fix: hermes doctor reports Nous Portal as 'not logged in' when credentials exist in pool

[nikolay]

Bug Description

hermes doctor (and hermes status) report Nous Portal auth as "not logged in" even when valid credentials exist and hermes auth list correctly shows them.

Root Cause

get_nous_auth_status() in hermes_cli/auth.py only checks the legacy providers section of auth.json. When credentials are added via hermes auth add (or stored directly in the credential pool), they live in the credential_pool section and are never seen by the doctor/status checks.

auth.json:
  "providers": {}                    <-- get_nous_auth_status() looks HERE (empty)
  "credential_pool": {
    "nous": [{ ...valid token... }]  <-- hermes auth list looks HERE (has credential)
  }

Steps to Reproduce

1. Add Nous credentials via hermes auth add (or have them migrate into the credential pool)
2. Run hermes auth list — shows the credential correctly
3. Run hermes doctor — reports "Nous Portal auth (not logged in)"

Expected Behavior

hermes doctor should report "logged in" when valid Nous credentials exist in either the legacy provider state or the credential pool.

Fix

get_nous_auth_status() should fall back to checking the credential pool when the legacy provider state is empty — the same pattern already used by get_codex_auth_status().

Environment

• macOS
• Hermes Agent latest main

[ricardoroche]

I've opened #5860 with a fix for this — rebased onto main and ready for review. CI is pending maintainer approval to run.

[teknium1]

Fixed by #15120 (commit cd22108, from @mssteuer's #14671).

get_nous_auth_status() was reading from the credential pool only. When credentials lived only in auth.json provider state (the runtime source of truth), hermes doctor / hermes status reported "not logged in" even though the agent could authenticate fine.

The fix prefers auth-store state and falls back to a pool snapshot when needed. Also selects the newest entry by agent-key expiry when multiple exist in the pool.