What & Why

#17135 (merged) fixed hermes doctor for providers whose Hermes runtime id differs from the models.dev catalog id: ai-gateway, copilot, kilocode, kimi-coding, kimi-coding-cn, opencode-zen. It did not cover local-endpoint aliases — ollama, vllm, llamacpp — which still produce a self-contradicting "unknown provider" error today.

Reproduction on current main (post #17135):

# ~/.hermes/config.yaml
model:
  provider: ollama
  default: dummy-model
  base_url: http://localhost:11434/v1

✗ model.provider 'ollama' is not a recognised provider
  (known: ai-gateway, alibaba, ..., custom, ..., zai)

ollama is not in the printed "known" list, but it's a documented user-facing value — auth.resolve_provider routes it to custom, which is in the list.

Closes #16076 (copilot, fixed by #17135). Closes the still-open part of #16085. Supersedes the earlier scope of this PR; #15159 / #15361 / #15583 / #15778 stay closed.

Root cause (what #17135 missed)

Three providers — ollama, vllm, llamacpp — sit in auth.py:_PROVIDER_ALIASES mapping to "custom", but have no entry in providers.py. After #17135, the validator built up provider_ids_to_accept = {raw, runtime_resolved, catalog_resolved} correctly (including "custom" for these three), but the failure condition still started with:

if catalog_provider is None or (
    known_providers and not (provider_ids_to_accept & valid_provider_ids)
):

resolve_provider_full("ollama") returns None, so catalog_provider is None, and the short-circuit rejects the provider before the intersection check ever runs.

bedrock and lmstudio were on the original #16085 list but were fixed independently — bedrock by adding a HERMES_OVERLAYS entry, lmstudio by promoting it to PROVIDER_REGISTRY (214ca94, feat(agent): add lmstudio integration). Both are kept in the parametrized test as regression guards.

Change

One behaviour change in hermes_cli/doctor.py: drop the catalog_provider is None or ... short-circuit. The intersection check below already covers the cases that matter — a None catalog id is not a sufficient signal that the provider is unknown when the auth-resolved runtime id lands in PROVIDER_REGISTRY.

Tests

tests/hermes_cli/test_doctor.py adds:

• test_run_doctor_accepts_provider_when_catalog_resolution_returns_none — parametrized over ollama, vllm, llamacpp (the cases fix(doctor): accept catalog provider aliases #17135 didn't fix) plus bedrock and lmstudio as regression guards.
• test_run_doctor_validator_invariant_holds_for_every_known_provider — invariant test asserting every name in PROVIDER_REGISTRY (i.e. every name doctor prints as valid) also passes its own validator. Catches forward regressions like the original bedrock shape if a future provider lands in PROVIDER_REGISTRY without a matching catalog or alias entry.
• test_run_doctor_still_flags_unknown_provider — negative case: provider: completely-made-up is still flagged.

$ scripts/run_tests.sh tests/hermes_cli/test_doctor.py
35 passed in 1.4s

Wider sweep on tests/hermes_cli/: 3471 passed, 9 unrelated failures (test_gateway_service, test_gateway_wsl, test_setup_openclaw_migration, test_tools_config) that reproduce on a clean main without these changes.

Platforms tested

• macOS 14 (Apple Silicon), Python 3.11.15

Scope

One commit, one file plus tests. Six-line diff in doctor.py (drop one short-circuit + a clarifying comment). No behaviour change for providers that already passed the validator.