fix(auth): share Codex OAuth pool across profiles

[vishutdhar]

Summary

• Share openai-codex credential-pool entries from the global root auth store in profile mode.
• Persist profile-mode Codex pool writes to the shared root store while leaving other providers profile-local.
• Sync device-code-backed Codex pool entries from the shared pool before status and refresh decisions.
• Preserve independent manual API-key entries when Codex OAuth tokens rotate.

Why

Codex OAuth refresh tokens are single-use. If profile-local pools keep separate copies, one profile can refresh and rotate the token while another profile keeps using a stale refresh token. Sharing the Codex pool in profile mode gives workers one source of truth for the active token pair.

Tests

• scripts/run_tests.sh -j 2 tests/hermes_cli/test_auth_codex_provider.py tests/agent/test_credential_pool.py -- -q
• scripts/run_tests.sh -j 2 tests/hermes_cli/test_auth_commands.py -- -q -k 'codex or credential_pool or write_credential_pool'
• .venv/bin/python -m py_compile hermes_cli/auth.py agent/credential_pool.py
• git diff --check

[alt-glitch]

Duplicate of #28277 — both fix sharing Codex OAuth pool across profiles. #34121 also touches credential_pool.py (broader scope) while #28277 adds a dedicated shared lock/path in root auth store.

[teknium1]

Thanks for addressing the real single-use Codex refresh-token hazard. This automated hermes-sweeper review found that current main now provides the behavioral fix through a narrower profile-safe design.

• a4091e49f writes a rotated borrowed Codex pool grant through to the global-root auth store; current implementation: agent/credential_pool.py:916-996.
• da6d5fcd1 additionally serializes the Codex pool refresh read → POST → write-back transaction under the cross-process auth-store lock: agent/credential_pool.py:1006-1028.
• Regression coverage exercises the root/profile write-through behavior against real temporary auth stores: tests/agent/test_credential_pool_oauth_writethrough.py:76-176.
• The member note identifying this as part of the duplicate cluster (fix(auth): share Codex OAuth across profiles #28277) was considered.

Closing as implemented on main.