hermes - 💡(How to fix) Fix xai-oauth auxiliary client incorrectly uses Responses API (CodexAuxiliaryClient), causing 403 on compression/vision/web_extract [1 pull requests]

Bug Description

When the main provider is configured as xai-oauth, auxiliary tasks (context compression, vision, web_extract, etc.) fail with:

Error code: 403 - {'code': 'The caller does not have permission to execute the specified operation', 'error': 'The OAuth2 access token could not be validated. [WKE=unauthenticated:bad-credentials]'}

Root Cause

In agent/auxiliary_client.py, the _build_xai_oauth_aux_client() function wraps the xAI OAuth client in CodexAuxiliaryClient:

# agent/auxiliary_client.py:1854-1856
real_client = OpenAI(api_key=api_key, base_url=base_url)
return CodexAuxiliaryClient(real_client, model), model

CodexAuxiliaryClient translates chat.completions.create() calls into OpenAI Responses API (/v1/responses). However, xAI OAuth tokens are only authorized for the standard Chat Completions API (/v1/chat/completions), not the Responses API.

This results in:

• Direct xAI API calls (/v1/models, /v1/chat/completions) → 200 OK, token is valid
• Calls via CodexAuxiliaryClient → 403, because Responses API is not authorized

Relevant Code

• agent/auxiliary_client.py:1834-1856 — _build_xai_oauth_aux_client() incorrectly uses CodexAuxiliaryClient
• agent/auxiliary_client.py:3311 — resolve_provider_client() xai-oauth branch calls _build_xai_oauth_aux_client()

Expected Behavior

The xAI OAuth auxiliary client should use a plain OpenAI client to call /v1/chat/completions directly, rather than routing through CodexAuxiliaryClient to the Responses API.

Environment

• Hermes version: latest (commit 69dfcdcc1)
• Provider: xai-oauth (xAI Grok OAuth PKCE)
• Model: grok-4.3
• Config: compression.summary_provider: xai-oauth, compression.summary_model: grok-4.3

Suggested Fix

Replace CodexAuxiliaryClient with a plain OpenAI client in _build_xai_oauth_aux_client(), or add conditional logic to only use CodexAuxiliaryClient when xAI explicitly supports the Responses API for OAuth tokens.