Hermes Agent Community Reports OAuth Refresh Race That May Break Shared Logins Across Profiles

A credential reliability issue has been reported in multi-profile Hermes Agent deployments. On October 29, a user said that several named profiles borrowing the default profile’s Anthropic OAuth login may try to refresh the access token at the same time when it expires. This could invalidate the shared authorization, causing the affected agents to report auth_permanent or say that no usable credentials were found. The report describes an environment running macOS and Hermes v0.22.5, and identifies the upstream commit that was tested. Public issue

The shared credential path is documented officially. Hermes profiles keep their own settings, memory, and sessions, but copying a profile does not copy OAuth logins for providers such as Anthropic. Instead, the new profile reads auth.json from the root directory, and token refreshes write back to that same location. This design avoids having multiple copies of a single-use refresh token rotated independently, but it also requires all users to coordinate refresh operations. Profile documentation

According to the reporter’s analysis, the issue is the scope of the lock: the refresh flow holds the current profile’s own auth.lock, while the shared credentials belong to the root directory. Two profiles could therefore each acquire their own lock and submit the same refresh token. The reporter’s test checks whether the root-directory lock is held when a request is sent. They say the upstream version did not hold that lock, while adding an additional lock made the test pass. However, the logs do not record which two processes competed, so the causal link between the locking gap and the actual revocation event still needs verification. Test and analysis

For engineering teams, this report is a reminder that writing rotated tokens back to shared storage still requires a common lock covering the read, network refresh, and write operations. The official documentation describes how to set up separate logins for individual profiles, which deployment operators can consider when configuring credentials. Follow-up items include cross-process regression tests, whether a fix is merged, and whether it ships in a release. The reporter’s speculation about other OAuth providers should not yet be treated as a confirmed impact. Official login configuration guide