fix(auth): use _save_xai_oauth_tokens in auth_commands to set active_provider by AhmetArif0 · Pull Request #37576 · NousResearch/hermes-agent

AhmetArif0 · 2026-06-02T18:42:36Z

Problem

hermes auth add xai-oauth called pool.add_entry() directly, writing only the
credential-pool entry without touching providers["xai-oauth"] or setting
active_provider in auth.json.

On a fresh install, _model_section_has_credentials() checks
get_active_provider() first. With active_provider unset it fell through to
env-var checks, found nothing (xAI OAuth tokens aren't env vars), and the setup
wizard reported "No inference provider configured" even though the OAuth flow
had succeeded.

Fix

Use _save_xai_oauth_tokens() instead of pool.add_entry() — the canonical
path that writes the providers.xai-oauth singleton (setting active_provider)
and lets the pool seed itself from auth.json via _seed_from_singletons on
the next load_pool() call.

This mirrors the fix applied to openai-codex in #37517, which had the
identical root cause.

The generic suppression-clearing loop at the top of auth_add_command() already
unsuppresses any prior removal marker before the OAuth flow, so re-linking after
hermes auth remove xai-oauth continues to work.

Changes

hermes_cli/auth_commands.py: replace hand-rolled pool.add_entry() for
xai-oauth with auth_mod._save_xai_oauth_tokens() + load_pool() to pick
up the seeded entry.
tests/hermes_cli/test_auth_commands.py: add
test_auth_add_xai_oauth_persists_provider_state — verifies that
active_provider == "xai-oauth", the singleton is written, and a
loopback_pkce pool entry exists after auth_add_command.

Test plan

New test test_auth_add_xai_oauth_persists_provider_state passes
All 47 existing test_auth_commands tests pass

…provider hermes auth add xai-oauth used pool.add_entry() directly, writing only the credential pool entry without touching providers["xai-oauth"] or setting active_provider in auth.json. On a fresh install _model_section_has_credentials() checks get_active_provider() first; with active_provider unset it fell through to env-var checks, found nothing, and the setup wizard reported "No inference provider configured" even though the OAuth flow had succeeded. Use _save_xai_oauth_tokens() instead — the canonical path that writes the providers.xai-oauth singleton (setting active_provider) and lets the pool seed itself from auth.json via _seed_from_singletons on the next load_pool() call. Mirrors the fix applied to openai-codex in NousResearch#37517.

hermes auth add google-gemini-cli called pool.add_entry() but never wrote to providers["google-gemini-cli"] or set active_provider in auth.json. _model_section_has_credentials() checks get_active_provider() first; with active_provider unset and no api_key_env_vars configured for oauth_external providers, the setup wizard reported "No inference provider configured" even after a successful OAuth login. Add _mark_google_gemini_cli_active() in auth.py: writes a minimal provider state entry (email for display only) and calls _save_provider_state() to set active_provider. The function deliberately does not copy access_token or refresh_token — those are managed by agent.google_oauth in the Google credential file and must not be duplicated in auth.json where they would become stale. pool.add_entry() is retained so "hermes auth list" continues to show the entry. Runtime credential resolution continues to use agent.google_oauth directly. Mirrors the fix applied to openai-codex (NousResearch#37517) and xai-oauth (NousResearch#37576).

hermes auth add qwen-oauth called pool.add_entry() but never wrote to providers["qwen-oauth"] or set active_provider in auth.json. _model_section_has_credentials() checks get_active_provider() first; with active_provider unset and no api_key_env_vars configured for oauth_external providers, the setup wizard reported "No inference provider configured" even after a successful Qwen CLI OAuth login. Add _mark_qwen_oauth_active() in auth.py: writes a minimal provider state entry (base_url for display only) and calls _save_provider_state() to set active_provider. The function deliberately does not copy the api_key — that lives in the Qwen CLI credential file managed by _save_qwen_cli_tokens / resolve_qwen_runtime_credentials and must not be duplicated in auth.json where it would become stale. pool.add_entry() is retained so "hermes auth list" continues to show the entry. Runtime credential resolution continues to use resolve_qwen_runtime_credentials. Mirrors the fix applied to openai-codex (NousResearch#37517) and xai-oauth (NousResearch#37576).

hermes auth add google-gemini-cli called pool.add_entry() but never wrote to providers["google-gemini-cli"] or set active_provider in auth.json. _model_section_has_credentials() checks get_active_provider() first; with active_provider unset and no api_key_env_vars configured for oauth_external providers, the setup wizard reported "No inference provider configured" even after a successful OAuth login. Add _mark_google_gemini_cli_active() in auth.py: writes a minimal provider state entry (email for display only) and calls _save_provider_state() to set active_provider. The function deliberately does not copy access_token or refresh_token — those are managed by agent.google_oauth in the Google credential file and must not be duplicated in auth.json where they would become stale. pool.add_entry() is retained so "hermes auth list" continues to show the entry. Runtime credential resolution continues to use agent.google_oauth directly. Mirrors the fix applied to openai-codex (#37517) and xai-oauth (#37576).

hermes auth add qwen-oauth called pool.add_entry() but never wrote to providers["qwen-oauth"] or set active_provider in auth.json. _model_section_has_credentials() checks get_active_provider() first; with active_provider unset and no api_key_env_vars configured for oauth_external providers, the setup wizard reported "No inference provider configured" even after a successful Qwen CLI OAuth login. Add _mark_qwen_oauth_active() in auth.py: writes a minimal provider state entry (base_url for display only) and calls _save_provider_state() to set active_provider. The function deliberately does not copy the api_key — that lives in the Qwen CLI credential file managed by _save_qwen_cli_tokens / resolve_qwen_runtime_credentials and must not be duplicated in auth.json where it would become stale. pool.add_entry() is retained so "hermes auth list" continues to show the entry. Runtime credential resolution continues to use resolve_qwen_runtime_credentials. Mirrors the fix applied to openai-codex (#37517) and xai-oauth (#37576).