hermes-web-ui 0.3.6 → 0.3.7

package/dist/client/assets/{sessions-C4bnNvzS.js → sessions-C0kvgvBm.js}

@@ -1 +1 @@
-import{o as e}from"./router-C-NNJUuf.js";async function t(t,n){let r=new URLSearchParams;t&&r.set(`source`,t),n&&r.set(`limit`,String(n));let i=r.toString();return(await e(`/api/hermes/sessions${i?`?${i}`:``}`)).sessions}async function n(t){try{return(await e(`/api/hermes/sessions/${t}`)).session}catch{return null}}async function r(t){try{return await e(`/api/hermes/sessions/${t}`,{method:`DELETE`}),!0}catch{return!1}}async function i(t,n){try{return await e(`/api/hermes/sessions/${t}/rename`,{method:`POST`,body:JSON.stringify({title:n})}),!0}catch{return!1}}export{i,n,t as r,r as t};
+import{o as e}from"./router-Dj-Nmg7q.js";async function t(t,n){let r=new URLSearchParams;t&&r.set(`source`,t),n&&r.set(`limit`,String(n));let i=r.toString();return(await e(`/api/hermes/sessions${i?`?${i}`:``}`)).sessions}async function n(t){try{return(await e(`/api/hermes/sessions/${t}`)).session}catch{return null}}async function r(t){try{return await e(`/api/hermes/sessions/${t}`,{method:`DELETE`}),!0}catch{return!1}}async function i(t,n){try{return await e(`/api/hermes/sessions/${t}/rename`,{method:`POST`,body:JSON.stringify({title:n})}),!0}catch{return!1}}export{i,n,t as r,r as t};

package/dist/client/assets/{skills-B4slZfeZ.js → skills-G7EoEvdS.js}

@@ -1 +1 @@
-import{o as e}from"./router-C-NNJUuf.js";async function t(){return(await e(`/api/hermes/skills`)).categories}async function n(t){return(await e(`/api/hermes/skills/${t}`)).content}async function r(t,n){return(await e(`/api/hermes/skills/${t}/${n}/files`)).files}async function i(){return e(`/api/hermes/memory`)}async function a(t,n){await e(`/api/hermes/memory`,{method:`POST`,body:JSON.stringify({section:t,content:n})})}async function o(t,n){await e(`/api/hermes/skills/toggle`,{method:`PUT`,body:JSON.stringify({name:t,enabled:n})})}export{a,t as i,n,o,r,i as t};
+import{o as e}from"./router-Dj-Nmg7q.js";async function t(){return(await e(`/api/hermes/skills`)).categories}async function n(t){return(await e(`/api/hermes/skills/${t}`)).content}async function r(t,n){return(await e(`/api/hermes/skills/${t}/${n}/files`)).files}async function i(){return e(`/api/hermes/memory`)}async function a(t,n){await e(`/api/hermes/memory`,{method:`POST`,body:JSON.stringify({section:t,content:n})})}async function o(t,n){await e(`/api/hermes/skills/toggle`,{method:`PUT`,body:JSON.stringify({name:t,enabled:n})})}export{a,t as i,n,o,r,i as t};

package/dist/client/assets/{use-message-BIpqgDet.js → use-message-BgToAqhv.js}

@@ -1 +1 @@
-import{F as e}from"./router-C-NNJUuf.js";import{$ as t,Y as n}from"./browser-Djp4tkp3.js";var r=t(`n-message-api`),i=t(`n-message-provider`);function a(){let t=e(r,null);return t===null&&n(`use-message`,"No outer <n-message-provider /> founded. See prerequisite in https://www.naiveui.com/en-US/os-theme/components/message for more details. If you want to use `useMessage` outside setup, please check https://www.naiveui.com/zh-CN/os-theme/components/message#Q-&-A."),t}export{r as n,i as r,a as t};
+import{F as e}from"./router-Dj-Nmg7q.js";import{$ as t,Y as n}from"./browser-CQRjhbaB.js";var r=t(`n-message-api`),i=t(`n-message-provider`);function a(){let t=e(r,null);return t===null&&n(`use-message`,"No outer <n-message-provider /> founded. See prerequisite in https://www.naiveui.com/en-US/os-theme/components/message for more details. If you want to use `useMessage` outside setup, please check https://www.naiveui.com/zh-CN/os-theme/components/message#Q-&-A."),t}export{r as n,i as r,a as t};

package/dist/client/assets/{useTheme-B78N9tyz.js → useTheme-BUShiwRu.js}

@@ -1 +1 @@
-import{X as e,ct as t}from"./router-C-NNJUuf.js";var n=`hermes_theme`,r=t(localStorage.getItem(n)||`system`),i=t(!1);function a(e){i.value=e,document.documentElement.classList.toggle(`dark`,e)}function o(e){return e===`system`?window.matchMedia(`(prefers-color-scheme: dark)`).matches:e===`dark`}a(o(r.value)),window.matchMedia(`(prefers-color-scheme: dark)`).addEventListener(`change`,()=>{r.value===`system`&&a(o(`system`))}),e(r,e=>{localStorage.setItem(n,e),a(o(e))});function s(){function e(e){r.value=e}function t(){r.value=i.value?`light`:`dark`}return{mode:r,isDark:i,setMode:e,toggleTheme:t}}export{s as t};
