From e89d78ff09cc0bcca4396cb50faa2e9da4301e48 Mon Sep 17 00:00:00 2001
From: EloquentBrush0x <283442588+EloquentBrush0x@users.noreply.github.com>
Date: Sun, 17 May 2026 03:40:22 +0300
Subject: [PATCH] fix(doctor): suppress stale XAI_API_KEY issue when xAI OAuth
 is healthy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

_has_healthy_oauth_fallback_for_apikey_provider() covers Gemini and
MiniMax (added by #26853) but omits xAI. The xAI provider profile
(plugins/model-providers/xai/__init__.py) has auth_type="api_key" and
env_vars=("XAI_API_KEY",), so it enters the generic API-key
connectivity loop. When XAI_API_KEY fails a 401 probe but xAI OAuth
is healthy, the failure is promoted to the blocking summary even though
xAI works fine via OAuth — the same false-positive #26853 fixed for
Gemini and MiniMax.

Fix: import get_xai_oauth_auth_status alongside the existing two
helpers and add the "xai" branch. get_xai_oauth_auth_status() already
exists in hermes_cli/auth.py and returns {"logged_in": True} when a
valid OAuth token is present.

Symmetric with the Gemini and MiniMax branches introduced in #26853.
No behavior change for providers without an OAuth path.
---
 hermes_cli/doctor.py            |  3 +++
 tests/hermes_cli/test_doctor.py | 18 ++++++++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/hermes_cli/doctor.py b/hermes_cli/doctor.py
index ef668e0794..04cfffef92 100644
--- a/hermes_cli/doctor.py
+++ b/hermes_cli/doctor.py
@@ -164,6 +164,7 @@ def _has_healthy_oauth_fallback_for_apikey_provider(provider_label: str) -> bool
         from hermes_cli.auth import (
             get_gemini_oauth_auth_status,
             get_minimax_oauth_auth_status,
+            get_xai_oauth_auth_status,
         )
     except Exception:
         return False
@@ -173,6 +174,8 @@ def _has_healthy_oauth_fallback_for_apikey_provider(provider_label: str) -> bool
         return bool((get_gemini_oauth_auth_status() or {}).get("logged_in"))
     if normalized == "minimax":
         return bool((get_minimax_oauth_auth_status() or {}).get("logged_in"))
+    if normalized == "xai":
+        return bool((get_xai_oauth_auth_status() or {}).get("logged_in"))
     return False
 
 
diff --git a/tests/hermes_cli/test_doctor.py b/tests/hermes_cli/test_doctor.py
index ee419656a7..d99947a988 100644
--- a/tests/hermes_cli/test_doctor.py
+++ b/tests/hermes_cli/test_doctor.py
@@ -944,3 +944,21 @@ def test_run_doctor_ignores_invalid_direct_keys_when_oauth_fallback_is_healthy(
 
     assert "invalid API key" in out
     assert unexpected_issue not in out
+
+
+class TestHasHealthyOauthFallbackForXai:
+    def test_returns_true_when_xai_oauth_healthy(self, monkeypatch):
+        from hermes_cli import auth as _auth_mod
+        monkeypatch.setattr(_auth_mod, "get_xai_oauth_auth_status", lambda: {"logged_in": True})
+        from hermes_cli.doctor import _has_healthy_oauth_fallback_for_apikey_provider
+        assert _has_healthy_oauth_fallback_for_apikey_provider("xai") is True
+
+    def test_returns_false_when_xai_oauth_not_logged_in(self, monkeypatch):
+        from hermes_cli import auth as _auth_mod
+        monkeypatch.setattr(_auth_mod, "get_xai_oauth_auth_status", lambda: {"logged_in": False})
+        from hermes_cli.doctor import _has_healthy_oauth_fallback_for_apikey_provider
+        assert _has_healthy_oauth_fallback_for_apikey_provider("xai") is False
+
+    def test_returns_false_for_unknown_provider(self):
+        from hermes_cli.doctor import _has_healthy_oauth_fallback_for_apikey_provider
+        assert _has_healthy_oauth_fallback_for_apikey_provider("unknown-provider") is False