Honor Anthropic API keys in built-in and Mastra Bots

[davidmckayv]

What this changes

Choosing an Anthropic API key previously left General Assistant, Knowledge, and Mastra trying to use OpenAI. Built-in Bots now resolve the selected provider's credentials and use the runtime's native Anthropic support, including routing and tool selection. Mastra uses its native Anthropic provider, preserves OpenAI Responses, and supports Chat Completions endpoints with or without a key.

Blank endpoint settings select the official API; Anthropic origins and proxy prefixes receive the required API version once. The source startup script no longer waits for the unused OpenAI-only sample when Anthropic is selected. prompt.txt now covers desktop, container, and clone setup, including explicit Anthropic model configuration and browser-plus-chart validation.

This changes API-key paths. Subscription sign-in still uses the existing provider-specific harnesses; it is not universal framework support.

Where it runs

• New state that outlives a request? None. Provider settings remain deployment configuration; stored keys remain in the existing encrypted credential store.
• Second replica? Resolves the same provider and rereads the shared stored key; rotation is covered.
• Anything serialised? No new write or migration.
• Browser fan-out? Existing AG-UI transport is unchanged.
• New listener, port, or schedule? None in production; test HTTP servers use ephemeral loopback ports and are stopped.

Boundary and audit

• Existing granted-tool execution, gateway decisions, and audit paths remain in use.
• Existing run failures carry provider errors; missing-key messages now name the selected provider.
• Provider and credential selection come from server configuration, not untrusted client input.

Changelog

• Added an Unreleased entry.

Proof

• 111 focused server tests pass, including actual CopilotKit runtime/Anthropic SDK tool roundtrips, key rotation, official and custom URLs, selector requests, and HTTP cancellation.
• 31 Mastra tests pass, including real SDK requests for OpenAI, Anthropic, custom endpoints, keyless endpoints, and missing-key refusal at official OpenAI.
• Eight source-startup tests pass. Anthropic-only setup omits the unused sample while retaining LangGraph readiness and failure checks; OpenAI startup is preserved.
• Scoped format/lint, root typecheck, server build/typecheck, and Bash syntax checks pass.
• Provider requests use local fake HTTP with real runtime/SDK code. No new live-provider billing or GUI validation is claimed. Existing desktop validation is not rerun for these shared changes.
• An extra standalone Mastra TypeScript probe reports the same pre-existing SDK/Mastra model-type error before and after the patch; the repository's normal CI and runtime tests cover this package.