fix(auth): anthropic OAuth login falls back to current token endpoint

[clower80]

Summary

hermes auth add anthropic --type oauth fails at the code→token exchange with:

Token exchange failed: HTTP Error 404: Not Found
Anthropic OAuth login did not return credentials.

Root cause: run_hermes_oauth_login_pure() in agent/anthropic_adapter.py exchanges the authorization code against only the legacy https://console.anthropic.com/v1/oauth/token endpoint, which now returns HTTP 404.

The token refresh path (refresh_anthropic_oauth_pure, the token_endpoints list around L997) already tries https://platform.claude.com/v1/oauth/token first and falls back to the console URL — but the login path was never updated to match. So a fresh subscription login is broken even though refresh works.

Fix

Mirror the same ordered-fallback list in the login exchange: try platform.claude.com first, fall back to console.anthropic.com, and only surface the error if every endpoint fails. Minimal, scoped to the one broken function.

Test

Adds test_token_exchange_falls_back_to_legacy_endpoint to tests/agent/test_anthropic_oauth_pkce.py, asserting the current endpoint is tried first and the legacy endpoint is used as a fallback when the first fails.

$ python -m pytest tests/agent/test_anthropic_oauth_pkce.py -o 'addopts=' -q
...                                                                      [100%]
3 passed in 0.74s

Notes

• Reproduced on a real macOS install (Hermes v0.16.0) — the login 404'd, the patch made it complete and store the OAuth credential successfully.
• No behavior change for users already on the working endpoint; this only adds a fallback when the first endpoint errors.

[tonydwb]

Code Review Summary

Verdict: Approved

Adds fallback for Anthropic OAuth login when token endpoint fails. 2-file fix with graceful degradation.

---

Reviewed by Hermes Agent

[teknium1]

Closing as a duplicate. This was fixed via #51723 (salvage of #48706 by @yusekiotacode, which fixed both the CLI login and dashboard OAuth paths). Thanks for the report and the fix — credited in the cluster.

#51723