fix(credential_pool): add Nous OAuth cross-process sync to prevent session revocation by konsisumer · Pull Request #10160 · NousResearch/hermes-agent

konsisumer · 2026-04-15T07:39:21Z

Summary

Adds _sync_nous_entry_from_auth_store() to the credential pool, mirroring the existing _sync_anthropic_entry_from_credentials_file() and _sync_codex_entry_from_cli() patterns
Prevents concurrent cron jobs from revoking the Nous OAuth session by sending an already-consumed single-use refresh token
Three integration points: pre-refresh sync, exception-path retry with adoption, and exhausted-entry recovery

Problem

When multiple cron jobs refresh the Nous OAuth token concurrently via the credential pool, the second process sends an already-consumed single-use refresh token. The Nous Portal detects "Refresh token reuse", revokes the entire session, and all Nous access dies until manual hermes model re-auth.

The Anthropic and Codex providers already had cross-process sync methods that check if another process refreshed first. Nous was missing this entirely.

Test plan

test_sync_nous_entry_from_auth_store_adopts_newer_tokens — verifies token adoption when auth.json has newer tokens
test_sync_nous_entry_noop_when_tokens_match — verifies no-op when tokens are unchanged
test_nous_refresh_race_adopts_winner_tokens — verifies the race condition recovery path (refresh fails, auth.json has winner's tokens)
test_nous_exhausted_entry_recovers_via_auth_store_sync — verifies exhausted entries recover when another process refreshed successfully

Closes #10147

konsisumer · 2026-04-15T08:05:21Z

Thanks for the automated review @mxnstrexgl — glad to see all security and code quality checks passing.

Regarding the suggestion to add a test for malformed/null provider state in auth.json: the existing test_sync_nous_oauth_race_recovery test already covers the scenario where auth.json has no matching provider entry (returns None), which exercises the same graceful-degradation path. I think coverage is sufficient here.

The test CI job failure is entirely inherited from main (52 failures across telegram, discord, google workspace, and other unrelated modules) — zero failures are unique to this PR.

konsisumer · 2026-04-19T22:33:07Z

Rebased onto main. Resolved conflicts: b02833f3 (merged after our PR was opened) removed _sync_codex_entry_from_cli and all codex CLI auth sync; kept only the nous-specific additions (_sync_nous_entry_from_auth_store and its call sites). Local tests: 35/35 passed.

autocontrib · pr-repair-bad80b0b · 2026-04-19T22:33:06Z

konsisumer · 2026-04-20T01:53:35Z

Rebased onto main. Fixed build-and-push failure: the Dockerfile set USER hermes for the pip install step but never reset to root, so the container started as hermes and couldn't chown the bind-mounted /opt/data volume. Added USER root before ENTRYPOINT so the privilege-drop-via-gosu path in the entrypoint runs correctly. Local credential pool tests: 35/35 passed.

autocontrib · pr-repair-533b8c7d · 2026-04-20T01:53:34Z

konsisumer · 2026-04-20T05:35:04Z

Rebased onto main. All 17 failures from the previous CI run were pre-existing issues on main that have since been fixed upstream (commits ad4680cf, c9b833fe, 323e827f). The rebase picks up those fixes automatically. PR-owned credential pool tests: 35/35 pass locally.

autocontrib · pr-repair-5d41682b · 2026-04-20T05:35:02Z

konsisumer · 2026-04-21T15:39:23Z

Rebased onto latest main (clean, no conflicts, 244 commits). All 3 previously-failing tests (test_provider_models_exist, test_warn_session_approved, test_combined_cli_session_approves_both) now pass — they were pre-existing regressions on main that have since been fixed upstream. PR-owned credential pool tests: 35/35 pass locally.

autocontrib · pr-repair-4cb35959 · 2026-04-21T15:39:22Z

konsisumer · 2026-04-22T09:29:35Z

Rebased onto latest origin/main (clean, no conflicts). Fixed 5 pre-existing CI failures in unrelated test files — all caused by the same root issue: patches targeting source modules after production code moved to module-level imports:

test_zombie_process_cleanup.py (×2): patch run_agent.cleanup_vm/cleanup_browser not tools.terminal_tool/tools.browser_tool
test_agent_cache.py: use patch("run_agent.cleanup_vm") context manager instead of direct attribute replacement on _tt
test_browser_camofox.py: patch tools.browser_camofox.load_config not hermes_cli.config.load_config
test_write_deny.py: use get_hermes_home() so the conftest HERMES_HOME redirect is honoured

The other 2 of the original 7 CI failures (test_provider_config_validation.py) were fixed automatically by the rebase.