+import{X as e,ct as t}from"./router-Dj-Nmg7q.js";var n=`hermes_theme`,r=t(localStorage.getItem(n)||`system`),i=t(!1);function a(e){i.value=e,document.documentElement.classList.toggle(`dark`,e)}function o(e){return e===`system`?window.matchMedia(`(prefers-color-scheme: dark)`).matches:e===`dark`}a(o(r.value)),window.matchMedia(`(prefers-color-scheme: dark)`).addEventListener(`change`,()=>{r.value===`system`&&a(o(`system`))}),e(r,e=>{localStorage.setItem(n,e),a(o(e))});function s(){function e(e){r.value=e}function t(){r.value=i.value?`light`:`dark`}return{mode:r,isDark:i,setMode:e,toggleTheme:t}}export{s as t};

package/dist/client/index.html

@@ -6,36 +6,36 @@
   <link rel="icon" type="image/svg+xml" href="/favicon.ico" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <title>Hermes</title>
-  <script type="module" crossorigin src="/assets/index-D12ukDT7.js"></script>
-  <link rel="modulepreload" crossorigin href="/assets/router-C-NNJUuf.js">
-  <link rel="modulepreload" crossorigin href="/assets/_plugin-vue_export-helper-CnosYBkx.js">
-  <link rel="modulepreload" crossorigin href="/assets/browser-Djp4tkp3.js">
-  <link rel="modulepreload" crossorigin href="/assets/fade-in.cssr-CIVyTG6A.js">
-  <link rel="modulepreload" crossorigin href="/assets/Suffix-3xK0KZGt.js">
-  <link rel="modulepreload" crossorigin href="/assets/Close-C9xwy-pW.js">
-  <link rel="modulepreload" crossorigin href="/assets/Popover-Cu52vG3D.js">
-  <link rel="modulepreload" crossorigin href="/assets/Button-CrrCCorI.js">
-  <link rel="modulepreload" crossorigin href="/assets/Tag-Dmbj68Ki.js">
+  <script type="module" crossorigin src="/assets/index-Tg6M43Om.js"></script>
+  <link rel="modulepreload" crossorigin href="/assets/router-Dj-Nmg7q.js">
+  <link rel="modulepreload" crossorigin href="/assets/_plugin-vue_export-helper-Cnn0Z73x.js">
+  <link rel="modulepreload" crossorigin href="/assets/browser-CQRjhbaB.js">
+  <link rel="modulepreload" crossorigin href="/assets/fade-in.cssr-lwO9nLky.js">
+  <link rel="modulepreload" crossorigin href="/assets/Suffix-DgzfIwzx.js">
+  <link rel="modulepreload" crossorigin href="/assets/Close-CKHcXisf.js">
+  <link rel="modulepreload" crossorigin href="/assets/Popover-mIRPCy7U.js">
+  <link rel="modulepreload" crossorigin href="/assets/Button-EoeZgIFH.js">
+  <link rel="modulepreload" crossorigin href="/assets/Tag-B2zrHMmZ.js">
   <link rel="modulepreload" crossorigin href="/assets/create-5zWq3BEB.js">
-  <link rel="modulepreload" crossorigin href="/assets/Select-BHc7u-Yf.js">
-  <link rel="modulepreload" crossorigin href="/assets/Warning-kBbRMAif.js">
-  <link rel="modulepreload" crossorigin href="/assets/Modal-B2zvXTrk.js">
-  <link rel="modulepreload" crossorigin href="/assets/Input-ChENEW-Z.js">
-  <link rel="modulepreload" crossorigin href="/assets/light-KCEDTUGE.js">
+  <link rel="modulepreload" crossorigin href="/assets/Select-uZBC8HC2.js">
+  <link rel="modulepreload" crossorigin href="/assets/Warning-CXXqHzLa.js">
+  <link rel="modulepreload" crossorigin href="/assets/Modal-C5-Iw50K.js">
+  <link rel="modulepreload" crossorigin href="/assets/Input-Bk7XdoG-.js">
+  <link rel="modulepreload" crossorigin href="/assets/light-Dx6qj2pM.js">
   <link rel="modulepreload" crossorigin href="/assets/omit-1BRB6K75.js">
-  <link rel="modulepreload" crossorigin href="/assets/pinia-iHE5_ZXa.js">
-  <link rel="modulepreload" crossorigin href="/assets/profiles-CJCR84uQ.js">
-  <link rel="modulepreload" crossorigin href="/assets/sessions-C4bnNvzS.js">
-  <link rel="modulepreload" crossorigin href="/assets/app-BT9yU6N6.js">
-  <link rel="modulepreload" crossorigin href="/assets/chat-DlC9S9DK.js">
-  <link rel="modulepreload" crossorigin href="/assets/light-BJ96fCLC.js">
-  <link rel="modulepreload" crossorigin href="/assets/use-message-BIpqgDet.js">
-  <link rel="modulepreload" crossorigin href="/assets/light-BPqyaxve.js">
-  <link rel="modulepreload" crossorigin href="/assets/light-D9G2GshF.js">
+  <link rel="modulepreload" crossorigin href="/assets/pinia-Dp_b1vdW.js">
+  <link rel="modulepreload" crossorigin href="/assets/profiles-CNTHYFZE.js">
+  <link rel="modulepreload" crossorigin href="/assets/sessions-C0kvgvBm.js">
+  <link rel="modulepreload" crossorigin href="/assets/app-BMobzABI.js">
+  <link rel="modulepreload" crossorigin href="/assets/chat-BIdq6ZXF.js">
+  <link rel="modulepreload" crossorigin href="/assets/light-DZ0Ns16h.js">
+  <link rel="modulepreload" crossorigin href="/assets/use-message-BgToAqhv.js">
+  <link rel="modulepreload" crossorigin href="/assets/light-DzpNsLai.js">
+  <link rel="modulepreload" crossorigin href="/assets/light-oE8MEiWL.js">
