Summary

When model_aliases contains multiple entries pointing to the same model ID but different providers (e.g. two providers both offering claude-opus-4-6), resolve_alias() in model_switch.py returns the first matching alias by dict iteration order, regardless of which provider was actually requested. This causes /model <name> --provider <slug> to silently use the wrong provider's base_url and api_key.

Reproduction

1. Configure two custom_providers with the same model name:

   custom_providers:
     - name: provider-a
       base_url: https://api-a.example.com
       api_key: sk-aaa
       model: claude-opus-4-6
     - name: provider-b
       base_url: https://api-b.example.com
       api_key: sk-bbb
       model: claude-opus-4-6

2. Add aliases for both:

   model_aliases:
     my-a:
       model: claude-opus-4-6
       provider: custom:provider-a
     my-b:
       model: claude-opus-4-6
       provider: custom:provider-b

3. Run /model claude-opus-4-6 --provider custom:provider-b
4. Observe that the request is sent to https://api-a.example.com (provider-a) instead of https://api-b.example.com (provider-b)

Root Cause

In hermes_cli/model_switch.py, resolve_alias() (around line 331) does a reverse lookup by iterating all DIRECT_ALIASES and returning the first entry where da.model == key:

for alias_name, da in DIRECT_ALIASES.items():
    if da.model.lower() == key:
        return (da.provider, da.model, alias_name)

This doesn't consider the current_provider / target provider parameter. In PATH A of switch_model() (line 535), when explicit_provider is given:

alias_result = resolve_alias(new_model, target_provider)
if alias_result is not None:
    _, new_model, resolved_alias = alias_result

The returned resolved_alias may belong to a different provider. Later, DIRECT_ALIASES.get(resolved_alias) retrieves the wrong base_url, overwriting the correct one from resolve_runtime_provider().

Suggested Fix

In switch_model() PATH A, validate that the resolved alias's provider matches the target:

alias_result = resolve_alias(new_model, target_provider)
if alias_result is not None:
    _alias_prov, new_model, resolved_alias = alias_result
    if _alias_prov and target_provider and _alias_prov != target_provider:
        resolved_alias = ""
        logger.debug(
            'Alias resolve mismatch: wanted %s, got %s — discarding alias override',
            target_provider, _alias_prov,
        )

Alternatively, resolve_alias() itself could filter by provider during the reverse lookup.

Impact

High — causes 401 errors when the wrong provider's API key is used, and the user has no indication that the wrong provider was selected. The model picker card shows the correct provider but the actual API call goes to a different one.

Environment

• Hermes agent version: 1acf81fd (Apr 13, 2026)
• Platform: Feishu channel, also affects CLI