hermes - 💡(How to fix) Fix Google Gemini CLI OAuth fails on remote servers — redirect to 127.0.0.1 unreachable [1 comments, 2 participants]

Problem

Running hermes auth add google-gemini-cli on a remote VM (no SSH tunnel from local machine) fails because Google OAuth is hardcoded to redirect to http://127.0.0.1:8085/oauth2callback. The browser opens a URL pointing at the remote server's 127.0.0.1, which the user's local machine cannot reach.

Workaround

The --manual-paste flag solves it:

hermes auth add google-gemini-cli --manual-paste

Open the URL, sign in, ignore the "can't connect" page, copy the full http://127.0.0.1:8085/oauth2callback?code=...&state=... from the address bar, and paste it into the terminal prompt.

What Should Happen

On remote/headless environments, --manual-paste should be auto-detected (or at least suggested as the default). The xAI OAuth flow already has headless detection via _is_headless(). Google Gemini CLI should follow the same pattern — check env vars like SSH_CONNECTION, CODESPACES, HERMES_HEADLESS and automatically route to the paste fallback.

Environment

• Running on: Remote cloud VM
• Command: hermes auth add google-gemini-cli
• Works with: hermes auth add google-gemini-cli --manual-paste

cc @teknium1