From 80d8d28392e555f1e5948a5b834cd926e594c4e7 Mon Sep 17 00:00:00 2001 From: kshitijk4poor <82637225+kshitijk4poor@users.noreply.github.com> Date: Thu, 24 Sep 2026 14:26:27 +0530 Subject: [PATCH] fix(auth): route the borrowed-root add_entry write through the token-base boundary The profile-claims-its-own-credential branch of add_entry wrote the profile store directly, so the newly owned rows had no recorded token base until the next pre-refresh sync, and a stale peer could not be told apart from an unknown one on the first later flush. Pass the current bases and reseed from the written rows, mirroring _persist(). --- agent/credential_pool_admin.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/agent/credential_pool_admin.py b/agent/credential_pool_admin.py index a4ebad859f..e773cc7cd4 100644 --- a/agent/credential_pool_admin.py +++ b/agent/credential_pool_admin.py @@ -109,6 +109,7 @@ class CredentialPoolAdminMixin: def add_entry(self, entry: PooledCredential) -> PooledCredential: from agent.credential_pool import _next_priority, write_credential_pool + from hermes_cli import auth as auth_mod with self._lock: entry = replace(entry, priority=_next_priority(self._entries)) @@ -121,7 +122,11 @@ class CredentialPoolAdminMixin: # its single-use refresh token (#100339). Once the profile owns # rows, the root fallback for this provider is shadowed. self._entries = [e for e in self._entries if e.id not in borrowed_ids] - write_credential_pool(self.provider, [e.to_dict() for e in self._entries]) + written = write_credential_pool( + self.provider, [e.to_dict() for e in self._entries], + token_bases=self._persisted_token_pairs, + ) + self._persisted_token_pairs = auth_mod._token_pairs_by_id(written) self._borrowed_root_ids = set() else: self._persist()