fix: fall back to OPENROUTER_API_KEY for Anthropic base URL

meat/anthropic.go

@@ -40,6 +40,10 @@ const implicitGatewayKey = "implicit"
 //
 // Resolution order:
 //  1. If ANTHROPIC_API_KEY (or ANTHROPIC_BASE_URL) is set, use it directly.
+//     If only ANTHROPIC_BASE_URL is set (no key), fall back to
+//     OPENROUTER_API_KEY — OpenRouter's Anthropic-compatible endpoint
+//     (https://openrouter.ai/api) accepts an OpenRouter key over the same
+//     x-api-key header Anthropic itself expects.
 //  2. Otherwise, on an exe.dev VM with an attached "llm" integration, route
 //     through the gateway at https://<llm-host>/anthropic with managed creds.
 //  3. Otherwise, error.
@@ -50,6 +54,9 @@ func NewAnthropicFromEnv(ctx context.Context, model string) (*AnthropicModel, er
 
 	key := os.Getenv("ANTHROPIC_API_KEY")
 	baseURL := os.Getenv("ANTHROPIC_BASE_URL")
+	if key == "" && baseURL != "" {
+		key = os.Getenv("OPENROUTER_API_KEY")
+	}
 	if key != "" || baseURL != "" {
 		return &AnthropicModel{APIKey: key, Model: model, BaseURL: baseURL}, nil
 	}

meat/gateway_test.go

@@ -93,6 +93,54 @@ func TestNewAnthropicFromEnv_PrefersExplicitKey(t *testing.T) {
 	}
 }
 
+func TestNewAnthropicFromEnv_BaseURLFallsBackToOpenRouterKey(t *testing.T) {
+	t.Setenv("ANTHROPIC_API_KEY", "")
+	t.Setenv("ANTHROPIC_BASE_URL", "https://openrouter.ai/api")
+	t.Setenv("OPENROUTER_API_KEY", "sk-or-explicit")
+
+	m, err := NewAnthropicFromEnv(context.Background(), "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if m.APIKey != "sk-or-explicit" {
+		t.Errorf("APIKey = %q, want sk-or-explicit", m.APIKey)
+	}
+	if m.BaseURL != "https://openrouter.ai/api" {
+		t.Errorf("BaseURL = %q, want https://openrouter.ai/api", m.BaseURL)
+	}
+}
+
+func TestNewAnthropicFromEnv_ExplicitKeyBeatsOpenRouterFallback(t *testing.T) {
+	t.Setenv("ANTHROPIC_API_KEY", "sk-explicit")
+	t.Setenv("ANTHROPIC_BASE_URL", "https://openrouter.ai/api")
+	t.Setenv("OPENROUTER_API_KEY", "sk-or-explicit")
+
+	m, err := NewAnthropicFromEnv(context.Background(), "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if m.APIKey != "sk-explicit" {
+		t.Errorf("APIKey = %q, want sk-explicit (explicit ANTHROPIC_API_KEY wins)", m.APIKey)
+	}
+}
+
+func TestNewAnthropicFromEnv_OpenRouterKeyIgnoredWithoutBaseURL(t *testing.T) {
+	t.Setenv("ANTHROPIC_API_KEY", "")
+	t.Setenv("ANTHROPIC_BASE_URL", "")
+	t.Setenv("OPENROUTER_API_KEY", "sk-or-explicit")
+	t.Setenv("MEAT_MODEL", "")
+	old := exeDevMarkerPath
+	exeDevMarkerPath = filepath.Join(t.TempDir(), "nope")
+	t.Cleanup(func() { exeDevMarkerPath = old })
+
+	// No ANTHROPIC_BASE_URL means no signal the caller wants an
+	// Anthropic-compatible third-party endpoint, so OPENROUTER_API_KEY must
+	// not be used implicitly.
+	if _, err := NewAnthropicFromEnv(context.Background(), ""); err == nil {
+		t.Errorf("want error: OPENROUTER_API_KEY alone should not satisfy Anthropic credentials")
+	}
+}
+
 func TestNewAnthropicFromEnv_FallsBackToGateway(t *testing.T) {
 	t.Setenv("ANTHROPIC_API_KEY", "")
 	t.Setenv("ANTHROPIC_BASE_URL", "")