   <link rel="modulepreload" crossorigin href="/assets/_common-Yp55QE79.js">
-  <link rel="modulepreload" crossorigin href="/assets/light-CSp9-LhE.js">
-  <link rel="modulepreload" crossorigin href="/assets/light-BF6E9z0k.js">
-  <link rel="modulepreload" crossorigin href="/assets/useTheme-B78N9tyz.js">
+  <link rel="modulepreload" crossorigin href="/assets/light-CjCy-Dkn.js">
+  <link rel="modulepreload" crossorigin href="/assets/light-DgIst23O.js">
+  <link rel="modulepreload" crossorigin href="/assets/useTheme-BUShiwRu.js">
   <link rel="modulepreload" crossorigin href="/assets/logo-Cd-t_oGE.js">
   <link rel="stylesheet" crossorigin href="/assets/index-BEcRccNA.css">
 </head>

package/dist/server/routes/hermes/filesystem.js

@@ -39,6 +39,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.fsRoutes = void 0;
 const router_1 = __importDefault(require("@koa/router"));
 const promises_1 = require("fs/promises");
+const fs_1 = require("fs");
 const path_1 = require("path");
 const js_yaml_1 = __importDefault(require("js-yaml"));
 const hermes_profile_1 = require("../../services/hermes/hermes-profile");
@@ -46,26 +47,25 @@ const hermesCli = __importStar(require("../../services/hermes/hermes-cli"));
 // --- Provider env var mapping (from hermes providers.py HERMES_OVERLAYS + config.py) ---
 // Maps provider key → { api_key_envs: all env var aliases for API key, base_url_env: env var for base URL }
 const PROVIDER_ENV_MAP = {
-    openrouter: { api_key_env: 'OPENROUTER_API_KEY', base_url_env: 'OPENROUTER_BASE_URL' },
-    zai: { api_key_env: 'ZAI_API_KEY', base_url_env: '' },
-    'kimi-coding': { api_key_env: 'KIMI_API_KEY', base_url_env: '' },
-    'kimi-coding-cn': { api_key_env: 'KIMI_API_KEY', base_url_env: '' },
-    moonshot: { api_key_env: 'MOONSHOT_API_KEY', base_url_env: 'MOONSHOT_BASE_URL' },
-    minimax: { api_key_env: 'MINIMAX_API_KEY', base_url_env: 'MINIMAX_BASE_URL' },
-    'minimax-cn': { api_key_env: 'MINIMAX_API_KEY', base_url_env: 'MINIMAX_CN_BASE_URL' },
-    deepseek: { api_key_env: 'DEEPSEEK_API_KEY', base_url_env: 'DEEPSEEK_BASE_URL' },
-    alibaba: { api_key_env: 'DASHSCOPE_API_KEY', base_url_env: 'DASHSCOPE_BASE_URL' },
+    openrouter: { api_key_env: 'OPENROUTER_API_KEY', base_url_env: '' },
+    zai: { api_key_env: 'GLM_API_KEY', base_url_env: '' },
+    'kimi-coding-cn': { api_key_env: 'KIMI_CN_API_KEY', base_url_env: '' },
+    moonshot: { api_key_env: 'MOONSHOT_API_KEY', base_url_env: '' },
+    minimax: { api_key_env: 'MINIMAX_API_KEY', base_url_env: '' },
+    'minimax-cn': { api_key_env: 'MINIMAX_CN_API_KEY', base_url_env: '' },
+    deepseek: { api_key_env: 'DEEPSEEK_API_KEY', base_url_env: '' },
+    alibaba: { api_key_env: 'DASHSCOPE_API_KEY', base_url_env: '' },
     anthropic: { api_key_env: 'ANTHROPIC_API_KEY', base_url_env: '' },
-    xai: { api_key_env: 'XAI_API_KEY', base_url_env: 'XAI_BASE_URL' },
-    xiaomi: { api_key_env: 'XIAOMI_API_KEY', base_url_env: 'XIAOMI_BASE_URL' },
+    xai: { api_key_env: 'XAI_API_KEY', base_url_env: '' },
+    xiaomi: { api_key_env: 'XIAOMI_API_KEY', base_url_env: '' },
     gemini: { api_key_env: 'GEMINI_API_KEY', base_url_env: '' },
-    kilocode: { api_key_env: 'KILO_API_KEY', base_url_env: 'KILOCODE_BASE_URL' },
+    kilocode: { api_key_env: 'KILO_API_KEY', base_url_env: '' },
     'ai-gateway': { api_key_env: 'AI_GATEWAY_API_KEY', base_url_env: '' },
-    'opencode-zen': { api_key_env: 'OPENCODE_API_KEY', base_url_env: 'OPENCODE_ZEN_BASE_URL' },
-    'opencode-go': { api_key_env: 'OPENCODE_API_KEY', base_url_env: 'OPENCODE_GO_BASE_URL' },
-    huggingface: { api_key_env: 'HF_TOKEN', base_url_env: 'HF_BASE_URL' },
+    'opencode-zen': { api_key_env: 'OPENCODE_API_KEY', base_url_env: '' },
+    'opencode-go': { api_key_env: 'OPENCODE_API_KEY', base_url_env: '' },
+    huggingface: { api_key_env: 'HF_TOKEN', base_url_env: '' },
     arcee: { api_key_env: 'ARCEE_API_KEY', base_url_env: '' },
-    'openai-codex': { api_key_env: '', base_url_env: 'HERMES_CODEX_BASE_URL' },
+    'openai-codex': { api_key_env: '', base_url_env: '' },
 };
 async function saveEnvValue(key, value) {
     const envPath = (0, hermes_profile_1.getActiveEnvPath)();
@@ -105,19 +105,7 @@ async function saveEnvValue(key, value) {
     let output = result.join('\n').replace(/\n{3,}/g, '\n\n').replace(/\n+$/, '') + '\n';
     await (0, promises_1.writeFile)(envPath, output, 'utf-8');
 }
-const authPath = () => (0, hermes_profile_1.getActiveAuthPath)();
-async function loadAuthJson() {
