fix: store custom provider API keys in .env instead of config.yaml

[konsisumer]

Summary

Fixes #8316 — custom providers stored API keys directly in config.yaml, unlike standard providers which use environment variables via .env.

• Adds _custom_provider_env_var() to derive a deterministic env var name from the provider URL (e.g. CUSTOM_API_SILICONFLOW_CN_API_KEY)
• _save_custom_provider() now stores an api_key_env reference in config.yaml and saves the actual key to .env via save_env_value()
• _model_flow_custom() and _model_flow_named_custom() updated to use api_key_env instead of inline api_key
• runtime_provider.py resolves api_key_env from environment at runtime
• Backward compatible: falls back to reading api_key if api_key_env is not present, and migrates legacy entries on next save

Test plan

• Add a custom provider via hermes model and verify API key appears in ~/.hermes/.env (not config.yaml)
• Verify config.yaml contains api_key_env: CUSTOM_<HOST>_API_KEY instead of api_key: <raw_key>
• Verify existing custom providers with inline api_key still work (backward compatibility)
• Verify existing custom providers get migrated to api_key_env on next save

[konsisumer]

CI failures here are pre-existing on main and not caused by this PR:

• tests/hermes_cli/test_web_server.py::TestBuildSchemaFromConfig::test_no_single_field_categories — fails on main@cf012a05 with the same Category 'code_execution' has only 1 field(s) assertion. actions/checkout on pull_request events checks out the PR merged with main, so this PR inherits the failure.
• tests/tools/test_browser_camofox_state.py::TestCamofoxConfigDefaults::test_config_version_matches_current_schema — fails on main@cf012a05 with assert 19 == 18. hermes_cli/config.py bumped _config_version to 19 on main, but the test still asserts == 18.
• nix (ubuntu-latest) — fails on main@cf012a05 too (separate npm-deps hash-mismatch / alibabacloud build issue).

The PR's own diff touches only custom-provider env handling; all 12891 other tests pass. Happy to rebase once main is green, but fixing these would be unrelated scope.

[konsisumer]

Rebased onto main and fixed both CI test failures:

• test_config_version_matches_current_schema: updated assertion from 18 to 19 (version was bumped in feat(execute_code): project/strict execution modes (default: project) #11971 on main)
• test_no_single_field_categories: added code_execution → terminal to _CATEGORY_MERGE in web_server.py — the code_execution config key was added in feat(execute_code): project/strict execution modes (default: project) #11971 with a single field (mode) but the merge map wasn't updated

The Nix check failure is a pre-existing infrastructure issue on main (alibabacloud-credentials-api missing setuptools build dep) unrelated to this PR. Local pytest: 2 previously-failing tests now pass.

---

autocontrib · pr-repair-72ce7d61 · 2026-04-19T15:52:29Z

[konsisumer]

Rebased onto main. One conflict in hermes_cli/web_server.py (_CATEGORY_MERGE["code_execution"]) — resolved by taking main's value ("agent") which already contained the fix. The previous fix(tests): update schema and config-version assertions to match main commit was dropped as empty (both _config_version == 19 and code_execution → agent were already in main). Docker build-and-push check won't run on PRs anymore after the path-filter CI update merged to main (2f67ef92). Local pytest on all PR-touched test files: 137 passed.

---

autocontrib · pr-repair-c7fd83ff · 2026-04-20T02:12:59Z

[konsisumer]

Rebased onto origin/main and fixed two pre-existing test failures that appeared on main after the last rebase:

• test_switch_to_minimax_does_not_resolve_anthropic_token: switch_model() now prunes _fallback_chain on provider change, but the test bypassed __init__ without seeding that attribute. Added _fallback_chain = [] to the manual stub.
• test_upload_encrypted_room_uses_file_payload: _upload_and_send() does from mautrix.crypto.attachments import encrypt_attachment at runtime for encrypted rooms. The test was missing patch.dict(sys.modules, _make_fake_mautrix()) — added it.

All PR-touched tests pass locally (98 tests). Remaining local failures are macOS-specific pre-existing issues (/private/var/ prefix in _SENSITIVE_PATH_PREFIXES blocking temp-dir writes) and unrelated to this PR's diff.

[alt-glitch]

Related to #4674 which proposed the same api_key_env approach. This PR appears to be a more complete implementation.

[alt-glitch]

Related to #4674.

[konsisumer]

Thanks for the pointer @alt-glitch. Looking at #4674 — @iws17's approach is cleaner: it stays focused on the feature request (add `api_key_env` support) without the broader .env migration this PR introduces. Closing in favor of #4674. Happy to see that one move forward.