ENH: do not hardcode hermes URL

bin/bwclaude

@@ -364,12 +364,18 @@ build_claude_env() {
         BWRAP_ARGS+=(--setenv ANTHROPIC_FOUNDRY_API_KEY "${AIFAPIM_API_KEY}")
     fi
 
-    # Foundry base URL: same hermes gateway path as the legacy Anthropic route.
-    # Honor a host override if the user explicitly sets ANTHROPIC_FOUNDRY_BASE_URL.
-    if [[ -z "${ANTHROPIC_FOUNDRY_BASE_URL:-}" ]]; then
-        BWRAP_ARGS+=(--setenv ANTHROPIC_FOUNDRY_BASE_URL "https://hermes.nsls2.bnl.gov/anthropic")
-    else
+    # Foundry base URL: prefer explicit ANTHROPIC_FOUNDRY_BASE_URL override;
+    # otherwise derive from AIFAPIM_HOST (required).
+    if [[ -n "${ANTHROPIC_FOUNDRY_BASE_URL:-}" ]]; then
         pass_through_if_set ANTHROPIC_FOUNDRY_BASE_URL
+    elif [[ -n "${AIFAPIM_HOST:-}" ]]; then
+        BWRAP_ARGS+=(--setenv ANTHROPIC_FOUNDRY_BASE_URL "https://${AIFAPIM_HOST}/anthropic")
+    else
+        echo "Error: bwclaude requires AIFAPIM_HOST (or ANTHROPIC_FOUNDRY_BASE_URL) to be set." >&2
+        echo "Export one of:" >&2
+        echo "  AIFAPIM_HOST=hermes.nsls2.bnl.gov        # NSLS-II Hermes gateway hostname" >&2
+        echo "  ANTHROPIC_FOUNDRY_BASE_URL=https://...   # full Foundry base URL override" >&2
+        exit 1
     fi
 
     # Forward any host CLAUDE_* env vars (incl. user overrides for verbosity, etc.).

bin/bwcodex

@@ -8,7 +8,7 @@
 #
 # Two approved auth paths are supported (configured in ~/.codex/config.toml):
 #   - Hermes (AIFAPIM) routing — provider block points at
-#       https://hermes.nsls2.bnl.gov/openai/v1 with x-api-key header;
+#       https://${AIFAPIM_HOST}/openai/v1 with x-api-key header;
 #       wrapper plumbs AIFAPIM_HOST + AIFAPIM_API_KEY through.  Set
 #       OPENAI_API_KEY=dummy on the host or rely on the wrapper default.
 #   - BNL ITD ChatGPT subscription — `codex login` OAuth flow persists

docs/bw-wrappers.md

@@ -59,9 +59,11 @@ bwclaude [bwclaude-options] [claude arguments...]
 Routes through the NSLS-II Hermes (AIFAPIM) gateway in Azure AI Foundry
 mode. The wrapper forces `CLAUDE_CODE_USE_FOUNDRY=1` and plumbs:
 
-- **`ANTHROPIC_FOUNDRY_BASE_URL`** — defaults to
-  `https://hermes.nsls2.bnl.gov/anthropic`; override by exporting
-  `ANTHROPIC_FOUNDRY_BASE_URL` on the host.
+- **`ANTHROPIC_FOUNDRY_BASE_URL`** — if not set, constructed as
+  `https://${AIFAPIM_HOST}/anthropic`; override by exporting
+  `ANTHROPIC_FOUNDRY_BASE_URL` on the host. If neither
+  `ANTHROPIC_FOUNDRY_BASE_URL` nor `AIFAPIM_HOST` is set, the wrapper
+  refuses to start with a clear error message.
 - **`ANTHROPIC_FOUNDRY_API_KEY`** — taken from the host's
   `ANTHROPIC_FOUNDRY_API_KEY` if set, otherwise from `AIFAPIM_API_KEY`
   (the existing NSLS-II convention). If neither is set, the wrapper
@@ -106,7 +108,7 @@ bwcodex [bwcodex-options] [codex arguments...]
 Two approved auth paths (configured in `~/.codex/config.toml`):
 
 - **Hermes (AIFAPIM) routing** — provider block points at
-  `https://hermes.nsls2.bnl.gov/openai/v1` with `x-api-key` header; the
+  `https://${AIFAPIM_HOST}/openai/v1` with `x-api-key` header; the
   wrapper plumbs `AIFAPIM_HOST` and `AIFAPIM_API_KEY` through.
 - **BNL ITD ChatGPT subscription** — `codex login` OAuth flow persists
   tokens to `~/.codex/auth.json`. Run once with `--init-auth` to make