fix(auxiliary): auto-detect Anthropic Messages transport for all aux clients

[teknium1]

Summary

Auxiliary tasks (title_generation, vision, compression, web_extract, session_search) now pick the correct wire protocol based on the endpoint — fixing 404s on Kimi Coding Plan and any other named provider whose endpoint speaks Anthropic Messages instead of OpenAI chat.completions.

Root cause (Discord reports from angelitusss, Dan The Man, multiple others today): With provider: kimi-coding + model: kimi-for-coding, every auxiliary call hit:

POST https://api.kimi.com/coding/v1/chat/completions
{"model": "kimi-for-coding", ...}
→ 404 resource_not_found_error

The /coding route only speaks the Anthropic Messages shape (Claude Code's native wire format) — the main agent already knows that via api_mode=anthropic_messages. But the api_key branch of resolve_provider_client (and the Step 2 fallback chain inside _resolve_auto) built a plain OpenAI client regardless of what the endpoint actually spoke. Earlier fixes (#16819, commit 22ddac4) patched the anonymous-custom, named-custom, and external-process branches — but the named api_key branch (kimi-coding, minimax, zai, future /anthropic providers) was the fourth sibling and never got the same treatment.

Changes

• agent/auxiliary_client.py:

  • New module-level _endpoint_speaks_anthropic_messages(url) mirroring hermes_cli.runtime_provider._detect_api_mode_for_url (/anthropic suffix, api.kimi.com/coding, api.anthropic.com).
  • New _maybe_wrap_anthropic(client, model, api_key, base_url, api_mode) — the single chokepoint that rewraps a plain OpenAI client in AnthropicAuxiliaryClient when the endpoint needs it. Pass-through for already-specialized adapters (Codex, Gemini, CopilotACP). Respects explicit api_mode. Falls back to plain client if the anthropic SDK is missing.
  • _wrap_if_needed now handles both Codex AND Anthropic wrapping, so every branch that flows through it gets the fix.
  • Applied at the two remaining bare sites: the Step 2 api_key fallback chain (_try_api_key_providers) and the custom-endpoint trailing return.

• tests/agent/test_auxiliary_transport_autodetect.py (new): 21 tests covering URL detection, wrap decisions, double-wrap safety, explicit api_mode override, missing-SDK fallback, and end-to-end resolve_provider_client('kimi-coding', 'kimi-for-coding') → AnthropicAuxiliaryClient.

Validation

case	before	after
provider=kimi-coding, model=kimi-for-coding	plain OpenAI → 404	AnthropicAuxiliaryClient ✓
provider=openrouter	plain OpenAI	plain OpenAI ✓ (no regression)
api_mode=chat_completions override	—	plain OpenAI ✓ (explicit wins)
URL ends in /anthropic (MiniMax, LiteLLM)	plain OpenAI (wrong)	AnthropicAuxiliaryClient ✓
api.anthropic.com	plain OpenAI (wrong on api-key branch)	AnthropicAuxiliaryClient ✓

• 21/21 new tests pass
• 204/205 existing aux tests pass (1 pre-existing failure on main, unrelated — test_custom_endpoint_uses_codex_wrapper_when_runtime_requests_responses_api, confirmed by checking out main without this diff)
• 614/616 with-this-diff tests pass across the wider aux/anthropic/kimi/codex test surface; the 2 failures are both pre-existing on main

E2E Test Plan (done locally)

export HERMES_HOME=/tmp/test-home
export KIMI_API_KEY=sk-kimi-fake
# config.yaml: provider: kimi-coding, model: kimi-for-coding, title_generation.provider: auto
# Before: title_generation → 404 resource_not_found_error
# After:  title_generation → AnthropicAuxiliaryClient → correct /v1/messages call

[github-actions]

🚨 CRITICAL Supply Chain Risk Detected

This PR contains a pattern that has been used in real supply chain attacks. A maintainer must review the flagged code carefully before merging.

🚨 CRITICAL: Install-hook file added or modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/setup.py

---

Scanner only fires on high-signal indicators: .pth files, base64+exec/eval combos, subprocess with encoded commands, or install-hook files. Low-signal warnings were removed intentionally — if you're seeing this comment, the finding is worth inspecting.