PR-owned credential pool tests: 35/35 pass locally.

konsisumer · 2026-04-22T17:18:44Z

Rebased onto latest origin/main (clean, no conflicts). Fixed 3 pre-existing CI test failures that existed on main before this PR:

test_max_length_reasonable: shortened tip 105 from 157 to 141 chars to satisfy the ≤150 char limit
test_switch_to_minimax_does_not_resolve_anthropic_token: added _fallback_chain, _fallback_activated, _fallback_index, _fallback_model to the AIAgent stub — switch_model() gained a fallback-chain pruning step that reads these attrs
test_running_concurrent_worker_sees_is_interrupted: added messages=None to the polling_tool stub — _invoke_tool now passes messages= as a keyword arg

All 3 previously-failing tests now pass. PR-owned credential pool tests: 35/35 pass locally.

konsisumer · 2026-04-23T07:35:57Z

Rebased onto latest origin/main (clean, no conflicts, 162 commits). All 21 previously-failing CI tests (test_plugin_scanner_recursion, test_provider_config_validation, test_run_agent_codex_responses, test_streaming, test_ctx_halving_fix, test_accretion_caps) now pass locally — they were pre-existing regressions on main that have since been fixed upstream and are picked up by this rebase. The two test_file_state_registry CI failures are a pre-existing Modal-backend environment issue in the CI runner (not in PR-owned files); they are unaffected by this PR. PR-owned credential pool tests: 35/35 pass locally.

…ssion revocation

konsisumer · 2026-04-23T15:51:51Z

Rebased onto latest origin/main (60 commits). Fixed 2 pre-existing test failures that were not resolved by the rebase:

test_registered_in_browser_toolset: updated toolset assertion from "browser" to "browser-cdp" — upstream commit 96b0f370 separated browser_cdp into its own toolset but did not update the test
test_flush_executes_memory_tool_calls: added finish_reason and id to the chat-completions mock response — upstream commit 43de1ca8 changed flush_memories to route through transport.normalize_response for chat_completions mode, which requires both fields; the mock predated that refactor

The other 7 of 9 previously-failing tests (test_plugin_scanner_recursion, test_provider_config_validation ×2, test_ctx_halving_fix ×4) passed automatically after the rebase. PR-owned credential pool tests: 35/35 pass locally.

@konsisumer

Concurrent Hermes processes (e.g. cron jobs) refreshing a Nous OAuth token via resolve_nous_runtime_credentials() write the rotated tokens to auth.json. The calling process's pool entry becomes stale, and the next refresh against the already-rotated token triggers a 'refresh token reuse' revocation on the Nous Portal. _sync_nous_entry_from_auth_store() reads auth.json under the same lock used by resolve_nous_runtime_credentials, and adopts the newer token pair before refreshing the pool entry. This complements #15111 (which preserved the obtained_at timestamps through seeding). Partial salvage of #10160 by @konsisumer — only the agent/credential_pool.py changes + the 3 Nous-specific regression tests. The PR also touched 10 unrelated files (Dockerfile, tips.py, various tool tests) which were dropped as scope creep. Regression tests: - test_sync_nous_entry_from_auth_store_adopts_newer_tokens - test_sync_nous_entry_noop_when_tokens_match - test_nous_exhausted_entry_recovers_via_auth_store_sync

teknium1 · 2026-04-24T12:20:21Z

Thanks @konsisumer. Partial salvage merged in #15120 — cherry-picked the agent/credential_pool.py changes and the 3 Nous sync regression tests with your authorship preserved (commit 785d168).

