Issue Station
Sign In
Tools hereToolbox

hermes - ✅(Solved) Fix [Bug]: hermes doctor reports valid China DashScope API key as invalid [2 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
NousResearch/hermes-agent#18904•Fetched 2026-05-03 04:53:40
View on GitHub
Comments
0
Participants
1
Timeline
6
Reactions
0
Author
hhqybhhqyb
Participants
hhqybhhqyb
Timeline (top)
labeled ×4cross-referenced ×2

Root Cause

Suspected Root Cause

Fix Action

Fixed

PR fix notes

PR #18910: fix(doctor): read env vars from .env and default to China DashScope endpoint

Description (problem / solution / changelog)

Summary

hermes doctor API-key health checks had two bugs:

Bug 1: env vars from .env invisible to doctor

os.getenv() does not read ~/.hermes/.env. Keys and base URLs stored only in .env (not exported to the shell) were invisible to all 16 api-key provider health checks.

Fix: Replace os.getenv() with get_env_value() for both API key and base URL resolution.

Bug 2: DashScope default URL is international-only

The default health-check URL was dashscope-intl.aliyuncs.com (international). China-region keys — the vast majority of DashScope users — are valid only on dashscope.aliyuncs.com. Doctor reported these as invalid.

Fix: Default to dashscope.aliyuncs.com (China). Users with DASHSCOPE_BASE_URL set are unaffected.

Same Bug Class

  • #14134 (PR #18906) — api_key drift on provider switch
  • #15914 (PR #16101) — api_key + credential_pool
  • #17140 (PR #17434) — TTS/STT tools
  • #18757 (PR #18908) — base_url_env_var in auth.py/runtime_provider.py

Testing

23 existing doctor tests: all pass, zero regression.

Scope

  • 1 file: hermes_cli/doctor.py (+5 / -4)
  • Affects all 16 api-key provider health checks (env var reading)
  • DashScope default URL change

Fixes #18904

Changed files

  • hermes_cli/doctor.py (modified, +28/-6)

PR #18952: fix(doctor): try China DashScope endpoint before declaring key invalid

Description (problem / solution / changelog)

Fix

When DASHSCOPE_BASE_URL is not set and the default intl endpoint (dashscope-intl.aliyuncs.com) returns 401, retry with the China endpoint (dashscope.aliyuncs.com) before declaring the key invalid.

If the China endpoint succeeds, show a hint: (China endpoint — set DASHSCOPE_BASE_URL) to guide the user toward proper configuration.

Why

China-region DashScope/Bailian API keys only work with dashscope.aliyuncs.com, not the international dashscope-intl.aliyuncs.com endpoint. Users without DASHSCOPE_BASE_URL configured get a false (invalid API key) report from hermes doctor.

Fixes #18904

Changed files

  • hermes_cli/doctor.py (modified, +18/-0)

Code Example

Checking Alibaba/DashScope API...
✗ Alibaba/DashScope    (invalid API key)

---

GET  https://dashscope.aliyuncs.com/compatible-mode/v1/models  -> HTTP 200
GET  https://dashscope.aliyuncs.com/api/v1/models              -> HTTP 200
POST https://dashscope.aliyuncs.com/api/v1/mcps/WebSearch/mcp  -> HTTP 200

---

https://dashscope-intl.aliyuncs.com/compatible-mode/v1/models

---

https://dashscope.aliyuncs.com/compatible-mode/v1/models
RAW_BUFFERClick to expand / collapse

Bug Description

hermes doctor reports a valid China-region Alibaba DashScope/Bailian API key as invalid.

Observed output:

Checking Alibaba/DashScope API...
✗ Alibaba/DashScope    (invalid API key)

However, the same DASHSCOPE_API_KEY succeeds against China-region DashScope/Bailian endpoints and WebSearch MCP.

Verification Results

The following checks were run locally with the same key, without exposing the key value:

GET  https://dashscope.aliyuncs.com/compatible-mode/v1/models  -> HTTP 200
GET  https://dashscope.aliyuncs.com/api/v1/models              -> HTTP 200
POST https://dashscope.aliyuncs.com/api/v1/mcps/WebSearch/mcp  -> HTTP 200

The MCP initialize response also returns a normal BaiLianMcpServer serverInfo payload.

Suspected Root Cause

In hermes_cli/doctor.py, the Alibaba/DashScope API-key health check appears to default to:

https://dashscope-intl.aliyuncs.com/compatible-mode/v1/models

For China-region DashScope/Bailian keys, the working endpoint is:

https://dashscope.aliyuncs.com/compatible-mode/v1/models

So the current doctor output can misclassify a region/endpoint mismatch as an invalid API key.

Expected Behavior

hermes doctor should not report a valid China-region DashScope key as invalid. Possible fixes:

  1. Respect DASHSCOPE_BASE_URL when configured.
  2. Try both dashscope-intl.aliyuncs.com and dashscope.aliyuncs.com before declaring the key invalid.
  3. If only one region fails, show a region/endpoint mismatch warning instead of (invalid API key).
  4. Optionally verify WebSearch MCP separately when the key is being used for MCP services rather than model inference.

Related Issues

  • #12220
  • #3912

Environment

  • Hermes Agent on macOS
  • DASHSCOPE_API_KEY configured in .env
  • China-region DashScope/Bailian endpoints respond successfully
  • hermes doctor still reports Alibaba/DashScope (invalid API key)

No API keys or tokens are included in this report.

extent analysis

TL;DR

The hermes doctor command may be using the wrong endpoint for China-region DashScope/Bailian API keys, leading to an incorrect "invalid API key" report.

Guidance

  • Verify that the DASHSCOPE_BASE_URL environment variable is set to the correct value (https://dashscope.aliyuncs.com) to ensure the correct endpoint is used.
  • Check the hermes_cli/doctor.py code to see if it respects the DASHSCOPE_BASE_URL configuration and if it can be modified to try both dashscope-intl.aliyuncs.com and dashscope.aliyuncs.com endpoints before declaring the key invalid.
  • Consider modifying the hermes doctor output to show a region/endpoint mismatch warning instead of (invalid API key) when only one region fails.
  • Test the API key with the WebSearch MCP endpoint separately to verify its validity for MCP services.

Example

No code snippet is provided as the issue is related to configuration and endpoint usage.

Notes

The issue seems to be specific to the China-region DashScope/Bailian API keys and the hermes doctor command. The provided verification results suggest that the API key is valid, but the hermes doctor command is using the wrong endpoint.

Recommendation

Apply workaround: Modify the hermes_cli/doctor.py code to respect the DASHSCOPE_BASE_URL configuration and try both dashscope-intl.aliyuncs.com and dashscope.aliyuncs.com endpoints before declaring the key invalid. This should resolve the issue until a permanent fix is available.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#latency issue#model loading#dependency error#configuration error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING