Bug Description

When a custom provider is removed from config.yaml (either manually or via hermes model interactive command), its credential pool entries remain in ~/.hermes/auth.json. However, these orphaned credentials become invisible to the interactive hermes auth remove menu, creating a cleanup gap where users cannot remove them through the official CLI workflow.

The root cause is that _get_custom_provider_names() in auth_commands.py reads from the current config.yaml, while auth.json retains stale entries. This creates a state desynchronization between the configuration source and the runtime credential store.

Steps to Reproduce

1. Add a custom provider to ~/.hermes/config.yaml:

   custom_providers:
   - name: Yunwu.ai
     base_url: https://yunwu.ai/v1
     api_key: sk-xxxxx

2. Run hermes auth list — confirms custom:yunwu.ai has 2 credentials (one from config:Yunwu.ai, one from model_config)

3. Remove the provider via hermes model interactive command (or manually delete from config.yaml)

4. Run hermes auth list again — orphaned credentials still appear:

   custom:yunwu.ai (2 credentials):
     #1  Yunwu.ai             api_key config:Yunwu.ai
     #2  model_config         api_key model_config

5. Run hermes auth (interactive mode) → select "Remove a credential" — yunwu does not appear in the provider selection menu

6. User cannot remove these credentials through the interactive workflow

Expected Behavior

• When a custom provider is removed from config.yaml, its credential pool entries should either:

  1. Be automatically cleaned up from auth.json on next startup, OR
  2. Still appear in the interactive hermes auth remove menu so users can manually delete them

• The interactive remove menu should show ALL providers with entries in auth.json, not just those currently in config.yaml

Actual Behavior

• hermes auth list shows orphaned credentials (reads from auth.json)
• hermes auth interactive remove menu does NOT show orphaned providers (reads from config.yaml via _get_custom_provider_names())
• Users must manually edit auth.json or use hermes auth remove custom:yunwu.ai --id <id> with exact provider key syntax

Affected Component

• CLI (interactive chat)
• Gateway (Telegram/Discord/Slack/WhatsApp)
• Setup / Installation
• Tools (terminal, file ops, web, code execution, etc.)
• Skills (skill loading, skill hub, skill guard)
• Agent Core (conversation loop, context compression, memory)
• Configuration (config.yaml, .env, hermes setup)
• Other

Debug Report

Report: (run `hermes debug share` and paste links)

Environment

• Operating System: Ubuntu 24.04
• Python Version: (run python --version)
• Hermes Version: (run hermes version)

Root Cause Analysis

The issue is in hermes_cli/auth_commands.py:

1. Line 39-57: _get_custom_provider_names() reads from current config.yaml only
2. Line 449-463: _pick_provider() displays custom providers from _get_custom_provider_names() — orphaned entries not shown
3. Line 317-341: auth_list_command() reads directly from auth.json via load_pool() — shows all entries including orphans
4. Line 322-326: Provider list built from PROVIDER_REGISTRY + list_custom_pool_providers() — but interactive mode uses different logic

The mismatch: auth_list_command() and _interactive_remove() use different sources of truth for custom provider discovery.

Proposed Fix

Option 1 (Recommended): Modify _get_custom_provider_names() to also scan auth.json for orphaned custom provider entries:

def _get_custom_provider_names() -> list:
    """Return list of (display_name, pool_key, provider_key) tuples."""
    try:
        from hermes_cli.config import get_compatible_custom_providers, load_config
        config = load_config()
    except Exception:
        config = {}
    
    result = []
    # First, add providers from current config.yaml
    for entry in get_compatible_custom_providers(config):
        # ... existing logic ...
        result.append((name.strip(), pool_key, provider_key))
    
    # Then, scan auth.json for orphaned custom provider entries
    try:
        from agent.credential_pool import load_pool, CUSTOM_POOL_PREFIX
        auth_store = _load_auth_store()
        credential_pool = auth_store.get("credential_pool", {})
        for pool_key in credential_pool.keys():
            if pool_key.startswith(CUSTOM_POOL_PREFIX) and pool_key not in [r[1] for r in result]:
                # Extract display name from pool_key (e.g., "custom:yunwu.ai" → "Yunwu.ai")
                display_name = pool_key.replace(CUSTOM_POOL_PREFIX, "").replace("-", ".").title()
                result.append((display_name, pool_key, ""))
    except Exception:
        pass  # Gracefully skip if auth.json unavailable
    
    return result

Option 2: Add a cleanup command hermes auth cleanup that removes all credential pool entries for providers no longer in config.yaml.

PR Willingness

• I'd like to fix this myself and submit a PR
• I'm reporting this for the maintainers to fix