verifyCredential ignores ANTHROPIC_BASE_URL — gateway keys 401 on api.anthropic.com and the run falls back to big-pickle #75

What happens

ANTHROPIC_API_KEY + ANTHROPIC_BASE_URL (a working Anthropic-format gateway — LiteLLM / cliproxy / corporate proxy) is treated as a dead credential on every run, even when the same key returns 200 from ${ANTHROPIC_BASE_URL}/v1/models and ${ANTHROPIC_BASE_URL}/v1/messages.

The action then deletes ANTHROPIC_API_KEY from the runner env and falls back to opencode/big-pickle. If the repo has no OPENCODE_API_KEY, the job dies with:

ANTHROPIC_API_KEY rejected by its provider — running opencode/big-pickle instead of <configured model>
**no API key found** — this repo is configured to use `opencode/big-pickle`, which needs `OPENCODE_API_KEY`

Why

Introduced in 693b2df (never infer which credential failed from the provider's wording, internal #1217), first released in v0.1.54. utils/credentialCheck.ts was new in that commit; it does not exist on v0.1.53.

The Anthropic probe is hardcoded:

ANTHROPIC_API_KEY: {
  request: (value) => ({
    url: "https://api.anthropic.com/v1/models",
    headers: { "x-api-key": value, "anthropic-version": "2023-06-01" },
  }),
},

ANTHROPIC_BASE_URL is never read. A gateway token is not a valid key on api.anthropic.com, so the probe returns 401 → dead → env deleted → big-pickle.

BYOK docs say Anthropic gateways via ANTHROPIC_BASE_URL are supported. The preflight undoes that.

ANTHROPIC_AUTH_TOKEN is also not recognized as a key (validateAgentApiKey only accepts ANTHROPIC_API_KEY / CLAUDE_CODE_OAUTH_TOKEN), so the Claude Code native gateway setup cannot bypass the probe.

Reproduce

1. Point ANTHROPIC_BASE_URL at any Anthropic-format proxy that accepts a non-sk-ant- key.
2. Put that gateway token in ANTHROPIC_API_KEY.
3. Set PULLFROG_MODEL to any anthropic/* slug and PULLFROG_AGENT=claude.
4. Run pullfrog/pullfrog@v0 (currently 0.1.56).

Expected: Claude Code talks to the gateway (this is what v0.1.53 does).
Actual: probe hits api.anthropic.com, 401, fallback to big-pickle.

Last good release

v0.1.53 (9397c1a891ef1fb961807498e12d2891bcd934a7). Pinning uses: pullfrog/[email protected] alone is not enough: runCli.ts still does npx pullfrog@^0.1.53, which resolves to 0.1.56. You also need PULLFROG_FORCE_LOCAL_CLI=1 so the action runs the tagged cli.ts.

Suggested fix

When ANTHROPIC_BASE_URL is set, probe ${ANTHROPIC_BASE_URL}/v1/models (or skip the probe / return unknown). Do not treat a 401 from api.anthropic.com as evidence that a gateway key is dead.