feat(gateway): share_auth on profiles.create + MCP servers in profiles.describe/configure - #85963
Merged
Merged
Conversation
Contributor
૮ >ﻌ< ა ci reviewran on 274ed9d — feat(gateway): share_auth on profiles.create + MCP servers i
|
alt-glitch
added
type/feature
…e/configure
Three widenings for capabilities UIs (Bot Mode's bot builder):
1. profiles.create share_auth (default false): skip the auth.json
COPY so the new profile reads OAuth/token state through the
existing global-root fallback and refreshes write through to it.
A copy forks token state — the first refresh on either side
invalidates the other for single-use refresh tokens; sharing keeps
ONE live token pool for the main profile and every bot. Static
.env keys still copy (no refresh semantics). Receipt:
mirrored.auth = 'shared'.
2. profiles.describe reports mcp_servers
[{name, enabled, transport}] from the profile's config.
3. profiles.configure accepts enabled_mcp_servers (replace
semantics): toggles via the standard disabled flag; enabling a
server the profile lacks copies its definition from the launch
profile's catalog (names never invented). Launch catalog read
BEFORE the home override flips config resolution.
E2E: describe keys include mcp_servers; create with share_auth ->
mirrored.auth='shared' + no auth.json in the profile dir; configure
applied.mcp_servers=true.
teknium1
force-pushed
the
feat/profile-create-shared-auth-mcp
branch
from
August 14, 2026 09:03
9971064 to
274ed9d
Compare
skappafrost
pushed a commit
to skappafrost/hermes-agent
that referenced
this pull request
Aug 15, 2026
…e/configure (NousResearch#85963) Three widenings for capabilities UIs (Bot Mode's bot builder): 1. profiles.create share_auth (default false): skip the auth.json COPY so the new profile reads OAuth/token state through the existing global-root fallback and refreshes write through to it. A copy forks token state — the first refresh on either side invalidates the other for single-use refresh tokens; sharing keeps ONE live token pool for the main profile and every bot. Static .env keys still copy (no refresh semantics). Receipt: mirrored.auth = 'shared'. 2. profiles.describe reports mcp_servers [{name, enabled, transport}] from the profile's config. 3. profiles.configure accepts enabled_mcp_servers (replace semantics): toggles via the standard disabled flag; enabling a server the profile lacks copies its definition from the launch profile's catalog (names never invented). Launch catalog read BEFORE the home override flips config resolution. E2E: describe keys include mcp_servers; create with share_auth -> mirrored.auth='shared' + no auth.json in the profile dir; configure applied.mcp_servers=true.
bobaba76
pushed a commit
to bobaba76/hermes-agent
that referenced
this pull request
Aug 27, 2026
…e/configure (NousResearch#85963) Three widenings for capabilities UIs (Bot Mode's bot builder): 1. profiles.create share_auth (default false): skip the auth.json COPY so the new profile reads OAuth/token state through the existing global-root fallback and refreshes write through to it. A copy forks token state — the first refresh on either side invalidates the other for single-use refresh tokens; sharing keeps ONE live token pool for the main profile and every bot. Static .env keys still copy (no refresh semantics). Receipt: mirrored.auth = 'shared'. 2. profiles.describe reports mcp_servers [{name, enabled, transport}] from the profile's config. 3. profiles.configure accepts enabled_mcp_servers (replace semantics): toggles via the standard disabled flag; enabling a server the profile lacks copies its definition from the launch profile's catalog (names never invented). Launch catalog read BEFORE the home override flips config resolution. E2E: describe keys include mcp_servers; create with share_auth -> mirrored.auth='shared' + no auth.json in the profile dir; configure applied.mcp_servers=true.
melon-xf
added a commit
to melon-xf/hermes-agent
that referenced
this pull request
Sep 3, 2026
…e/configure (NousResearch#85963) Three widenings for capabilities UIs (Bot Mode's bot builder): 1. profiles.create share_auth (default false): skip the auth.json COPY so the new profile reads OAuth/token state through the existing global-root fallback and refreshes write through to it. A copy forks token state — the first refresh on either side invalidates the other for single-use refresh tokens; sharing keeps ONE live token pool for the main profile and every bot. Static .env keys still copy (no refresh semantics). Receipt: mirrored.auth = 'shared'. 2. profiles.describe reports mcp_servers [{name, enabled, transport}] from the profile's config. 3. profiles.configure accepts enabled_mcp_servers (replace semantics): toggles via the standard disabled flag; enabling a server the profile lacks copies its definition from the launch profile's catalog (names never invented). Launch catalog read BEFORE the home override flips config resolution. E2E: describe keys include mcp_servers; create with share_auth -> mirrored.auth='shared' + no auth.json in the profile dir; configure applied.mcp_servers=true.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three generic widenings any multi-profile capabilities UI needs (Bot Mode's bot builder is the first consumer):
1.
share_authonprofiles.create(default false — current copy behavior unchanged). When set, the auth.json COPY is skipped so the new profile resolves OAuth/token state through the existing global-root fallback chain (_load_global_auth_storereads; refreshes write through). Copying forks token state: the first refresh on either side invalidates the other for single-use refresh tokens (Anthropic/Copilot OAuth). Sharing keeps ONE live token pool across the main profile and every bot — subscriptions and OAuths just work, permanently. Static.envkeys still copy (no refresh semantics, copying is safe). Receipt:mirrored.auth = 'shared'.2.
profiles.describereportsmcp_servers—[{name, enabled, transport}]from the profile's config, so capability UIs can list them without parsing raw config.3.
profiles.configureacceptsenabled_mcp_servers(replace semantics, mirroringenabled_toolsets): toggles entries via the standarddisabledflag; enabling a server the profile doesn't define copies the definition from the launch profile's catalog (read BEFORE the home override flips config resolution; unknown names skipped, never invented). Definitions are config, not secrets — credentials stay in .env/auth.E2E against a live HERMES_HOME: describe includes
mcp_servers; create withshare_auth→mirrored.auth='shared'and no auth.json in the profile dir; configure →applied.mcp_servers=true.