From 82cce3d26ca15cef812c7ab5275200022e19e682 Mon Sep 17 00:00:00 2001
From: li0near <22549957+li0near@users.noreply.github.com>
Date: Mon, 20 Apr 2026 06:47:42 +0000
Subject: [PATCH] fix: add base_url_env_var to Anthropic ProviderConfig
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Anthropic provider entry in PROVIDER_REGISTRY is the only standard
API-key provider missing a base_url_env_var. This causes the credential
pool to hardcode base_url to https://api.anthropic.com, ignoring
ANTHROPIC_BASE_URL from the environment.

When using a proxy (e.g. LiteLLM, custom gateway), subagent delegation
fails with 401 because:
1. _seed_from_env() creates pool entries with the hardcoded base_url
2. On error recovery, _swap_credential() overwrites the child agent's
   proxy URL with the pool entry's api.anthropic.com
3. The proxy API key is sent to real Anthropic → authentication_error

Adding base_url_env_var="ANTHROPIC_BASE_URL" aligns Anthropic with the
20+ other providers that already have this field set (alibaba, gemini,
deepseek, xai, etc.).
---
 hermes_cli/auth.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hermes_cli/auth.py b/hermes_cli/auth.py
index 3fab36a2c..98ac4edb3 100644
--- a/hermes_cli/auth.py
+++ b/hermes_cli/auth.py
@@ -214,6 +214,7 @@ PROVIDER_REGISTRY: Dict[str, ProviderConfig] = {
         auth_type="api_key",
         inference_base_url="https://api.anthropic.com",
         api_key_env_vars=("ANTHROPIC_API_KEY", "ANTHROPIC_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN"),
+        base_url_env_var="ANTHROPIC_BASE_URL",
     ),
     "alibaba": ProviderConfig(
         id="alibaba",