Summary

hermes doctor reports the Google Gemini API key as invalid API key, but the same key successfully authenticates against the Gemini API directly.

What I verified

From this host:

• GET https://generativelanguage.googleapis.com/v1beta/models?key=<API_KEY> returned HTTP 200
• POST https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent?key=<API_KEY> returned HTTP 200 and generated a valid response
• GET /v1beta/models with Authorization: Bearer <API_KEY> returned HTTP 401, which suggests the doctor check is using the wrong auth style for this provider

Expected behavior

hermes doctor should validate Gemini API keys using the Gemini API's ?key= auth flow, or otherwise avoid reporting a false invalid-key error when the key is actually valid.

Actual behavior

hermes doctor prints a Gemini connectivity warning/invalid key message even though the Gemini API calls succeed.

Notes

• OpenAI/Codex remains the default provider; Gemini was configured only as an optional credential.
• This appears to be a false positive in the doctor connectivity check, not a billing issue.

Environment

• Hermes Agent on AWS Lightsail Ubuntu 24.04
• hermes update completed successfully before this check

Reproduction steps

1. Set GEMINI_API_KEY in ~/.hermes/.env
2. Run hermes doctor
3. Observe Gemini being flagged invalid
4. Call the Gemini API directly with the same key and observe success