From f86c06d5214ff84f12c2a5f957fbfddbda3c7697 Mon Sep 17 00:00:00 2001
From: domfelipe <domfelipe@users.noreply.github.com>
Date: Mon, 3 Aug 2026 00:01:28 -0300
Subject: [PATCH] Always set DeepSeek base_url to avoid OpenRouter 401

Leftover model.base_url pointing at openrouter.ai causes Missing
Authentication header even with a valid DEEPSEEK_API_KEY.
---
 README.md                                                 | 1 +
 skill/hermes-client-onboarding/SKILL.md                   | 5 +++++
 .../references/troubleshooting.md                         | 8 ++++++++
 .../hermes-client-onboarding/scripts/apply-core-config.sh | 7 +++++++
 4 files changed, 21 insertions(+)

diff --git a/README.md b/README.md
index fb77f27..905c0bd 100644
--- a/README.md
+++ b/README.md
@@ -141,6 +141,7 @@ Equivalente manual:
 hermes config set DEEPSEEK_API_KEY "sk-..."
 hermes config set model.provider deepseek
 hermes config set model.default deepseek-v4-flash
+hermes config set model.base_url "https://api.deepseek.com/v1"
 ```
 
 Não imprime secrets.
diff --git a/skill/hermes-client-onboarding/SKILL.md b/skill/hermes-client-onboarding/SKILL.md
index 393657b..0c7b9fc 100644
--- a/skill/hermes-client-onboarding/SKILL.md
+++ b/skill/hermes-client-onboarding/SKILL.md
@@ -87,13 +87,17 @@ Ask:
 hermes config set DEEPSEEK_API_KEY "THE_KEY"
 hermes config set model.provider deepseek
 hermes config set model.default deepseek-v4-flash
+hermes config set model.base_url "https://api.deepseek.com/v1"
 ```
 
+Important: always set `model.base_url` to the DeepSeek API. A leftover OpenRouter URL causes HTTP 401 ("Missing Authentication header") even with a valid `DEEPSEEK_API_KEY`.
+
 4. Verify with:
 
 ```bash
 hermes config get model.default
 hermes config get model.provider
+hermes config get model.base_url
 ```
 
 Optional: Offer fallback model `deepseek-v4-pro` if the user wants a stronger model (higher cost).
@@ -232,6 +236,7 @@ curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash -s -- --skip-
 hermes config set DEEPSEEK_API_KEY "sk-..."
 hermes config set model.provider deepseek
 hermes config set model.default deepseek-v4-flash
+hermes config set model.base_url "https://api.deepseek.com/v1"
 hermes config set TELEGRAM_BOT_TOKEN "..."
 hermes config set TELEGRAM_ALLOWED_USERS "123456789"
 
diff --git a/skill/hermes-client-onboarding/references/troubleshooting.md b/skill/hermes-client-onboarding/references/troubleshooting.md
index 5c0b700..35d7330 100644
--- a/skill/hermes-client-onboarding/references/troubleshooting.md
+++ b/skill/hermes-client-onboarding/references/troubleshooting.md
@@ -25,6 +25,7 @@ curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash -s -- --skip-
 hermes config set DEEPSEEK_API_KEY "THE_KEY"
 hermes config set model.provider deepseek
 hermes config set model.default deepseek-v4-flash
+hermes config set model.base_url "https://api.deepseek.com/v1"
 ```
 
 3. Check:
@@ -32,9 +33,16 @@ hermes config set model.default deepseek-v4-flash
 ```bash
 hermes config get model.default
 hermes config get model.provider
+hermes config get model.base_url
 # key lives in ~/.hermes/.env — never cat full file in front of client
 ```
 
+If HTTP 401 "Missing Authentication header" with a valid key: `model.base_url` is probably still OpenRouter. Force DeepSeek:
+
+```bash
+hermes config set model.base_url "https://api.deepseek.com/v1"
+```
+
 4. Test connectivity: `curl -sI https://api.deepseek.com | head -1`
 
 5. If the model name is rejected, stick to Hermes-supported IDs: `deepseek-v4-flash` or `deepseek-v4-pro` (legacy `deepseek-chat` / `deepseek-reasoner` were retired).
diff --git a/skill/hermes-client-onboarding/scripts/apply-core-config.sh b/skill/hermes-client-onboarding/scripts/apply-core-config.sh
index a8a0317..31a9b7f 100755
--- a/skill/hermes-client-onboarding/scripts/apply-core-config.sh
+++ b/skill/hermes-client-onboarding/scripts/apply-core-config.sh
@@ -52,13 +52,20 @@ if [[ ! "$TG_USERS" =~ ^[0-9]+(,[0-9]+)*$ ]]; then
   exit 1
 fi
 
+BASE_URL="https://api.deepseek.com/v1"
+if [[ "$PROVIDER" == "openrouter" ]]; then
+  BASE_URL="https://openrouter.ai/api/v1"
+fi
+
 hermes config set DEEPSEEK_API_KEY "$DS_KEY"
 hermes config set model.provider "$PROVIDER"
 hermes config set model.default "$MODEL"
+hermes config set model.base_url "$BASE_URL"
 hermes config set TELEGRAM_BOT_TOKEN "$TG_TOKEN"
 hermes config set TELEGRAM_ALLOWED_USERS "$TG_USERS"
 
 echo "ok: provider=$(hermes config get model.provider 2>/dev/null || echo "$PROVIDER")"
 echo "ok: model=$(hermes config get model.default 2>/dev/null || echo "$MODEL")"
+echo "ok: base_url=$(hermes config get model.base_url 2>/dev/null || echo "$BASE_URL")"
 echo "ok: allowed_users=$TG_USERS"
 echo "ok: secrets written (not displayed)"