hermes - 💡(How to fix) Fix [Feature]: Allow manually selecting the active credential within a provider credential pool

Feature Description

When a provider credential pool contains multiple credentials for the same provider (for example, two openai-codex OAuth/device-code credentials), Hermes currently supports rotation strategies such as fill_first, round_robin, least_used, and random, but does not provide a direct way to manually select which specific credential should be used next or pinned as the active credential.

Motivation

This makes some real-world workflows harder than necessary:

• A user may add a second credential with a higher quota and want to switch to it immediately.
• A user may want to temporarily force a known-good credential during incident response or quota exhaustion.
• Rotation strategies are useful for balancing load, but they are not a substitute for intentional operator control.
• In multi-profile Hermes setups that share the auth pool, operators may want a deterministic way to cut over all profiles to a specific credential without deleting other entries.

Proposed Solution

Add explicit manual-selection support for provider credential pools.

Possible forms:

1. CLI command to select a credential by provider + index/id/label, for example:

   • hermes auth select openai-codex --label 20x
   • hermes auth select openai-codex --id <credential-id>
   • hermes auth select openai-codex --index 2

2. Interactive hermes auth menu action such as:

   • Select active credential for a provider

3. Optional pinning behavior so the selected credential remains preferred until:

   • manually changed, or
   • explicitly unpinned, or
   • the credential becomes invalid/exhausted.

Expected Behavior

Users should be able to:

• inspect the credentials in a provider pool,
• choose one specific credential intentionally,
• verify which credential is currently selected,
• optionally revert back to automatic rotation later.

Why current workarounds are insufficient

Today the closest workarounds are:

• changing credential_pool_strategies, or
• deleting / disabling the old credential.

These are imperfect because:

• least_used / round_robin do not guarantee immediate deterministic cutover,
• fill_first still depends on entry ordering,
• deleting credentials is heavier and riskier than a simple manual switch.

Example Use Case

A user has two openai-codex OAuth credentials in the shared auth pool:

1. device_code
2. 20x

The user adds 20x specifically because it has more quota and wants Hermes to start using it immediately. There is currently no explicit built-in way to say “switch to #2 now” without relying on rotation behavior or removing the first credential.

Alternatives Considered

• Keep using rotation strategies only: not deterministic enough.
• Remove the old credential: too destructive for a simple cutover.
• Reorder credentials indirectly: still not a clear user-facing control.

Suggested Scope

Minimum viable support would be:

• add a CLI/interactive way to select one credential explicitly,
• persist the selected credential as the current/preferred one,
• keep existing rotation strategies available for users who want automatic balancing.

Environment

• Repo: NousResearch/hermes-agent
• Provider example: openai-codex
• Credential types observed: OAuth / device_code