seb/hermes-agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

review: validate refresh_token, path-agnostic recovery log, map author email

Browse Source 
Addresses PR review feedback:
- Validate refresh_token (not only access_token) before persisting the
  re-imported Codex token, so a half-token payload can't silently break the
  next refresh cycle.
- Make the recovery log path-agnostic ("Codex CLI auth.json") since
  _import_codex_cli_tokens can read $CODEX_HOME, not only ~/.codex.
- Add regression test: relogin-required + imported token missing refresh_token
  -> re-raise and persist nothing.
- Map kenmege@yahoo.com -> Kenmege in scripts/release.py AUTHOR_MAP
  (fixes the check-attribution job).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Kennedy Umege
2026-06-13 05:15:26 -07:00
committed by Teknium
co-authored by Claude Opus 4.8
parent bd66e7e3fb
commit 311ff967de
3 changed files with 33 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hermes_cli/auth.py
+8 -2
View File
@@ -3682,10 +3682,16 @@ def _refresh_codex_auth_tokens(
if not getattr(exc, "relogin_required", False):
raise
imported = _import_codex_cli_tokens()
if not (imported and str(imported.get("access_token", "") or "").strip()):
# Require BOTH tokens before adopting: persisting a payload without a
# usable refresh_token would only break the next refresh cycle.
if not (
imported
and str(imported.get("access_token", "") or "").strip()
and str(imported.get("refresh_token", "") or "").strip()
):
raise
logger.info(
"Codex refresh_token rejected (%s); recovered from ~/.codex/auth.json.",
"Codex refresh_token rejected (%s); recovered from Codex CLI auth.json.",
getattr(exc, "code", None) or "auth_error",
)
_save_codex_tokens(imported)