feat(auth): share openai-codex OAuth token across profiles via shared store

[andrewkangkr]

Problem

Hermes keeps a per-profile openai-codex singleton token, but OAuth refresh_tokens are single-use. When one gateway (e.g. the default profile) refreshes, it rotates the shared ChatGPT/Codex account token, so a sibling profile (e.g. a separate --profile gateway such as a dedicated assistant) that still holds the old refresh token starts failing with relogin-required 401s until a manual re-auth.

The existing ~/.codex/auth.json self-heal only recovers tokens the Codex CLI rotated. It does not cover the case where a sibling Hermes profile rotated the token, because Hermes deliberately does not write back to ~/.codex (#12360). With two gateways on the same account (default + a profile gateway), they rotate each other's tokens and intermittently 401.

Fix

Mirror the patterns already used for Nous (shared store) and xAI (global-root write-through, #43589), now for openai-codex:

• Write-through: publish the singleton token to <hermes-root>/shared/codex_auth.json on every _save_codex_tokens, atomically (O_EXCL, 0o600) under a cross-profile lock.
• Recover: on a relogin-required refresh failure, prefer a still-valid sibling-published token from the shared store before falling back to the Codex CLI store (~/.codex). An expiring shared token is skipped so the caller still falls through.

The shared dir resolution (HERMES_SHARED_AUTH_DIR → <hermes-root>/shared/) is factored into _shared_auth_dir() and reused by the existing Nous helper.

Safety / scope

• Only the singleton token is shared. Independent accounts added via hermes auth add openai-codex live in the credential pool and never flow through _save_codex_tokens, so they are never published (regression guard for [Bug]: openai-codex OAuth add/reauth overwrites existing credential-pool entries while preserving stale labels #39236).
• Lock-ordering invariant preserved: _auth_store_lock is always acquired before the shared-store lock.
• Best-effort: shared-store write/read failures are swallowed; the per-profile auth.json remains the source of truth.
• Same TOCTOU-safe atomic write + 0o600 perms as the Nous/xAI stores (fix(google_oauth): close TOCTOU window when saving credentials #19673, fix(security): close TOCTOU window when saving MCP OAuth credentials #21148).

Tests

New tests/hermes_cli/test_auth_codex_shared_store.py (10 tests, all passing):

• write/read roundtrip; write skips without refresh_token; read returns None on missing/malformed; owner-only file perms
• _save_codex_tokens publishes to the shared store
• recovery adopts a valid token, returns None when empty, and skips an expiring token
• integration: a relogin-required refresh prefers the shared store over ~/.codex

Existing codex/nous auth suites pass unchanged.

🤖 Generated with Claude Code

[teknium1]

Thanks for the careful investigation and regression coverage. This is already implemented on current main through the existing global-root OAuth write-through path rather than a second shared-store protocol.

• Automated hermes-sweeper review verified merged commit a4091e49f (#52760), which writes a refreshed openai-codex credential-pool grant back to the global root when a profile inherited that grant.
• agent/credential_pool.py:916-996 preserves profile shadowing while updating the rotated token chain for sibling profiles that use the root fallback.
• tests/agent/test_credential_pool_oauth_writethrough.py:76-176 covers the Codex root write-through and verifies profile-owned credentials do not clobber the root state.
• The related cross-reference, PR feat(auth): Codex OAuth write-through to global root (multi-profile parity with xAI #43589) #50632, also records that this issue was fixed on main via #52760.

Closing as implemented on main.