fix(auxiliary): honor /anthropic-suffixed gateway base_url on aux + fallback calls

[iso2kx]

[alt-glitch]

This was generated by AI during triage.

Related: auxiliary-client custom-provider base_url routing family — #36757 (post-override base_url for endpoint detection), #24586/#34299 (ProviderProfile.api_mode consult), #17027 (merged, Anthropic Messages transport auto-detect). Same agent/auxiliary_client.py area, distinct mechanism (this preserves the /anthropic suffix on aux+fallback calls).

[teknium1]

Thanks for the focused regression fix. Current main still has the reported gap: agent/auxiliary_client.py:824-832 accepts only api.anthropic.com, and _try_anthropic() consequently discards a configured gateway URL at agent/auxiliary_client.py:2639-2643. The proposed /anthropic and /anthropic/v1 predicate matches the primary resolver's established routing convention in hermes_cli/runtime_provider.py:128-130 and the existing auxiliary transport detector in agent/auxiliary_client.py:1476-1483.

The added config-backed regression test exercises the affected _try_anthropic() construction path while retaining the existing non-Anthropic-host guard. The PR is behind current main, but the only current target-file change after its base is unrelated at agent/auxiliary_client.py:4711-4714, so this appears mechanically salvageable.

Automated hermes-sweeper review.

[iso2kx]

Rebased onto current main — now ahead 1, behind 0, and the target hunk applied cleanly (the _is_anthropic_compatible_host body is unchanged on main since this branch's original base).

Bumping this because the gap bit me again in production this morning, which I think makes the P3 a little optimistic.

Setup: provider: anthropic with model.base_url pointing at a local Anthropic-compatible gateway under an /anthropic suffix — the exact convention runtime_provider._detect_api_mode_for_url already routes on. The primary path honors it; aux and fallback don't.

What happened:

1. Primary ran fine through the gateway — 9 consecutive claude-opus-5 calls.
2. Primary hit a 429, so the chain did its job: Fallback activated: claude-opus-5 → claude-opus-4-8 (anthropic).
3. The fallback went to base_url=https://api.anthropic.com — not the gateway — despite fallback_providers[0].base_url being explicitly set to the gateway URL.
4. Auth lives on the gateway, not at Anthropic, so the request came back 400 and the session was dead.

The relevant log line, verbatim:

agent.conversation_loop: API call failed (attempt 2/3) provider=anthropic
  base_url=https://api.anthropic.com model=claude-opus-4-8 summary=HTTP 400

Confirmed the traffic genuinely never reached the gateway (its own request counter didn't move for those calls), so this isn't a mislabelled log line. A second tell from the same window: during a concurrent DNS outage the primary leg returned 502 getaddrinfo ENOTFOUND api.anthropic.com — loopback reachable, upstream dead — while the fallback leg returned a client-side APIConnectionError: Connection error., which is only possible if that client was dialling an external host.

Worth noting the blast radius is wider than the fallback chain: because _try_anthropic() is the shared chokepoint, every provider: anthropic auxiliary call (compression, title generation, vision) diverges the same way. Those fail quietly rather than surfacing a 400, so the fallback case is just the loud one.

Two smaller notes for whoever picks this up:

• The failure mode is specifically silent divergence — the main agent and its side channels talk to different endpoints, and nothing logs the disagreement. That's what made it take a while to find both times.
• I'd previously carried this as a local patch to the vendored auxiliary_client.py; a routine update overwrote it and the regression came straight back. That's not an argument for the patch, just for landing it upstream rather than leaving people to re-apply it.

Happy to add a WARNING when _try_anthropic() discards a configured model.base_url, if that'd be a useful companion to the predicate change — it would have turned both of these incidents into a one-line grep.

[teknium1]

Merged via PR #85533 with your commit cherry-picked onto current main — authorship preserved in git log. The path-suffix trust now matches the primary path's convention while keeping the #52608 bare-host rejection, exactly as your tests pinned. Thanks for the clean, well-scoped fix.