Summary

Closes #28140.

When the user removes an API-key env var (e.g. MINIMAX_CN_API_KEY) from .env, an empty credential_pool array left behind in ~/.hermes/auth.json (e.g. "minimax-cn": []) still caused the provider to appear authenticated in the /model picker.

Root cause

In hermes_cli/model_switch.py::list_authenticated_providers, the auth-store fallback checked only whether the provider key existed in the pool dict, not whether the value held any actual credentials:

if store and hermes_id in store.get("credential_pool", {}):
    has_creds = True

"minimax-cn": [] satisfies hermes_id in {...} even though the list is empty, so has_creds flipped to True with zero usable credentials, and the provider appeared in the /model picker.

Fix

Pull the list out and gate on its truthiness:

if store:
    pool_entries = store.get("credential_pool", {}).get(hermes_id) or []
    if pool_entries:
        has_creds = True

This matches the intent ("any usable credential in the pool?") and is consistent with how agent/credential_pool.py itself treats empty lists elsewhere.

Test plan

• Added 4 unit tests in tests/hermes_cli/test_credential_pool_empty.py:
  • test_empty_credential_pool_does_not_authenticate_provider — the regression case
  • test_populated_credential_pool_does_authenticate_provider — sanity check: real entries still work
  • test_missing_credential_pool_key_does_not_authenticate_provider — no entry at all → hidden
  • test_env_var_still_authenticates_even_with_empty_pool — env-var path still wins
• All 4 pass with the fix; the first one fails without it (verified true regression test)
• No other tests touched (tests/hermes_cli/test_credential_pool_empty.py is new and self-contained)