feat(codex): add browser OAuth login via oauth-cli-kit

[kaskabayev]

Summary

• hermes auth add openai-codex --method browser runs an oauth-cli-kit browser redirect flow. The resulting tokens land in Hermes's own auth store under providers.openai-codex, sharing the existing refresh / removal / suppression lifecycle with device-code.
• hermes model prompts for the login method when the user isn't already signed in.
• oauth-cli-kit is used only as a flow helper. A private in-memory TokenStorage is passed in so the library never writes its shared codex.json on disk. fix(codex): Hermes owns its own Codex auth; stop touching ~/.codex/auth.json #12360 invariant preserved — no read/write of ~/.codex/auth.json, no cross-tool refresh-token contention.

Out of scope (deliberately)

• No shared-credential reuse, NanoBOT interop, or --purge-shared. Those require a separate lifecycle (suppression, stale pruning, attribution rules, priority, platform paths) and should land as a follow-up PR if wanted.

Files changed

• hermes_cli/auth.py — _InMemoryOAuthTokenStorage, _codex_browser_oauth_login, --method dispatch in _login_openai_codex.
• hermes_cli/auth_commands.py — Codex branch picks browser vs device-code based on args.method; pool entry still stored under manual:device_code so existing removal / suppression paths cover both.
• hermes_cli/main.py — --method {device-code,browser} on auth add; interactive prompt in _model_flow_openai_codex.
• pyproject.toml, uv.lock — pinned oauth-cli-kit==0.1.3.
• website/docs/integrations/providers.md — Codex note mentions both login methods.
• Tests — 6 new cases covering the browser flow end-to-end plus the no-shared-file invariant.

[maesegallardo]

I need it because I have a businnes Openai account

[kaskabayev]

I need it because I have a businnes Openai account

you can pull and checkout to this branch, login via to OpenAI Codex via browser and checkout to main again. The session will persist (but idk for how much time tbf 😄 )

[kaskabayev]

@teknium1 could you please take a look here?

[teknium1]

Thanks for preserving Hermes-owned token storage and adding focused flow coverage.

Problems

• hermes_cli/auth.py:6252-6255 calls oauth-cli-kit without originator. In oauth-cli-kit v0.1.3, flow.py:170-182 uses the provider default, and providers/openai_codex.py:17 sets it to nanobot; the OAuth URL is therefore attributed to a third party. AGENTS.md:118-121 prohibits outbound attribution without an opt-in gate.
• The same dependency starts a local callback server (flow.py:192-205). Main removed xAI's comparable loopback/PKCE route in 5ef0b8ac specifically for headless/SSH/container compatibility and smaller local attack surface.
• pyproject.toml:52 adds this browser-only provider dependency to core, conflicting with the core-dependency scope rule at current pyproject.toml:39-44.
• tests/hermes_cli/test_auth_codex_provider.py:428-435 replaces the dependency with a fake that does not write through the passed storage, so its filesystem assertion does not test the stated invariant.

Suggested changes

• Rework the flow to eliminate unactioned attribution and avoid reintroducing loopback OAuth; then place any provider-specific package on the optional/lazy dependency path and test the real storage contract.

Automated hermes-sweeper review.

[teknium1]

This invokes oauth-cli-kit without originator. In v0.1.3, the library serializes originator or provider.default_originator, and its Codex provider defaults that value to nanobot; this adds third-party attribution to the OAuth request. Please do not use this provider path unless that parameter is removed under an approved opt-in design.

[teknium1]

This package is only imported by the optional Codex browser-login route, while current pyproject.toml reserves core dependencies for packages used in every Hermes session. Please use the established provider-specific optional/lazy dependency path instead.

[teknium1]

The fake login_oauth_interactive only returns a token and never calls storage.save(), so the later filesystem assertions prove only that this fake wrote nothing. Exercise oauth-cli-kit's actual storage contract while mocking callback/token transport to cover the no-shared-file invariant.