fix(agent): sync skills into persistent Codex threads

[FPSUnleashed]

What does this PR do?

Fixes the codex_app_server runtime so persistent Codex threads can discover and use skills from the active Hermes home, including skills created or modified between turns.

Hermes already manages its own skill tree, but Codex App Server requires explicit extra-root registration. A forced skills/list refresh updates server metadata, yet does not guarantee that a persistent thread receives newly available skills as native turn inputs. This patch registers the Hermes skill root and attaches only new or changed skills to the next turn/start.

The change is limited to the opt-in codex_app_server path. It does not modify the normal Hermes agent loop, other providers, memory, UI, or Codex itself.

Related Issue

No issue found. I searched open and closed issues/PRs for skills/extraRoots/set, Codex App Server skill roots, and persistent skill discovery. Nearby PRs about project-local discovery and local skill inspection address different paths.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• Pass get_hermes_home() / "skills" into CodexAppServerSession as an extra skill root.
• Register roots through skills/extraRoots/set after thread/start and retry transient registration failures on later turns.
• Force skills/list reloads before turns and attach newly created or modified skills as native SkillUserInput entries.
• Commit skill fingerprints only after turn/start is accepted, preserving pending skills after transient turn failures.
• Recover safely when initial root registration or initial skill reload fails by attaching one complete available baseline after the thread has already started.
• Resolve real paths and reject discovered skills outside configured roots, including escaping symlinks.
• Add transport and runtime integration coverage for ordering, retries, baseline recovery, path confinement, and HERMES_HOME wiring.

How to Test

1. Run:

   scripts/run_tests.sh \
     tests/agent/transports/test_codex_app_server_session.py \
     tests/run_agent/test_codex_app_server_integration.py -q

2. Start an interactive Hermes session with codex_app_server.
3. Create a skill under $HERMES_HOME/skills between two turns and verify that the next Codex turn/start contains a native skill input and follows the skill.

Local targeted result after rebasing onto current main:

101 tests passed, 0 failed
71 transport/session tests
30 runtime integration tests

Live smoke test on Ubuntu 24.04 also created a skill between turns, confirmed the native skill input in the Codex rollout, and returned the expected nonce.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass — targeted canonical tests pass; full validation is delegated to CI because the managed worker venv does not contain every dev extra
• I've added tests for my changes
• I've tested on my platform: Ubuntu 24.04 x86_64, Python 3.11, Codex App Server with OAuth

Documentation & Housekeeping

• Relevant documentation update: N/A; no user-facing configuration or command changes
• cli-config.yaml.example: N/A; no config keys added or changed
• CONTRIBUTING.md / AGENTS.md: N/A; existing runtime architecture is preserved
• I've considered cross-platform impact; the runtime code uses platform-neutral path APIs and the symlink regression test is skipped on Windows where symlink creation requires elevated privileges
• Tool descriptions/schemas: N/A; no Hermes tool schema changed

Development note

The implementation was AI-assisted, then exercised through targeted regression tests, two independent logic/security reviews, and a live persistent-thread smoke test. The PR contains the code and reproducible tests needed to review the behavior directly.

[tonydwb]

Code Review Summary\n\nVerdict: COMMENT\n\nSwitched to comment-only mode due to 422 on API. Original intention: APPROVE. Original reason: Looks good: low surface area, no obvious issues\n\n---\nReviewed by Hermes Agent

[FPSUnleashed]

Superseded by #63798, which carries the persistent-skill synchronization together with the complete Codex App Server context, tool, and clarification bridge.