fix: warn on provider/model mismatch, surface auth errors (#266)

api/streaming.py

@@ -463,12 +463,29 @@ def on_tool(name, preview, args):
         # Detect rate limit errors specifically so the client can show a helpful card
         # rather than the generic "Connection lost" message
         is_rate_limit = 'rate limit' in err_str.lower() or '429' in err_str or 'RateLimitError' in type(e).__name__
+        is_auth_error = (
+            '401' in err_str
+            or 'AuthenticationError' in type(e).__name__
+            or 'authentication' in err_str.lower()
+            or 'unauthorized' in err_str.lower()
+            or 'invalid api key' in err_str.lower()
+            or 'no cookie auth credentials' in err_str.lower()
+        )
         if is_rate_limit:
             put('apperror', {
                 'message': err_str,
                 'type': 'rate_limit',
                 'hint': 'Rate limit reached. The fallback model (if configured) was also exhausted. Try again in a moment.',
             })
+        elif is_auth_error:
+            put('apperror', {
+                'message': err_str,
+                'type': 'auth_mismatch',
+                'hint': (
+                    'The selected model may not be supported by your configured provider. '
+                    'Run `hermes model` in your terminal to switch providers, then restart the WebUI.'
+                ),
+            })
         else:
             put('apperror', {'message': err_str, 'type': 'error'})
     finally:

static/boot.js

@@ -209,6 +209,11 @@ $('modelSelect').onchange=async()=>{
   localStorage.setItem('hermes-webui-model', selectedModel);
   await api('/api/session/update',{method:'POST',body:JSON.stringify({session_id:S.session.session_id,workspace:S.session.workspace,model:selectedModel})});
   S.session.model=selectedModel;syncTopbar();
+  // Warn if selected model belongs to a different provider than what Hermes is configured for
+  if(typeof _checkProviderMismatch==='function'){
+    const warn=_checkProviderMismatch(selectedModel);
+    if(warn&&typeof showToast==='function') showToast(warn,4000);
+  }
 };
 $('msg').addEventListener('input',()=>{
   autoResize();

static/i18n.js

@@ -48,6 +48,8 @@ const LOCALES = {
     n_messages: (n) => `${n} messages`,
     model_unavailable: ' (unavailable)',
     model_unavailable_title: 'This model is no longer in your current provider list',
+    provider_mismatch_warning: (m,p)=>`"${m}" may not work with your configured provider (${p}). Send anyway, or run \`hermes model\` in your terminal to switch.`,
+    provider_mismatch_label: 'Provider mismatch',
     // commands.js
     cmd_help: 'List available commands',
     cmd_clear: 'Clear conversation messages',
@@ -237,6 +239,8 @@ const LOCALES = {
     n_messages: (n) => `${n} mensajes`,
     model_unavailable: ' (no disponible)',
     model_unavailable_title: 'Este modelo ya no está en tu lista actual de proveedores',
+    provider_mismatch_warning: (m,p)=>`"${m}" puede no funcionar con tu proveedor configurado (${p}). Envía de todas formas, o ejecuta \`hermes model\` en la terminal para cambiar.`,
+    provider_mismatch_label: 'Proveedor incompatible',
     // commands.js
     cmd_help: 'Listar los comandos disponibles',
     cmd_clear: 'Borrar los mensajes de la conversación',
@@ -426,6 +430,8 @@ const LOCALES = {
     n_messages: (n) => `${n} Nachrichten`,
     model_unavailable: ' (nicht verfügbar)',
     model_unavailable_title: 'Dieses Modell ist nicht mehr in Ihrer aktuellen Provider-Liste',
+    provider_mismatch_warning: (m,p)=>`"${m}" funktioniert möglicherweise nicht mit Ihrem konfigurierten Provider (${p}). Trotzdem senden, oder \`hermes model\` im Terminal ausführen.`,
+    provider_mismatch_label: 'Provider-Konflikt',
     // commands.js
     cmd_help: 'Verfügbare Befehle auflisten',
     cmd_clear: 'Konversationsverlauf löschen',
@@ -615,6 +621,8 @@ const LOCALES = {
     n_messages: (n) => `${n} \u6761\u6d88\u606f`,
     model_unavailable: '\uff08\u4e0d\u53ef\u7528\uff09',
     model_unavailable_title: '\u8fd9\u4e2a\u6a21\u578b\u5df2\u7ecf\u4e0d\u5728\u5f53\u524d provider \u5217\u8868\u4e2d',
+    provider_mismatch_warning: (m,p)=>`\"${m}\" \u53ef\u80fd\u65e0\u6cd5\u5728\u5f53\u524d\u914d\u7f6e\u7684\u63d0\u4f9b\u5546 (${p}) \u4e0b\u5de5\u4f5c\u3002\u76f4\u63a5\u53d1\u9001\uff0c\u6216\u5728\u7ec8\u7aef\u8fd0\u884c \`hermes model\` \u5207\u6362\u3002`,
+    provider_mismatch_label: '\u63d0\u4f9b\u5546\u4e0d\u5339\u914d',
     // commands.js
     cmd_help: '\u67e5\u770b\u53ef\u7528\u547d\u4ee4',
     cmd_clear: '\u6e05\u7a7a\u5f53\u524d\u5bf9\u8bdd\u6d88\u606f',
@@ -802,6 +810,8 @@ const LOCALES = {
     n_messages: (n) => `${n} \u689d\u8a0a\u606f`,
     model_unavailable: '\uff08\u4e0d\u53ef\u7528\uff09',
     model_unavailable_title: '\u6b64\u6a21\u578b\u5df2\u7d93\u4e0d\u5728\u7576\u524d provider \u5217\u8868\u4e2d',
+    provider_mismatch_warning: (m,p)=>`\"${m}\" \u53ef\u80fd\u7121\u6cd5\u5728\u7576\u524d\u914d\u7f6e\u7684\u63d0\u4f9b\u8005 (${p}) \u4e0b\u904b\u4f5c\u3002\u5c1a\u9001\uff0c\u6216\u5728\u7d42\u7aef\u57f7\u884c \`hermes model\` \u5207\u63db\u3002`,
+    provider_mismatch_label: '\u63d0\u4f9b\u8005\u4e0d\u76f8\u7b26',
     // commands.js
     cmd_help: '\u67e5\u770b\u53ef\u7528\u547d\u4ee4',
     cmd_clear: '\u6e05\u7a7a\u7576\u524d\u5c0d\u8a71\u8a0a\u606f',

