fix: redirect interactive stderr away from TUI

[rumbin]

Summary:

• redirect interactive CLI stderr to ~/.hermes/logs/cli-stderr.log while the prompt_toolkit app is running
• redact anything written to that side log
• add targeted tests for stderr redirection and redaction

Why:

• patch_stdout() only protects stdout
• raw stderr writes from warnings, third-party SDKs, or MCP reconnect/auth chatter can still corrupt the live TUI prompt and make the session feel dead

Verification:

• python -m pytest tests/test_hermes_logging.py -q -o 'addopts='
• python -m py_compile cli.py hermes_logging.py tests/test_hermes_logging.py

[alt-glitch]

This was generated by AI during triage.

Related: this PR bundles two changes. The MCP OAuth redirect_host config + dual-stack loopback callback binding in tools/mcp_oauth.py overlaps open #21482 (same oauth.redirect_host config) and your earlier closed #29875. The stderr-redirect work (cli.py, hermes_logging.py) is the part matching the title. Reviewers may want the OAuth-redirect-host change split out to compare against #21482.

[teknium1]

Thanks for addressing terminal corruption and adding focused coverage. The stdio-MCP portion of the reported problem is already addressed on current main by 379b2273d: tools/mcp_tool.py:2097-2105 passes a profile-local log file as stdio_client(..., errlog=...).

Problems

• The new redirect_stderr_to_log() context around the entire interactive app (cli.py:14475 in this PR) also hides deliberate user-facing OAuth output. tools/mcp_oauth.py:567 writes the authorization URL to sys.stderr, and tools/mcp_oauth.py:673 writes the paste fallback prompt; both would go only to the side log.
• The changed URI construction at tools/mcp_oauth.py:744 directly interpolates ::1, yielding http://::1:<port>/callback. The added test itself expects the bracketed form http://[::1]:8771/callback; the pre-registered-client path has the same construction.

Suggested changes

• Scope redirection to the identified non-interactive producer rather than replacing process-wide stderr during app.run().
• Centralize URI-host formatting and use it in both OAuth metadata paths.
• Consider splitting the redirect-host work noted in the existing #21482 discussion.

Automated hermes-sweeper review.

[teknium1]

This replaces sys.stderr for the full interactive session, but MCP OAuth intentionally prints its authorization URL and paste fallback to stderr (tools/mcp_oauth.py:567,673). Those user-required instructions would be silently diverted to the side log; scope the redirect to the noisy producer instead.

[teknium1]

For the allowed ::1 host this constructs http://::1:<port>/callback, while the added test expects http://[::1]:8771/callback. Format IPv6 URI authorities with brackets here and in the pre-registered-client path.