Summary

When Hermes runs MiniMax via the Anthropic-compatible endpoint (https://api.minimax.io/anthropic), auth can be overwritten by Anthropic OAuth/token resolution (ANTHROPIC_TOKEN / Claude Code creds). This results in 401s from MiniMax even though MINIMAX_API_KEY is set and valid.

Environment

• Hermes Agent v0.4.0 (installed CLI)
• Provider: minimax
• Model: MiniMax-M2.7-highspeed
• Base URL: https://api.minimax.io/anthropic

Repro

1. Configure model.provider: minimax with base URL https://api.minimax.io/anthropic.
2. Set MINIMAX_API_KEY in ~/.hermes/.env.
3. Have Anthropic OAuth/token state present (for example from Claude login/setup token).
4. Run a normal Hermes prompt.

Actual

Hermes logs show auth method Bearer with an Anthropic-style token (sk-ant-oat...) and MiniMax responds 401, e.g. "Please carry the API secret key in the Authorization field".

Expected

For provider minimax / minimax-cn, Hermes should always keep provider key auth (MINIMAX_API_KEY / MINIMAX_CN_API_KEY) and never refresh/override from Anthropic token sources.

Root Cause

In run_agent.py under api_mode == "anthropic_messages":

• Init path falls back to resolve_anthropic_token() for non-DashScope providers.
• _try_refresh_anthropic_client_credentials() refreshes from resolve_anthropic_token() for non-DashScope providers.
• Fallback activation path also uses resolve_anthropic_token().

This logic is correct for native Anthropic, but too broad for third-party Anthropic-compatible providers (MiniMax, custom /anthropic endpoints).

Proposed Fix

Gate Anthropic token fallback/refresh to native Anthropic only (for example: provider == "anthropic" or base URL contains api.anthropic.com).

Suggested implementation shape:

1. Add helper like _uses_native_anthropic_auth(provider, base_url) -> bool.
2. In Anthropic init path, only call resolve_anthropic_token() when helper returns true.
3. In _try_refresh_anthropic_client_credentials(), early-return false when helper returns false.
4. In fallback activation path for anthropic_messages, apply the same gating.
5. Add regression tests:
   • MiniMax init must not call resolve_anthropic_token()
   • MiniMax refresh must not call resolve_anthropic_token()

Additional note

ANTHROPIC_AUTH_TOKEN in .env appears to be a user-facing convention/comment only and is not consumed by auth resolution; this can confuse users troubleshooting MiniMax auth. Consider documenting/removing it if present in templates.