fix(runtime): honor NOUS_INFERENCE_BASE_URL across pool/explicit/aux paths (salvage #55198)

[hashbender]

What this is

Salvage of NousResearch#55198 by @counterposition (Harish Kukreja) onto an org-owned branch. His commit is cherry-picked verbatim (authorship preserved); this PR exists only so the arm64 Docker build gets a token with packages: write.

Why salvage instead of a re-run: NousResearch#55198 is a fork PR (counterposition/hermes-agent). Its Build&Test Docker image / build-arm64 check fails with denied: installation not allowed to Write organization package — fork PRs get a read-only GITHUB_TOKEN for org packages by design, so re-running the fork PR fails identically every time. Every other check on NousResearch#55198 is green (all 8 test slices, e2e, ruff, ty, uv.lock). Running the same commit from an org branch clears the package-write permission.

The fix (unchanged from NousResearch#55198)

NousResearch#52270 added _nous_inference_env_override() so NOUS_INFERENCE_BASE_URL can point a Nous OAuth session at a self-hosted / staging inference endpoint, but only wired it into resolve_nous_runtime_credentials. Three sibling resolution paths still dropped the override:

• credential pool — _resolve_runtime_from_pool_entry (hermes_cli/runtime_provider.py)
• explicit provider — _resolve_explicit_runtime (hermes_cli/runtime_provider.py)
• auxiliary side-LLM client — _pool_runtime_base_url (agent/auxiliary_client.py)

This routes all three through the same auth-layer reader, so every NOUS_INFERENCE_BASE_URL read shares one normalization + trusted-bypass path. Live-only invariant preserved: the override wins for the base URL returned this run but is never persisted to auth.json or the credential pool.

Verification

Cherry-picked cleanly onto current main (56d4bfe4b). PR's own suites re-run on the merged tree: 97 passed (tests/hermes_cli/test_runtime_provider_resolution.py, test_auth_nous_provider.py, tests/agent/test_auxiliary_client.py), including the pool/explicit/aux override tests and the live-not-persisted invariant.

Attribution

Co-authored-by preserved from the original commit. Full credit to @counterposition — closing NousResearch#55198 in favour of this once merged.

Salvages NousResearch#55198.

---

Mirror-of: NousResearch#56122
NousResearch#56122

[tenki-reviewer]

Review Complete
No issues found!

Risk: 🟢 Low (12/100) — no findings · 123 LOC across 5 files

---

No issues found in this PR. The changes to auxiliary_client.py and runtime_provider.py are well-structured refactors and test additions with no regressions, security vulnerabilities, or data-handling concerns.

Files Reviewed (5 files)

agent/auxiliary_client.py
hermes_cli/runtime_provider.py
tests/agent/test_auxiliary_client.py
tests/hermes_cli/test_auth_nous_provider.py
tests/hermes_cli/test_runtime_provider_resolution.py