feat(builder): render-mode-aware tool output (plain text in TUI, JSON in CLI)

[iap]

TUI mode: returns plain text for human readability (no JSON walls of text).
CLI/standalone: returns JSON for scriptability.

Tools affected: models, tags, q_debug.
All 241 tests pass.

Uses existing _format.load_render_prefs() to detect render_mode.

Confidence Score: 5/5

Safe to merge.

Summary

• This change keeps registered tool handlers returning structured JSON while applying human-readable formatting only for explicit TUI display. The debug view also shows an explicit negative refresh-token state.

_{Reviews (3) · Last reviewed commit: "feat(builder): render-mode-aware tool ou..."}

[iap]

Review (verified on macOS, PR head a71ed8c) — do not merge as-is

P1: keep handlers JSON, move presentation out (confirmed valid)

I independently verified Greptile's "Preserve tool result structure" finding three ways — it is not a false positive:

1. verify.py:184,195 does json.loads() on handler outputs. With render_mode: tui in a real Hermes config, models/tags/q_debug return plain text and the gate crashes instead of gating.
2. CI green is camouflage, not safety. In CI/standalone hermes_cli isn't importable, load_render_prefs() falls back to auto, and every test exercises only the JSON path. "241 pass" proves nothing about the 108 changed lines.
3. Contract violation. AGENTS.md + _tool_result_helpers require handler output byte-identical to core tool JSON. A display preference must never change the tool-result envelope.

Suggested rework (leaving the design choice to the feature owner):

1. Handlers return JSON always — restore _success(...) routing for models/tags/q_debug.
2. Presentation moves outside the tool boundary (separate non-tool helper, TUI-side rendering, or dropped). Delete the dead bid_status branch in format_output either way — no handler routes through it.
3. Add TUI-path tests for whatever presentation survives (currently zero coverage on the new branches; existing tests only pin CLI mode).
4. P2 one-liner (valid, trivial): if identity.get("has_refresh_token"): conflates missing with False — check is not None before rendering yes/no.
5. Retitle scope-less (feat: …) per the current convention.

Verification gate I will run on the next push: verify.py under stubbed render_mode: tui (today's breaking case), full suite, Greptile re-review.

Checked and cleared

• token_expires_at_iso: real key from sso_oidc (line 547, None default at 596) — the payload addition is sound.
• Suite green locally (241 passed) — expected per above, not evidence of correctness.

---

Co-author: Hermes 6572003+iap@users.noreply.github.com