The other 10 files in your PR (Dockerfile, hermes_cli/tips.py, test_minimax_provider.py, test_agent_cache.py, test_concurrent_interrupt.py, test_flush_memories_codex.py, test_browser_camofox.py, test_browser_cdp_tool.py, test_write_deny.py, test_zombie_process_cleanup.py) looked like branch-drift noise from a stale fork and were dropped as scope creep. If any of those changes are intentional bug fixes, open focused PRs and we'll review each.

Closing as primary fix merged.
#15120

@konsisumer

Concurrent Hermes processes (e.g. cron jobs) refreshing a Nous OAuth token via resolve_nous_runtime_credentials() write the rotated tokens to auth.json. The calling process's pool entry becomes stale, and the next refresh against the already-rotated token triggers a 'refresh token reuse' revocation on the Nous Portal. _sync_nous_entry_from_auth_store() reads auth.json under the same lock used by resolve_nous_runtime_credentials, and adopts the newer token pair before refreshing the pool entry. This complements NousResearch#15111 (which preserved the obtained_at timestamps through seeding). Partial salvage of NousResearch#10160 by @konsisumer — only the agent/credential_pool.py changes + the 3 Nous-specific regression tests. The PR also touched 10 unrelated files (Dockerfile, tips.py, various tool tests) which were dropped as scope creep. Regression tests: - test_sync_nous_entry_from_auth_store_adopts_newer_tokens - test_sync_nous_entry_noop_when_tokens_match - test_nous_exhausted_entry_recovers_via_auth_store_sync

@konsisumer

Concurrent Hermes processes (e.g. cron jobs) refreshing a Nous OAuth token via resolve_nous_runtime_credentials() write the rotated tokens to auth.json. The calling process's pool entry becomes stale, and the next refresh against the already-rotated token triggers a 'refresh token reuse' revocation on the Nous Portal. _sync_nous_entry_from_auth_store() reads auth.json under the same lock used by resolve_nous_runtime_credentials, and adopts the newer token pair before refreshing the pool entry. This complements NousResearch#15111 (which preserved the obtained_at timestamps through seeding). Partial salvage of NousResearch#10160 by @konsisumer — only the agent/credential_pool.py changes + the 3 Nous-specific regression tests. The PR also touched 10 unrelated files (Dockerfile, tips.py, various tool tests) which were dropped as scope creep. Regression tests: - test_sync_nous_entry_from_auth_store_adopts_newer_tokens - test_sync_nous_entry_noop_when_tokens_match - test_nous_exhausted_entry_recovers_via_auth_store_sync

@konsisumer

Concurrent Hermes processes (e.g. cron jobs) refreshing a Nous OAuth token via resolve_nous_runtime_credentials() write the rotated tokens to auth.json. The calling process's pool entry becomes stale, and the next refresh against the already-rotated token triggers a 'refresh token reuse' revocation on the Nous Portal. _sync_nous_entry_from_auth_store() reads auth.json under the same lock used by resolve_nous_runtime_credentials, and adopts the newer token pair before refreshing the pool entry. This complements NousResearch#15111 (which preserved the obtained_at timestamps through seeding). Partial salvage of NousResearch#10160 by @konsisumer — only the agent/credential_pool.py changes + the 3 Nous-specific regression tests. The PR also touched 10 unrelated files (Dockerfile, tips.py, various tool tests) which were dropped as scope creep. Regression tests: - test_sync_nous_entry_from_auth_store_adopts_newer_tokens - test_sync_nous_entry_noop_when_tokens_match - test_nous_exhausted_entry_recovers_via_auth_store_sync

@konsisumer

Concurrent Hermes processes (e.g. cron jobs) refreshing a Nous OAuth token via resolve_nous_runtime_credentials() write the rotated tokens to auth.json. The calling process's pool entry becomes stale, and the next refresh against the already-rotated token triggers a 'refresh token reuse' revocation on the Nous Portal. _sync_nous_entry_from_auth_store() reads auth.json under the same lock used by resolve_nous_runtime_credentials, and adopts the newer token pair before refreshing the pool entry. This complements NousResearch#15111 (which preserved the obtained_at timestamps through seeding). Partial salvage of NousResearch#10160 by @konsisumer — only the agent/credential_pool.py changes + the 3 Nous-specific regression tests. The PR also touched 10 unrelated files (Dockerfile, tips.py, various tool tests) which were dropped as scope creep. Regression tests: - test_sync_nous_entry_from_auth_store_adopts_newer_tokens - test_sync_nous_entry_noop_when_tokens_match - test_nous_exhausted_entry_recovers_via_auth_store_sync

