feat: support explicit api_key in config for Codex provider

[kingsleydon]

Summary

Single-file, pure-additive patch that lets config.yaml provide the Codex provider's api_key directly, instead of requiring OAuth credentials in hermes-auth-store.

Needed for hosted deployments (e.g. Clawdi pods) that pre-configure a sub2api bearer token per deployment — the pod has no interactive OAuth login and no ~/.hermes/auth/codex.json.

Diff

1 file, +16 / -0, hermes_cli/runtime_provider.py:

if provider == "openai-codex":
    # Direct config: explicit api_key in config.yaml (e.g. sub2api proxy).
    # Takes priority over OAuth credentials from hermes-auth-store.
    cfg_api_key = str(model_cfg.get("api_key") or "").strip()
    if cfg_api_key:
        cfg_base_url = (
            str(model_cfg.get("base_url") or "").strip().rstrip("/")
        )
        return {
            "provider": "openai-codex",
            "api_mode": "codex_responses",
            "base_url": cfg_base_url or DEFAULT_CODEX_BASE_URL,
            "api_key": cfg_api_key,
            "source": "config",
            "requested_provider": requested_provider,
        }
    # Fallback: OAuth credentials from hermes-auth-store
    try:
        creds = resolve_codex_runtime_credentials()
        # ... existing OAuth path, unchanged ...

Priority order

1. config.yaml model.api_key (new) — hosted deployments
2. hermes-auth-store (upstream) — interactive OAuth (ChatGPT Plus/Pro)
3. env-var fallback (upstream) — e.g. OpenRouter on AuthError

Zero behavior change when model.api_key is empty — the existing OAuth path runs unchanged.

Why patch instead of using custom_providers

The provider: custom path does accept model.api_key from config, but:

• It auto-detects api_mode from URL; sub2api's internal hostname doesn't match the api.openai.com heuristic → defaults to chat_completions, which is the wrong shape for Codex Responses API.
• Loses openai-codex-specific routing (GPT-5 reasoning params, Codex Responses details).
• Forces Clawdi's config generator to emit a different shape (custom_providers: [...]) than the model.* convention users expect.

The 16-line patch keeps provider: openai-codex first-class while satisfying the hosted-deployment use case.

Rebase hygiene

• Rebased onto upstream/main (currently 677f1227) — clean, no conflicts
• Pure additive insert at the top of the openai-codex branch; existing OAuth code path untouched
• Insertion point is a stable conditional block header — low rebase-conflict risk going forward

Not for upstream

Internal-only PR against Clawdi-AI/hermes-agent:main. Not submitting upstream to NousResearch/hermes-agent.

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: base64 encoding/decoding detected

Base64 has legitimate uses (images, JWT, etc.) but is also commonly used to obfuscate malicious payloads. Verify the usage is appropriate.

Matches (first 20):

3280:+        b64 = base64.b64encode(raw).decode("ascii")
8311:+        body = base64.urlsafe_b64decode(payload["body"]["data"]).decode("utf-8", errors="replace")
8315:+                body = base64.urlsafe_b64decode(part["body"]["data"]).decode("utf-8", errors="replace")
8320:+                    body = base64.urlsafe_b64decode(part["body"]["data"]).decode("utf-8", errors="replace")

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

2737:+            proc = await asyncio.create_subprocess_exec(
14689:+            parent_check = self._exec(
14693:+                ls_result = self._exec(
14739:+        result = self._exec(cmd_sorted, timeout=60)
14749:+            result = self._exec(cmd_plain, timeout=60)

⚠️ WARNING: Outbound network calls (POST/PUT)

Outbound POST/PUT requests in new code could be data exfiltration. Verify the destination URLs are legitimate.

