hermes-agent/agent
Teknium f268215019
fix(auth): codex auth remove no longer silently undone by auto-import (#11485)
* feat(skills): add 'hermes skills reset' to un-stick bundled skills

When a user edits a bundled skill, sync flags it as user_modified and
skips it forever. The problem: if the user later tries to undo the edit
by copying the current bundled version back into ~/.hermes/skills/, the
manifest still holds the old origin hash from the last successful
sync, so the fresh bundled hash still doesn't match and the skill stays
stuck as user_modified.

Adds an escape hatch for this case.

  hermes skills reset <name>
      Drops the skill's entry from ~/.hermes/skills/.bundled_manifest and
      re-baselines against the user's current copy. Future 'hermes update'
      runs accept upstream changes again. Non-destructive.

  hermes skills reset <name> --restore
      Also deletes the user's copy and re-copies the bundled version.
      Use when you want the pristine upstream skill back.

Also available as /skills reset in chat.

- tools/skills_sync.py: new reset_bundled_skill(name, restore=False)
- hermes_cli/skills_hub.py: do_reset() + wired into skills_command and
  handle_skills_slash; added to the slash /skills help panel
- hermes_cli/main.py: argparse entry for 'hermes skills reset'
- tests/tools/test_skills_sync.py: 5 new tests covering the stuck-flag
  repro, --restore, unknown-skill error, upstream-removed-skill, and
  no-op on already-clean state
- website/docs/user-guide/features/skills.md: new 'Bundled skill updates'
  section explaining the origin-hash mechanic + reset usage

* fix(auth): codex auth remove no longer silently undone by auto-import

'hermes auth remove openai-codex' appeared to succeed but the credential
reappeared on the next command.  Two compounding bugs:

1. _seed_from_singletons() for openai-codex unconditionally re-imports
   tokens from ~/.codex/auth.json whenever the Hermes auth store is
   empty (by design — the Codex CLI and Hermes share that file).  There
   was no suppression check, unlike the claude_code seed path.

2. auth_remove_command's cleanup branch only matched
   removed.source == 'device_code' exactly.  Entries added via
   'hermes auth add openai-codex' have source 'manual:device_code', so
   for those the Hermes auth store's providers['openai-codex'] state was
   never cleared on remove — the next load_pool() re-seeded straight
   from there.

Net effect: there was no way to make a codex removal stick short of
manually editing both ~/.hermes/auth.json and ~/.codex/auth.json before
opening Hermes again.

Fix:

- Add unsuppress_credential_source() helper (mirrors
  suppress_credential_source()).
- Gate the openai-codex branch in _seed_from_singletons() with
  is_source_suppressed(), matching the claude_code pattern.
- Broaden auth_remove_command's codex match to handle both
  'device_code' and 'manual:device_code' (via endswith check), always
  call suppress_credential_source(), and print guidance about the
  unchanged ~/.codex/auth.json file.
- Clear the suppression marker in auth_add_command's openai-codex
  branch so re-linking via 'hermes auth add openai-codex' works.

~/.codex/auth.json is left untouched — that's the Codex CLI's own
credential store, not ours to delete.

Tests cover: unsuppress helper behavior, remove of both source
variants, add clears suppression, seed respects suppression.  E2E
verified: remove → load → add → load flow now behaves correctly.
2026-04-17 04:10:17 -07:00
..
__init__.py Refactor Terminal and AIAgent cleanup 2026-02-21 22:31:43 -08:00
anthropic_adapter.py fix(agent): downgrade xhigh→max on Anthropic pre-4.7 adaptive models 2026-04-16 12:00:56 -07:00
auxiliary_client.py fix(agent): complete Claude Opus 4.7 API migration 2026-04-16 10:48:20 -07:00
bedrock_adapter.py feat: native AWS Bedrock provider via Converse API 2026-04-15 16:17:17 -07:00
context_compressor.py fix(context_compressor): always keep last user message in tail to prevent active-task loss 2026-04-16 07:45:31 -07:00
context_engine.py refactor: remove dead code — 1,784 lines across 77 files (#9180) 2026-04-13 16:32:04 -07:00
context_references.py fix(agent): preserve quoted @file references with spaces 2026-04-10 13:05:01 -07:00
copilot_acp_client.py fix: handle httpx.Timeout object in CopilotACPClient (#11058) 2026-04-16 12:05:11 -07:00
credential_pool.py fix(auth): codex auth remove no longer silently undone by auto-import (#11485) 2026-04-17 04:10:17 -07:00
display.py fix: remove context pressure warnings entirely (#11039) 2026-04-16 06:44:23 -07:00
error_classifier.py feat: native AWS Bedrock provider via Converse API 2026-04-15 16:17:17 -07:00
gemini_cloudcode_adapter.py feat(gemini): add Google Gemini CLI OAuth provider via Cloud Code Assist (free + paid tiers) (#11270) 2026-04-16 16:49:00 -07:00
google_code_assist.py feat(gemini): add Google Gemini CLI OAuth provider via Cloud Code Assist (free + paid tiers) (#11270) 2026-04-16 16:49:00 -07:00
google_oauth.py feat(gemini): add Google Gemini CLI OAuth provider via Cloud Code Assist (free + paid tiers) (#11270) 2026-04-16 16:49:00 -07:00
insights.py fix(insights): hide cache read/write and cost metrics from display (#11477) 2026-04-17 01:02:06 -07:00
manual_compression_feedback.py fix(gateway): make manual compression feedback truthful 2026-04-10 21:16:53 -07:00
memory_manager.py feat(honcho): context injection overhaul, 5-tool surface, cost safety, session isolation (#10619) 2026-04-15 19:12:19 -07:00
memory_provider.py refactor(memory): drop on_session_reset — commit-only is enough 2026-04-15 11:28:45 -07:00
model_metadata.py fix(agent): complete Claude Opus 4.7 API migration 2026-04-16 10:48:20 -07:00
models_dev.py feat: add Ollama Cloud as built-in provider 2026-04-16 02:22:09 -07:00
nous_rate_guard.py fix: Nous Portal rate limit guard — prevent retry amplification (#10568) 2026-04-15 16:31:48 -07:00
prompt_builder.py fix(prompt): list all supported Telegram markdown formatting 2026-04-15 17:54:13 -07:00
prompt_caching.py fix(prompt-caching): skip top-level cache_control on role:tool for OpenRouter 2026-03-21 16:54:43 -07:00
rate_limit_tracker.py refactor: remove dead code — 1,784 lines across 77 files (#9180) 2026-04-13 16:32:04 -07:00
redact.py fix(security): add JWT token and Discord mention redaction (#10547) 2026-04-15 16:08:52 -07:00
retry_utils.py feat(agent): add jittered retry backoff 2026-04-08 00:41:36 -07:00
skill_commands.py fix: use absolute skill_dir for external skills (#10313) (#10587) 2026-04-15 17:22:55 -07:00
skill_utils.py feat(plugins): namespaced skill registration for plugin skill bundles 2026-04-14 10:42:58 -07:00
smart_model_routing.py fix: UTF-8 config encoding, pairing hint, credential_pool key, header normalization (#7174) 2026-04-10 05:33:48 -07:00
subdirectory_hints.py fix(agent): catch PermissionError in subdirectory hint discovery 2026-04-09 03:10:30 -07:00
title_generator.py fix: title_generator no longer logs as 'compression' task 2026-04-12 04:17:18 -07:00
trajectory.py Refactor Terminal and AIAgent cleanup 2026-02-21 22:31:43 -08:00
usage_pricing.py feat: native AWS Bedrock provider via Converse API 2026-04-15 16:17:17 -07:00