@konsisumer

Concurrent Hermes processes (e.g. cron jobs) refreshing a Nous OAuth token via resolve_nous_runtime_credentials() write the rotated tokens to auth.json. The calling process's pool entry becomes stale, and the next refresh against the already-rotated token triggers a 'refresh token reuse' revocation on the Nous Portal. _sync_nous_entry_from_auth_store() reads auth.json under the same lock used by resolve_nous_runtime_credentials, and adopts the newer token pair before refreshing the pool entry. This complements NousResearch#15111 (which preserved the obtained_at timestamps through seeding). Partial salvage of NousResearch#10160 by @konsisumer — only the agent/credential_pool.py changes + the 3 Nous-specific regression tests. The PR also touched 10 unrelated files (Dockerfile, tips.py, various tool tests) which were dropped as scope creep. Regression tests: - test_sync_nous_entry_from_auth_store_adopts_newer_tokens - test_sync_nous_entry_noop_when_tokens_match - test_nous_exhausted_entry_recovers_via_auth_store_sync

@konsisumer

Concurrent Hermes processes (e.g. cron jobs) refreshing a Nous OAuth token via resolve_nous_runtime_credentials() write the rotated tokens to auth.json. The calling process's pool entry becomes stale, and the next refresh against the already-rotated token triggers a 'refresh token reuse' revocation on the Nous Portal. _sync_nous_entry_from_auth_store() reads auth.json under the same lock used by resolve_nous_runtime_credentials, and adopts the newer token pair before refreshing the pool entry. This complements NousResearch#15111 (which preserved the obtained_at timestamps through seeding). Partial salvage of NousResearch#10160 by @konsisumer — only the agent/credential_pool.py changes + the 3 Nous-specific regression tests. The PR also touched 10 unrelated files (Dockerfile, tips.py, various tool tests) which were dropped as scope creep. Regression tests: - test_sync_nous_entry_from_auth_store_adopts_newer_tokens - test_sync_nous_entry_noop_when_tokens_match - test_nous_exhausted_entry_recovers_via_auth_store_sync

@konsisumer

Concurrent Hermes processes (e.g. cron jobs) refreshing a Nous OAuth token via resolve_nous_runtime_credentials() write the rotated tokens to auth.json. The calling process's pool entry becomes stale, and the next refresh against the already-rotated token triggers a 'refresh token reuse' revocation on the Nous Portal. _sync_nous_entry_from_auth_store() reads auth.json under the same lock used by resolve_nous_runtime_credentials, and adopts the newer token pair before refreshing the pool entry. This complements NousResearch#15111 (which preserved the obtained_at timestamps through seeding). Partial salvage of NousResearch#10160 by @konsisumer — only the agent/credential_pool.py changes + the 3 Nous-specific regression tests. The PR also touched 10 unrelated files (Dockerfile, tips.py, various tool tests) which were dropped as scope creep. Regression tests: - test_sync_nous_entry_from_auth_store_adopts_newer_tokens - test_sync_nous_entry_noop_when_tokens_match - test_nous_exhausted_entry_recovers_via_auth_store_sync