-    try {
-        const raw = await (0, promises_1.readFile)(authPath(), 'utf-8');
-        return JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-}
-async function saveAuthJson(auth) {
-    await (0, promises_1.writeFile)(authPath(), JSON.stringify(auth, null, 2) + '\n', 'utf-8');
-}
+// --- Auth / Credential Pool ---
 async function fetchProviderModels(baseUrl, apiKey) {
     try {
         const url = baseUrl.replace(/\/+$/, '') + '/models';
@@ -126,12 +114,12 @@ async function fetchProviderModels(baseUrl, apiKey) {
             signal: AbortSignal.timeout(8000),
         });
         if (!res.ok) {
-            console.error(`[available-models] ${baseUrl} returned ${res.status}`);
+            console.warn(`[available-models] ${baseUrl} returned ${res.status}`);
             return [];
         }
         const data = await res.json();
         if (!Array.isArray(data.data)) {
-            console.error(`[available-models] ${baseUrl} returned unexpected format`);
+            console.warn(`[available-models] ${baseUrl} returned unexpected format`);
             return [];
         }
         return data.data.map(m => m.id).sort();
@@ -422,17 +410,11 @@ function buildModelGroups(config) {
             groups.push({ provider: 'Custom', models: customModels });
         }
     }
-    // 3. Add current default model (if not already in custom_providers)
-    if (defaultModel && !allModelIds.has(defaultModel)) {
-        groups.unshift({ provider: 'Current', models: [{ id: defaultModel, label: defaultModel }] });
-    }
     return { default: defaultModel, groups };
 }
-// GET /api/available-models — fetch models from all credential pool endpoints
+// GET /api/available-models — resolve models from .env authorized providers + credential pool + custom providers
 exports.fsRoutes.get('/api/hermes/available-models', async (ctx) => {
     try {
-        const auth = await loadAuthJson();
-        const pool = auth?.credential_pool || {};
         const config = await readConfigYaml();
         const modelSection = config.model;
         let currentDefault = '';
@@ -444,125 +426,122 @@ exports.fsRoutes.get('/api/hermes/available-models', async (ctx) => {
         else if (typeof modelSection === 'string') {
             currentDefault = modelSection.trim();
         }
-        // Collect unique endpoints from credential pool
-        const endpoints = [];
-        const seenUrls = new Set();
-        for (const [providerKey, entries] of Object.entries(pool)) {
-            if (!Array.isArray(entries) || entries.length === 0)
-                continue;
-            const entry = entries.find(e => e.last_status !== 'exhausted') || entries[0];
-            if (!entry?.base_url || !entry?.access_token)
-                continue;
-            const baseUrl = entry.base_url.replace(/\/+$/, '');
-            if (seenUrls.has(baseUrl))
-                continue;
-            seenUrls.add(baseUrl);
-            endpoints.push({
-                key: providerKey,
-                label: providerKey.replace(/^custom:/, '') || entry.label || baseUrl,
-                base_url: baseUrl,
-                token: entry.access_token,
-            });
-        }
-        // Resolve models: hardcoded catalog first, live probe as fallback
         const groups = [];
-        const liveEndpoints = [];
-        for (const ep of endpoints) {
-            const catalogModels = PROVIDER_MODEL_CATALOG[ep.key];
-            if (catalogModels && catalogModels.length > 0) {
-                groups.push({ provider: ep.key, label: ep.label, base_url: ep.base_url, models: catalogModels });
-            }
-            else {
-                liveEndpoints.push(ep);
-            }
-        }
-        if (liveEndpoints.length > 0) {
-            const results = await Promise.allSettled(liveEndpoints.map(async (ep) => {
-                const models = await fetchProviderModels(ep.base_url, ep.token);
-                return { ...ep, models };
-            }));
-            for (const result of results) {
-                if (result.status === 'fulfilled' && result.value.models.length > 0) {
-                    const { key, label, base_url, models } = result.value;
-                    groups.push({ provider: key, label, base_url, models: Array.from(new Set(models)) });
-                }
-                else if (result.status === 'rejected') {
-                    console.error(`[available-models] Failed: ${result.reason?.message || result.reason}`);
