fix(auxiliary): support minimax-oauth in auxiliary client router (fixes #21521, #36091)

[ubxty]

Problem

Hermes users with minimax-oauth as their main provider see this on every CLI session:

⚠ Auxiliary title generation failed: HTTP 401: Invalid Authentication

The same root cause breaks kanban specify and any other auxiliary task that doesn't pin a fallback provider.

Root cause

hermes_cli/auth.py:301 declares MiniMax OAuth with auth_type="oauth_minimax". agent/auxiliary_client.py dispatches on pconfig.auth_type, but the OAuth provider branch was gated on {"oauth_device_code", "oauth_external"} — "oauth_minimax" was not in the set. The call therefore fell through to the generic warning at the bottom of the resolver and returned (None, None).

Fix

1. Add "oauth_minimax" to the OAuth provider dispatch gate (1 line).
2. Add a minimax-oauth case in the provider switch that delegates to a new builder, _build_minimax_oauth_aux_client() (12 lines).
3. The builder mirrors _try_anthropic() — MiniMax's inference endpoint is Anthropic-API compatible — but installs build_minimax_oauth_token_provider() as a per-request callable api_key, so MiniMax's 15-minute access-token TTL is auto-refreshed on every outbound request. Same pattern the main runtime uses (agent/agent_runtime_helpers.py:1460).

Tests

Four new tests in TestMiniMaxOAuthAuxiliaryClient:

• test_resolve_minimax_oauth_dispatches_to_anthropic_compat — happy path, asserts the builder is called with the right inference_base_url.
• test_resolve_minimax_oauth_uses_main_model_when_empty — universal fallback chain (Step 3 main-model) still works when no model is passed and there is no catalog default.
• test_resolve_minimax_oauth_returns_none_when_not_logged_in — swallowed AuthError returns (None, None) so the chain falls through to its next provider.
• test_builder_uses_anthropic_sdk_not_openai — regression guard for the previous fix attempt (PR fix: resolve minimax-oauth auxiliary client routing #35539) that wrapped an OpenAI client in AnthropicAuxiliaryClient and crashed at runtime.

Verification

• pytest tests/agent/test_auxiliary_client.py — 211 passed.
• pytest tests/agent/test_minimax_provider.py tests/agent/test_minimax_auxiliary_url.py tests/plugins/model_providers/test_minimax_profile.py — 276 passed total.
• End-to-end repro: call_llm(task='title_generation', ...) returns a real title (no HTTP 401, no 'unhandled auth_type' warning).

Notes

• The fix makes minimax-oauth work for ALL auxiliary tasks, not just title generation. The default model is the one registered on the provider profile (MiniMax-M2.7 per plugins/model-providers/minimax/__init__.py).
• AnthropicAuxiliaryClient already accepts a callable api_key (the bearer-hook machinery in agent/anthropic_adapter.py calls it per-request), so no upstream changes to the wrapper are needed.

Fixes #21521, #36091

[teknium1]

Thanks for tracing the missing MiniMax OAuth auxiliary route. The premise still holds on current main: hermes_cli/auth.py:301-310 registers minimax-oauth as oauth_minimax, while agent/auxiliary_client.py:5106-5119 only handles oauth_device_code and oauth_external, so this request reaches the unhandled-auth-type return.

Problems

• The proposed builder takes pconfig.inference_base_url. Current OAuth runtime credentials instead return the persisted, region-specific URL at hermes_cli/auth.py:7826-7864; OAuth setup selects the China inference URL at hermes_cli/auth.py:7613. The auxiliary path should use that runtime URL, not the global registry default.
• The resolver has moved since this branch: merged a8841e2a now preserves first-class provider identity with resolved endpoints (agent/auxiliary_client.py:5969-5974). The fix needs a current-head integration rather than a verbatim application of the older hunk.

Suggested changes

• Build the client from resolve_minimax_oauth_runtime_credentials(as_token_provider=True) and cover its callable token provider plus the persisted regional base URL.

Automated hermes-sweeper review.

[digitalscalvia]

Salvaged this contribution onto current main in #68620, preserving @ubxty as the commit author. The replacement implements the maintainer-requested resolve_minimax_oauth_runtime_credentials(as_token_provider=True) path, including callable refresh credentials and the persisted region-specific inference URL. Canonical targeted suite: 385 passed; live MiniMax-M2.7 MoA-reference canary: failed=false.