What does this PR do?

Fixes auxiliary provider resolution when a user-defined provider is named codex.

Before this change, resolve_provider_client() normalized aliases before checking named custom providers:

custom:codex -> codex -> openai-codex
codex        -> openai-codex

That meant a configured local/custom endpoint named codex was bypassed and Hermes tried to find OpenAI Codex OAuth credentials instead. This PR gives the raw requested provider name a chance to resolve against providers: / custom_providers: before the built-in codex -> openai-codex alias wins.

The existing alias behavior is preserved when no custom provider named codex exists.

Related Issue

Fixes #17488

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• agent/auxiliary_client.py
  • Preserve the raw requested provider string in resolve_provider_client().
  • Resolve named custom providers with that raw name before built-in aliases route to OAuth-backed providers.
  • Keep the normalized-provider custom lookup so existing named-provider behavior remains intact.
• tests/agent/test_auxiliary_named_custom_providers.py
  • Add regression coverage for a custom provider named codex.
  • Add coverage for explicit custom:codex.
  • Add coverage that bare codex still resolves to built-in openai-codex when no custom provider shadows it.

How to Test

1. Configure a custom provider named codex:

   model:
     default: gpt-5.4
     provider: codex
   
   custom_providers:
     - name: codex
       base_url: http://127.0.0.1:8317/api/provider/codex
       api_key: ccs-internal-managed
       model: gpt-5.4

2. Resolve an auxiliary client for codex.

3. Confirm it uses the configured custom endpoint instead of the built-in openai-codex OAuth path.

Automated checks run:

PYTHONPATH=/private/tmp/hermes-agent-pr /Users/ansel/.hermes/hermes-agent/venv/bin/python -m pytest tests/agent/test_auxiliary_named_custom_providers.py tests/agent/test_auxiliary_client.py::TestNormalizeAuxProvider tests/agent/test_auxiliary_client.py::TestTryPaymentFallback -q
# 35 passed

PYTHONPATH=/private/tmp/hermes-agent-pr /Users/ansel/.hermes/hermes-agent/venv/bin/python -m pytest tests/agent/test_auxiliary_client.py -q
# 110 passed

git diff --check

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

For New Skills

N/A.

Screenshots / Logs

N/A. This is provider-resolution logic covered by unit tests.