phaseo setup hermes looked like it worked, but with current Hermes every request to Phaseo went out without a key. A real end-to-end test against Hermes found this, plus a second bug on Windows where the key went to a folder Hermes never reads.

What changed

• Setup now sets Hermes' model.key_env to OPENAI_API_KEY, so Hermes sends the key to Phaseo. The previous value is recorded and restored on remove.
• Setup asks Hermes where its .env is (hermes config env-path). If Hermes can't say, it falls back to HERMES_HOME, then %LOCALAPPDATA%\hermes on Windows and ~/.hermes elsewhere.
• Running setup again moves a key that an earlier version wrote to the wrong file.
• If one setting fails during removal, removal carries on, so the key still comes out of .env.
• Messages show the real path, and the "Finish setup" step is now a real step: restart Hermes sessions.
• The refusal message no longer gives manual steps that wouldn't work.
• The README and the coding-assistants guide are updated in English and all 8 locales, with translation freshness recorded.

Why

• Key not sent: Hermes only sends OPENAI_API_KEY to OpenAI's own hosts (a guard against leaking keys). For any other custom endpoint it needs model.key_env. Without it, Hermes' own resolver returned no-key-required as the key for api.phaseo.app.
• Windows path: native Windows Hermes keeps its files in %LOCALAPPDATA%\hermes. Model settings were set through hermes config set, so they landed in the right place, but the key went to ~/.hermes/.env.

How

The key stays in OPENAI_API_KEY, inside the existing managed block. I also tried writing it as PHASEO_API_KEY, which Hermes would pick up from the host name. That works, but Hermes passes PHASEO_API_KEY through to commands its agent runs, while it strips OPENAI_API_KEY. So model.key_env is the safer choice. Hermes versions without model.key_env get a clear "run hermes update" error, and setup rolls back.

Before and after (real Hermes, isolated test folder)

Verification

• pnpm --filter @phaseo/cli build and pnpm test: 170 pass, 0 fail, 3 skipped on Windows. The 3 new adapter tests use a fake hermes on PATH and run on Linux CI.
• node scripts/translation-freshness.mjs check in apps/docs: pass.
• End to end against Hermes a938f00 (editable install, isolated home, LOCALAPPDATA and HERMES_HOME, fake keys, no Phaseo API calls). Covered:
  • fresh setup and re-setup with a new key (block updated in place);
  • Hermes' own .env.example comments;
  • refusal of lines with backslashes and of a user's own OPENAI_API_KEY;
  • removal;
  • upgrade from the previous CLI build, with HERMES_HOME set and unset (the move).
• Hermes' resolve_runtime_provider() confirmed the key it would send in each case.

Proved by reproducing the missing key against real Hermes, then watching Hermes send the Phaseo key after the fix (log in the Verification section).

Reviewed with sol-loop: 1 round with gpt-6.1-sol. Sol verdict: approved

Created with Claude Opus 5.5 in Claude Code.

🤖 Generated with Claude Code