Skip to content

[Bug]: bug(cli): hermes doctor falsely reports Google Gemini API key as invalid (HTTP 401 due to OpenAI auth format) #26623

@dzerozero32-hue

Description

@dzerozero32-hue

Bug Description

Describe the bug
The hermes doctor connectivity check (_probe_apikey_provider) falsely reports a valid Google Gemini API key (GOOGLE_API_KEY) as invalid with a red cross ✗ gemini (invalid API key). This happens because the health check treats the Gemini endpoint as OpenAI-compatible and uses the standard Authorization: Bearer <key> header, which Google AI Studio rejects with an HTTP 401 status code.

To Reproduce

  1. Configure a valid GOOGLE_API_KEY in ~/.hermes/.env.
  2. Run hermes doctor.
  3. See the ✗ gemini (invalid API key) error in the API Connectivity section, even though the main hermes agent chat works perfectly fine with the exact same key.

Root Cause Analysis
In /hermes_cli/doctor.py, the generic helper function _probe_apikey_provider performs an HTTP GET request to check connectivity:

headers = {
    "Authorization": f"Bearer {key}",
    "User-Agent": _HERMES_USER_AGENT,
}
r = httpx.get(url, headers=headers, timeout=10)

Google Gemini API does not authenticate via Bearer tokens in the standard Authorization header. It expects the API key either as a query parameter (?key=...) or via the x-goog-api-key header. Because httpx sends a Bearer token, Google returns 401 Unauthorized, which the doctor script catches and flags as an invalid API key on line 1466:

if r.status_code == 401:
    return _ConnectivityResult(
        pname,
        [(color("✗", Colors.RED), label, color("(invalid API key)", Colors.DIM))],
        [f"Check {env_vars[0]} in .env"],
    )

Expected behavior
The _probe_apikey_provider function should handle Gemini/Google specifically by using the correct authentication method (e.g., passing x-goog-api-key header or appending the key parameter to the URL) so that the health check passes successfully.

Steps to Reproduce

  1. Configure a valid GOOGLE_API_KEY in ~/.hermes/.env.
  2. Run hermes doctor in the terminal.
  3. Observe the ✗ gemini (invalid API key) error in the "API Connectivity" section.

Expected Behavior

The hermes doctor command should successfully validate the Gemini API key and display a green checkmark ✓ gemini, since the key is fully functional and the main hermes agent chat works perfectly with it.

Actual Behavior

hermes doctor outputs a false positive error:
✗ gemini (invalid API key)
And appends an issue: Check GOOGLE_API_KEY in .env

Affected Component

CLI (interactive chat)

Messaging Platform (if gateway-related)

N/A (CLI only)

Debug Report

hermes debug share

Operating System

Ubuntu 20.04

Python Version

3.11

Hermes Version

Latest main branch (git clone)

Additional Logs / Traceback (optional)

Root Cause Analysis (optional)

No response

Proposed Fix (optional)

No response

Are you willing to submit a PR for this?

  • I'd like to fix this myself and submit a PR

Metadata

Metadata

Assignees

No one assigned

    Labels

    P3Low — cosmetic, nice to havecomp/cliCLI entry point, hermes_cli/, setup wizardprovider/geminiGoogle Gemini (AI Studio, Cloud Code)sweeper:implemented-on-mainSweeper: behavior already present on current maintype/bugSomething isn't working

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions