feat(anthropic): support ANTHROPIC_CUSTOM_HEADERS for anthropic_messages models

[danliustc]

What

Adds support for the ANTHROPIC_CUSTOM_HEADERS environment variable so custom (and other) models running on the anthropic_messages wire format can attach arbitrary request headers.

Why

Custom models on the Anthropic-wire format had no way to inject custom request headers:

• The OpenAI-side model.default_headers mechanism explicitly skips anthropic_messages/bedrock_converse modes (run_agent.py:4039 returns early for those api_modes).
• ANTHROPIC_CUSTOM_HEADERS was not read anywhere in the codebase.

This blocks Anthropic-compatible gateways that require extra headers for project/tenant routing, WAF tokens, etc. (e.g. x-project: <project>).

How

• New _parse_anthropic_custom_headers() parses the env var following Claude Code's convention: one Name: Value pair per line (newline-separated), whitespace-trimmed, lines without a : ignored.
• New _apply_anthropic_custom_headers() merges those headers onto the client-level default_headers, with user values taking precedence over SDK/provider defaults (e.g. anthropic-beta) while preserving them.
• Wired into all three Anthropic SDK client constructors: build_anthropic_client, _build_anthropic_client_with_bearer_hook (Azure Entra), and build_anthropic_bedrock_client.
• No-op when the env var is unset.

Usage

# Single header
export ANTHROPIC_CUSTOM_HEADERS="x-project: my-project"

# Multiple headers (newline-separated)
export ANTHROPIC_CUSTOM_HEADERS=$'x-project: my-project\nx-team: infra'

This mirrors Claude Code's ANTHROPIC_CUSTOM_HEADERS convention; the OpenAI-wire equivalent remains model.default_headers in config.yaml.

Tests

• Added 3 tests in tests/agent/test_anthropic_adapter.py: single header, multiple headers, and no-op when unset. All pass.
• The pre-existing 14 failures in this test file (keychain/OAuth env-related) are unrelated to this change — verified they fail identically on a clean tree.

Docs

• Documented the env var in website/docs/integrations/providers.md next to the anthropic_messages custom-provider example.

🤖 Generated with Claude Code

[teknium1]

Thanks for identifying a real Anthropic-wire gap. Current main still excludes custom-provider headers from this path: run_agent.py:4474 skips anthropic_messages and bedrock_converse before applying the existing resolver.

Problems

• The new global ANTHROPIC_CUSTOM_HEADERS applies to every Anthropic SDK client, including native Anthropic and Bedrock. Current header configuration is endpoint-scoped: hermes_cli/config.py:5042-5074 matches providers / custom_providers by base_url, which prevents a proxy's tenant or auth header from being sent elsewhere.
• The added tests cover only the static build_anthropic_client path. The bearer-hook and Bedrock constructor changes need coverage, including preservation of their existing anthropic-beta defaults.

Suggested changes

• Reuse the existing extra_headers configuration/resolution path for Anthropic Messages clients and preserve endpoint scope.
• Add constructor-specific regression tests for bearer-hook and Bedrock behavior.

This is an automated hermes-sweeper review.

[danliustc]

Thanks for the review — addressed in 7cc7476 (branch also rebased onto current main).

Endpoint scoping (problem 1):

• Anthropic Messages clients now reuse the existing endpoint-scoped resolution path: hermes_cli.config.get_custom_provider_extra_headers is applied in the client builders, matching providers / custom_providers entries by base_url (both the caller's original URL form and its normalized /v1-stripped variant, since config may record either). Config extra_headers take precedence over the env var.
• ANTHROPIC_CUSTOM_HEADERS is retained for Claude Code parity, but no longer global: it only applies to clients constructed with an explicit custom base_url. Native Anthropic (no base_url) and Bedrock never see it, so a proxy's tenant/auth header cannot be sent elsewhere. Bedrock is fully excluded from both mechanisms.

Test coverage (problem 2): added constructor-specific regression tests:

• bearer-hook constructor: env var + config extra_headers both applied, anthropic-beta defaults preserved;
• Bedrock constructor: env var not applied, beta defaults intact;
• native Anthropic (no base_url): env var not applied;
• config-over-env precedence and normalized-URL matching.

Docs updated to present config extra_headers as the recommended endpoint-scoped mechanism with the env var as the Claude-Code-compatible alternative, including the precedence order.