[codex] Preserve agent continuity across cache and compression paths

[changw98ic]

Summary

This PR tightens several continuity boundaries in the agent runtime:

• Preserve Codex backend cache routing by sending request-level session_id and x-client-request-id headers for stable prompt-cache keys.
• Flush the current conversation tail before compression rotates the session, so session persistence and memory extraction do not drop the active turn.
• Recover complete tool-call markup emitted as Anthropic text into normalized tool calls.
• Coerce hermes config set values based on the known default type, avoiding boolean coercion for string enums such as approvals.mode=off.
• Wait briefly for in-flight MCP discovery before agent construction and log MCP discovery failures with actionable warning context.
• Handle non-text macOS keychain stdout defensively when reading Claude Code credentials.

Validation

• git diff --check
• .venv/bin/python -m pytest tests/hermes_cli/test_set_config_value.py tests/hermes_cli/test_mcp_startup.py tests/tui_gateway/test_wait_for_mcp_discovery.py -q
45 passed
• .venv/bin/python -m pytest tests/agent/transports/test_codex_transport.py tests/agent/transports/test_transport.py -q
80 passed, 1 warning
• .venv/bin/python -m pytest tests/run_agent/test_compression_boundary_hook.py tests/run_agent/test_compression_persistence.py -q
13 passed, 1 warning
• Live Codex cache probe with request-level session headers: second request reported cached_tokens=5376.

Full-suite note

I also ran scripts/run_tests.sh after creating a local .venv. The run completed with 30975 passed, 57 failed, and 4 per-file timeouts. I did not treat that as a green full-suite because the failures were traced to local environment and runner constraints:

• local DNS maps github.com, example.com, and cdn.discordapp.com to 198.18.0.x, triggering SSRF protections in browser/web/Discord/Matrix tests;
• wecom optional extra was missing initially; installing it made tests/gateway/test_wecom_callback.py pass;
• macOS lacks Linux systemctl / user D-Bus for systemd tests;
• /tmp resolves to /private/tmp on macOS;
• the per-file runner timeout is 140s while slow files pass individually, e.g. tests/run_agent/test_run_agent.py passed standalone in 322s.

[teknium1]

Thanks for collecting several continuity cases. One configuration bug is still present on current main: hermes_cli/config.py:8157-8165 globally converts off to False, even though approvals.mode is a string enum in DEFAULT_CONFIG (hermes_cli/config.py:2533-2536). The type-aware coercion and regression test are worth preserving as a focused salvage.

Problems

• The new Anthropic parser converts plain text markup into executable tool calls. Current main deliberately strips standalone tool-call markup instead (agent/agent_runtime_helpers.py:641-664; tests/run_agent/test_run_agent.py:453-496). Please do not add a new model-output reconstruction path without a focused reproduction and end-to-end safety case.
• The fixed six-second MCP wait conflicts with the current configurable, cache-safe late-refresh design (hermes_cli/config.py:1359-1372; hermes_cli/mcp_startup.py:87-100).
• Codex cache headers and compression-tail persistence are already implemented on main (agent/transports/codex.py:332-354, commit 4d39a603d; agent/conversation_compression.py:765-775, commit 81ff916e5).

Suggested changes

• Split and salvage only the config coercion fix with its regression test.
• Drop the text-to-tool-call and fixed-wait portions unless independently reworked against current main.

Automated hermes-sweeper review.