Add Codex upstream to local proxy broker

[blazing-mj]

Summary

• add openai-codex as a hermes proxy upstream backed by the shared Hermes Codex credential pool
• forward Codex-required Cloudflare headers via proxy credentials and refresh once on upstream 401 through existing pool refresh logic
• expose OpenAI-compatible /v1/chat/completions by translating to Codex /responses streaming and returning chat-completion JSON
• register the provider in hermes proxy providers and update CLI help

Verify-first notes

• Reviewed hermes_cli/proxy/adapters/base.py, nous_portal.py, xai.py, and server.py contract.
• Reused existing agent.credential_pool.load_pool("openai-codex"), pool.select(), and pool.try_refresh_current(); no new OAuth implementation.
• Reused agent.auxiliary_client._codex_cloudflare_headers for originator, User-Agent, and ChatGPT-Account-ID.
• Inspected Hermes profile config base_url locations and OpenClaw openclaw.json Codex model references without modifying live config.
• Live rollout was limited to a temporary foreground proxy smoke; no launchd service or profile/OpenClaw config was changed in this PR.

Tests / proof

• python -m pytest tests/hermes_cli/test_proxy.py tests/agent/test_codex_cloudflare_headers.py -q → 62 passed
• python -m py_compile hermes_cli/proxy/adapters/codex.py hermes_cli/proxy/adapters/base.py hermes_cli/proxy/server.py hermes_cli/proxy/adapters/__init__.py hermes_cli/subcommands/gateway.py tests/hermes_cli/test_proxy.py
• git diff --check
• Temporary live proxy smoke on 127.0.0.1:8645:
  • /health → {"status":"ok","upstream":"OpenAI Codex","authenticated":true}
  • /v1/chat/completions with dummy bearer/model gpt-5.5 → HTTP 200, content BROKER_OK

Rollout safety

No live config was changed. Next staged rollout step is to install/run the proxy service persistently, then repoint one low-traffic Hermes profile to http://127.0.0.1:8645/v1, verify, then continue profile-by-profile before OpenClaw.

[tonydwb]

Code Review Summary

Verdict: LGTM — clean Codex upstream adapter.

Well-structured implementation with proper base class extension. Good test coverage for the adapter and chat.completions to responses translation.

---

Reviewed by Hermes Agent

[tonydwb]

Code Review Summary

Verdict: LGTM

Clean, well-scoped change with no concerns.

--- Reviewed by Hermes Agent

[teknium1]

Thanks for the focused reuse of the existing Codex credential pool and Cloudflare-header helper.

Problems

• hermes_cli/proxy/server.py:110-129 translates messages but drops Chat Completions tools and tool_choice. Native Codex transport explicitly converts tools in agent/transports/codex.py:91-94; tool-using downstream clients would silently lose their tool contract.
• hermes_cli/proxy/server.py:133-178 consumes Responses SSE into text-only JSON, hard-codes finish_reason: stop, and cannot surface function calls. It also returns JSON even if the downstream request sets stream: true.
• The parser help changes, but hermes_cli/proxy/cli.py:126 and website/docs/user-guide/features/subscription-proxy.md:75 still advertise only nous|xai.

Suggested changes

• Add complete request and response translation coverage for tools and streaming, or narrow the documented compatibility contract.
• Update the proxy CLI help and user/reference docs alongside provider registration.

Automated hermes-sweeper review.

[teknium1]

This payload drops inbound Chat Completions tools and tool_choice. The native Codex transport converts tool schemas through _responses_tools (agent/transports/codex.py:91-94); please either implement the equivalent mapping and test a tool-call turn, or explicitly narrow this compatibility endpoint.

[teknium1]

This always emits a text-only, non-streaming completion with finish_reason: stop. Responses function calls are discarded, and a caller that requested stream: true cannot receive SSE. Preserve the caller's streaming mode and map function-call output before advertising Chat Completions compatibility.

[teknium1]

Please update the other user-facing help/docs too: hermes_cli/proxy/cli.py:126 still lists only nous|xai, and website/docs/user-guide/features/subscription-proxy.md:75 says those are the only shipped providers.