refactor(auth): mostly cleanups and style changes

tests/hermes_cli/test_auth_nous_provider.py

@@ -217,8 +217,8 @@ def test_resolve_nous_runtime_credentials_prefers_invoke_jwt_and_mirrors(
     creds = auth_mod.resolve_nous_runtime_credentials(min_key_ttl_seconds=300)
 
     assert creds["api_key"] == token
-    assert creds["source"] == "invoke_jwt"
-    assert creds["auth_path"] == "invoke_jwt"
+    assert creds["source"] == auth_mod.NOUS_AUTH_PATH_INVOKE_JWT
+    assert creds["auth_path"] == auth_mod.NOUS_AUTH_PATH_INVOKE_JWT
 
     payload = json.loads((hermes_home / "auth.json").read_text())
     singleton = payload["providers"]["nous"]
@@ -297,7 +297,7 @@ def test_resolve_nous_runtime_credentials_invoke_jwt_is_idempotent(
     creds = auth_mod.resolve_nous_runtime_credentials(min_key_ttl_seconds=300)
 
     assert creds["api_key"] == token
-    assert creds["source"] == "invoke_jwt"
+    assert creds["source"] == auth_mod.NOUS_AUTH_PATH_INVOKE_JWT
     assert auth_path.read_text() == before_content
     assert auth_path.stat().st_mtime_ns == before_mtime
     assert sync_calls == []
@@ -339,7 +339,7 @@ def test_resolve_nous_runtime_credentials_trusts_invoke_jwt_exp_over_stale_metad
     creds = auth_mod.resolve_nous_runtime_credentials(min_key_ttl_seconds=300)
 
     assert creds["api_key"] == token
-    assert creds["source"] == "invoke_jwt"
+    assert creds["source"] == auth_mod.NOUS_AUTH_PATH_INVOKE_JWT
     payload = json.loads((hermes_home / "auth.json").read_text())
     singleton = payload["providers"]["nous"]
     assert singleton["agent_key"] == token
@@ -372,7 +372,7 @@ def test_resolve_nous_runtime_credentials_does_not_apply_legacy_ttl_to_invoke_jw
     creds = auth_mod.resolve_nous_runtime_credentials(min_key_ttl_seconds=1800)
 
     assert creds["api_key"] == token
-    assert creds["source"] == "invoke_jwt"
+    assert creds["source"] == auth_mod.NOUS_AUTH_PATH_INVOKE_JWT
     payload = json.loads((hermes_home / "auth.json").read_text())
     assert payload["providers"]["nous"]["agent_key"] == token
     assert payload["credential_pool"]["nous"][0]["agent_key"] == token
@@ -403,12 +403,12 @@ def test_legacy_auth_mode_bypasses_usable_invoke_jwt(tmp_path, monkeypatch):
 
     creds = auth_mod.resolve_nous_runtime_credentials(
         min_key_ttl_seconds=300,
-        auth_mode=auth_mod.NOUS_INFERENCE_AUTH_LEGACY,
+        inference_auth_mode=auth_mod.NOUS_INFERENCE_AUTH_MODE_LEGACY,
     )
 
     assert mint_calls == [token]
     assert creds["api_key"] == "legacy-after-jwt-401"
-    assert creds["auth_path"] == "legacy_session_key_mint"
+    assert creds["auth_path"] == auth_mod.NOUS_AUTH_PATH_LEGACY_SESSION_KEY_MINT
     payload = json.loads((hermes_home / "auth.json").read_text())
     assert payload["providers"]["nous"]["agent_key"] == "legacy-after-jwt-401"
 
@@ -1199,7 +1199,7 @@ def test_persist_nous_credentials_allows_recovery_from_401(tmp_path, monkeypatch
     providers.nous was empty.
     """
     from hermes_cli.auth import (
-        NOUS_INFERENCE_AUTH_FRESH,
+        NOUS_INFERENCE_AUTH_MODE_FRESH,
         persist_nous_credentials,
         resolve_nous_runtime_credentials,
     )
@@ -1232,7 +1232,7 @@ def test_persist_nous_credentials_allows_recovery_from_401(tmp_path, monkeypatch
 
     creds = resolve_nous_runtime_credentials(
         min_key_ttl_seconds=300,
-        auth_mode=NOUS_INFERENCE_AUTH_FRESH,
+        inference_auth_mode=NOUS_INFERENCE_AUTH_MODE_FRESH,
     )
     assert creds["api_key"] == "new-agent-key"
 
