Summary

hermes status / hermes doctor can report Nous Portal as logged in and managed web tools as available even when the saved Nous auth state is already stale/revoked and managed web calls fail with AUTH_ERROR Unauthorized.

In the current main, status/readiness appears to trust cached auth presence rather than verified refreshability:

• hermes_cli.auth.get_nous_auth_status() reports logged_in from token presence alone
• tools.managed_tool_gateway.read_nous_access_token() falls back to returning the cached access token when refresh fails
• hermes_cli.nous_subscription.get_nous_subscription_features() / hermes status then treat the gateway as ready

Repro / evidence

Environment: local macOS checkout of main at 93f9db59b.

Local auth state (token values redacted, only metadata shown):

jq '{active_provider, nous: {expires_at: .providers.nous.expires_at, agent_key_expires_at: .providers.nous.agent_key_expires_at, has_refresh_token: (.providers.nous.refresh_token != null and .providers.nous.refresh_token != ""), portal_base_url: .providers.nous.portal_base_url}}' ~/.hermes/auth.json

returns:

{
  "active_provider": "openai-codex",
  "nous": {
    "expires_at": "2026-04-21T20:06:53.514142+00:00",
    "agent_key_expires_at": "2026-04-22T19:56:25.014Z",
    "has_refresh_token": true,
    "portal_base_url": "https://portal.nousresearch.com"
  }
}

Forcing a real refresh against the saved Nous state fails:

python - <<'PY'
from hermes_cli.auth import get_provider_auth_state, refresh_nous_oauth_from_state
state = get_provider_auth_state('nous') or {}
try:
    refresh_nous_oauth_from_state(state, force_refresh=True)
    print('refresh_ok')
except Exception as e:
    print(type(e).__name__ + ': ' + str(e))
PY

Output:

AuthError: Refresh session has been revoked

But status still reports healthy auth + managed web availability:

◆ Auth Providers
  Nous Portal   ✓ logged in
    Portal URL: https://portal.nousresearch.com
    Access exp: 2026-04-21 13:06:53 PDT
    Key exp:    2026-04-22 12:56:25 PDT
    Refresh:    yes

◆ Nous Tool Gateway
  Nous Portal   ✓ managed tools available
  Web tools       ✓ included by subscription, not currently selected

And the underlying helpers also still say the gateway is ready:

python - <<'PY'
from hermes_cli.auth import get_nous_auth_status
from tools.managed_tool_gateway import read_nous_access_token, is_managed_tool_gateway_ready
import json
s = get_nous_auth_status()
print(json.dumps({
  'logged_in': s.get('logged_in'),
  'access_expires_at': s.get('access_expires_at'),
  'agent_key_expires_at': s.get('agent_key_expires_at'),
  'has_refresh_token': s.get('has_refresh_token'),
  'gateway_ready_firecrawl': is_managed_tool_gateway_ready('firecrawl'),
  'token_reader_nonempty': bool(read_nous_access_token()),
}, indent=2))
PY

Output:

{
  "logged_in": true,
  "access_expires_at": "2026-04-21T20:06:53.514142+00:00",
  "agent_key_expires_at": "2026-04-22T19:56:25.014Z",
  "has_refresh_token": true,
  "gateway_ready_firecrawl": true,
  "token_reader_nonempty": true
}

In this state, managed web calls fail with AUTH_ERROR Unauthorized because the cached Nous session is revoked/stale.

Relevant code paths on current main

hermes_cli/auth.py:get_nous_auth_status():

• pool path returns logged_in=True if an access token string exists
• fallback path returns logged_in=bool(state.get("access_token"))
• neither path verifies token freshness or refreshability

tools/managed_tool_gateway.py:read_nous_access_token():

• tries resolve_nous_access_token() when the token is expiring
• if refresh fails, catches the exception and returns the stale cached token anyway:

except Exception as exc:
    logger.debug("Nous access token refresh failed: %s", exc)

return cached_token

That makes is_managed_tool_gateway_ready() return true as long as a cached token string exists.

Expected behavior

One of these should happen when the cached Nous auth cannot be refreshed / is revoked:

1. hermes status / hermes doctor should not show Nous as simply “logged in”; surface a degraded / re-auth-required state.
2. Managed tool readiness should fail closed when refresh fails, instead of advertising managed web tools as available.
3. Ideally the status output should include the refresh error (Refresh session has been revoked) or a concise re-auth hint.

Actual behavior

Hermes advertises Nous Tool Gateway availability based on stale cached auth, while managed web calls fail immediately with unauthorized errors.

Notes

This seems distinct from the earlier concurrent-refresh / RT-rotation bugs (#10147 / #15099). Those were about how valid sessions become revoked. This issue is about incorrect auth-status / readiness reporting after the session is already revoked.