fix(auth): resolve Codex usage credentials from auth fallbacks

[NoxsMedia]

Summary

• allows Codex token readers used by /usage to resolve OAuth credentials from credential_pool.openai-codex when the legacy providers.openai-codex block is absent
• keeps profile-local auth authoritative, with the global root auth store as a read-only fallback only when no local provider/pool credentials are present
• preserves Codex pool base_url and source provenance metadata during runtime credential resolution
• lets gateway /usage probe account-usage-capable credential pools when no live/cached agent or billing row has identified a provider yet

Fixes #15167.
Related: #15173.

Latest main refresh

• Base: 355af2c20 (origin/main)
• Head: 4962d8477e69f5c0b4408da0bcef91f19cbba736
• Rebuilt as one clean commit on latest main.
• Semantic conflict resolved: latest main had moved Codex pool fallback into the shared token reader, so this refresh preserves latest-main reader behavior while carrying source provenance forward, avoiding global auth fallback shadowing of local pool credentials, and skipping pool entries still in an exhaustion cooldown.

Test Plan

• git diff --check
• /home/ubuntu/.hermes/hermes-agent/.venv/bin/python -m pytest -o addopts='' tests/hermes_cli/test_auth_codex_provider.py tests/hermes_cli/test_auth_profile_fallback.py tests/gateway/test_usage_command.py -q

Focused result: 53 passed in 0.57s.

[teknium1]

Thanks for refreshing the focused /usage fix. The current main checkout still has the no-agent/provider-resolution gap: gateway/slash_commands.py:3960-3984 only fetches account usage when a live/cached agent or persisted billing row supplies a provider.

Problems

• The pool projection in the proposed _read_codex_tokens() changes a pool credential into singleton refresh state. resolve_codex_runtime_credentials() force-refreshes through _refresh_codex_auth_tokens() and _save_codex_tokens() (hermes_cli/auth.py:3539-3580, 3361-3386), while _sync_codex_pool_entries() deliberately does not rewrite independent manual:device_code entries (hermes_cli/auth.py:3279-3307, 3334-3346). A refreshed independent pool account can therefore leave its original pool entry stale while a separate singleton copy is written.

Suggested changes

• Keep the no-provider /usage probe, but resolve/refresh pool-backed Codex credentials through the selected CredentialPool entry rather than the singleton reader path.
• Add a forced-refresh regression for a pool-only independent manual:device_code account, asserting its selected entry is updated and other accounts remain unchanged.

This is an automated hermes-sweeper review.

[NoxsMedia]

Closing at the author’s request. We no longer plan to carry this patch. Official main already renders Codex limits once the provider is known, and we are not continuing the additional cold-start credential-pool path in its current form.