fix: replace stale 'hermes login' with 'hermes auth' + fix credential removal re-seeding#5670
Merged
fix: replace stale 'hermes login' with 'hermes auth' + fix credential removal re-seeding#5670
Conversation
…ntial removal re-seeding Two fixes: 1. Replace all stale 'hermes login' references with 'hermes auth' across auth.py, auxiliary_client.py, delegate_tool.py, config.py, run_agent.py, and documentation. The 'hermes login' command was deprecated; 'hermes auth' now handles OAuth credential management. 2. Fix credential removal not persisting for singleton-sourced credentials (device_code for openai-codex/nous, hermes_pkce for anthropic). auth_remove_command already cleared env vars for env-sourced credentials, but singleton credentials stored in the auth store were re-seeded by _seed_from_singletons() on the next load_pool() call. Now clears the underlying auth store entry when removing singleton-sourced credentials.
DiscoStew6082
pushed a commit
to DiscoStew6082/hermes-agent
that referenced
this pull request
Apr 9, 2026
…ntial removal re-seeding (NousResearch#5670) Two fixes: 1. Replace all stale 'hermes login' references with 'hermes auth' across auth.py, auxiliary_client.py, delegate_tool.py, config.py, run_agent.py, and documentation. The 'hermes login' command was deprecated; 'hermes auth' now handles OAuth credential management. 2. Fix credential removal not persisting for singleton-sourced credentials (device_code for openai-codex/nous, hermes_pkce for anthropic). auth_remove_command already cleared env vars for env-sourced credentials, but singleton credentials stored in the auth store were re-seeded by _seed_from_singletons() on the next load_pool() call. Now clears the underlying auth store entry when removing singleton-sourced credentials.
dbmizrahi
pushed a commit
to dbmizrahi/hermes-agent
that referenced
this pull request
Apr 10, 2026
…ntial removal re-seeding (NousResearch#5670) Two fixes: 1. Replace all stale 'hermes login' references with 'hermes auth' across auth.py, auxiliary_client.py, delegate_tool.py, config.py, run_agent.py, and documentation. The 'hermes login' command was deprecated; 'hermes auth' now handles OAuth credential management. 2. Fix credential removal not persisting for singleton-sourced credentials (device_code for openai-codex/nous, hermes_pkce for anthropic). auth_remove_command already cleared env vars for env-sourced credentials, but singleton credentials stored in the auth store were re-seeded by _seed_from_singletons() on the next load_pool() call. Now clears the underlying auth store entry when removing singleton-sourced credentials.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two fixes:
1. Stale
hermes loginreferences →hermes authhermes loginwas deprecated but 17+ references across the codebase still pointed users to it. Updated across:hermes_cli/auth.py— Codex credential error messages, migration hints, refresh conflict messagesagent/auxiliary_client.py— Nous Portal warningstools/delegate_tool.py— delegation credential errorsrun_agent.py— Codex 401 recovery hintshermes_cli/config.py— config template comments2. Credential removal doesn't stick for singleton-sourced credentials
Bug:
hermes auth remove openai-codex 1says "Removed" but the credential reappears on nexthermes authinvocation.Root cause:
auth_remove_commandremoves the entry from the credential pool file but the underlying auth store (auth.json providers.openai-codex) still has the OAuth tokens. On nextload_pool(),_seed_from_singletons()finds those tokens and re-adds the entry.Fix: Added parallel clearing logic for singleton sources (matching the existing env-var clearing pattern):
device_codeon openai-codex/nous → clears auth store provider entryhermes_pkceon anthropic → deletes~/.hermes/.anthropic_oauth.jsonclaude_codeon anthropic → warns user (we don't own Claude Code's credential file)Test plan