mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-08-13 17:16:12 +00:00
6ea01262fc
An expired access token could pause Honcho memory for hours with no user-facing signal: ensure_fresh_token swallowed every exchange failure and returned the stale token, no code handled a 401 from the Honcho API, and each failed dialectic cycle widened the cadence backoff. Hypothesis for the trigger (not confirmed): the refresh POST times out after the server already rotated the token pair, Hermes keeps the old refresh token, and the eventual replay lands outside the server's 60-second rotation grace window, which revokes the whole grant. - oauth: the exchange reads the token endpoint's error body instead of discarding it. invalid_grant and other permanent OAuth errors mark the grant dead so no code retries a revoked grant; transient failures retry once immediately, which keeps a replayed refresh token inside the grace window. Log lines redact token values. - oauth: force_refresh_token() rotates the token now, ignoring local expiry, to recover from a server-side 401. - session: dialectic_query and _flush_session treat a 401 as a trigger to force one token rotation and retry the call exactly once. A persistent auth failure raises HonchoAuthError (dialectic) or records the failure (sync) instead of being returned as an empty result. - provider: injects a one-time notice into the memory context so the model tells the user memory is paused and 'hermes honcho setup' restores it. Auth failures no longer widen the dialectic cadence backoff. New tests cover the exchange retry, invalid_grant terminality plus re-login recovery, forced refresh, 401 retry on both the sync and dialectic paths, the one-time notice, and the backoff exemption.