fix(model): let Codex setup reuse or reauthenticate

tests/hermes_cli/test_auth_codex_provider.py

@@ -4,6 +4,7 @@ import json
 import time
 import base64
 from pathlib import Path
+from types import SimpleNamespace
 
 import pytest
 import yaml
@@ -15,6 +16,7 @@ from hermes_cli.auth import (
     _read_codex_tokens,
     _save_codex_tokens,
     _import_codex_cli_tokens,
+    _login_openai_codex,
     get_codex_auth_status,
     get_provider_auth_state,
     refresh_codex_oauth_pure,
@@ -244,7 +246,7 @@ def test_refresh_parses_openai_nested_error_shape_refresh_token_reused(monkeypat
     _patch_httpx(monkeypatch, response)
 
     with pytest.raises(AuthError) as exc_info:
-        refresh_codex_oauth_pure("access-old", "refresh-old")
+        refresh_codex_oauth_pure("a-tok", "r-tok")
 
     err = exc_info.value
     assert err.code == "refresh_token_reused"
@@ -268,7 +270,7 @@ def test_refresh_parses_openai_nested_error_shape_generic_code(monkeypatch):
     _patch_httpx(monkeypatch, response)
 
     with pytest.raises(AuthError) as exc_info:
-        refresh_codex_oauth_pure("access-old", "refresh-old")
+        refresh_codex_oauth_pure("a-tok", "r-tok")
 
     err = exc_info.value
     assert err.code == "invalid_client"
@@ -289,7 +291,7 @@ def test_refresh_parses_oauth_spec_flat_error_shape_invalid_grant(monkeypatch):
     _patch_httpx(monkeypatch, response)
 
     with pytest.raises(AuthError) as exc_info:
-        refresh_codex_oauth_pure("access-old", "refresh-old")
+        refresh_codex_oauth_pure("a-tok", "r-tok")
 
     err = exc_info.value
     assert err.code == "invalid_grant"
@@ -303,7 +305,7 @@ def test_refresh_falls_back_to_generic_message_on_unparseable_body(monkeypatch):
     _patch_httpx(monkeypatch, response)
 
     with pytest.raises(AuthError) as exc_info:
-        refresh_codex_oauth_pure("access-old", "refresh-old")
+        refresh_codex_oauth_pure("a-tok", "r-tok")
 
     err = exc_info.value
     assert err.code == "codex_refresh_failed"
@@ -311,3 +313,41 @@ def test_refresh_falls_back_to_generic_message_on_unparseable_body(monkeypatch):
     # invalid/expired — force relogin even without a parseable error body.
     assert err.relogin_required is True
     assert "status 401" in str(err)
+
+
+def test_login_openai_codex_force_new_login_skips_existing_reuse_prompt(monkeypatch):
+    called = {"device_login": 0}
+
+    monkeypatch.setattr(
+        "hermes_cli.auth.resolve_codex_runtime_credentials",
+        lambda: {"base_url": DEFAULT_CODEX_BASE_URL},
+    )
+    monkeypatch.setattr(
+        "hermes_cli.auth._import_codex_cli_tokens",
+        lambda: {"access_token": "cli-at", "refresh_token": "cli-rt"},
+    )
+    monkeypatch.setattr(
+        "hermes_cli.auth._codex_device_code_login",
+        lambda: {
+            "tokens": {"access_token": "fresh-at", "refresh_token": "fresh-rt"},
+            "last_refresh": "2026-04-01T00:00:00Z",
+            "base_url": DEFAULT_CODEX_BASE_URL,
+        },
+    )
+
+    def _fake_save(tokens, last_refresh=None):
+        called["device_login"] += 1
+        called["tokens"] = dict(tokens)
+        called["last_refresh"] = last_refresh
+
+    monkeypatch.setattr("hermes_cli.auth._save_codex_tokens", _fake_save)
+    monkeypatch.setattr("hermes_cli.auth._update_config_for_provider", lambda *args, **kwargs: "/tmp/config.yaml")
+    monkeypatch.setattr(
+        "builtins.input",
+        lambda prompt="": (_ for _ in ()).throw(AssertionError("force_new_login should not prompt for reuse/import")),
+    )
+
+    _login_openai_codex(SimpleNamespace(), PROVIDER_REGISTRY["openai-codex"], force_new_login=True)
+
+    assert called["device_login"] == 1
+    assert called["tokens"]["access_token"] == "fresh-at"