{"repo":"NousResearch/hermes-agent","public_id":"87503","display_label":"Codex token refresh not persisted to global auth store","summary":"A bug where profile-scoped Codex token refreshes fail to write updated tokens back to the global authentication store, causing rotation family revocation. Multiple fixes and a salvage attempt address the write-through and reuse behavior of the root grant.","subsystem":"agent","counts":{"members":4,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":110024,"merged_at":"2026-09-14T14:19:38+00:00"},"resolution":{"state":"resolved","by":"pr-110024"},"freshness":{"state":"verified","last_verified_at":"2026-09-14T14:19:38+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[{"issue_number":87503,"pr_number":110024,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-14T14:19:38+00:00"}],"members":[{"kind":"issue","number":87503,"title":"[Bug][auth] _save_codex_tokens() never writes back to the global auth store, so a profile-scoped refresh revokes the rotation family","url":null,"state":"closed"},{"kind":"pr","number":87510,"title":"fix(auth): write profile-refreshed Codex tokens through to the global store","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"66ddd5f83c","number":0},{"kind":"pr","value":"#110024","number":110024},{"kind":"pr","value":"#87503","number":87503}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":95984,"title":"fix(auth): codex singleton root write-through + reuse-rescue (#87503)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"66ddd5f83c","number":0},{"kind":"pr","value":"#110024","number":110024},{"kind":"pr","value":"#87510","number":87510},{"kind":"pr","value":"#87503","number":87503}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":110024,"title":"fix(auth): a Codex refresh under a profile rotates the root grant it borrowed (#87503, salvage #87510)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["hermes_cli/auth_codex.py","tests/hermes_cli/test_codex_token_writethrough.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}