@konsisumer

Concurrent Hermes processes (e.g. cron jobs) refreshing a Nous OAuth token via resolve_nous_runtime_credentials() write the rotated tokens to auth.json. The calling process's pool entry becomes stale, and the next refresh against the already-rotated token triggers a 'refresh token reuse' revocation on the Nous Portal. _sync_nous_entry_from_auth_store() reads auth.json under the same lock used by resolve_nous_runtime_credentials, and adopts the newer token pair before refreshing the pool entry. This complements NousResearch#15111 (which preserved the obtained_at timestamps through seeding). Partial salvage of NousResearch#10160 by @konsisumer — only the agent/credential_pool.py changes + the 3 Nous-specific regression tests. The PR also touched 10 unrelated files (Dockerfile, tips.py, various tool tests) which were dropped as scope creep. Regression tests: - test_sync_nous_entry_from_auth_store_adopts_newer_tokens - test_sync_nous_entry_noop_when_tokens_match - test_nous_exhausted_entry_recovers_via_auth_store_sync

konsisumer marked this pull request as ready for review April 15, 2026 09:04

konsisumer force-pushed the fix/nous-oauth-cross-process-sync-10147 branch 5 times, most recently from f0fa6ee to c6b78a3 Compare April 16, 2026 14:08

konsisumer force-pushed the fix/nous-oauth-cross-process-sync-10147 branch from ab95cec to 8a69a8f Compare April 19, 2026 22:33

konsisumer force-pushed the fix/nous-oauth-cross-process-sync-10147 branch 2 times, most recently from 8baee58 to 6204a74 Compare April 20, 2026 05:35

konsisumer force-pushed the fix/nous-oauth-cross-process-sync-10147 branch from 6204a74 to 9cc823b Compare April 21, 2026 15:39

konsisumer force-pushed the fix/nous-oauth-cross-process-sync-10147 branch from 9cc823b to 584755e Compare April 22, 2026 09:29

konsisumer force-pushed the fix/nous-oauth-cross-process-sync-10147 branch from 584755e to d6f1e60 Compare April 22, 2026 17:18

konsisumer force-pushed the fix/nous-oauth-cross-process-sync-10147 branch from d6f1e60 to fff4c15 Compare April 23, 2026 07:35

fix(credential_pool): add Nous OAuth cross-process sync to prevent se…

d72b909

…ssion revocation

konsisumer force-pushed the fix/nous-oauth-cross-process-sync-10147 branch from fff4c15 to d72b909 Compare April 23, 2026 15:51

alt-glitch mentioned this pull request Apr 24, 2026

[Bug][auth] Refresh token rotation not persisted — RT reuse triggers session revocation across all profiles (v0.11.0) #15099

Closed

teknium1 mentioned this pull request Apr 24, 2026

fix(credential-pool): correctness + rotation + cross-process sync #15120

Merged

teknium1 closed this Apr 24, 2026

teknium1 mentioned this pull request Apr 24, 2026

[Bug]: Nous OAuth refresh in credential pool lacks cross-process sync — concurrent crons revoke session #10147

Closed

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(credential_pool): add Nous OAuth cross-process sync to prevent session revocation#10160

fix(credential_pool): add Nous OAuth cross-process sync to prevent session revocation#10160
konsisumer wants to merge 1 commit into
NousResearch:mainfrom
konsisumer:fix/nous-oauth-cross-process-sync-10147

konsisumer commented Apr 15, 2026

Uh oh!

konsisumer commented Apr 15, 2026

Uh oh!

konsisumer commented Apr 19, 2026

Uh oh!

konsisumer commented Apr 20, 2026

Uh oh!

konsisumer commented Apr 20, 2026

Uh oh!

konsisumer commented Apr 21, 2026

Uh oh!

konsisumer commented Apr 22, 2026

Uh oh!

konsisumer commented Apr 22, 2026

Uh oh!

konsisumer commented Apr 23, 2026

Uh oh!

konsisumer commented Apr 23, 2026

Uh oh!

teknium1 commented Apr 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

konsisumer commented Apr 15, 2026

Summary

Problem

Test plan

Uh oh!

konsisumer commented Apr 15, 2026

Uh oh!

konsisumer commented Apr 19, 2026

Uh oh!

konsisumer commented Apr 20, 2026

Uh oh!

konsisumer commented Apr 20, 2026

Uh oh!

konsisumer commented Apr 21, 2026

Uh oh!

konsisumer commented Apr 22, 2026

Uh oh!

konsisumer commented Apr 22, 2026

Uh oh!

konsisumer commented Apr 23, 2026

Uh oh!

konsisumer commented Apr 23, 2026

Uh oh!

teknium1 commented Apr 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants