Gateway model discovery does not use apiKeyHelper for authentication

Summary

Gateway model discovery (CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1) fails silently when authentication is provided via apiKeyHelper in managed settings. The /v1/models request appears to run before the credential helper is invoked, resulting in an unauthenticated request that fails.

Reproduction

1. Configure managed settings with apiKeyHelper and gateway discovery:

{
  "apiKeyHelper": "/usr/local/bin/my-credential-helper",
  "env": {
    "ANTHROPIC_BASE_URL": "https://my-litellm-gateway.example.com",
    "CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY": "1"
  }
}

1. Start Claude Code — /model picker does NOT show gateway models
2. No ~/.claude/cache/gateway-models.json file is created (discovery fails silently)

Workaround

Setting ANTHROPIC_AUTH_TOKEN statically works:

ANTHROPIC_AUTH_TOKEN=$(my-credential-helper) claude

With this, gateway models appear in the /model picker as expected.

Expected behavior

Gateway model discovery should invoke the apiKeyHelper to obtain a token before making the /v1/models request, the same way inference requests do.

Environment

• Claude Code version: 2.1.140
• OS: macOS (arm64)
• Gateway: LiteLLM proxy requiring bearer token auth on /v1/models