fix(anthropic): use platform.claude.com for OAuth token exchange

[larrykite]

Summary

Anthropic migrated the OAuth token endpoint from console.anthropic.com to platform.claude.com. The initial authorization_code exchange in begin_anthropic_oauth() (agent/anthropic_adapter.py) still POSTs only to _OAUTH_TOKEN_URL (https://console.anthropic.com/v1/oauth/token), which now returns HTTP 404. As a result, every hermes auth add anthropic --type oauth login fails with:

Token exchange failed: HTTP Error 404: Not Found
Anthropic OAuth login did not return credentials.

even though the browser authorization succeeds and a valid code is returned.

The refresh path (refresh_anthropic_oauth_token) was already updated to try platform.claude.com first with console.anthropic.com as fallback (see the token_endpoints list). The initial exchange was missed and never got the same treatment.

Fix

Apply the same multi-endpoint pattern to the initial exchange: try https://platform.claude.com/v1/oauth/token first, fall back to the legacy _OAUTH_TOKEN_URL. Re-raises the last error if both fail, preserving the existing Token exchange failed: ... message.

Test plan

• Reproduced on current main (6c34088): OAuth login 404s at the exchange step.
• With the patch applied, hermes auth add anthropic --type oauth completes (Added anthropic OAuth credential), hermes auth status anthropic reports logged in, and a live hermes chat -q call routes successfully through the OAuth credential.
• python3 -c "import ast; ast.parse(...)" syntax check passes.

Notes

Endpoint string is inlined to mirror the existing refresh-path list rather than introducing a new module constant; happy to hoist both into a shared tuple if preferred.

[alt-glitch]

Duplicate of #45254 (earlier open PR, same fix for #45250 — adds platform.claude.com to the initial OAuth authorization-code exchange path, matching the refresh flow). Closed twin: #45441.

[teknium1]

Closing alongside the issue this addresses — working as intended, won't implement.

This change is in service of making Claude Pro/Max/Team OAuth credentials bill on-plan for programmatic traffic. As of Anthropic's mid-June 2026 change, that traffic is metered as extra usage by design. The only way to restore on-plan billing is to present as the first-party Claude CLI/Agent-SDK surface — exactly the spoof filter Anthropic enforces against — which puts users at real risk of account suspension. We won't ship a mitigation whose mechanism is evading the provider's usage-attribution filter.

For Anthropic API access, use a standard x-api-key API key (ANTHROPIC_API_KEY). Thanks for the work and the detailed tracing.