…oviders (NousResearch#5091)

Users on direct API-key providers (Alibaba, DeepSeek, ZAI, etc.) without
an OpenRouter or Nous key would get broken auxiliary tasks (compression,
vision, etc.) because _resolve_auto() only tried aggregator providers
first, then fell back to iterating PROVIDER_REGISTRY with wrong default
model names.

Now _resolve_auto() checks the user's main provider first. If it's not
an aggregator (OpenRouter/Nous), it uses their main model directly for
all auxiliary tasks. Aggregator users still get the cheap gemini-flash
model as before.

Adds _read_main_provider() to read model.provider from config.yaml,
mirroring the existing _read_main_model().

Reported by SkyLinx — Alibaba Coding Plan user getting 400 errors from
google/gemini-3-flash-preview being sent to DashScope.

…s-obsidian toolset

Merges 33 upstream commits while preserving local NixOS compatibility fixes:
- agent/auxiliary_client.py: deferred imports for get_hermes_home() and _AUTH_JSON_PATH
- agent/credential_pool.py: __getattr__ lazy-loading for hermes_cli.auth imports
- hermes_cli/config.py: lazy-load tool_backend_helpers to break circular deps

Adds hermes-obsidian toolset for Obsidian vault semantic search via ChromaDB.

Upstream highlights:
- fix: use main provider model for auxiliary tasks on non-aggregator providers (NousResearch#5091)
- feat: /model command — models.dev primary database + --provider flag (NousResearch#5181)
- feat(gateway): live-stream /update output + interactive prompt buttons (NousResearch#5180)
- fix(telegram): prevent duplicate message delivery on send timeout (NousResearch#5153)
- 54 new web design templates in popular-web-designs skill
- gitnexus-explorer skill for GitHub/GitLab reconnaissance

…sResearch#5091 follow-up)

PR NousResearch#5091 fixed _resolve_auto() so that users on non-aggregator providers
(Alibaba, DeepSeek, ZAI, Gemini Direct, etc.) have their main provider
used for auxiliary tasks instead of silently failing.

However, resolve_vision_provider_client() has its own "auto" routing
path that was NOT updated. It only checks _VISION_AUTO_PROVIDER_ORDER
(openrouter, nous, openai-codex, anthropic, custom) and promotes the
main provider only when it already belongs to that list — so non-aggregator
providers were skipped entirely, causing the vision tool to always fail
for those users ("vision tool keep failing").

Fix: mirror the same non-aggregator check that _resolve_auto() received
in NousResearch#5091, inserted before the _VISION_AUTO_PROVIDER_ORDER loop in the
"auto" branch of resolve_vision_provider_client(). If the user's main
provider is not an aggregator and not already in _VISION_AUTO_PROVIDER_ORDER,
we attempt it via resolve_provider_client() first.

Closes NousResearch#5366

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…oviders (NousResearch#5091)

Users on direct API-key providers (Alibaba, DeepSeek, ZAI, etc.) without
an OpenRouter or Nous key would get broken auxiliary tasks (compression,
vision, etc.) because _resolve_auto() only tried aggregator providers
first, then fell back to iterating PROVIDER_REGISTRY with wrong default
model names.

Now _resolve_auto() checks the user's main provider first. If it's not
an aggregator (OpenRouter/Nous), it uses their main model directly for
all auxiliary tasks. Aggregator users still get the cheap gemini-flash
model as before.

Adds _read_main_provider() to read model.provider from config.yaml,
mirroring the existing _read_main_model().

Reported by SkyLinx — Alibaba Coding Plan user getting 400 errors from
google/gemini-3-flash-preview being sent to DashScope.

…oviders (NousResearch#5091)

Users on direct API-key providers (Alibaba, DeepSeek, ZAI, etc.) without
an OpenRouter or Nous key would get broken auxiliary tasks (compression,
vision, etc.) because _resolve_auto() only tried aggregator providers
first, then fell back to iterating PROVIDER_REGISTRY with wrong default
model names.

Now _resolve_auto() checks the user's main provider first. If it's not
an aggregator (OpenRouter/Nous), it uses their main model directly for
all auxiliary tasks. Aggregator users still get the cheap gemini-flash
model as before.

Adds _read_main_provider() to read model.provider from config.yaml,
mirroring the existing _read_main_model().

Reported by SkyLinx — Alibaba Coding Plan user getting 400 errors from
google/gemini-3-flash-preview being sent to DashScope.

…oviders (NousResearch#5091)

Users on direct API-key providers (Alibaba, DeepSeek, ZAI, etc.) without
an OpenRouter or Nous key would get broken auxiliary tasks (compression,
vision, etc.) because _resolve_auto() only tried aggregator providers
first, then fell back to iterating PROVIDER_REGISTRY with wrong default
model names.

Now _resolve_auto() checks the user's main provider first. If it's not
an aggregator (OpenRouter/Nous), it uses their main model directly for
all auxiliary tasks. Aggregator users still get the cheap gemini-flash
model as before.

Adds _read_main_provider() to read model.provider from config.yaml,
mirroring the existing _read_main_model().

Reported by SkyLinx — Alibaba Coding Plan user getting 400 errors from
google/gemini-3-flash-preview being sent to DashScope.

…oviders (NousResearch#5091)

Users on direct API-key providers (Alibaba, DeepSeek, ZAI, etc.) without
an OpenRouter or Nous key would get broken auxiliary tasks (compression,
vision, etc.) because _resolve_auto() only tried aggregator providers
first, then fell back to iterating PROVIDER_REGISTRY with wrong default
model names.

Now _resolve_auto() checks the user's main provider first. If it's not
an aggregator (OpenRouter/Nous), it uses their main model directly for
all auxiliary tasks. Aggregator users still get the cheap gemini-flash
model as before.

Adds _read_main_provider() to read model.provider from config.yaml,
mirroring the existing _read_main_model().

Reported by SkyLinx — Alibaba Coding Plan user getting 400 errors from
google/gemini-3-flash-preview being sent to DashScope.

…oviders (NousResearch#5091)

Users on direct API-key providers (Alibaba, DeepSeek, ZAI, etc.) without
an OpenRouter or Nous key would get broken auxiliary tasks (compression,
vision, etc.) because _resolve_auto() only tried aggregator providers
first, then fell back to iterating PROVIDER_REGISTRY with wrong default
model names.

Now _resolve_auto() checks the user's main provider first. If it's not
an aggregator (OpenRouter/Nous), it uses their main model directly for
all auxiliary tasks. Aggregator users still get the cheap gemini-flash
model as before.

Adds _read_main_provider() to read model.provider from config.yaml,
mirroring the existing _read_main_model().

Reported by SkyLinx — Alibaba Coding Plan user getting 400 errors from
google/gemini-3-flash-preview being sent to DashScope.

…oviders (NousResearch#5091)

Users on direct API-key providers (Alibaba, DeepSeek, ZAI, etc.) without
an OpenRouter or Nous key would get broken auxiliary tasks (compression,
vision, etc.) because _resolve_auto() only tried aggregator providers
first, then fell back to iterating PROVIDER_REGISTRY with wrong default
model names.

Now _resolve_auto() checks the user's main provider first. If it's not
an aggregator (OpenRouter/Nous), it uses their main model directly for
all auxiliary tasks. Aggregator users still get the cheap gemini-flash
model as before.

Adds _read_main_provider() to read model.provider from config.yaml,
mirroring the existing _read_main_model().

Reported by SkyLinx — Alibaba Coding Plan user getting 400 errors from
google/gemini-3-flash-preview being sent to DashScope.