Teknium
3038493ee6
Anthropic / Codex / xAI OAuth refresh tokens are single-use: a grant copied into a second auth.json is one credential with two owners, and the first profile to refresh it revokes the pair for every sibling (invalid_grant / refresh_token_reused). Two code paths forked grants that way: 1. `hermes profile create --clone-all` and the dashboard/TUI `mirror_credentials` flow copied auth.json (+ .anthropic_oauth.json) verbatim. Both now run `strip_cloned_single_use_oauth_grants()`, which drops OAuth rows for SINGLE_USE_REFRESH_POOL_PROVIDERS, the matching `providers.<id>` device-code blocks, and the PKCE singleton file; API keys are still copied. The clone reads the root grant through the existing credential-pool root fallback. 2. A named profile with no local rows BORROWS the root grant via `read_credential_pool()`'s fallback, but every persist (`CredentialPool._persist`, `load_pool` reseed, `remove_index`) wrote the rows into the profile's own auth.json — materializing a fork on the first rotation. `persist_pool_entries()` now routes borrowed single-use rows back to the root store (update-only, under the root lock; never falls back to a local copy). A borrowed `hermes_pkce` rotation commits its singleton to the root `.anthropic_oauth.json`, the borrower never prunes root-seeded rows it cannot see the backing file for, and `hermes -p <profile> auth add` persists only the profile's own rows. Live repro (real imports, temp root + profiles, fake single-use token endpoint): before — first profile rotation RT0->RT1 in profile only; root and sibling then hit `invalid_grant`, `resolve_anthropic_token()` -> None. After — rotation lands in root; root and both siblings select AT1, no reuse. Direction per Teknium: stop cloning OAuth into profiles (ONE grant at root, children inherit via context) rather than making clones survive. Supersedes the clone-strip/root-write-through half of #100389 and the init-refresh idea in #100703 (an expired-but-refreshable row already refreshes on select()). Closes #100339 Co-authored-by: HexLab98 <liruixinch@outlook.com>
Website
This website is built using Docusaurus, a modern static website generator.
Installation
yarn
Local Development
yarn start
This command starts a local development server and opens up a browser window. Most changes are reflected live without having to restart the server.
Build
yarn build
This command generates static content into the build directory and can be served using any static contents hosting service.
Deployment
Using SSH:
USE_SSH=true yarn deploy
Not using SSH:
GIT_USER=<Your GitHub username> yarn deploy
If you are using GitHub pages for hosting, this command is a convenient way to build the website and push to the gh-pages branch.
Diagram Linting
CI runs ascii-guard to lint docs for ASCII box diagrams. Use Mermaid (````mermaid`) or plain lists/tables instead of ASCII boxes to avoid CI failures.