[BUG] Gateway model discovery never issues /v1/models request when auth uses apiKeyHelper (v2.1.223)

Preflight Checklist

• [ ] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Gateway model discovery does not run when authentication is provided by
apiKeyHelper. With CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1 set in an
enterprise managed settings file, Claude Code never requests /v1/models:

• ~/.claude/cache/gateway-models.json is never created
• No [gatewayDiscovery] entries appear in ~/.claude/debug/latest
• The gateway logs show no /v1/models request arriving at all
• The /model picker shows no gateway-discovered rows

The failure is silent. There is no error, warning, or skip message anywhere.

Setting ANTHROPIC_AUTH_TOKEN in the environment, using a token from the exact
same helper script, makes discovery work immediately. Unsetting it breaks it
again. This isolates the credential source as the variable.

This was reported previously in #58581 and #56675 on v2.1.140. #58581 was closed
as a duplicate. It still reproduces on v2.1.223.

Impact: this makes the feature unusable for any deployment that authenticates via
apiKeyHelper, which is the standard pattern for enterprise fleets using an LLM
gateway with short-lived SSO-issued tokens.

What Should Happen?

Gateway model discovery should invoke apiKeyHelper to obtain a credential
before issuing the /v1/models request, the same way inference requests do.

Failing that, when discovery is enabled but cannot obtain a credential, it should
log a skip reason to the debug log rather than returning silently.

Error Messages/Logs

No error is produced.

Steps to Reproduce

Environment: Claude Code 2.1.223, AI Gateway fronting Amazon
Bedrock, serving Anthropic Messages format. Auth is a short-lived issued
token produced by a helper script.

1. Deploy an enterprise managed settings file containing:

   {
     "apiKeyHelper": "/path/to/get-token.sh",
     "env": {
       "ANTHROPIC_BASE_URL": "https://GATEWAY_HOST",
       "CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY": "1"
     }
   }

1. Confirm the gateway responds to /v1/models with valid Anthropic-format JSON

using a token from that same helper script (see Error Messages section).

1. Ensure CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC is unset, to rule out #61112.

1. Delete any cached result: rm -f ~/.claude/cache/gateway-models.json

1. Launch claude interactively and let it fully load.

1. Run /model. No gateway rows appear.

1. Check ls ~/.claude/cache/gateway-models.json. The file does not exist.

1. Check grep -i "gateway\|discover" ~/.claude/debug/latest. No [gatewayDiscovery] entries.

1. Confirm no /v1/models request reached the gateway in its access logs.

Now A/B the credential source, changing nothing else:

1. export ANTHROPIC_AUTH_TOKEN="$(/path/to/get-token.sh)"
2. Launch claude, let it load, exit.
3. cat ~/.claude/cache/gateway-models.json now returns a populated cache with

all five models and a fetchedAt timestamp. /model shows the gateway rows.

1. unset ANTHROPIC_AUTH_TOKEN, delete the cache, relaunch. Discovery fails

silently again.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.223

Platform

Other

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_