fix(auth): address Nous JWT fallback review

tests/hermes_cli/test_proxy.py

@@ -105,7 +105,7 @@ def test_nous_adapter_authenticated_with_agent_key(tmp_path, monkeypatch):
 
 
 def test_nous_adapter_authenticated_with_refresh_token_only(tmp_path, monkeypatch):
-    """If access_token+refresh_token exist but no agent_key yet, we can still mint."""
+    """If access_token+refresh_token exist but no agent_key yet, we can still refresh."""
     monkeypatch.setenv("HERMES_HOME", str(tmp_path))
     _write_auth_store(tmp_path, {
         "access_token": "access-tok",
@@ -125,7 +125,7 @@ def test_nous_adapter_get_credential_uses_runtime_resolver(tmp_path, monkeypatch
     })
 
     refreshed_state = {
-        "api_key": "minted-bearer",
+        "api_key": "jwt-bearer",
         "base_url": "https://inference-api.nousresearch.com/v1",
         "expires_at": "2099-01-01T00:00:00Z",
     }
@@ -138,13 +138,13 @@ def test_nous_adapter_get_credential_uses_runtime_resolver(tmp_path, monkeypatch
         cred = adapter.get_credential()
 
     mock_resolve.assert_called_once()
-    assert cred.bearer == "minted-bearer"
+    assert cred.bearer == "jwt-bearer"
     assert cred.base_url == "https://inference-api.nousresearch.com/v1"
     assert cred.expires_at == "2099-01-01T00:00:00Z"
     assert cred.token_type == "Bearer"
 
 
-def test_nous_adapter_retry_credential_does_not_fallback_on_jwt_401(tmp_path, monkeypatch):
+def test_nous_adapter_retry_credential_force_refreshes_on_jwt_401(tmp_path, monkeypatch):
     monkeypatch.setenv("HERMES_HOME", str(tmp_path))
     _write_auth_store(tmp_path, {
         "access_token": "jwt-access",
@@ -154,9 +154,15 @@ def test_nous_adapter_retry_credential_does_not_fallback_on_jwt_401(tmp_path, mo
         "inference_base_url": "https://inference-api.nousresearch.com/v1",
         "agent_key": "jwt-access",
     })
+    refreshed_state = {
+        "api_key": "fresh-jwt-bearer",
+        "base_url": "https://inference-api.nousresearch.com/v1",
+        "expires_at": "2099-01-01T00:00:00Z",
+    }
 
     with patch(
         "hermes_cli.proxy.adapters.nous_portal.resolve_nous_runtime_credentials",
+        return_value=refreshed_state,
     ) as mock_resolve:
         adapter = NousPortalAdapter()
         cred = adapter.get_retry_credential(
@@ -167,11 +173,13 @@ def test_nous_adapter_retry_credential_does_not_fallback_on_jwt_401(tmp_path, mo
             status_code=401,
         )
 
-    assert cred is None
-    mock_resolve.assert_not_called()
+    assert cred is not None
+    assert cred.bearer == "fresh-jwt-bearer"
+    assert mock_resolve.call_args.kwargs["force_refresh"] is True
+    assert mock_resolve.call_args.kwargs["inference_auth_mode"] == "auto"
 
 
-def test_nous_adapter_retry_credential_skips_opaque_bearer(tmp_path, monkeypatch):
+def test_nous_adapter_retry_credential_skips_non_401(tmp_path, monkeypatch):
     monkeypatch.setenv("HERMES_HOME", str(tmp_path))
     _write_auth_store(tmp_path, {
         "access_token": "jwt-access",
@@ -188,7 +196,7 @@ def test_nous_adapter_retry_credential_skips_opaque_bearer(tmp_path, monkeypatch
                 bearer="opaque-bearer",
                 base_url="https://inference-api.nousresearch.com/v1",
             ),
-            status_code=401,
+            status_code=403,
         )
 
     assert cred is None