-                }
+        const seenProviders = new Set();
+        // 1. Read .env to discover authorized providers via PROVIDER_ENV_MAP
+        let envContent = '';
+        try {
+            envContent = await (0, promises_1.readFile)((0, hermes_profile_1.getActiveEnvPath)(), 'utf-8');
+        }
+        catch { }
+        const envHasValue = (key) => {
+            if (!key)
+                return false;
+            const match = envContent.match(new RegExp(`^${key}\\s*=\\s*(.+)`, 'm'));
+            return !!match && match[1].trim() !== '' && !match[1].trim().startsWith('#');
+        };
+        const envGetValue = (key) => {
+            if (!key)
+                return '';
+            const match = envContent.match(new RegExp(`^${key}\\s*=\\s*(.+)`, 'm'));
+            return match?.[1]?.trim() || '';
+        };
+        const addGroup = (provider, label, base_url, models, api_key) => {
+            if (seenProviders.has(provider))
+                return;
+            seenProviders.add(provider);
+            groups.push({ provider, label, base_url, models: [...models], api_key });
+        };
+        // Import PROVIDER_PRESETS for label + base_url lookup
+        const { PROVIDER_PRESETS } = await Promise.resolve().then(() => __importStar(require('../../shared/providers')));
+        // 1. Authorized providers from .env + OAuth-based providers (no api_key_env)
+        // Check OAuth auth (e.g. openai-codex) via auth.json
+        const isOAuthAuthorized = (providerKey) => {
+            try {
+                const authPath = (0, hermes_profile_1.getActiveAuthPath)();
+                if (!(0, fs_1.existsSync)(authPath))
+                    return false;
+                const auth = JSON.parse((0, fs_1.readFileSync)(authPath, 'utf-8'));
+                return !!auth.providers?.[providerKey]?.tokens?.access_token;
             }
-        }
-        // Deduplicate models within each group and merge groups with the same provider key
-        const dedupedGroups = [];
-        const seenProviders = new Map();
-        for (const g of groups) {
-            g.models = Array.from(new Set(g.models));
-            const existingIdx = seenProviders.get(g.provider);
-            if (existingIdx !== undefined) {
-                // Merge models into existing group
-                const existing = dedupedGroups[existingIdx];
-                const existingSet = new Set(existing.models);
-                for (const m of g.models) {
-                    if (!existingSet.has(m))
-                        existing.models.push(m);
-                }
+            catch {
+                return false;
             }
-            else {
-                seenProviders.set(g.provider, dedupedGroups.length);
-                dedupedGroups.push(g);
+        };
+        for (const [providerKey, envMapping] of Object.entries(PROVIDER_ENV_MAP)) {
+            // Skip providers that require API key but don't have one configured
+            if (envMapping.api_key_env && !envHasValue(envMapping.api_key_env))
+                continue;
+            // Skip OAuth providers that haven't been authenticated
+            if (!envMapping.api_key_env && !isOAuthAuthorized(providerKey))
+                continue;
+            const preset = PROVIDER_PRESETS.find(p => p.value === providerKey);
+            const label = preset?.label || providerKey.replace(/^custom:/, '');
+            const baseUrl = preset?.base_url || '';
+            const catalogModels = PROVIDER_MODEL_CATALOG[providerKey];
+            if (catalogModels && catalogModels.length > 0) {
+                const apiKey = envMapping.api_key_env ? envGetValue(envMapping.api_key_env) : '';
+                addGroup(providerKey, label, baseUrl, catalogModels, apiKey);
             }
         }
-        // Merge custom_providers from config.yaml (ensures manually-input model names appear)
+        // 2. Custom providers from config.yaml — dynamically fetch models
         const customProviders = Array.isArray(config.custom_providers)
             ? config.custom_providers
             : [];
-        for (const cp of customProviders) {
-            if (!cp.base_url || !cp.model)
-                continue;
+        const customFetches = await Promise.allSettled(customProviders.map(async (cp) => {
+            if (!cp.base_url)
+                return null;
+            const providerKey = `custom:${cp.name.trim().toLowerCase().replace(/ /g, '-')}`;
