mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-07-31 19:16:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fix(auth): stop JWT refreshes from status polling

Browse source
This commit is contained in:
Shannon Sands 2026-07-13 13:53:38 +10:00 • committed by Teknium
parent 3ab583044a
commit 0764163f80
3 changed files with 154 additions and 100 deletions
Download patch file Download diff file Expand all files Collapse all files

49
hermes_cli/auth.py
View file

@ -2328,7 +2328,7 @@ def _log_nous_invoke_jwt_selected(
access_token: Any,
sequence_id: Optional[str] = None,
) -> None:
logger.info("Nous inference auth: using NAS invoke JWT")
logger.debug("Nous inference auth: using NAS invoke JWT")
_oauth_trace(
"nous_invoke_jwt_selected",
sequence_id=sequence_id,
@ -6540,7 +6540,9 @@ def get_nous_session_validity() -> str:
non-terminal error). Never triggers a re-mint.
Determinable with NO working token — it reads local auth-store state only,
which is exactly the condition a dead hosted box is in.
which is exactly the condition a dead hosted box is in. This function is
called by the frequently-polled public ``/api/status`` endpoint, so it must
never resolve credentials or perform an OAuth refresh.
ANTI-FLAP CONTRACT: only a *terminal* failure maps to "terminal". A normal
mid-rotation blip, a transient network error, or a merely-expiring token
@ -6557,34 +6559,29 @@ def get_nous_session_validity() -> str:
try:
state = get_provider_auth_state("nous")
except Exception:
state = None
if state:
last_err = state.get("last_auth_error")
if isinstance(last_err, dict) and last_err.get("relogin_required"):
# Only terminal while there is no usable credential left. If a later
# successful login repopulated tokens, the stale marker must not
# keep reporting terminal.
if not (state.get("access_token") or state.get("refresh_token")):
return NOUS_SESSION_TERMINAL
try:
status = get_nous_auth_status()
except Exception:
# Status computation itself failed — indeterminate, not terminal.
return NOUS_SESSION_UNKNOWN
if status.get("logged_in"):
if not state:
return NOUS_SESSION_UNKNOWN
last_err = state.get("last_auth_error")
if isinstance(last_err, dict) and last_err.get("relogin_required"):
# Only terminal while there is no usable credential left. If a later
# successful login repopulated tokens, the stale marker must not
# keep reporting terminal.
if not (state.get("access_token") or state.get("refresh_token")):
return NOUS_SESSION_TERMINAL
if _nous_invoke_jwt_status(
state.get("access_token"),
scope=state.get("scope"),
expires_at=state.get("expires_at"),
) is None:
return NOUS_SESSION_VALID
# Not logged in. Distinguish a terminal (relogin-required) failure from a
# transient / indeterminate one. Only the former is actionable by NAS.
if status.get("relogin_required"):
return NOUS_SESSION_TERMINAL
# No Nous provider state at all, or a non-terminal not-logged-in condition
# (e.g. a transient refresh error that did not set relogin_required). Treat
# as unknown so a healthy box mid-blip never triggers a re-mint.
# Missing, malformed, expired, or merely expiring credentials are not proof
# of a terminal session. Runtime inference/keepalive paths own refreshes;
# the health endpoint remains side-effect free and reports indeterminate.
return NOUS_SESSION_UNKNOWN