fix: rotate credential pool on 403 (Forbidden) responses#8289
Closed
YueLich wants to merge 1 commit into
Closed
Conversation
Previously _handle_credential_pool_error handled 401, 402, and 429 but silently ignored 403. When a provider returns 403 for a revoked or unauthorised credential (e.g. Nous agent_key invalidated by a newer login), the pool was never rotated and every subsequent request continued to use the same failing credential. Treat 403 the same as 402: immediately mark the current credential exhausted and rotate to the next pool entry, since a Forbidden response will not resolve itself with a retry. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
682a4cf to
041a748
Compare
Contributor
|
Thanks for the fix, @YueLich! 🤖 This is an automated hermes-sweeper review. The change proposed here is already on
Closing as implemented on main. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
_handle_credential_pool_errorhandled 401, 402, and 429 but silently ignored 403agent_keyinvalidated by a newer login), the pool was never rotated — every subsequent request kept hitting the same failing credentialRoot cause
Nous (and other OAuth providers) invalidate older agent keys when new ones are minted. If a user has multiple credential pool entries (accumulated via repeated
hermes auth add nous), the oldest entry (lowest priority, selected first byfill_first) may be revoked. Without 403 rotation, the pool is stuck on that entry indefinitely.Test plan
🤖 Generated with Claude Code