Skip to content

fix(provider): route api.anthropic.com to anthropic_messages (#32243) - #233

Closed
hashbender wants to merge 1 commit into
mainfrom
mirror/pr-56226
Closed

fix(provider): route api.anthropic.com to anthropic_messages (#32243)#233
hashbender wants to merge 1 commit into
mainfrom
mirror/pr-56226

Conversation

@hashbender

Copy link
Copy Markdown
Owner

Summary

_detect_api_mode_for_url now returns anthropic_messages for the native api.anthropic.com host, realigning it with its sibling providers.determine_api_mode — which already maps that host. Previously the two helpers disagreed, so any URL-fallback path resolving a base_url of api.anthropic.com defaulted to chat_completionsPOST /v1/chat/completions, the OpenAI-compat shim that bills OAuth Pro/Max against a separate "extra usage" pool (surfacing as the misleading 400 "out of extra usage").

Root cause: _detect_api_mode_for_url only matched the third-party /anthropic path suffix (MiniMax, Zhipu GLM, LiteLLM proxies) and api.kimi.com/coding; the direct Anthropic host fell through to None.

Salvage of NousResearch#32318 (@xxxigm), widened to also cover the try_activate_fallback sibling call site (NousResearch#49247, @x9x9x9x9x9x91) so the whole bug class is fixed, not just one path. Both bug sites confirmed live on current main.

Changes

  • hermes_cli/runtime_provider.py: _detect_api_mode_for_url maps hostname == "api.anthropic.com"anthropic_messages. Exact-hostname match (base_url_hostname) rejects lookalike subdomains and path-segment spoofing.
  • agent/chat_completion_helpers.py: try_activate_fallback matches the same native host, so a custom fallback provider on api.anthropic.com no longer 404s on /v1/chat/completions.
  • Tests: test_detect_api_mode_for_url.py (host shapes + spoof rejection), test_anthropic_oauth_routes_to_messages_api.py (pins all runtime branches + api_mode_override precedence), test_provider_fallback.py (fallback path).
  • scripts/release.py: AUTHOR_MAP entries for both contributors.

Scope note

The canonical OAuth pool path (provider: anthropic) already sets anthropic_messages in _resolve_runtime_from_pool_entry. This bug only bit custom-provider / direct-alias / api-key-fallback configs pointing at api.anthropic.com. Complementary to NousResearch#56128 (which classifies the "out of extra usage" 400 as billing) — that's error classification, this is routing.

Validation

Before After
_detect_api_mode_for_url("https://api.anthropic.com") Nonechat_completions anthropic_messages
api.anthropic.com.attacker.test rejected (not native)
proxy.test/api.anthropic.com/v1 rejected (path-segment spoof)
Targeted tests 53/53 pass

Supersedes stale-based NousResearch#56214. Cherry-picked onto current main, contributor authorship preserved per-commit.

Infographic

Anthropic OAuth routing fix


Mirror-of: NousResearch#56226
NousResearch#56226

@hashbender hashbender closed this Jul 1, 2026
@tenki-reviewer

tenki-reviewer Bot commented Jul 1, 2026

Copy link
Copy Markdown

Review Complete
No issues found!

Risk: 🟢 Low (5/100) — no findings · 4 LOC across 1 file


Single-file change adding entries to the AUTHOR_MAP dictionary in scripts/release.py — pure data, no logic changes.

Files Reviewed (1 files)
scripts/release.py

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant