Problem

Two code paths where Codex authentication failures silently bypassed the fallback provider chain instead of switching to the next configured provider.

1. cli.py — pre-turn credential check blocks fallback entirely

_ensure_runtime_credentials() is called before every agent turn. It calls resolve_runtime_provider(requested=self.requested_provider). When the provider is explicitly configured (e.g. provider: openai-codex in config.yaml — the typical setup), resolve_runtime_provider re-raises AuthError on token refresh failure rather than falling through. This error is caught, printed in bold red, and the function returns False — so the agent never starts and fallback_providers is never consulted.

Symptom: User sees a raw Codex token refresh failed with status 401 error in the Hermes TUI instead of a transparent switch to the fallback model.

2. run_agent.py — response.status=failed escapes the retry/fallback loop

Inside the codex_responses validity gate (inner retry loop), a response with status in {failed, cancelled} and non-empty output_items was treated as valid (the not isinstance(output_items, list) check passed) and broke out of the loop. It then reached _normalize_codex_response() — which is called outside the retry loop and raises RuntimeError on terminal status codes. That exception propagated to the outer except Exception handler which has no fallback logic.

Symptom: Quota exhaustion on the Codex provider (which returns response.status=failed) showed a raw GPT error instead of switching to the fallback chain.

Fix

cli.py: On AuthError in _ensure_runtime_credentials, iterate fallback_providers and try each in order. On first success, swap self.requested_provider and self.model to the fallback and continue normally. Only fail if every provider in the chain is exhausted.

run_agent.py: Add an explicit elif _codex_resp_status in {failed, cancelled}: check before the not isinstance(output_items, list) check inside the codex validity gate. Sets response_invalid = True with a logging.warning so the existing _try_activate_fallback() path fires.

Testing

Reproduced locally with an expired Codex OAuth token (401 on refresh) and with quota exhaustion (response.status=failed). Both now transparently switch to the first working fallback_providers entry.