hermes - 💡(How to fix) Fix DEEPSEEK_API_KEY blocked by env blocklist in gateway process — cron jobs fail with deepseek provider

Bug Description

When DEEPSEEK_API_KEY is set in the container env (via --env-file), cron jobs configured to use the deepseek provider (deepseek/deepseek-v4-flash) consistently fail with error status.

Environment

• hermes-agent version: 0.11.0
• Provider: deepseek
• Model: deepseek/deepseek-v4-flash
• DEEPSEEK_API_KEY present in /opt/data/.env (container env-file) ✓
• DEEPSEEK_API_KEY present in ~/.hermes/.env ✓

Investigation

1. DEEPSEEK_API_KEY exists in /opt/data/.env but is not visible in the gateway process environment (env | grep DEEPSEEK returns nothing)
2. hermes-agent has an environment variable blocklist in local.py that explicitly blocks DEEPSEEK_API_KEY
3. The blocklist appears to affect the gateway process itself, not just terminal/sandbox subprocesses — so the provider system and cron scheduler cannot read the key
4. A prior change journal noted the blocklist "only affects sandbox, not gateway", but this does not match observed behavior in v0.11.0

Steps to Reproduce

1. Set DEEPSEEK_API_KEY in /opt/data/.env
2. Create a cron job with provider: deepseek, model: deepseek/deepseek-v4-flash
3. Run the cron job — it fails with error status
4. Verify: env | grep DEEPSEEK returns empty in the gateway process

Expected Behavior

Either:

• The blocklist should only apply to sandbox subprocesses (terminal/code execution), not the gateway process that needs the key for provider resolution
• Or there should be a documented way to configure the deepseek provider key that bypasses the blocklist

Workaround

Switch cron jobs back to a non-blocked provider (e.g., glm-5-turbo@zai).