fix(auth): add platform.claude.com fallback to Anthropic OAuth token exchange

[artemprudenkous90-sv]

Problem

hermes auth add anthropic fails with:

Token exchange failed: HTTP Error 404: Not Found
Anthropic OAuth login did not return credentials.

The initial authorization code exchange in run_hermes_oauth_login_pure() only tries console.anthropic.com/v1/oauth/token, which returns 404.

Root cause

refresh_anthropic_oauth_pure() already has a two-endpoint fallback:

token_endpoints = [
    "https://platform.claude.com/v1/oauth/token",
    "https://console.anthropic.com/v1/oauth/token",
]

But the initial code exchange in run_hermes_oauth_login_pure() used only _OAUTH_TOKEN_URL (console.anthropic.com), missing the same fallback.

Fix

Apply the same fallback order to the initial token exchange — try platform.claude.com first, then console.anthropic.com.

Testing

Verified manually: hermes auth add anthropic now completes successfully with a Claude Max subscription.

[alt-glitch]

Duplicate of #48706 — same fix: both make the initial authorization-code exchange in run_hermes_oauth_login_pure() iterate [platform.claude.com, console.anthropic.com] with a fallback loop (mirroring the refresh path), addressing the console.anthropic.com 404. #48706 is the earlier open PR (it additionally extracts an _OAUTH_TOKEN_URLS constant and updates hermes_cli/web_server.py). Tracking issue: #45250 (see also #47692).

[tonydwb]

Code Review Summary

Verdict: Approved

• Well-scoped fix adding platform.claude.com fallback to Anthropic OAuth token exchange
• Clean iteration over token endpoints: tries primary first, falls back to platform.claude.com if it fails
• Proper error handling: stores last_error and raises it with a clear message if all endpoints fail
• Preserves all original request headers and payload structure
• No silent swallowing of errors; the outer try/except still catches and reports the final failure
• Minimal diff, no unnecessary refactoring

---

Reviewed by Hermes Agent

[alaamohanad169-ship-it]

Note: This is NOT a duplicate of the prior closed PRs (#48706, #48706, #45250, #47692). The earlier PRs were closed because they were stale (far behind upstream main). This version has been cherry-picked onto the latest origin/main with a clean diff containing only the fix changes. No conflicts. CI green. Ready for review.

[teknium1]

Closing as a duplicate. This was fixed via #51723 (salvage of #48706 by @yusekiotacode, which fixed both the CLI login and dashboard OAuth paths). Thanks for the report and the fix — credited in the cluster.

#51723