Problem

Currently hermes model / /model shows all providers from the hardcoded _PROVIDER_MODELS catalog, regardless of whether the user has credentials configured for them.

This means:

• Unconfigured providers pollute the list. OpenRouter, Anthropic, Copilot, MiniMax, etc. all appear even when the user only has DEEPSEEK_API_KEY set. Selecting them silently fails or throws auth errors.
• The user cannot control what appears. There is no allowlist, no models block in config.yaml to restrict the picker.
• OpenRouter is hardcoded as a first-class provider in the source. Users who don't use OpenRouter cannot remove it from their model list.
• The current workaround is manual: users must remember which providers they have keys for and avoid selecting the others. No UI indication of "unconfigured" in the picker.

Related issues:

• [Feature Request] Filter unconfigured providers from model selection UI #15267 — Filter unconfigured providers from model selection UI
• [Feature]: Make /model autocomplete provider-aware and authenticated-only #14352 — Make /model autocomplete provider-aware and authenticated-only
• fix(model): sort configured providers first in hermes model wizard #3227 — Sort configured providers first (partial fix, still shows all unconfigured)

OpenClaw solves this elegantly with agents.defaults.models — an explicit allowlist:

{
  "agents": {
    "defaults": {
      "models": {
        "deepseek/deepseek-v4-pro": {},
        "deepseek/deepseek-chat": {}
      }
    }
  }
}

Only listed models appear in /model.

Proposed Solution

Add a model.allowlist section to config.yaml:

model:
  provider: deepseek
  model: deepseek-v4-pro
  allowlist:
    - deepseek/deepseek-v4-pro
    - deepseek/deepseek-chat

Behavior:

1. If allowlist is set → /model only shows those entries. Providers with zero allowed models are hidden.
2. If allowlist is not set → current behavior (backward compatible; optionally sort configured-first as per fix(model): sort configured providers first in hermes model wizard #3227).
3. hermes model interactive picker respects the allowlist.
4. Gateway /model slash command respects the allowlist.

Why sorting alone (#3227) is insufficient

Sorting configured providers first helps, but:

• The list is still 20+ entries for a user with 1–2 API keys.
• Users must scroll past irrelevant entries every time.
• No way to permanently hide a provider you explicitly don't want.

Scope

• config.yaml schema: model.allowlist
• CLI hermes model / TUI /model picker respects allowlist
• Gateway /model slash command respects allowlist
• Documentation update