fix(auxiliary): route minimax-oauth provider through dedicated helper

[VIPKaiser]

Problem

Users with MiniMax OAuth authentication (configured via hermes model -> MiniMax (OAuth)) cannot use it for auxiliary tasks (compression, title_generation, web_extract, etc.). Any auxiliary.<task>.provider: minimax-oauth config in config.yaml produces:

RuntimeError: Provider 'minimax-oauth' is set in config.yaml but no API key
was found. Set the MINIMAX-OAUTH_API_KEY environment variable, or switch
to a different provider with `hermes model`.

This is misleading: the user is correctly authenticated; the failure is in the dispatch.

Root cause

resolve_provider_client() in agent/auxiliary_client.py has early branches for the other OAuth providers:

if provider == "nous": ...
if provider == "openai-codex": ...
if provider == "xai-oauth": ...

…but no branch for minimax-oauth. So requests fall through to the generic pconfig.auth_type in {"oauth_device_code", "oauth_external"} arm, which doesn't list oauth_minimax (the auth_type the MiniMax ProviderConfig uses). It hits the final unhandled auth_type oauth_minimax warning, returns (None, None), and the caller raises the misleading error.

Fix

1. New helper _build_minimax_oauth_aux_client() — plumbs the MiniMax OAuth token provider callable (build_minimax_oauth_token_provider()) into the OpenAI client so a fresh access token is minted per request (MiniMax issues short-lived tokens, ~15min TTL).
2. New early branch in resolve_provider_client() — parallel to the nous/openai-codex/xai-oauth branches, routes provider='minimax-oauth' to the new helper.
3. Defensive elif pconfig.auth_type == 'oauth_minimax' arm — belt-and-braces: if someone refactors out the early branch in the future, the auth_type fallback still works.
4. OpenAI-compatible base_url rewrite — MiniMax's /anthropic endpoint works over /v1/chat/completions too, so auxiliary tasks can use the bare OpenAI client (matching the existing minimax api-key path).

Tests

8 new test cases in tests/agent/test_auxiliary_client_minimax_oauth.py:

• test_returns_client_when_logged_in — happy path
• test_returns_client_with_model_fallback — caller passes no model
• test_returns_none_when_not_logged_in — clean (None, None) when auth.json has no MiniMax entry
• test_returns_none_when_creds_resolution_raises — AuthError handled
• test_dispatches_to_minimax_oauth_helper — confirm early-branch routing
• test_returns_none_cleanly_when_helper_returns_none — no false-positive error
• test_oauth_minimax_auth_type_branch_exists — defensive source-grep on the auth_type fallback
• test_does_not_raise_api_key_error_when_logged_in — regression test for the original misleading error string

All 388 auxiliary/minimax tests pass; the 5 unrelated failures elsewhere in tests/agent/ are pre-existing (verified by running on stashed/clean main).

Live verification

$ python -c "from agent.auxiliary_client import resolve_provider_client, call_llm;               client, model = resolve_provider_client('minimax-oauth', 'MiniMax-M3');               r = call_llm(task='title_generation', messages=[...], max_tokens=200, temperature=0.3)"
client: OpenAI
base_url: https://api.minimax.io/v1/
model: MiniMax-M3
OK, response: ChatCompletion(id='066cb47be319db96ceb0134cb4f5689e', ...)

End-to-end call to MiniMax via the new auxiliary path returns a real ChatCompletion.

Risk

• auxiliary_client.py is on the hot path for every auxiliary call (compression, web_extract, title_generation, curator, profile_describer, kanban_decomposer, triage_specifier, approval, mcp, skills_hub, vision). The new code is contained to one early branch and one helper function, both gated on provider == 'minimax-oauth'. The defensive auth_type arm only fires for the same provider.
• The /anthropic → /v1 base_url rewrite is wrapped in a try/except so a non-matching base URL silently keeps the original (and would surface the same Anthropic 404 the user might have been seeing before).
• No new dependencies, no new env vars, no schema changes to auth.json.

Checklist

• Tested locally with live MiniMax OAuth
• All existing auxiliary/minimax tests still pass
• New regression tests cover the original error message
• Defensive fallback for the auth_type dispatch

[mxnstrexgl]

🤖 Automated PR Review

Security Scan

• ✓ No hardcoded secrets, injection sinks, unsafe deserialization, or dependency red flags found by this automated scan.

Code Quality

• ✓ No blocking code-quality issues found by this automated scan.

Summary

Status: APPROVE — security findings: 0, quality suggestions: 0.

Automated review; raw diff content intentionally omitted.

[sweetcornna]

I verified this branch locally while triaging #38685. Focused checks pass in an isolated worktree:

python -m pytest tests/agent/test_auxiliary_client_minimax_oauth.py -q
# 8 passed

python -m ruff check agent/auxiliary_client.py tests/agent/test_auxiliary_client_minimax_oauth.py
# All checks passed

git diff --check origin/main...HEAD
# passed

This PR looks like the existing fix coverage for #38685 / #21521 from the focused regression angle. GitHub currently reports no checks on the branch, but the local focused verification is clean.

[teknium1]

Thanks for isolating a real auxiliary-routing gap. Current main still registers minimax-oauth as oauth_minimax (hermes_cli/auth.py:301-310), while resolve_provider_client() only routes oauth_device_code and oauth_external (agent/auxiliary_client.py:5106-5119).

Problems

• The proposed raw OpenAI /v1 route bypasses the current MiniMax OAuth transport path. The provider declares anthropic_messages (plugins/model-providers/minimax/__init__.py:82-92), and the callable credential is designed for build_anthropic_client()'s per-request bearer hook (hermes_cli/auth.py:7779-7823, agent/anthropic_adapter.py:745-751).
• The source-inspection regression test is implementation-coupled rather than proving the authenticated client and transport behavior.

Suggested changes

• Port the route onto current agent/auxiliary_client.py, using resolve_minimax_oauth_runtime_credentials(as_token_provider=True) plus build_anthropic_client() and AnthropicAuxiliaryClient.
• Replace the source-grep assertion with a mocked behavioral routing/transport test.

This is an automated hermes-sweeper review.

[teknium1]

Please preserve the current MiniMax OAuth transport rather than returning a raw OpenAI /v1 client here. Current main declares this provider anthropic_messages and uses build_anthropic_client() to install the callable credential as a per-request bearer hook (hermes_cli/auth.py:7779-7823; agent/anthropic_adapter.py:745-751). Build and return the Anthropic auxiliary adapter from that established path instead.