Problem
When running hermes model (or any OAuth login) on a remote VM or browser-based console (GCP Cloud Shell, AWS EC2 Instance Connect, GitHub Codespaces, etc.), OAuth flows fail because the authorization URL contains a hardcoded redirect_uri=http://127.0.0.1:<port>/callback.
After the user authorizes in their local browser, the provider redirects back to 127.0.0.1 on the remote machine, which is unreachable. The existing SSH tunnel hint only helps users with a real local SSH client — it provides no path forward for browser-only remote consoles.
Solution Implemented
Added a reusable _oauth_prompt_manual_code() helper that allows users to complete OAuth login by pasting either the full failed callback URL or just the authorization code.
The helper was integrated into the xAI Grok OAuth flow (and prepared for Spotify). Users can now simply paste the code when the browser redirect fails, and authentication completes successfully.
Changes
- New helper:
_oauth_prompt_manual_code() in hermes_cli/auth.py
- Refactored xAI OAuth login to use the helper
- Supports both full callback URL and raw code input
The fix has been tested and confirmed working on a remote GCP VM.
Problem
When running
hermes model(or any OAuth login) on a remote VM or browser-based console (GCP Cloud Shell, AWS EC2 Instance Connect, GitHub Codespaces, etc.), OAuth flows fail because the authorization URL contains a hardcodedredirect_uri=http://127.0.0.1:<port>/callback.After the user authorizes in their local browser, the provider redirects back to
127.0.0.1on the remote machine, which is unreachable. The existing SSH tunnel hint only helps users with a real local SSH client — it provides no path forward for browser-only remote consoles.Solution Implemented
Added a reusable
_oauth_prompt_manual_code()helper that allows users to complete OAuth login by pasting either the full failed callback URL or just the authorization code.The helper was integrated into the xAI Grok OAuth flow (and prepared for Spotify). Users can now simply paste the code when the browser redirect fails, and authentication completes successfully.
Changes
_oauth_prompt_manual_code()inhermes_cli/auth.pyThe fix has been tested and confirmed working on a remote GCP VM.