{"repo":"NousResearch/hermes-agent","public_id":"28250","display_label":"xAI OAuth token expiry, refresh, and 403 bugs","summary":"These issues and fixes center on xAI OAuth tokens expiring or becoming invalid (within ~24h or after idle periods), causing 403 errors that are not always correctly detected as auth failures, and on stale or retired token endpoints being trusted during refresh. Several fixes address detection logic and endpoint discovery to support proper token refresh.","subsystem":"agent","counts":{"members":9,"open_issues":2,"open_issues_distinct":2,"open_prs":1,"closed_issues":4,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":30872},"resolution":{"state":"partially_resolved","by":"pr-30872"},"freshness":{"state":"verified","last_verified_at":"2026-05-23T09:48:13+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_PARTIAL","link_density":0.1811111111111111},"fix_edges":[{"issue_number":28250,"pr_number":30872,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true},{"issue_number":29344,"pr_number":30872,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true}],"members":[{"kind":"issue","number":28250,"title":"[Bug] xAI Grok OAuth token expires within ~24h; auxiliary title generation fails with HTTP 403","url":null,"state":"closed"},{"kind":"issue","number":29344,"title":"[Bug]: _is_entitlement_failure over-matches xAI 'bad-credentials' 403 — long-running TUI sessions can't auto-refresh stale OAuth tokens","url":null,"state":"closed"},{"kind":"issue","number":40307,"title":"Bug: xai-oauth token expires overnight even when gateway is running persistently","url":null,"state":"closed"},{"kind":"issue","number":47953,"title":"xai-oauth: 403 bad-credentials after idle in TUI/Desktop sessions (refresh token revoked)","url":null,"state":"closed"},{"kind":"issue","number":65394,"title":"[Feature]: Support shared xAI OAuth state across independent Hermes roots","url":null,"state":"open"},{"kind":"issue","number":68694,"title":"[Bug]: xAI OAuth refresh trusts retired persisted token endpoint","url":null,"state":"open"},{"kind":"pr","number":29348,"title":"fix(xai-oauth): honor [WKE=unauthenticated] disambiguator in entitlement classifier (#29344)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#30872","number":30872},{"kind":"pr","value":"#26847","number":26847},{"kind":"pr","value":"#26847","number":26847}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":30872,"title":"fix(xai-oauth): honor WKE=unauthenticated disambiguator at both classifier sites (#29344)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["agent/agent_runtime_helpers.py","run_agent.py","tests/run_agent/test_codex_xai_oauth_recovery.py"]},{"kind":"pr","number":68696,"title":"fix(xai): rediscover retired OAuth token endpoint","url":null,"state":"open","close_reason":{"refs":[{"kind":"commit","value":"84fbb15d4981","number":0},{"kind":"pr","value":"#68694","number":68694},{"kind":"pr","value":"#68696","number":68696},{"kind":"pr","value":"#68696","number":68696},{"kind":"pr","value":"#68696","number":68696},{"kind":"pr","value":"#374151","number":374151},{"kind":"pr","value":"#68694","number":68694},{"kind":"pr","value":"#68696","number":68696}],"category":"partial_fix","implication":"needs_llm"},"merged":false}],"trust":{"default_tier":"verified","includes_suggested":false}}