             const baseUrl = cp.base_url.replace(/\/+$/, '');
-            // Check if we already have a group for this base_url
-            const existing = dedupedGroups.find(g => g.base_url.replace(/\/+$/, '') === baseUrl);
-            if (existing) {
-                if (!existing.models.includes(cp.model)) {
-                    existing.models.push(cp.model);
+            let models = [cp.model]; // always include the statically configured model
+            if (cp.api_key) {
+                try {
+                    const fetched = await fetchProviderModels(baseUrl, cp.api_key);
+                    if (fetched.length > 0)
+                        models = fetched;
                 }
+                catch { }
             }
-            else {
-                dedupedGroups.push({
-                    provider: `custom:${cp.name.trim().toLowerCase().replace(/ /g, '-')}`,
-                    label: cp.name,
-                    base_url: baseUrl,
-                    models: [cp.model],
-                });
-            }
-        }
-        // Ensure config's current default model appears in the model list
-        if (currentDefault) {
-            const currentProvider = typeof config.model === 'object' ? String(config.model.provider || '').trim() : '';
-            if (currentProvider) {
-                const targetGroup = dedupedGroups.find(g => g.provider === currentProvider);
-                if (targetGroup && !targetGroup.models.includes(currentDefault)) {
-                    targetGroup.models.unshift(currentDefault);
-                }
-            }
-            else {
-                // No provider specified — add to the first group that matches via base_url
-                // or just prepend to all groups
-                let found = false;
-                for (const g of dedupedGroups) {
-                    if (!found && !g.models.includes(currentDefault)) {
-                        g.models.unshift(currentDefault);
-                        found = true;
+            return { providerKey, label: cp.name, base_url: baseUrl, models, api_key: cp.api_key || '' };
+        }));
+        for (const result of customFetches) {
+            if (result.status === 'fulfilled' && result.value) {
+                const { providerKey, label, base_url, models, api_key: cpApiKey } = result.value;
+                const existing = groups.find(g => g.base_url.replace(/\/+$/, '') === base_url);
+                if (existing) {
+                    for (const m of models) {
+                        if (!existing.models.includes(m))
+                            existing.models.push(m);
                     }
                 }
+                else {
+                    addGroup(providerKey, label, base_url, models, cpApiKey);
+                }
             }
         }
+        // Deduplicate models within each group
+        for (const g of groups) {
+            g.models = Array.from(new Set(g.models));
+        }
         // Fallback: if still no providers, fall back to config.yaml parsing
-        if (dedupedGroups.length === 0) {
+        if (groups.length === 0) {
             const fallback = buildModelGroups(config);
-            ctx.body = fallback;
+            const allProviders = PROVIDER_PRESETS.map(p => ({
+                provider: p.value,
+                label: p.label,
+                base_url: p.base_url,
+                models: p.models,
+            }));
+            ctx.body = { ...fallback, allProviders };
             return;
         }
-        ctx.body = { default: currentDefault, default_provider: currentDefaultProvider, groups: dedupedGroups };
+        const allProviders = PROVIDER_PRESETS.map(p => ({
+            provider: p.value,
+            label: p.label,
+            base_url: p.base_url,
+            models: p.models,
+        }));
+        ctx.body = { default: currentDefault, default_provider: currentDefaultProvider, groups, allProviders };
     }
     catch (err) {
         ctx.status = 500;
@@ -632,21 +611,6 @@ exports.fsRoutes.post('/api/hermes/config/providers', async (ctx) => {
             config.custom_providers.push({ name, base_url, api_key, model });
             await writeConfigYaml(config);
         }
-        // Write to auth.json credential_pool (all providers)
-        const auth = await loadAuthJson() || { credential_pool: {} };
-        if (!auth.credential_pool)
-            auth.credential_pool = {};
-        if (!auth.credential_pool[poolKey]) {
