Description

When running hermes auth add xai-oauth --no-browser, the OAuth authorization callback is received successfully (shows "xAI authorization received. You can close this tab.") but the token exchange with xAI fails with:

AuthError: xAI authorization failed: code_challenge is required

Steps to reproduce

1. hermes auth add xai-oauth --no-browser
2. Open the printed authorize URL in a browser
3. Complete the OAuth flow (authorize the app)
4. The callback is received (browser shows success page)
5. Token exchange fails with code_challenge is required

Expected behavior

The authorization code should be successfully exchanged for tokens, and the xAI OAuth credential should be stored.

Actual behavior

The authorization code is received but the token exchange fails because the PKCE code_verifier is not being sent to xAI's token endpoint.

Environment

• Hermes Agent v0.14.0 (2026.5.16)
• Installed via pipx install git+https://github.com/NousResearch/hermes-agent.git
• Running on Ubuntu 24.04

The OIDC discovery confirms xAI supports PKCE (code_challenge_methods_supported": ["S256"]), but Hermes doesn't include the code_verifier parameter in the token exchange POST request.