fix(agent): improve Codex OAuth 401 error message to cover server-side token invalidation (#65346) - #65396
Open
kyssta-exe wants to merge 1 commit into
Open
fix(agent): improve Codex OAuth 401 error message to cover server-side token invalidation (#65346)#65396kyssta-exe wants to merge 1 commit into
kyssta-exe wants to merge 1 commit into
Conversation
…e token invalidation (NousResearch#65346) The existing error message told users their Codex OAuth token might have been 'refreshed by another client' but OpenAI Codex also invalidates tokens server-side (verified: tokens with 10-day declarations fail after ~2.5 days with 'token_invalidated'). The message now covers both causes and uses the explicit command for a more targeted re-auth path.
alt-glitch
added
type/bug
teknium1
reviewed
Jul 16, 2026
teknium1
left a comment
teknium1
left a comment
Contributor
There was a problem hiding this comment.
Thanks for improving the misleading Codex OAuth recovery guidance. The current-main handler still emits the older client-refresh-only wording at agent/conversation_loop.py:3894-3897, so the message update remains useful.
Problems
agent/conversation_loop.py:3898changes the instruction tohermes auth openai-codex, but the CLI parser definesopenai-codexas the provider argument underhermes auth add(hermes_cli/subcommands/auth.py:18-23). The documented supported form ishermes auth add openai-codex(website/docs/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-hermes-agent.md:121).
Suggested changes
- Replace the new command with
hermes auth add openai-codex. - Add a focused regression test for this provider-specific 401 guidance path.
Automated hermes-sweeper review.
| agent._vprint(f"{agent.log_prefix} To fix:", force=True) | ||
| agent._vprint(f"{agent.log_prefix} 1. Run `codex` in your terminal to generate fresh tokens.", force=True) | ||
| agent._vprint(f"{agent.log_prefix} 2. Then run `hermes auth` to re-authenticate.", force=True) | ||
| agent._vprint(f"{agent.log_prefix} 2. Then run `hermes auth openai-codex` to re-authenticate.", force=True) |
Contributor
There was a problem hiding this comment.
openai-codex is accepted as the provider argument only under hermes auth add (hermes_cli/subcommands/auth.py:18-23). Please use hermes auth add openai-codex; the current command form is not registered.
teknium1
added
sweeper:risk-compatibility
1 task
Contributor
SummaryOf the 33 listed PRs, only #65396 directly addresses #65346; its diff improves Codex OAuth 401 guidance but does not change token refresh, persistence, or recovery, so it is the recorded best available yet partial fix. The other 32 PRs cover separate Anthropic, Nous, MiniMax, or diagnostic paths rather than the reported Codex credential lifecycle. Related pull requests
DuplicatesAnthropic refresh: #2741 and #2968 were superseded by merged #3246. Anthropic login endpoint cluster: #45254, #45339, #45441, #46251, #46769, #47333, #47474, #47765, #48704, #48706, #48957, #49356, #50982, and #53971 substantially overlap, with #51723 as the merged canonical implementation; #47989 and #47992 are rejected endpoint/redirect variants. Anthropic UA cluster: #48580, #48687, and #51948 were superseded by #56263, while #57922 was salvaged into merged #58178. Diagnostics: #55552 overlaps the Anthropic portion of #54221. Suggested consolidationKeep #65396 open with a salvage path: correct the re-authentication command to Complex graphflowchart LR
classDef open fill:#dbeafe,stroke:#1d4ed8,color:#1e3a8a
classDef merged fill:#dcfce7,stroke:#15803d,color:#14532d
classDef closed fill:#e5e7eb,stroke:#6b7280,color:#1f2937
classDef unverified fill:#f3f4f6,stroke:#9ca3af,color:#374151
classDef best stroke-width:3px,stroke:#b45309
classDef target stroke-width:3px,stroke:#4338ca
I65346(["issue #65346 (open)"])
P65396["PR #65396 (open)"]
P65396 -->|best fix| I65346
class I65346 open
class P65396 open
class P65396 best
class P65396 target
click I65346 "https://github.com/NousResearch/hermes-agent/issues/65346"
click P65396 "https://github.com/NousResearch/hermes-agent/pull/65396"
Graph: solid arrow = fixes / best fix, dashed arrow = partial or unverified (see edge label); boxed group = PRs duplicating each other; amber border = best fix; indigo border = target; gray node = closed (state tag in the node label). Cross-PR triage: Reviewed 33 pull requests and 15 issues in this complex. Each diff was read against this issue; Assessment working set: 202 kB of PR diffs, 172 kB of issue/PR text, 66 kB of discussion (93 comments), 48 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
OpenAI Codex OAuth tokens are invalidated server-side after ~2.5 days despite a 10-day declared expiration. When Hermes receives HTTP 401
token_invalidated, the error message only says the token 'may have been refreshed by another client (Codex CLI, VS Code)' — this is misleading when the actual cause is server-side invalidation.Root Cause
The Codex OAuth provider revokes access tokens before their natural expiration. Hermes correctly attempts a credential refresh but the refresh token is also invalidated, making recovery impossible without manual re-authentication. The existing error message did not mention server-side invalidation as a possibility.
Fix
Improved the HTTP 401 error message for Codex OAuth to:
To fix:labelhermes auth openai-codexre-auth commandCloses #65346
Testing
python -m py_compile agent/conversation_loop.py)