fix(auxiliary): support minimax oauth providers

[LeonSGP43]

What does this PR do?

Supports MiniMax auxiliary providers that authenticate with oauth_minimax by resolving runtime OAuth credentials instead of treating them as unsupported non-API-key providers.

Related Issue

Fixes #21521

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• update agent/auxiliary_client.py so resolve_provider_client() accepts oauth_minimax
• resolve MiniMax OAuth credentials via resolve_minimax_oauth_runtime_credentials() instead of the generic API-key helper
• add a regression test in tests/agent/test_auxiliary_client.py covering the MiniMax OAuth path

How to Test

1. uv run --frozen --extra dev pytest -q -o addopts='' tests/agent/test_auxiliary_client.py -k minimax_oauth
2. uv run --frozen ruff check agent/auxiliary_client.py tests/agent/test_auxiliary_client.py
3. confirm resolve_provider_client("minimax-oauth") builds the OpenAI-compatible client with the OAuth-derived token and base URL

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 15.5

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

• targeted pytest: 1 passed, 154 deselected
• ruff check passed

[alt-glitch]

Duplicate of #22213 — same oauth_minimax handling in resolve_provider_client(). Both fix #21521.

[teknium1]

Thanks for isolating a real auxiliary-provider routing gap: current main still sends oauth_minimax through the unhandled-auth-type fallback at agent/auxiliary_client.py:5112-5117.

Problems

• The proposed resolver call uses the static-token default and the surrounding branch coerces it with str(). MiniMax OAuth requires as_token_provider=True so the client receives a callable that refreshes short-lived tokens per request (hermes_cli/auth.py:7759-7791).
• The surrounding auxiliary routing was refactored. Current Anthropic transport correction is _maybe_wrap_anthropic() at agent/auxiliary_client.py:1487-1568; callable API keys are supported by build_anthropic_client() at agent/anthropic_adapter.py:744-750.
• The test freezes MiniMax-M2.7-highspeed, but the current OAuth profile default is MiniMax-M2.7 (plugins/model-providers/minimax/__init__.py:82-93).

Suggested changes

• Salvage the branch into the current provider-resolution path with as_token_provider=True, preserving the callable through the Anthropic wrapper.
• Test an explicit model and callable-token/Anthropic-wrapper propagation rather than a mutable provider default.

Automated hermes-sweeper review.

[teknium1]

Please resolve MiniMax credentials with as_token_provider=True and preserve the resulting callable rather than flowing it into the following str(...) coercion. Current hermes_cli/auth.py:7759-7791 documents that this is required to refresh MiniMax's short-lived OAuth access token per request.

[teknium1]

Avoid asserting a provider-default model literal here: current minimax-oauth declares MiniMax-M2.7 at plugins/model-providers/minimax/__init__.py:82-93. Pass an explicit model and assert the OAuth callable reaches the current Anthropic transport path instead.