Summary

• Pass the current CLI model into runtime credential resolution.
• Keep fallback credential resolution aligned with the fallback model being selected.
• Add regression coverage for mid-session /model switches that require a non-default api_mode.

Root cause

HermesCLI._ensure_runtime_credentials() re-resolved provider credentials without passing the active model. Providers whose transport depends on the selected model could therefore recompute api_mode from stale persisted config instead of the current /model selection.

Fix

Forward target_model=self.model during normal runtime resolution and target_model=_fb_model when falling through to an auth fallback.

Regression coverage

Added tests/cli/test_runtime_credentials.py to assert that _ensure_runtime_credentials() passes the active model to resolve_runtime_provider() and invalidates the cached agent when routing changes.

Testing

• scripts/run_tests.sh tests/cli/test_runtime_credentials.py -q
• scripts/run_tests.sh tests/cli/test_runtime_credentials.py tests/hermes_cli/test_runtime_provider_resolution.py -q

Closes #17574