fix: select Codex runtime after desktop OAuth

[donovan-yohan]

Summary

• select openai-codex as the active runtime provider after successful Desktop Codex device-code OAuth
• keep the existing token persistence path intact, then call the same provider/config updater used by CLI auth/model setup
• add a focused regression test proving Desktop OAuth leaves resolve_runtime_provider(requested=None) ready

Why

Desktop onboarding could show OpenAI Codex as connected because the device-code worker saved auth tokens, but runtime resolution still failed with “No inference provider configured” because no provider configuration was activated. Running hermes model in the CLI fixed affected installs by doing the missing provider selection. This PR makes the Desktop OAuth success path do that provider activation automatically.

Fixes #37515.

Validation

• RED: uv run --extra dev python -m pytest tests/hermes_cli/test_web_oauth_dispatch.py::test_codex_dashboard_login_persists_active_runtime_provider -q -o 'addopts=' failed before the implementation because no active Codex runtime provider was selected
• uv run --extra dev python -m pytest tests/hermes_cli/test_web_oauth_dispatch.py::test_codex_dashboard_login_persists_active_runtime_provider -q -o 'addopts=' → 1 passed
• uv run --extra dev python -m pytest tests/hermes_cli/test_web_oauth_dispatch.py tests/hermes_cli/test_auth_codex_provider.py -q -o 'addopts=' → 33 passed
• ./scripts/run_tests.sh tests/hermes_cli/test_web_oauth_dispatch.py tests/hermes_cli/test_auth_codex_provider.py → 33 passed
• uv run --extra dev ruff check hermes_cli/web_server.py tests/hermes_cli/test_web_oauth_dispatch.py → passed
• git diff --check → passed

Review notes

• Kept the production diff to the existing _codex_full_login_worker() success path: after _save_codex_tokens(...), call _update_config_for_provider("openai-codex", base_url).
• Trimmed the regression to the issue symptom: OAuth completes, auth.json.active_provider is set, and resolve_runtime_provider(requested=None) resolves Codex with the new token.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR adjusts the Codex dashboard OAuth device-code flow to persist login state via the canonical auth/config storage so runtime provider resolution is immediately usable after login.

Changes:

• Update _codex_full_login_worker to persist Codex tokens and set the active provider/config via hermes_cli.auth helpers (instead of writing only to the credential pool).
• Add a regression test that asserts auth.json, config.yaml, and resolve_runtime_provider() reflect the newly logged-in Codex provider.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
tests/hermes_cli/test_web_oauth_dispatch.py	Adds an integration-style test ensuring a Codex dashboard OAuth login persists tokens + active provider and updates config for runtime resolution.
hermes_cli/web_server.py	Switches Codex dashboard login persistence to _save_codex_tokens / _update_config_for_provider to make runtime resolution ready post-login.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[donovan-yohan]

Superseded by #37517, which has been merged. Closing this out to keep the queue clean.