fix(anthropic): OAuth token endpoint UA must be axios/, not claude-code/ (login 429, #48534)

[mssteuer]

Summary

Fixes #48534 (current regression). The OAuth token-exchange 429 is back: Anthropic has extended the same anti-abuse gate that once blocked claude-cli/ (404) to the claude-code/ UA prefix (429). The fix merged in #56263 (claude-cli/ → claude-code/) worked for ~2 weeks and is now blocked again.

hermes auth add anthropic fails 100% at token exchange on current main:

Token exchange failed: HTTP Error 429: Too Many Requests
Anthropic OAuth login did not return credentials.

Root cause

The three /v1/oauth/token call sites in agent/anthropic_adapter.py send User-Agent: claude-code/{ver} (external, cli). Anthropic now rate-limits (429) any token-endpoint request whose UA starts with claude-code/ — the Max-subscription-as-API-key anti-abuse net. It's prefix-based, not version-gated, so _CLAUDE_CODE_VERSION_FALLBACK bumps can't help (same shape as the original claude-cli/ finding in this issue).

The genuine Claude Code CLI exchanges the auth code with a bare axios client (axios/<ver>). Its claude-code/ + x-app: cli fingerprint is attached only to the inference path (/v1/messages), which is a separate code path and is not throttled there. The two endpoints have opposite UA requirements.

Empirical isolation (garbage code, nothing burned)

A 429 is applied before code validation, so the exchange can be probed with a throwaway code — 400 invalid_grant means the request was accepted and only the fake code rejected (a real code → 200):

User-Agent	Result
claude-code/2.1.200 (external, cli) (current main)	429 rate_limit
claude-code/2.1.200	429 rate_limit
Mozilla/5.0	429 rate_limit
axios/1.7.9	400 invalid_grant ✅ reached validation
node / empty / Claude-User (claude-code/…)	400 ✅

Fix

Introduce _OAUTH_TOKEN_USER_AGENT = "axios/1.7.9" and apply it at all three token-endpoint call sites:

• refresh_anthropic_oauth_pure (refresh POST)
• build_anthropic_client OAuth refresh POST
• run_hermes_oauth_login_pure (login exchange POST)

The inference path (build_anthropic_kwargs) is deliberately left untouched — it keeps user-agent: claude-code/{ver} (external, cli) + x-app: cli, which is required on /v1/messages and is not throttled there. Two endpoints, opposite UA requirements.

Tests

tests/agent/test_anthropic_oauth_ua_prefix.py is updated so the invariant now encodes the split instead of freezing a single UA string:

• token endpoint UA must not start with claude-code/ (nor claude-cli/)
• inference UA must still be claude-code/

Two _refresh_oauth_token tests that leaked the machine's live ~/.claude/.credentials.json (they never patched Path.home, so they adopted a real token instead of returning None) are isolated with monkeypatch.setattr("agent.anthropic_adapter.Path.home", lambda: tmp_path), matching the sibling test_successful_refresh.

tests/agent/test_anthropic_oauth_pkce.py
tests/agent/test_anthropic_oauth_ua_prefix.py
tests/agent/test_anthropic_adapter.py
→ 181 passed

Verified end-to-end

With the fix applied (inference UA untouched), hermes auth add anthropic completes:

Added anthropic OAuth credential #2: "anthropic-oauth-2"

Note for maintainers

This UA gate is a moving target on Anthropic's side (claude-cli/ → claude-code/ → now axios/ needed on the token endpoint). If it flips again, the diagnostic is: fire the exchange with a throwaway code and compare the HTTP status per-UA (429 = blocked, 400 = reached validation), then match whatever the current Claude Code CLI's OAuth client actually sends.

[kshitijk4poor]

Thanks @mssteuer — your UA-split diagnosis was exactly right. Salvaged and merged via #58178.

I kept the load-bearing part of your fix (the axios/ User-Agent on the OAuth token endpoint, with the inference path deliberately left on claude-code/ + x-app: cli), and dropped the bundled authorize-host and scope changes as non-load-bearing:

• The claude.com/cai/oauth/authorize URL just 307-redirects straight back to claude.ai/oauth/authorize with the same params, so it adds a redirect hop but no behavioral difference.
• I verified live against platform.claude.com/v1/oauth/token (throwaway code) that the UA change alone — with the original console.anthropic.com redirect_uri and scopes — clears the 429 (axios/ → 400 invalid_grant, i.e. reached validation), so the scope expansion isn't required to fix the reported failure.

Your authorship is preserved in the merge (rebase). Follow-up commit fixed a stale inline comment and made the TestRefreshOauthToken isolation neutralize the macOS Keychain source too (your Path.home patch only covered the ~/.claude file source; _refresh_oauth_token re-reads the Keychain first).

Merged: #58178
Closes #48534.