fix(auth): key reentrancy by auth store path

Remove the dynamic active-store holder so a profile context switch cannot inherit another auth store's lock depth and skip its kernel lock.

hermes_cli/auth.py

@@ -984,7 +984,6 @@ def _auth_lock_path() -> Path:
     return _auth_file_path().with_suffix(".lock")
 
 
-_auth_lock_holder = threading.local()
 _auth_target_lock_holders: Dict[str, threading.local] = {}
 _auth_target_lock_holders_guard = threading.Lock()
 
@@ -997,10 +996,7 @@ def _same_path(left: Path, right: Path) -> bool:
 
 
 def _auth_lock_holder_for(target_path: Path) -> threading.local:
-    """Return a reentrancy tracker scoped to one auth-store lock path."""
-    active_path = _auth_file_path()
-    if _same_path(target_path, active_path):
-        return _auth_lock_holder
+    """Return a reentrancy tracker keyed to one canonical auth-store path."""
     try:
         key = str(target_path.resolve(strict=False))
     except Exception:

tests/hermes_cli/test_auth_profile_fallback.py

@@ -490,3 +490,32 @@ def test_provider_state_transaction_locks_global_fallback_before_use(
         profile_env["profile"] / "auth.lock",
         profile_env["global"] / "auth.lock",
     ]
+
+
+def test_auth_lock_reentrancy_is_scoped_after_profile_context_switch(profile_env):
+    """Changing profile context cannot inherit another store's lock depth."""
+    import hermes_cli.auth as auth
+    from hermes_constants import reset_hermes_home_override, set_hermes_home_override
+
+    profile_b = profile_env["global"] / "profiles" / "reviewer"
+    profile_b.mkdir(parents=True)
+    profile_b_lock = profile_b / "auth.lock"
+
+    with auth._auth_store_lock():
+        holder_a = auth._auth_lock_holder_for(profile_env["profile"] / "auth.json")
+        assert getattr(holder_a, "depth", 0) == 1
+
+        token = set_hermes_home_override(profile_b)
+        try:
+            holder_b = auth._auth_lock_holder_for(profile_b / "auth.json")
+            assert holder_b is not holder_a
+            assert getattr(holder_b, "depth", 0) == 0
+            assert not profile_b_lock.exists()
+
+            with auth._auth_store_lock():
+                assert profile_b_lock.exists()
+                assert getattr(holder_b, "depth", 0) == 1
+        finally:
+            reset_hermes_home_override(token)
+
+    assert getattr(holder_a, "depth", 0) == 0