{"repo":"NousResearch/hermes-agent","public_id":"121649","display_label":"Nous OAuth refresh token single-use pool fixes","summary":"These issues and pull requests address a bug where Nous refresh tokens were not treated as single-use, causing cloned profiles to share and invalidate each other's tokens. The work involves adding Nous to the single-use refresh pool and related auth handling corrections.","subsystem":"agent/secret_sources","counts":{"members":4,"open_issues":0,"open_issues_distinct":0,"open_prs":1,"closed_issues":1,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":125033,"merged_at":"2026-09-27T13:07:03+00:00"},"resolution":{"state":"resolved","by":"pr-125033"},"freshness":{"state":"verified","last_verified_at":"2026-09-27T13:07:03+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[{"issue_number":121649,"pr_number":125033,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-27T13:07:03+00:00"}],"members":[{"kind":"issue","number":121649,"title":"[Bug]: nous is missing from SINGLE_USE_REFRESH_POOL_PROVIDERS — cloned profiles fork one refresh token and strand each other with invalid_grant","url":null,"state":"closed"},{"kind":"pr","number":121658,"title":"fix(auth): prevent cloned Nous OAuth refresh-token forks","url":null,"state":"open","close_reason":{"refs":[{"kind":"commit","value":"42c1f615c059b23cc72610ec056e7333105f92d3","number":0},{"kind":"commit","value":"ee5ee84a345204a3b1d6ef6ba1ab747e602867b9","number":0},{"kind":"commit","value":"7c23f41b7b0a833f7f318e6974588f9e73768246","number":0},{"kind":"pr","value":"#121649","number":121649},{"kind":"pr","value":"#100929","number":100929},{"kind":"pr","value":"#100389","number":100389},{"kind":"pr","value":"#100703","number":100703},{"kind":"pr","value":"#103712","number":103712}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":121781,"title":"fix(p0p1): nous single-use pool + canonical dashboard matcher","url":null,"state":"closed","close_reason":{"category":"silent_close","implication":"active"},"merged":false},{"kind":"pr","number":125033,"title":"fix(auth): keep root's single-use Nous refresh token out of named profiles","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["agent/credential_pool.py","hermes_cli/auth_oauth_grants.py","tests/agent/test_credential_pool_profile_oauth_fork.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}