Skip to content

feat(auth): support named credentials with manual selection + session-scoped auth (#76937) - #77583

Open
TCK0423 wants to merge 4 commits into
NousResearch:mainfrom
TCK0423:feat/multi-key-auth
Open

feat(auth): support named credentials with manual selection + session-scoped auth (#76937)#77583
TCK0423 wants to merge 4 commits into
NousResearch:mainfrom
TCK0423:feat/multi-key-auth

Conversation

@TCK0423

@TCK0423 TCK0423 commented Aug 3, 2026

Copy link
Copy Markdown

Summary

Cherry-picks webtecnica's PR #76987 and fixes the three blocking issues from teknium1's review.

What this PR adds

  • hermes auth add openrouter --api-key sk-or-xxx --name daily — name credentials at add time
  • default_auth in config.yaml — profile-wide default credential name per provider
  • Named credentials are persisted through pool persistence (survive restarts)
  • select() and peek() narrow to named credential when available; fall back to auto-rotate when exhausted

Fixes vs original PR #76987

  1. acquire_lease() now narrows to default_auth — delegated subagent tasks respect the configured credential name.
  2. HERMES_AUTH_NAME env var for per-session credential override (precedes config default_auth).
  3. Regression tests for session-env override, fallback, and acquire_lease narrowing.

Verification

  • 12/12 tests passed (test_credential_pool_named_selection)
  • 58/58 existing credential_pool tests still pass

Co-authored-by: webtecnica webtecnica@gmail.com

webtecnica and others added 4 commits August 3, 2026 18:41
@webtecnica @TCK0423
feat(skills): add skill group organization (NousResearch#76830)
478a515 
With 60+ skills installed, 'hermes skills list' is a flat list that gets
hard to navigate. This adds named skill groups:

- hermes skills group add <group> <skill> [skill ...] — create a group
  and associate skills with it (dedupes, warns about skills that are not
  currently installed)
- hermes skills group remove <group> [skill ...] — remove skills from a
  group, or delete the whole group (rm alias)
- hermes skills group list (ls) — show groups and members, --json for
  scripting
- hermes skills list --group <name> — filter the installed-skills table
  to a group; unknown groups print an error listing available groups

Groups are stored in config.yaml under skills.groups (group name ->
list of skill names), consistent with how skills.disabled is persisted.
They are purely organizational and do not change how skills load.

Also wires --group through the /skills list slash command.

Closes NousResearch#76830
@TCK0423 @webtecnica
fix(skills): reject --group with no value or flag-like value in slash…
872dcde 
… /skills list

Cherry-picks webtecnica's PR NousResearch#76985 (skill group organization) and fixes
the two blocking slash-command parser issues:

- /skills list --group (no value) now prints an error instead of listing
  unfiltered
- /skills list --group --source hub now rejects the flag-like value
  instead of consuming --source as the group name

Includes the full NousResearch#76985 feature set: skills.groups config, hermes skills
group add/remove/list, and --group filter on hermes skills list.

Co-authored-by: webtecnica <webtecnica@gmail.com>
@webtecnica @TCK0423
feat(auth): support named credentials with manual selection (NousRese…
6a6b0a8 
…arch#76937)
@TCK0423 @webtecnica
fix(auth): narrow acquire_lease to default_auth + session-scoped auth…
258ed13 
… env var

Builds on webtecnica's PR NousResearch#76987 (named credential persistence) and fixes
the three blocking issues from teknium1's review:

1. acquire_lease() now narrows to default_auth like select() does,
   so delegated subagent tasks respect the configured credential name.

2. Added HERMES_AUTH_NAME env var for per-session credential override
   (precedes config default_auth). This enables hermes chat --auth <name>.

3. Regression tests for session-env override, fallback, and
   acquire_lease narrowing.

Co-authored-by: webtecnica <webtecnica@gmail.com>
@alt-glitch alt-glitch added type/feature New feature or request comp/agent Core agent runtime: loop, agent_init, prompt builder, context-compression, responses endpoint comp/cli CLI entry point, hermes_cli/, setup wizard tool/skills Skills system (list, view, manage) area/auth Authentication, OAuth, credential pools P3 Low — cosmetic, nice to have needs-decision Awaiting maintainer decision before any implementation sweeper:risk-security-boundary Sweeper risk: may affect sandboxing, auth, credentials, or sensitive data sweeper:risk-compatibility Sweeper risk: may break existing users, config, migrations, defaults, or upgrades labels Aug 3, 2026
@alt-glitch

alt-glitch commented Aug 3, 2026

Copy link
Copy Markdown
Collaborator

This was generated by AI during triage.

Related to #76987 and #77580. This composite branch retains both feature implementations while adding session-scoped credential selection and slash-command parser hardening; please choose a consolidation path.

@briandevans briandevans mentioned this pull request Aug 8, 2026
Open
19 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/auth Authentication, OAuth, credential pools comp/agent Core agent runtime: loop, agent_init, prompt builder, context-compression, responses endpoint comp/cli CLI entry point, hermes_cli/, setup wizard needs-decision Awaiting maintainer decision before any implementation P3 Low — cosmetic, nice to have sweeper:risk-compatibility Sweeper risk: may break existing users, config, migrations, defaults, or upgrades sweeper:risk-security-boundary Sweeper risk: may affect sandboxing, auth, credentials, or sensitive data tool/skills Skills system (list, view, manage) type/feature New feature or request

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@TCK0423 @alt-glitch @webtecnica