fix(auth): propagate credential label to pool entries on re-auth

[liuhao1024]

What does this PR do?

Fixes credential label not updating on re-auth for hermes auth add openai-codex (and other OAuth providers). When a user re-authenticates, the computed label (e.g., openai-codex-oauth-2) was saved to auth.json but never propagated to the credential pool, so the entry kept its stale label (e.g., openai-codex-oauth-1). The --label flag was similarly ignored for existing entries.

Related Issue

Fixes #42102

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• agent/credential_pool.py: In _upsert_entry(), changed label skip logic from "skip if existing has any label" to "skip only if new label equals existing label". This allows label updates when re-authentication produces a different label.
• hermes_cli/auth.py: Added label parameter to _sync_codex_pool_entries() and propagated it to pool entries alongside token updates. Updated _save_codex_tokens() to pass the label through.
• tests/hermes_cli/test_auth_codex_provider.py: Added 4 regression tests covering label sync to pool, custom --label propagation, label update on difference, and label preservation when unchanged.

How to Test

1. Run pytest tests/hermes_cli/test_auth_codex_provider.py -v — all 28 tests pass (24 existing + 4 new)
2. Run pytest tests/agent/test_credential_pool.py -v — all 78 tests pass (no regression from _upsert_entry change)
3. Run pytest tests/hermes_cli/test_auth_commands.py -v — all 49 tests pass

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Code Intelligence

• Analyzed: agent/credential_pool.py::_upsert_entry (callers: ~15 via _seed_from_singletons, _seed_from_env)
• Analyzed: hermes_cli/auth.py::_sync_codex_pool_entries (callers: 1 — _save_codex_tokens)
• Blast radius: LOW — label field is metadata only, change is additive (allows updates that were previously skipped)
• Related patterns: _upsert_entry is used by all pool seeding paths (anthropic, nous, xai, env-seeded). The label change is safe because re-authentication always produces a valid label.

[tonydwb]

Code Review Summary

Verdict: Approved

Looks Good

• Fixes credential label propagation: ensures the label is passed to _sync_codex_pool_entries when re-authenticating, so pool entries reflect the correct label.
• Dedicated test covers the re-auth propagation case.
• No security concerns, no debug artifacts.

---

Reviewed by Hermes Agent

[teknium1]

Thanks for the focused regression work.

Automated hermes-sweeper review found that current main already handles the reported hermes auth add openai-codex behavior through a newer persistence path:

• hermes_cli/auth_commands.py:310-344 derives the requested/default label and writes a distinct manual:device_code PooledCredential with pool.add_entry().
• tests/hermes_cli/test_auth_commands.py:401-409 covers multiple independent Codex additions and documents that the command no longer routes through _save_codex_tokens().
• The PR's _save_codex_tokens() label propagation targets the prior singleton path, which the current CLI add flow no longer uses.

Closing as implemented on main.