fix(agent): raw_codex client uses runtime-resolved base_url

[Tranquil-Flow]

What does this PR do?

resolve_provider_client() was hardcoding _CODEX_AUX_BASE_URL for the raw_codex=True path, ignoring any custom base URL set via HERMES_CODEX_BASE_URL or a Codex-compatible proxy. This change calls resolve_codex_runtime_credentials() (the same resolver used by the non-raw path) so custom proxies and load balancers work correctly.

Related Issue

Fixes #5875

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• agent/auxiliary_client.py — targeted fix in resolve_provider_client() so the raw_codex=True path uses resolve_codex_runtime_credentials() instead of the hardcoded base URL constant
• tests/agent/test_auxiliary_client.py — regression test covering runtime-resolved base_url for the raw Codex client

How to Test

1. pytest tests/agent/test_auxiliary_client.py — passes
2. With HERMES_CODEX_BASE_URL set to a proxy URL, confirm raw_codex=True sessions hit the custom endpoint correctly

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 15 (Darwin 24.6.0)

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

$ pytest tests/agent/test_auxiliary_client.py

[blasai1739217-cmyk]

Friendly bump on this PR in case it fell through the cracks \u2014 would love a review when someone has a minute. Thanks!

[alt-glitch]

Related to #15855 — both fix #5875 (raw_codex base_url resolution). Same root cause in resolve_provider_client().

[teknium1]

Thanks for addressing the live raw-Codex routing defect. Current main still constructs raw Codex clients with the fixed endpoint at agent/auxiliary_client.py:4574-4588, while the main-agent initialization reaches that branch through agent/agent_init.py:953.

Problems

• The same runtime override remains absent from the non-raw Codex path: resolve_provider_client() calls _build_codex_client() at agent/auxiliary_client.py:4590, and that helper still uses _CODEX_AUX_BASE_URL for singleton credentials at agent/auxiliary_client.py:2469 and agent/auxiliary_client.py:2474.
• The new test stubs the resolver, so it does not prove that HERMES_CODEX_BASE_URL reaches the constructed client through the actual auth-store resolver (hermes_cli/auth.py:3718-3726).

Suggested changes

• Reuse resolve_codex_runtime_credentials() in _build_codex_client() too, retaining the existing adapter behavior.
• Add a temp-HERMES_HOME integration regression covering the environment override for both raw and wrapped Codex client construction.

This is an automated hermes-sweeper review.