fix: explain codex oauth gpt-5.4 limits

tests/hermes_cli/test_setup.py

@@ -97,7 +97,7 @@ def test_custom_setup_clears_active_oauth_provider(tmp_path, monkeypatch):
     assert reloaded["model"]["default"] == "custom/model"
 
 
-def test_codex_setup_uses_runtime_access_token_for_live_model_list(tmp_path, monkeypatch):
+def test_codex_setup_uses_runtime_access_token_for_live_model_list(tmp_path, monkeypatch, capsys):
     monkeypatch.setenv("HERMES_HOME", str(tmp_path))
     monkeypatch.setenv("OPENROUTER_API_KEY", "or-test-key")
     _clear_provider_env(monkeypatch)
@@ -125,7 +125,7 @@ def test_codex_setup_uses_runtime_access_token_for_live_model_list(tmp_path, mon
 
     def _fake_get_codex_model_ids(access_token=None):
         captured["access_token"] = access_token
-        return ["gpt-5.4", "gpt-5.3-codex"]
+        return ["gpt-5.2-codex", "gpt-5.2"]
 
     monkeypatch.setattr(
         "hermes_cli.codex_models.get_codex_model_ids",
@@ -136,9 +136,11 @@ def test_codex_setup_uses_runtime_access_token_for_live_model_list(tmp_path, mon
     save_config(config)
 
     reloaded = load_config()
+    output = capsys.readouterr().out
 
     assert captured["access_token"] == "codex-access-token"
+    assert "not currently supported for ChatGPT/Codex OAuth accounts" in output
     assert isinstance(reloaded["model"], dict)
     assert reloaded["model"]["provider"] == "openai-codex"
-    assert reloaded["model"]["default"] == "gpt-5.4"
+    assert reloaded["model"]["default"] == "gpt-5.2-codex"
     assert reloaded["model"]["base_url"] == "https://chatgpt.com/backend-api/codex"

tests/test_codex_models.py

@@ -54,6 +54,47 @@ def test_get_codex_model_ids_falls_back_to_curated_defaults(tmp_path, monkeypatc
     assert models[: len(DEFAULT_CODEX_MODELS)] == DEFAULT_CODEX_MODELS
 
 
+def test_model_command_warns_when_gpt_5_4_is_unavailable_for_codex(monkeypatch, capsys):
+    from hermes_cli.main import _model_flow_openai_codex
+
+    captured = {}
+
+    monkeypatch.setattr(
+        "hermes_cli.auth.get_codex_auth_status",
+        lambda: {"logged_in": True},
+    )
+    monkeypatch.setattr(
+        "hermes_cli.auth.resolve_codex_runtime_credentials",
+        lambda *args, **kwargs: {"api_key": "codex-access-token"},
+    )
+
+    def _fake_get_codex_model_ids(access_token=None):
+        captured["access_token"] = access_token
+        return ["gpt-5.2-codex", "gpt-5.2"]
+
+    def _fake_prompt_model_selection(model_ids, current_model=""):
+        captured["model_ids"] = list(model_ids)
+        captured["current_model"] = current_model
+        return None
+
+    monkeypatch.setattr(
+        "hermes_cli.codex_models.get_codex_model_ids",
+        _fake_get_codex_model_ids,
+    )
+    monkeypatch.setattr(
+        "hermes_cli.auth._prompt_model_selection",
+        _fake_prompt_model_selection,
+    )
+
+    _model_flow_openai_codex({}, current_model="openai/gpt-5.4")
+    output = capsys.readouterr().out
+
+    assert captured["access_token"] == "codex-access-token"
+    assert captured["model_ids"] == ["gpt-5.2-codex", "gpt-5.2"]
+    assert "not currently supported for ChatGPT/Codex OAuth accounts" in output
+    assert "Use OpenRouter if you need GPT-5.4 specifically." in output
+
+
 # ── Tests for _normalize_model_for_provider ──────────────────────────