Fixes #44108

Problem

_runtime_model_config() (tui_gateway/server.py) persists the live agent's resolved provider into the session row's model_config JSON. For any named providers: / custom_providers: entry, agent.provider is the literal string "custom" — the entry name is lost, and the api_key is deliberately never persisted (credentials must keep coming from config/env, see _stored_session_runtime_overrides).

On session.resume / _reset_session_agent, the stored provider="custom" feeds resolve_runtime_provider(requested="custom"), which _get_named_custom_provider cannot match back to the named entry. Depending on config, the rebuild either raises No LLM provider configured. Run hermes model... (resume fails) or silently resolves placeholder credentials ("no-key-required") against the patched-back base_url.

Sibling of #44022 (which covers rows where model_config was never written and only the bare billing_provider column exists — that path is not changed here). Same resolved-vs-requested identity-loss family as the #44070 investigation in #44099.

Fix

Persist the requested/entry identity, not the resolved one:

• hermes_cli/runtime_provider.py: new reverse lookup find_custom_provider_identity(base_url) mapping an endpoint URL back to the canonical custom:<normalized-name> menu key (scans providers: dict and legacy custom_providers: list; trailing-slash/case tolerant). The slug form matches what a live /model switch already records via pdef.id and what _get_named_custom_provider resolves.
• tui_gateway/server.py::_runtime_model_config: when agent.provider == "custom" and the base_url maps to an entry, persist the custom:<name> key instead of the lossy "custom". Built-in providers never trigger the lookup.
• tui_gateway/server.py::_make_agent: heals rows persisted before this fix — when the stored override is provider="custom" with a base_url, recover the entry identity the same way; if no entry matches, pass the stored base_url as explicit_base_url so the direct-alias branch resolves pool/env credentials for the session's actual endpoint instead of raising auth_unavailable.

Tests

tests/tui_gateway/test_custom_provider_session_persistence.py (style mirrors the #44070 regression tests):

• _runtime_model_config persists custom:<name> for both config shapes; keeps bare "custom" when nothing matches; never persists api_key; built-ins untouched.
• Full persist → _stored_session_runtime_overrides → _make_agent round-trip through the real resolve_runtime_provider restores the entry's credentials (the exact path that raised before).
• Legacy poisoned row (provider="custom" + base_url) heals via base_url recovery; unmatched legacy row keeps its endpoint via the direct-alias branch.

tests/hermes_cli/test_custom_provider_identity.py: unit coverage for the reverse lookup, including that the returned slug round-trips through _get_named_custom_provider.

Red/green verified: 5/7 gateway tests fail on origin/main sources, all pass with the fix. tests/test_tui_gateway_server.py, tests/tui_gateway/, tests/hermes_cli/ pass (the 12 pre-existing failures there — WSL/service-manager/browser-hint, macOS environment — fail identically on pristine origin/main).

🤖 Generated with Claude Code