-            auth.credential_pool[poolKey] = [];
-        }
-        auth.credential_pool[poolKey].push({
-            id: `${poolKey}-${Date.now()}`,
-            label: name,
-            base_url,
-            access_token: api_key,
-            last_status: null,
-        });
-        await saveAuthJson(auth);
         // Write API key to .env (built-in providers only)
         const envMapping = PROVIDER_ENV_MAP[poolKey] || PROVIDER_ENV_MAP[providerKey || ''];
         if (envMapping) {
@@ -677,63 +641,131 @@ exports.fsRoutes.post('/api/hermes/config/providers', async (ctx) => {
         ctx.body = { error: err.message };
     }
 });
-// DELETE /api/config/providers/:poolKey
-exports.fsRoutes.delete('/api/hermes/config/providers/:poolKey', async (ctx) => {
+// PUT /api/config/providers/:poolKey — update existing provider
+exports.fsRoutes.put('/api/hermes/config/providers/:poolKey', async (ctx) => {
     const poolKey = decodeURIComponent(ctx.params.poolKey);
+    const { name, base_url, api_key, model } = ctx.request.body;
     try {
-        const auth = await loadAuthJson();
-        if (!auth?.credential_pool) {
-            ctx.status = 404;
-            ctx.body = { error: 'No credential pool found' };
-            return;
-        }
-        const keys = Object.keys(auth.credential_pool);
-        if (keys.length <= 1) {
-            ctx.status = 400;
-            ctx.body = { error: 'Cannot delete the last provider' };
-            return;
-        }
-        // Case-insensitive key lookup: normalize poolKey to match credential_pool
-        let resolvedKey = poolKey;
-        if (!(poolKey in auth.credential_pool)) {
-            const normalized = poolKey.toLowerCase();
-            const match = Object.keys(auth.credential_pool).find(k => k.toLowerCase() === normalized);
-            if (!match) {
+        const isCustom = poolKey.startsWith('custom:');
+        if (isCustom) {
+            // Update custom provider in config.yaml
+            const config = await readConfigYaml();
+            if (!Array.isArray(config.custom_providers)) {
+                ctx.status = 404;
+                ctx.body = { error: `Custom provider "${poolKey}" not found` };
+                return;
+            }
+            const entry = config.custom_providers.find((e) => {
+                const key = `custom:${e.name.trim().toLowerCase().replace(/ /g, '-')}`;
+                return key === poolKey;
+            });
+            if (!entry) {
                 ctx.status = 404;
-                ctx.body = { error: `Provider "${poolKey}" not found` };
+                ctx.body = { error: `Custom provider "${poolKey}" not found` };
                 return;
             }
-            resolvedKey = match;
+            if (name !== undefined)
+                entry.name = name;
+            if (base_url !== undefined)
+                entry.base_url = base_url;
+            if (api_key !== undefined)
+                entry.api_key = api_key;
+            if (model !== undefined)
+                entry.model = model;
+            await writeConfigYaml(config);
+        }
+        else {
+            // Built-in provider: update API key in .env
+            const envMapping = PROVIDER_ENV_MAP[poolKey];
+            if (!envMapping?.api_key_env) {
+                // OAuth provider — cannot update key
+                ctx.status = 400;
+                ctx.body = { error: `Cannot update credentials for "${poolKey}"` };
+                return;
+            }
+            if (api_key !== undefined) {
+                await saveEnvValue(envMapping.api_key_env, api_key);
+            }
+        }
+        // Restart gateway to pick up changes
+        try {
+            await hermesCli.restartGateway();
+        }
+        catch (e) {
+            console.error('[Provider] Gateway restart failed:', e.message);
         }
-        // Check if this is the current active provider
+        ctx.body = { success: true };
+    }
+    catch (err) {
+        ctx.status = 500;
+        ctx.body = { error: err.message };
+    }
+});
+// DELETE /api/config/providers/:poolKey
+exports.fsRoutes.delete('/api/hermes/config/providers/:poolKey', async (ctx) => {
+    const poolKey = decodeURIComponent(ctx.params.poolKey);
+    try {
         const config = await readConfigYaml();
-        const currentProvider = config.model?.provider;
-        const isCurrent = currentProvider === poolKey || currentProvider === resolvedKey;
