fix(provider): route api.anthropic.com to anthropic_messages (#32243)

[hashbender]

Summary

_detect_api_mode_for_url now returns anthropic_messages for the native api.anthropic.com host, realigning it with its sibling providers.determine_api_mode — which already maps that host. Previously the two helpers disagreed, so any URL-fallback path resolving a base_url of api.anthropic.com defaulted to chat_completions → POST /v1/chat/completions, the OpenAI-compat shim that bills OAuth Pro/Max against a separate "extra usage" pool (surfacing as the misleading 400 "out of extra usage").

Root cause: _detect_api_mode_for_url only matched the third-party /anthropic path suffix (MiniMax, Zhipu, LiteLLM proxies) and api.kimi.com/coding; the direct Anthropic host fell through to None.

Salvage of NousResearch#32318 (@xxxigm), widened to also cover the try_activate_fallback sibling call site from NousResearch#49247 (@x9x9x9x9x9x91) so the whole bug class is fixed, not just one path.

Changes

• hermes_cli/runtime_provider.py: _detect_api_mode_for_url maps hostname == "api.anthropic.com" → anthropic_messages. Exact-hostname match rejects lookalike subdomains and path-segment spoofing.
• agent/chat_completion_helpers.py: try_activate_fallback matches the same native host, so a custom fallback provider on api.anthropic.com no longer 404s on /v1/chat/completions.
• Tests: test_detect_api_mode_for_url.py, test_anthropic_oauth_routes_to_messages_api.py (pins all runtime branches), test_provider_fallback.py (fallback path).

Scope note

The reporter's primary scenario (a provider: anthropic OAuth pool credential) already routes correctly on main — that branch hardcodes anthropic_messages — and the specific 400 "out of extra usage" symptom is separately handled on main by NousResearch#56128 (billing classification + pool rotation). This PR fixes the adjacent, real helper-disagreement affecting custom-provider / bare-api-key setups pointed at the native host.

Validation

api.anthropic.com (native host)	Before	After
_detect_api_mode_for_url	None → chat_completions	anthropic_messages
try_activate_fallback custom provider	chat_completions → 404	anthropic_messages
lookalike subdomain / path spoof	—	rejected (exact hostname)

scripts/run_tests.sh — 3 files, 53 tests passed. Live E2E confirmed native host resolves and both spoof shapes are rejected.

Infographic

---

Mirror-of: NousResearch#56214
NousResearch#56214

[tenki-reviewer]

Review Complete
No issues found!

Risk: 🟢 Low (5/100) — no findings · 333 LOC across 6 files

---

No issues found. The PR modifies provider URL detection, Anthropic OAuth routing, fallback logic, and corresponding tests — all changes are well-structured and correct.

Files Reviewed (6 files)

agent/chat_completion_helpers.py
hermes_cli/runtime_provider.py
scripts/release.py
tests/hermes_cli/test_anthropic_oauth_routes_to_messages_api.py
tests/hermes_cli/test_detect_api_mode_for_url.py
tests/run_agent/test_provider_fallback.py