fix(auth): resolve xAI OAuth credentials across profiles + write rotated tokens back to root - #46614
Merged
kshitijk4poor merged 3 commits intoJun 15, 2026
Conversation
(cherry picked from commit 8d8b9f5)
…search#43589) The salvaged read-side fix lets a profile resolve the xAI OAuth grant from the global-root auth store when it has no own providers.xai-oauth block. But _save_xai_oauth_tokens still wrote rotated tokens only to the active profile store. Because xAI rotates the refresh_token on every refresh, a profile that reads root's grant and refreshes it left root holding a now- revoked refresh token — killing every other profile reading the stale root grant with invalid_grant once its access token expired (NousResearch#43589). Detect the read-from-root case (profile lacks its own providers.xai-oauth block) and, after the profile save, write the rotated chain back to the global root too via a best-effort, TOCTOU-safe write-through that reuses _save_auth_store with an explicit target path. A profile that genuinely shadows root (has its own block) is left untouched, classic mode is a no-op, and a failed root write never breaks the profile's own save. Pairs with the read fallback in the preceding commit so the cross-profile xAI grant stays coherent in both directions.
Salvaged commit in this PR is authored by capt-marbles (andrewdmwalker@gmail.com), a bare gmail that does not auto-resolve in the check-attribution job. Add the AUTHOR_MAP entry.
kshitijk4poor
enabled auto-merge
June 15, 2026 11:42
This was referenced Jun 15, 2026
T02200059
pushed a commit
to T02200059/hermes-agent
that referenced
this pull request
Jun 18, 2026
…oauth-profile-writethrough fix(auth): resolve xAI OAuth credentials across profiles + write rotated tokens back to root
Closed
13 tasks
1 task
waefrebeorn
pushed a commit
to waefrebeorn/slermes
that referenced
this pull request
Jul 2, 2026
…oauth-profile-writethrough fix(auth): resolve xAI OAuth credentials across profiles + write rotated tokens back to root
Methodician
added a commit
to Methodician/hermes-agent
that referenced
this pull request
Jul 4, 2026
…oauth-profile-writethrough fix(auth): resolve xAI OAuth credentials across profiles + write rotated tokens back to root
habarmc1223-sudo
pushed a commit
to habarmc1223-sudo/hermes-agent-fluxmem
that referenced
this pull request
Jul 8, 2026
…oauth-profile-writethrough fix(auth): resolve xAI OAuth credentials across profiles + write rotated tokens back to root
santhreal
pushed a commit
to santhreal/hermes-agent
that referenced
this pull request
Jul 13, 2026
…oauth-profile-writethrough fix(auth): resolve xAI OAuth credentials across profiles + write rotated tokens back to root
Gravezzz
pushed a commit
to Gravezzz/hermes-agent
that referenced
this pull request
Jul 21, 2026
…oauth-profile-writethrough fix(auth): resolve xAI OAuth credentials across profiles + write rotated tokens back to root
This was referenced Jul 23, 2026
9 tasks
leewenjie
pushed a commit
to leewenjie/hermes-agent
that referenced
this pull request
Aug 7, 2026
…oauth-profile-writethrough fix(auth): resolve xAI OAuth credentials across profiles + write rotated tokens back to root
19 tasks
melon-xf
added a commit
to melon-xf/hermes-agent
that referenced
this pull request
Sep 3, 2026
…oauth-profile-writethrough fix(auth): resolve xAI OAuth credentials across profiles + write rotated tokens back to root
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Salvages #38440 (@capt-marbles) onto current main and pairs it with the write-through half of the fix so the cross-profile xAI OAuth grant stays coherent in both directions.
Commits
_read_xai_oauth_tokensnow resolves usable xAI OAuth tokens through profile state → profile credential pool → global-root store, so profile/cron contexts stop raisingxai_auth_missing_access_tokenwhen usable credentials exist (fixes the read side of xAI OAuth credential resolution broken in Docker sandboxes (hermes-default, coding-agent) #39276).providers.xai-oauthblock (i.e. it read root via fallback), the rotated chain is written back to root too — best-effort, TOCTOU-safe (reuses_save_auth_storewith an explicit target path), with a pytest seat belt. A profile that genuinely shadows root is untouched; classic mode is a no-op; a failed root write never breaks the profile's own save.Why both halves
resolve_xai_http_credentials(x_search / image_gen / TTS) already funnels through_read_xai_oauth_tokens, so commit 1 fixes the HTTP path at the single chokepoint too. But read-fallback without write-through is exactly the trap #43589 documents, so they must land together.Tests
test_auth_xai_oauth_provider(82) +test_auth_profile_fallback(16) green — the_save_auth_storeoptional-target signature is back-compatible.Closes #43589. Supersedes the read-path duplicates #43513 and #39069 (same fix, further downstream + larger).