hermes - 💡(How to fix) Fix OAuth loopback login broken for remote/browser-based consoles (GCP, Codespaces, etc.) [1 pull requests]

Problem

When running hermes model (or any OAuth login) on a remote VM or browser-based console (GCP Cloud Shell, AWS EC2 Instance Connect, GitHub Codespaces, etc.), OAuth flows fail because the authorization URL contains a hardcoded redirect_uri=http://127.0.0.1:<port>/callback.

After the user authorizes in their local browser, the provider redirects back to 127.0.0.1 on the remote machine, which is unreachable. The existing SSH tunnel hint only helps users with a real local SSH client — it provides no path forward for browser-only remote consoles.

Solution Implemented

Added a reusable _oauth_prompt_manual_code() helper that allows users to complete OAuth login by pasting either the full failed callback URL or just the authorization code.

The helper was integrated into the xAI Grok OAuth flow (and prepared for Spotify). Users can now simply paste the code when the browser redirect fails, and authentication completes successfully.

Changes

• New helper: _oauth_prompt_manual_code() in hermes_cli/auth.py
• Refactored xAI OAuth login to use the helper
• Supports both full callback URL and raw code input

The fix has been tested and confirmed working on a remote GCP VM.