fix(codex): recover hermes auth from cli tokens

[submit77]

Title: fix(codex): recover hermes auth from cli tokens

What does this PR do?

Adds a narrow recovery path for OpenAI Codex auth when Hermes' private auth store is missing valid runtime credentials but the local Codex CLI store still has usable tokens.

Specifically, Hermes now attempts recovery from ~/.codex/auth.json when:

• Hermes has no stored Codex credentials (codex_auth_missing)
• a Codex refresh fails with invalid_grant
• a Codex refresh fails with invalid_token

If no valid CLI tokens are available, Hermes preserves the original error.

Related Issue

Fixes #

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• ✅ Tests (adding or improving test coverage)
• 📝 Documentation update
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• hermes_cli/auth.py
  • add _codex_auth_error_allows_external_recovery()
  • add _recover_codex_auth_from_cli()
  • recover from CLI tokens on codex_auth_missing
  • retry refresh using recovered CLI tokens on invalid_grant / invalid_token
  • preserve original failure if recovery cannot happen
• tests/hermes_cli/test_auth_codex_provider.py
  • add regression for refresh failure recovering from CLI tokens
  • add regression proving original invalid_grant is preserved when recovery source is missing

How to Test

1. source venv/bin/activate
2. python -m pytest tests/hermes_cli/test_auth_codex_provider.py -q -o addopts=
3. Confirm all tests pass, including:
   • refresh failure recovery from CLI tokens
   • original error propagation when no recovery source exists

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes
• I've tested on my platform: Ubuntu 24.04 / WSL

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

Targeted verification:

• python -m pytest tests/hermes_cli/test_auth_codex_provider.py -q -o addopts=
• result: passing locally

Note: the full repository suite currently has unrelated baseline failures in this environment on origin/main, so targeted verification was used for this scoped bugfix.

[submit77]

Closing this proactively to avoid duplicate/competing auth-side work. This overlaps too heavily with the already-open Codex auth recovery PR #3279, and I had already commented there rather than intending to open a competing PR. Keeping the branch around in case any specific test cases or narrower follow-up pieces are useful later.