Matches (first 10):

4504:+                resp = httpx.post(
6437:+            with urllib.request.urlopen(req, timeout=_GATEWAY_HEALTH_TIMEOUT) as resp:
6992:+        with urllib.request.urlopen(req, timeout=15) as r:
7052:+        with urllib.request.urlopen(url, timeout=10) as r:
12751:+        original_urlopen = ws.urllib.request.urlopen
20362:+        resp = urllib.request.urlopen(req, timeout=10)

⚠️ WARNING: Install hook files modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/memory_setup.py
hermes_cli/setup.py

⚠️ WARNING: marshal/pickle/compile usage

These can deserialize or construct executable code objects.

Matches:

20630:+   - Unsafe deserialization (pickle.loads, yaml.load without SafeLoader)

⚠️ WARNING: CI/CD workflow files modified

Changes to workflow files can alter build pipelines, inject steps, or modify permissions. Verify no unauthorized actions or secrets access were added.

Files:

.github/workflows/contributor-check.yml
.github/workflows/deploy-site.yml
.github/workflows/docker-publish.yml
.github/workflows/docs-site-checks.yml
.github/workflows/nix.yml
.github/workflows/skills-index.yml
.github/workflows/supply-chain-audit.yml
.github/workflows/tests.yml

⚠️ WARNING: Dependency manifest files modified

Changes to dependency files can introduce new packages or change version pins. Verify all dependency changes are intentional and from trusted sources.

Files:

package.json
pyproject.toml
scripts/whatsapp-bridge/package.json

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: base64 encoding/decoding detected

Base64 has legitimate uses (images, JWT, etc.) but is also commonly used to obfuscate malicious payloads. Verify the usage is appropriate.

Matches (first 20):

3280:+        b64 = base64.b64encode(raw).decode("ascii")
8311:+        body = base64.urlsafe_b64decode(payload["body"]["data"]).decode("utf-8", errors="replace")
8315:+                body = base64.urlsafe_b64decode(part["body"]["data"]).decode("utf-8", errors="replace")
8320:+                    body = base64.urlsafe_b64decode(part["body"]["data"]).decode("utf-8", errors="replace")

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

2737:+            proc = await asyncio.create_subprocess_exec(
14689:+            parent_check = self._exec(
14693:+                ls_result = self._exec(
14739:+        result = self._exec(cmd_sorted, timeout=60)
14749:+            result = self._exec(cmd_plain, timeout=60)

⚠️ WARNING: Outbound network calls (POST/PUT)

Outbound POST/PUT requests in new code could be data exfiltration. Verify the destination URLs are legitimate.

Matches (first 10):

4504:+                resp = httpx.post(
6437:+            with urllib.request.urlopen(req, timeout=_GATEWAY_HEALTH_TIMEOUT) as resp:
6992:+        with urllib.request.urlopen(req, timeout=15) as r:
7052:+        with urllib.request.urlopen(url, timeout=10) as r:
12751:+        original_urlopen = ws.urllib.request.urlopen
20362:+        resp = urllib.request.urlopen(req, timeout=10)

⚠️ WARNING: Install hook files modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/memory_setup.py
hermes_cli/setup.py

⚠️ WARNING: marshal/pickle/compile usage

These can deserialize or construct executable code objects.

Matches:

20630:+   - Unsafe deserialization (pickle.loads, yaml.load without SafeLoader)

⚠️ WARNING: CI/CD workflow files modified

Changes to workflow files can alter build pipelines, inject steps, or modify permissions. Verify no unauthorized actions or secrets access were added.

Files:

.github/workflows/contributor-check.yml
.github/workflows/deploy-site.yml
.github/workflows/docker-publish.yml
.github/workflows/docs-site-checks.yml
.github/workflows/nix.yml
.github/workflows/skills-index.yml
.github/workflows/supply-chain-audit.yml
.github/workflows/tests.yml

⚠️ WARNING: Dependency manifest files modified

Changes to dependency files can introduce new packages or change version pins. Verify all dependency changes are intentional and from trusted sources.

Files:

package.json
pyproject.toml
scripts/whatsapp-bridge/package.json

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.