static/messages.js

@@ -234,7 +234,8 @@ async function send(){
         try{
           const d=JSON.parse(e.data);
           const isRateLimit=d.type==='rate_limit';
-          const label=isRateLimit?'Rate limit reached':'Error';
+          const isAuthMismatch=d.type==='auth_mismatch';
+          const label=isRateLimit?'Rate limit reached':isAuthMismatch?(typeof t==='function'?t('provider_mismatch_label'):'Provider mismatch'):'Error';
           const hint=d.hint?`\n\n*${d.hint}*`:'';
           S.messages.push({role:'assistant',content:`**${label}:** ${d.message}${hint}`});
         }catch(_){

static/ui.js

@@ -45,6 +45,8 @@ async function populateModelDropdown(){
   try{
     const data=await fetch(new URL('/api/models',location.origin).href,{credentials:'include'}).then(r=>r.json());
     if(!data.groups||!data.groups.length) return; // keep HTML defaults
+    // Store active provider globally so the send path can warn on mismatch
+    window._activeProvider=data.active_provider||null;
     // Clear existing options
     sel.innerHTML='';
     _dynamicModelLabels={};
@@ -70,6 +72,32 @@ async function populateModelDropdown(){
   }
 }
 
+/**
+ * Check if the given model ID belongs to a different provider than the one
+ * currently configured in Hermes. Returns a warning string if mismatched,
+ * or null if the selection looks compatible.
+ *
+ * Provider detection is intentionally loose — we compare the model's slash
+ * prefix (e.g. "openai/" from "openai/gpt-4o") against the active provider
+ * name. Custom/local endpoints report active_provider='custom' or the
+ * base_url hostname and we skip the check to avoid false positives.
+ */
+function _checkProviderMismatch(modelId){
+  const ap=(window._activeProvider||'').toLowerCase();
+  if(!ap||ap==='custom'||ap==='openrouter') return null; // can't reliably check
+  const slash=modelId.indexOf('/');
+  if(slash<0) return null; // bare model name, no provider prefix
+  const modelProvider=modelId.substring(0,slash).toLowerCase();
+  // Normalise common aliases
+  const aliases={'claude':'anthropic','gpt':'openai','gemini':'google'};
+  const norm=p=>aliases[p]||p;
+  if(norm(modelProvider)!==norm(ap)){
+    return (window.t?window.t('provider_mismatch_warning',modelId,ap):
+      `"${modelId}" may not work with your configured provider (${ap}). Send anyway or run \`hermes model\` to switch.`);
+  }
+  return null;
+}
+
 // ── Scroll pinning ──────────────────────────────────────────────────────────
 // When streaming, auto-scroll only if the user hasn't manually scrolled up.
 // Once the user scrolls back to within 80px of the bottom, re-pin.