fix(codex): adopt refresh_token from auth.json even without access_token (#70097)

[JonthanaHanh]

Summary

Fixes two defects in the openai-codex credential pool recovery path that cause profiles to go terminally DEAD when a sibling profile rotates the shared token pair.

Defect 1 — adoption path silently no-ops

Root cause: _sync_codex_entry_from_auth_store() (credential_pool.py:768) skips adoption when store_access is empty. When another process rotated the token pair and the auth store only has last_refresh + a new refresh_token (no access_token), the stale profile's entry keeps the consumed refresh_token and replays it, getting refresh_token_reused → terminally DEAD.

Fix: Also adopt when store_refresh differs from entry_refresh, even when store_access is empty. Preserve the entry's existing access_token via store_access or entry.access_token.

Defect 2 — false "auth refreshed" success log

Root cause: _try_refresh_codex_client_credentials() (run_agent.py:4583) returns True whenever resolve_codex_runtime_credentials() returns any non-empty credentials — including the same stale token when the underlying refresh failed (failure is logger.debug-only). The conversation loop then logs "auth refreshed after 401" right before the retry fails with the identical token_expired.

Fix: Compare the access token before/after the refresh. If unchanged, return False so the 401-retry path doesn't claim success.

Changes

File	Lines	Change
agent/credential_pool.py	+25	Adopt refresh_token even without access_token
run_agent.py	+15	Return False when refresh produced no new token

Fixes #70097

[teknium1]

Thanks for isolating the refresh-token-only adoption case. The Codex pool defect is still present on current main: agent/credential_pool.py:813-816 requires store_access, while agent/credential_pool.py:1219-1225 then refreshes with the unchanged entry token.

Problems

• The run_agent.py portion is based on stale behavior. A forced Codex refresh now either returns refreshed/recovered credentials (hermes_cli/auth.py:3976-3978) or raises; run_agent.py:5035-5037 catches that failure and returns False already.
• The PR changes two recovery paths but adds no regression tests. In particular, the refresh-only auth-store state needs a direct test.

Suggested changes

• Keep the credential-pool hunk and add a regression covering a missing stored access token plus a changed refresh token, including preservation of the pool entry's access token and clearing stale status.
• Drop or re-demonstrate the unchanged-token run_agent.py guard against current main before retaining it.

This is an automated hermes-sweeper review.

[kshitijk4poor]

Merged via #77028. Your fix for both defects (refresh_token adoption without access_token + false auth-refreshed log) was cherry-picked with authorship preserved. A follow-up commit widens the source guard to also cover manual:device_code entries — the recommended quarantine-safe configuration — which was unreachable in the original PR. Credits to @imgyf for the source guard analysis.