@@ -1698,7 +1698,10 @@ def test_try_import_shared_rehydrates_on_success(shared_store_env, monkeypatch):
     def _fake_refresh(state, **kwargs):
         # Simulate portal returning fresh tokens + a new agent_key
         assert kwargs.get("force_refresh") is True
-        assert kwargs.get("auth_mode") == auth_mod.NOUS_INFERENCE_AUTH_FRESH
+        assert (
+            kwargs.get("inference_auth_mode")
+            == auth_mod.NOUS_INFERENCE_AUTH_MODE_FRESH
+        )
         return {
             **state,
             "access_token": "fresh-access-tok",
@@ -1826,7 +1829,7 @@ def test_runtime_refresh_uses_newer_shared_token_before_local_stale_token(
 
     creds = auth_mod.resolve_nous_runtime_credentials(
         min_key_ttl_seconds=300,
-        auth_mode=auth_mod.NOUS_INFERENCE_AUTH_FRESH,
+        inference_auth_mode=auth_mod.NOUS_INFERENCE_AUTH_MODE_FRESH,
     )
 
     assert creds["api_key"] == "agent-key-from-shared-token"

tests/hermes_cli/test_proxy.py

@@ -169,7 +169,7 @@ def test_nous_adapter_retry_credential_forces_legacy_mint(tmp_path, monkeypatch)
         adapter = NousPortalAdapter()
         cred = adapter.get_retry_credential(
             failed_credential=UpstreamCredential(
-                bearer="jwt-access",
+                bearer="header.jwt.signature",
                 base_url="https://inference-api.nousresearch.com/v1",
             ),
             status_code=401,
@@ -177,7 +177,31 @@ def test_nous_adapter_retry_credential_forces_legacy_mint(tmp_path, monkeypatch)
 
     assert cred is not None
     assert cred.bearer == "legacy-bearer"
-    assert mock_refresh.call_args.kwargs["auth_mode"] == "legacy"
+    assert mock_refresh.call_args.kwargs["inference_auth_mode"] == "legacy"
+
+
+def test_nous_adapter_retry_credential_skips_opaque_bearer(tmp_path, monkeypatch):
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    _write_auth_store(tmp_path, {
+        "access_token": "jwt-access",
+        "refresh_token": "refresh-tok",
+        "agent_key": "opaque-bearer",
+    })
+
+    with patch(
+        "hermes_cli.proxy.adapters.nous_portal.refresh_nous_oauth_from_state",
+    ) as mock_refresh:
+        adapter = NousPortalAdapter()
+        cred = adapter.get_retry_credential(
+            failed_credential=UpstreamCredential(
+                bearer="opaque-bearer",
+                base_url="https://inference-api.nousresearch.com/v1",
+            ),
+            status_code=401,
+        )
+
+    assert cred is None
+    mock_refresh.assert_not_called()
 
 
 def test_nous_adapter_get_credential_raises_when_not_logged_in(tmp_path, monkeypatch):
@@ -364,7 +388,7 @@ class FakeAdapter(UpstreamAdapter):
         )
 
     def get_retry_credential(self, *, failed_credential, status_code):
-        del failed_credential
+        _ = failed_credential
         self.retry_calls += 1
         if status_code != 401 or not self._retry_bearer:
             return None

tests/run_agent/test_run_agent.py

@@ -3667,7 +3667,7 @@ class TestNousCredentialRefresh:
 
         assert ok is True
         assert closed["value"] is True
-        assert captured["auth_mode"] == "legacy"
+        assert captured["inference_auth_mode"] == "legacy"
         assert rebuilt["kwargs"]["api_key"] == "new-nous-key"
         assert (
             rebuilt["kwargs"]["base_url"] == "https://inference-api.nousresearch.com/v1"