Cairn
NousResearch/hermes-agent

macOS Keychain sync for Claude Code OAuth refresh tokens

Cluster 98334. Data as of

Nothing open on GitHub. Fix merged in #115690 on 19 Sep 2026. Check it covers your case.

The short answer

0open issues
0open PRs
5items grouped
Known?
Yes. 5 related items grouped here, 1 issue already closed.
Fix event
A fix was merged to main in PR #115690. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this resolved, deciding PR #115690. That is separate from the fix event.
Still open
Nothing open on GitHub.

These items address a bug where OAuth token refreshes update a credentials file but leave the macOS Keychain holding a stale or spent refresh token, causing login failures. Related work includes fixes to mirror token rotation into the Keychain and an opt-out environment variable for the behavior.

Open issues0

No open issues.

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #115690 macOS: a Hermes OAuth refresh no longer leaves Claude Code's Keychain holding a spent refresh token (#98334, salvage #109584)

    merged to main

    files: agent/anthropic_credentials.py, agent/credential_pool.py, tests/agent/test_anthropic_borrowed_row_authority.py, tests/agent/test_anthropic_keychain.py, tests/agent/test_auxiliary_client.py, tests/conftest.py

3 PRs closed without merging

From the close comments: duplicate 1 · merged via another change 1 · superseded by another PR 1

  • #98343 fix(agent): mirror Claude Code OAuth rotation to the macOS Keychain · superseded by another PR → #55051
  • #104006 feat(auth): add HERMES_DISABLE_CLAUDE_CODE_CREDENTIALS opt-out env var · duplicate → #103978, #98334
  • #109584 fix(agent): mirror Claude Code OAuth refresh into the macOS Keychain (#98334) · merged via another change → 14a3463, #115690, #98334
Closed issues · 1
  • Closed#98334[Bug]: macOS OAuth refresh writes only ~/.claude/.credentials.json, never the Keychain — stale Keychain refresh token expires the Claude Code login
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.40: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Merged PRs
#115690
Closed issues
1
Attempts
3 PRs closed without merging
Fix link checked
19 Sep 2026

For your agent

The same facts, typed.

cluster/98334.json
cluster/98334.md