings were removed intentionally — if you're seeing this comment, the finding is worth inspecting.

[github-actions]

🔎 Lint report: hermes/hermes-ee3c6288 vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 9005 on HEAD, 9002 on base (🆕 +3)

🆕 New issues (2):

Rule	Count
unresolved-attribute	2

First entries

hermes_cli/tools_config.py:2437: [unresolved-attribute] unresolved-attribute: Attribute `get` is not defined on `str` in union `str | dict[str, str | list[Unknown] | bool | list[str]] | dict[str, str | list[Unknown]] | dict[str, str | list[dict[str, str]]] | Unknown`
hermes_cli/portal_cli.py:70: [unresolved-attribute] unresolved-attribute: Attribute `get` is not defined on `None` in union `Any | None | dict[Unknown, Unknown]`

✅ Fixed issues: none

Unchanged: 4780 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

[github-actions]

🚨 CRITICAL Supply Chain Risk Detected

This PR contains a pattern that has been used in real supply chain attacks. A maintainer must review the flagged code carefully before merging.

🚨 CRITICAL: Install-hook file added or modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/setup.py

---

Scanner only fires on high-signal indicators: .pth files, base64+exec/eval combos, subprocess with encoded commands, or install-hook files. Low-signal warnings were removed intentionally — if you're seeing this comment, the finding is worth inspecting.