What does this PR do?

Routes selected local Hermes control commands typed in the classic interactive CLI prompt through the local CLI instead of sending them to the agent. This lets users run hermes config ..., hermes gateway stop/status/list, hermes debug ..., and hermes model without first making a model API call, which avoids the 402 deadlock reported in #37858.

Related Issue

Fixes #37858

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• cli.py: add an allowlisted hermes ... prompt fast path before regular chat dispatch, using shlex.split and argv-based subprocess.run without a shell.
• tests/cli/test_local_hermes_command_passthrough.py: cover allowlisted config/gateway commands, rejection of unrelated shell text, and subprocess argv dispatch.

How to Test

1. pytest tests/cli/test_local_hermes_command_passthrough.py -q -> 4 passed.
2. pytest tests/hermes_cli/test_gateway_restart_loop.py tests/hermes_cli/test_gateway.py tests/hermes_cli/test_set_config_value.py -q -x --timeout=60 -> 99 passed.
3. ruff check cli.py tests/cli/test_local_hermes_command_passthrough.py and ruff format --check tests/cli/test_local_hermes_command_passthrough.py -> passed.
4. python scripts/check-windows-footguns.py cli.py tests/cli/test_local_hermes_command_passthrough.py -> passed.
5. git diff --check -> passed.
6. pytest tests/ -q -x --timeout=60 was attempted, but local collection stopped before this change was exercised because tests/hermes_cli/test_dashboard_auth_401_reauth.py imports missing optional dependency fastapi.
7. pytest tests/cli -q -x --timeout=60 was attempted as fallback coverage; it reached 283 passes, then timed out in unrelated tests/cli/test_cli_preloaded_skills.py::test_show_banner_does_not_print_skills while lazy dependency installs and auxiliary provider/account failures were logged.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS Darwin 24.6.0 arm64

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

For New Skills

• This skill is broadly useful to most users (if bundled) — see Contributing Guide
• SKILL.md follows the standard format (frontmatter, trigger conditions, steps, pitfalls)
• No external dependencies that aren't already available (prefer stdlib, curl, existing Hermes tools)
• I've tested the skill end-to-end: hermes --toolsets skills -q "Use the X skill to do Y"

Screenshots / Logs

N/A