Summary

Two related bugs prevented users from reliably switching providers via hermes model and /model:

Bug 1: OPENAI_BASE_URL poisons OpenRouter resolution

When a user has a custom endpoint (OPENAI_BASE_URL set) and tries /model openrouter:anthropic/claude-opus-4.6, the runtime provider resolution picks up OPENAI_BASE_URL instead of the OpenRouter URL. Model validation probes the wrong API and rejects valid models.

Fix: Skip OPENAI_BASE_URL in the URL resolution chain when the user explicitly requests openrouter.

Bug 2: Provider never saved to config after model selection

_save_model_choice() could save config.model as a plain string (not a dict). All five _model_flow_* functions then checked isinstance(model, dict) before writing the provider — which silently failed on strings. With no provider in config, resolve_requested_provider() fell through to "auto" detection, which would pick up stale credentials (e.g. Codex desktop app tokens) instead of the user's explicit choice.

Fix:

• _save_model_choice() now always saves in dict format: {"default": model_id}
• All 5 flow functions normalize string→dict before writing provider (safety net)

Files Changed

• hermes_cli/runtime_provider.py — skip OPENAI_BASE_URL for explicit openrouter
• hermes_cli/auth.py — _save_model_choice always uses dict format
• hermes_cli/main.py — 5 flow functions hardened
• tests/test_runtime_provider_resolution.py — 1 regression test
• tests/test_model_provider_persistence.py — 3 regression tests

Test Plan

• 2873 tests pass (4 new)
• Verified: selecting Kimi via hermes model now correctly persists provider: kimi-coding to config even when config.model started as a plain string
• Verified: /model openrouter:model works correctly when OPENAI_BASE_URL is set to a custom endpoint