refactor(auth): collapse duplicate corrupt-store warning, drop dead _SUPPORTED_PREFIXES

hermes_cli/auth.py

@@ -1134,29 +1134,22 @@ def _load_auth_store(auth_file: Optional[Path] = None) -> Dict[str, Any]:
     except Exception as exc:
         # Genuine corruption: unparseable JSON, or bytes that are not UTF-8.
         corrupt_path = auth_file.with_suffix(".json.corrupt")
-        preserved = False
         try:
-            import shutil
             shutil.copy2(auth_file, corrupt_path)
             preserved = True
         except Exception:
+            preserved = False
             logger.debug(
                 "auth: could not preserve a copy of the corrupt store at %s",
                 corrupt_path, exc_info=True,
             )
-        if preserved:
-            logger.warning(
-                "auth: failed to parse %s (%s), starting with empty store. "
-                "Corrupt file preserved at %s",
-                auth_file, exc, corrupt_path,
-            )
-        else:
-            # Do not advertise a backup that was never written.
-            logger.warning(
-                "auth: failed to parse %s (%s), starting with empty store. "
-                "A copy could NOT be preserved at %s",
-                auth_file, exc, corrupt_path,
-            )
+        # Never advertise a backup that was not written.
+        logger.warning(
+            "auth: failed to parse %s (%s), starting with empty store. %s %s",
+            auth_file, exc,
+            "Corrupt file preserved at" if preserved else "A copy could NOT be preserved at",
+            corrupt_path,
+        )
         return {"version": AUTH_STORE_VERSION, "providers": {}}
 
     if isinstance(raw, dict) and (
@@ -2403,9 +2396,7 @@ def _auth_file_cache_key() -> Tuple[str, Optional[float]]:
         auth_file_key = str(auth_file)
     try:
         return auth_file_key, auth_file.stat().st_mtime
-    except FileNotFoundError:
-        return auth_file_key, None
-    except Exception:
+    except Exception:  # missing file included: key without an mtime
         return auth_file_key, None
 
 

hermes_cli/copilot_auth.py

@@ -28,9 +28,8 @@ logger = logging.getLogger(__name__)
 # (e.g. claude-opus-4.6-1m) and enterprise endpoints.
 # Tested on Individual and Enterprise accounts.
 COPILOT_OAUTH_CLIENT_ID = "Iv1.b507a08c87ecfe98"
-# Token type prefixes
+# ghp_ classic PATs are rejected by the Copilot API (gho_ / github_pat_ / ghu_ work).
 _CLASSIC_PAT_PREFIX = "ghp_"
-_SUPPORTED_PREFIXES = ("gho_", "github_pat_", "ghu_")
 
 # Env var search order (matches Copilot CLI)
 COPILOT_ENV_VARS = ("COPILOT_GITHUB_TOKEN", "GH_TOKEN", "GITHUB_TOKEN")