Bug

hermes_cli/copilot_auth.py uses an OAuth client_id that cannot access the Copilot API, so any user who logs in via hermes auth add copilot (or the existing device-code flow) ends up with a token that gets HTTP 404 from https://api.github.com/copilot_internal/v2/token, even when their GitHub account has an active Copilot subscription.

Root cause

# hermes_cli/copilot_auth.py
COPILOT_OAUTH_CLIENT_ID = "Ov23li...Qebz"   # GitHub App client id

This is a GitHub App client id (Ov23li... prefix). Tokens minted by it are not authorized for copilot_internal/v2/token, regardless of the user's Copilot plan.

The official VS Code / Copilot CLI / opencode flow uses the legacy OAuth App id:

Iv1.b507a08c87ecfe98

A token from this client_id (with read:user scope) successfully exchanges at copilot_internal/v2/token and lists the full live model catalog (including gpt-5.5, claude-opus-4.5, etc.) — confirmed by manual reproduction.

Reproduction

1. hermes auth add copilot (or call copilot_device_code_login() directly)
2. Authorize as a user with an active Copilot subscription (Individual/Business)
3. Hermes saves token to COPILOT_GITHUB_TOKEN
4. Any code path calling exchange_copilot_token() → HTTP 404 Not Found
5. fetch_github_model_catalog() returns None, so hermes model falls back to the hardcoded curated list — which is missing gpt-5.5 and other newer models.

Symptoms users see

• /model gpt-5.5 not in the list even though it works in VS Code on the same account
• hermes model shows a stale subset of the Copilot catalog
• Token exchange silently fails; users assume their account doesn't have access

Fix

Change COPILOT_OAUTH_CLIENT_ID to Iv1.b507a08c87ecfe98. After this, the live /models catalog populates correctly and dynamic model discovery works as designed.

Side issues spotted while debugging

• hermes auth add copilot --type oauth returns not implemented for auth type oauth yet. — the device-code flow is only reachable via setup wizard / internal call, not via the documented auth add path.
• After copilot_device_code_login() returns a token, hermes_cli/main.py (line ~3528) calls save_env_value("COPILOT_GITHUB_TOKEN", token), but save_env_value is no longer importable from hermes_cli.main (got ImportError on current main branch). Token is fetched but never persisted.

Environment

• Hermes Agent (current main)
• Linux (cachyos), Python 3.11
• Account: GitHub Individual Copilot subscription