Repro context from production use: an pool contained both shared CLI/device-code credentials and manual dashboard-added credentials. After a 429, the exhausted manual entry could be synced from , immediately become selectable again, and appear to rotate back to the same label. In the affected state, labels could also drift away from the actual token identity, and duplicate polluted entries could remain in the pool.

Repro context from production use: an openai-codex pool contained both shared CLI/device-code credentials and manual dashboard-added credentials. After a 429, the exhausted manual entry could be synced from ~/.codex/auth.json, immediately become selectable again, and appear to rotate back to the same label. In the affected state, labels could also drift away from the actual token identity, and duplicate polluted entries could remain in the pool.

Related to #11727 (credential rotation sync guard), #11364 (same root cause description). May supersede both.

Related to #11727, #11364.

Thanks for the submission @Alex-giao. Closing as superseded — fixed _sync_codex_entry_from_cli() which was removed by #12360 — Hermes no longer touches ~/.codex/auth.json at runtime.

Hermes's Codex auth design was reworked in #12360 ("Hermes owns its own Codex auth; stop touching ~/.codex/auth.json") to stop sharing refresh tokens with the Codex CLI / VS Code extension (they rotate on every use, so shared access caused refresh_token_reused races). Users who want to adopt Codex CLI credentials get a one-time explicit prompt via hermes auth openai-codex instead.

The valid adjacent fixes from this batch (error parsing, fallback chain on auth failure, reauth UX) landed together in #15104.