Summary

Section 1 of list_authenticated_providers (the api_key auth path in hermes_cli/model_switch.py) was checking:

if store and hermes_id in store.get("credential_pool", {}):
    has_creds = True

This gave false positives for entries whose value is an empty list — a state that occurs naturally after credential rotation or partial seeding. The picker therefore surfaced providers the user never authenticated to (huggingface, opencode-go, minimax / minimax-cn, zai, …). Selecting one of those routes every turn at a dead endpoint and 401s.

Sister fix 46072425f closed the same class of bug in sections 2 and 2b but missed section 1. (PR #20703 tried to paper over the symptom with a config-side allowlist; that's been closed in favor of this focused fix.)

Fix

Drop the key-presence test on the auth store and use the same pattern already used elsewhere in the function:

from agent.credential_pool import load_pool
pool = load_pool(hermes_id)
if pool.has_credentials():
    has_creds = True

load_pool().has_credentials() checks that real credentials exist (env vars, singletons, and pool entries, with the usual seeding paths) — empty lists no longer leak through.

Tests

• New: tests/hermes_cli/test_picker_empty_credential_pool.py
  • Empty credential_pool['huggingface'] = [] ⇒ NOT in returned slugs.
  • Pool reports real creds ⇒ row appears.
• Updated test_mapped_provider_credential_pool_visibility (in test_overlay_slug_resolution.py) to validate via the new pool path instead of the leaky bandaid it previously asserted.
• Full target run: tests/hermes_cli/ -k 'model_switch or picker or list_auth or overlay' → 185 passed.

Scope

• No new public APIs.
• Single-function change inside list_authenticated_providers.
• Mirrors the approach already shipped in sections 2 / 2b.