fix(auth): resolve Codex credentials from pool fallback

[kpadilha]

What does this PR do?

Fixes Codex runtime credential resolution when OAuth credentials exist only in the credential pool and the legacy/provider-state slot is empty.

This can happen after hermes auth add openai-codex --type oauth appends a fresh pooled credential without writing the older provider-state shape. Before this change, _read_codex_tokens() raised codex_auth_missing even though a valid pooled Codex credential was present. The runtime now falls back to the selected pooled credential and preserves the source label for diagnostics.

Related Issue

N/A — found while validating local gateway/runtime auth after an upstream cleanup.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• hermes_cli/auth.py
  • Let _read_codex_tokens() fall back to read_credential_pool("openai-codex") when provider state is absent.
  • Preserve a source field so resolve_codex_runtime_credentials() can report whether credentials came from provider state or a pool entry.
• tests/hermes_cli/test_auth_codex_provider.py
  • Add regression coverage for provider-state-missing / credential-pool-present Codex auth.

How to Test

Targeted validation run on Ubuntu/Linux with Python 3.11:

1. python -m py_compile hermes_cli/auth.py
2. python -m pytest tests/hermes_cli/test_auth_codex_provider.py -q -o 'addopts='

Result:

17 passed in 0.40s

Full pytest tests/ -q was not run for this small PR branch, so the full-suite checklist item is intentionally left unchecked.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Debian Linux / Python 3.11

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

For New Skills

N/A

Screenshots / Logs

$ python -m pytest tests/hermes_cli/test_auth_codex_provider.py -q -o 'addopts='
.................                                                        [100%]
17 passed in 0.40s

[kpadilha]

Closing as superseded by upstream main. The original fix (Codex chat path falling back to credential_pool when provider singleton is empty) is now covered upstream by commit 69dfcdc, with broader handling/tests including exhausted pool entries and source normalization. I verified current upstream/main passes tests/hermes_cli/test_auth_codex_provider.py (24 passed). Rebasing this old PR commit on current main would regress the newer upstream source contract, so there is no branch update to submit here.

[dsameer0-code]

Unsubscribe  Sent from Yahoo Mail for iPhone On Monday, June 1, 2026, 7:29 AM, Krishna ***@***.***> wrote: Closed #29873. — Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today! You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>