feat: add managed tool gateway and Nous subscription support

- add managed modal and gateway-backed tool integrations\n- improve CLI setup, auth, and configuration for subscriber flows\n- expand tests and docs for managed tool support

tests/hermes_cli/test_tools_config.py

@@ -3,10 +3,14 @@
 from unittest.mock import patch
 
 from hermes_cli.tools_config import (
+    _configure_provider,
     _get_platform_tools,
     _platform_toolset_summary,
     _save_platform_tools,
     _toolset_has_keys,
+    TOOL_CATEGORIES,
+    _visible_providers,
+    tools_command,
 )
 
 
@@ -45,6 +49,10 @@ def test_toolset_has_keys_for_vision_accepts_codex_auth(tmp_path, monkeypatch):
     monkeypatch.delenv("OPENAI_API_KEY", raising=False)
     monkeypatch.delenv("AUXILIARY_VISION_PROVIDER", raising=False)
     monkeypatch.delenv("CONTEXT_VISION_PROVIDER", raising=False)
+    monkeypatch.setattr(
+        "agent.auxiliary_client.resolve_vision_provider_client",
+        lambda: ("openai-codex", object(), "gpt-4.1"),
+    )
 
     assert _toolset_has_keys("vision") is True
 
@@ -204,3 +212,74 @@ def test_save_platform_tools_still_preserves_mcp_with_platform_default_present()
 
     # Deselected configurable toolset removed
     assert "terminal" not in saved
+
+
+def test_visible_providers_include_nous_subscription_when_logged_in(monkeypatch):
+    config = {"model": {"provider": "nous"}}
+
+    monkeypatch.setattr(
+        "hermes_cli.nous_subscription.get_nous_auth_status",
+        lambda: {"logged_in": True},
+    )
+
+    providers = _visible_providers(TOOL_CATEGORIES["browser"], config)
+
+    assert providers[0]["name"].startswith("Nous Subscription")
+
+
+def test_local_browser_provider_is_saved_explicitly(monkeypatch):
+    config = {}
+    local_provider = next(
+        provider
+        for provider in TOOL_CATEGORIES["browser"]["providers"]
+        if provider.get("browser_provider") == "local"
+    )
+    monkeypatch.setattr("hermes_cli.tools_config._run_post_setup", lambda key: None)
+
+    _configure_provider(local_provider, config)
+
+    assert config["browser"]["cloud_provider"] == "local"
+
+
+def test_first_install_nous_auto_configures_managed_defaults(monkeypatch):
+    config = {
+        "model": {"provider": "nous"},
+        "platform_toolsets": {"cli": []},
+    }
+    for env_var in (
+        "VOICE_TOOLS_OPENAI_KEY",
+        "OPENAI_API_KEY",
+        "ELEVENLABS_API_KEY",
+        "FIRECRAWL_API_KEY",
+        "FIRECRAWL_API_URL",
+        "TAVILY_API_KEY",
+        "PARALLEL_API_KEY",
+        "BROWSERBASE_API_KEY",
+        "BROWSERBASE_PROJECT_ID",
+        "BROWSER_USE_API_KEY",
+        "FAL_KEY",
+    ):
+        monkeypatch.delenv(env_var, raising=False)
+
+    monkeypatch.setattr(
+        "hermes_cli.tools_config._prompt_toolset_checklist",
+        lambda *args, **kwargs: {"web", "image_gen", "tts", "browser"},
+    )
+    monkeypatch.setattr("hermes_cli.tools_config.save_config", lambda config: None)
+    monkeypatch.setattr(
+        "hermes_cli.nous_subscription.get_nous_auth_status",
+        lambda: {"logged_in": True},
+    )
+
+    configured = []
+    monkeypatch.setattr(
+        "hermes_cli.tools_config._configure_toolset",
+        lambda ts_key, config: configured.append(ts_key),
+    )
+
+    tools_command(first_install=True, config=config)
+
+    assert config["web"]["backend"] == "firecrawl"
+    assert config["tts"]["provider"] == "openai"
+    assert config["browser"]["cloud_provider"] == "browserbase"
+    assert configured == []