Separate pooled credential runtime state from persisted credentials#5187
Open
kshitijk4poor wants to merge 1 commit into
Open
Separate pooled credential runtime state from persisted credentials#5187kshitijk4poor wants to merge 1 commit into
kshitijk4poor wants to merge 1 commit into
Conversation
This keeps pooled credential cooldown and error tracking in a dedicated runtime store instead of persisting it inline with durable credential definitions. Hermes now migrates legacy inline state on read, preserves provider reset hints for accurate cooldown windows, and leaves the already-merged label-targeting and reset-window UI work to upstream main. Constraint: Current upstream main already includes the earlier cooldown parsing and auth CLI targeting fixes, so this branch must only carry the remaining runtime-state delta Constraint: Existing auth.json files with inline credential status must continue to work without manual migration Rejected: Keep runtime state inline and append more fields | continues mixing durable credentials with transient execution state Rejected: Re-carry already-merged auth CLI and cooldown-display commits in this branch | redundant with upstream main and makes the PR noisy Confidence: high Scope-risk: moderate Reversibility: clean Directive: Keep runtime execution state in ; future pool changes should not persist transient exhaustion state back into credential definitions Tested: uv run python -m pytest tests/test_auth_commands.py tests/test_credential_pool.py tests/test_run_agent.py tests/test_credential_pool_routing.py -q (274 passed); py_compile on changed files; hermes -w auth list/remove smoke test with temporary HERMES_HOME Not-tested: Full repository pytest suite, non-pooled gateway/integration paths
ae069e2 to
7b76935
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR separates pooled credential runtime state from pooled credential definitions.
Hermes currently persists temporary execution state like cooldowns and recent exhaustion directly on the credential records themselves. This branch introduces a dedicated
credential_pool_runtimestore inauth.jsonso Hermes can treat those as transient operational facts instead of durable credential identity.What this does
credential_pool_runtimeas the home for pooled credential runtime statecredential_poolfocused on durable credential definitions onlycredential_poolentries into runtime state automatically on readmainin the runtime layer instead of writing it back into the credential definitionWhy the runtime split matters
A pooled credential has two different kinds of data:
Before this split, Hermes mixed those together. That makes temporary rate limits look like part of the saved credential itself.
This change makes Hermes distinguish between:
Bugs this helps prevent
Scope note
Current
upstream/mainalready includes the earlier work for:resets_atThis branch was cleaned up and rebased so it now carries only the remaining runtime-state split.
Verification
uv run python -m pytest tests/test_auth_commands.py tests/test_credential_pool.py tests/test_run_agent.py tests/test_credential_pool_routing.py -quv run python -m py_compile agent/credential_pool.py hermes_cli/auth.py run_agent.py tests/test_auth_commands.py tests/test_credential_pool.pyHERMES_HOME=<tmp> uv run hermes -w auth list openai-codexHERMES_HOME=<tmp> uv run hermes -w auth remove openai-codex personal-accountNotes
upstream/mainremoved redundant code that had already merged upstream.