Summary

Fix native Gemini authentication against the Google AI Studio OpenAI-compatible endpoint.

Hermes was constructing OpenAI clients in a way that could cause Google to receive multiple auth credentials for Gemini requests, leading to:

HTTP 400: Multiple authentication credentials received. Please pass only one.

This patch introduces a centralized OpenAI compatibility layer for Gemini and routes both primary-agent and auxiliary-client creation through it.

Root cause

Google AI Studio accepts either:

• x-goog-api-key for standard API keys (AIza...)
• Authorization: Bearer ... for bearer-style tokens

but not both at the same time.

The fix ensures:

• AIza... keys use x-goog-api-key
• bearer-style tokens such as AQ... continue using Authorization
• conflicting auth headers are not emitted together

Changes

• Added agent/openai_compat.py
  • central OpenAI/Gemini-compatible client factory
  • Gemini-specific auth header selection
• Updated run_agent.py
  • main agent client creation now uses the compatibility factory
• Updated agent/auxiliary_client.py
  • auxiliary sync/async client creation now also uses the compatibility factory
• Added regression tests in tests/agent/test_openai_compat.py

Behavior after fix

• Gemini + AIza... key → sends only x-goog-api-key
• Gemini + bearer token (AQ...) → sends only Authorization
• Existing non-Gemini providers remain unchanged

Validation

Ran:

pytest -q tests/agent/test_openai_compat.py tests/hermes_cli/test_gemini_provider.py -q

Passed successfully.