-        // Save base_url before deleting
-        const deletedBaseUrl = auth.credential_pool[resolvedKey]?.[0]?.base_url;
-        // 1. Delete from auth.json
-        delete auth.credential_pool[resolvedKey];
-        await saveAuthJson(auth);
-        // 2. Remove matching entry from config.yaml custom_providers
-        if (deletedBaseUrl && Array.isArray(config.custom_providers)) {
-            config.custom_providers = config.custom_providers.filter((entry) => entry.base_url !== deletedBaseUrl);
+        const isCustom = poolKey.startsWith('custom:');
+        if (isCustom) {
+            // Delete from config.yaml custom_providers
+            const idx = Array.isArray(config.custom_providers)
+                ? config.custom_providers.findIndex((e) => {
+                    const key = `custom:${e.name.trim().toLowerCase().replace(/ /g, '-')}`;
+                    return key === poolKey;
+                })
+                : -1;
+            if (idx === -1) {
+                ctx.status = 404;
+                ctx.body = { error: `Custom provider "${poolKey}" not found` };
+                return;
+            }
+            config.custom_providers.splice(idx, 1);
             await writeConfigYaml(config);
         }
-        // 3. If was the current provider, switch to first remaining
+        else {
+            // Built-in provider: remove API key from .env
+            const envMapping = PROVIDER_ENV_MAP[poolKey];
+            if (envMapping?.api_key_env) {
+                await saveEnvValue(envMapping.api_key_env, '');
+            }
+            else if (!envMapping?.api_key_env) {
+                // OAuth provider (e.g. openai-codex): clear tokens from auth.json
+                try {
+                    const authPath = (0, hermes_profile_1.getActiveAuthPath)();
+                    if ((0, fs_1.existsSync)(authPath)) {
+                        const auth = JSON.parse((0, fs_1.readFileSync)(authPath, 'utf-8'));
+                        if (auth.providers?.[poolKey]) {
+                            delete auth.providers[poolKey];
+                        }
+                        if (auth.credential_pool?.[poolKey]) {
+                            delete auth.credential_pool[poolKey];
+                        }
+                        const { writeFile: wfs } = await Promise.resolve().then(() => __importStar(require('fs/promises')));
+                        await wfs(authPath, JSON.stringify(auth, null, 2) + '\n', 'utf-8');
+                    }
+                }
+                catch (err) {
+                    console.error(`[Provider] Failed to clear OAuth tokens for ${poolKey}:`, err.message);
+                }
+            }
+        }
+        // If was the current provider, switch to first remaining
+        const currentProvider = config.model?.provider;
+        const isCurrent = currentProvider === poolKey;
         if (isCurrent) {
-            const remainingKeys = Object.keys(auth.credential_pool);
-            if (remainingKeys.length > 0) {
-                const fallback = remainingKeys[0];
-                const fallbackEntry = auth.credential_pool[fallback]?.[0];
-                const catalogModels = PROVIDER_MODEL_CATALOG[fallback] || [];
-                const fallbackModel = catalogModels[0] || fallbackEntry?.label || fallback;
-                const config2 = await readConfigYaml();
-                if (typeof config2.model !== 'object' || config2.model === null) {
-                    config2.model = {};
+            // Find fallback from .env authorized providers or remaining custom_providers
+            const freshConfig = await readConfigYaml();
+            const remaining = Array.isArray(freshConfig.custom_providers) ? freshConfig.custom_providers : [];
+            const fallbackCp = remaining[0];
+            if (fallbackCp) {
+                const fallbackKey = `custom:${fallbackCp.name.trim().toLowerCase().replace(/ /g, '-')}`;
+                if (typeof freshConfig.model !== 'object' || freshConfig.model === null) {
+                    freshConfig.model = {};
                 }
-                config2.model.default = fallbackModel;
-                config2.model.provider = fallback;
-                await writeConfigYaml(config2);
+                freshConfig.model.default = fallbackCp.model;
+                freshConfig.model.provider = fallbackKey;
+                await writeConfigYaml(freshConfig);
             }
         }
         ctx.body = { success: true };