fix(providers): strip Anthropic env values so whitespace-only OAuth tokens don't false-positive (#4995 gate finding)

api/config.py

@@ -5739,7 +5739,7 @@ def get_available_models(*, prefer_cache: bool = False, force_refresh: bool = Fa
                 "AWS_ACCESS_KEY_ID",
                 "AWS_SECRET_ACCESS_KEY",
             ):
-                val = _thread_local_env_value(k)
+                val = _thread_local_env_value(k).strip()
                 if val:
                     all_env[k] = val
             if any(all_env.get(env_var) for env_var in _anthropic_env_vars):

tests/test_issue4770_anthropic_oauth_detection.py

@@ -92,6 +92,22 @@ def test_anthropic_token_env_var_surfaces_anthropic_models(monkeypatch, tmp_path
     assert groups["anthropic"]["models"], "Anthropic fallback should include model entries"
 
 
+def test_whitespace_only_anthropic_oauth_env_vars_do_not_surface_anthropic(monkeypatch, tmp_path):
+    """A whitespace-only ANTHROPIC_TOKEN / CLAUDE_CODE_OAUTH_TOKEN must NOT
+    false-positive the Anthropic provider (env values are stripped before the
+    availability check)."""
+    for ws_var in ("ANTHROPIC_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN"):
+        _clear_provider_env(monkeypatch)
+        _force_env_fallback(monkeypatch)
+        monkeypatch.setenv(ws_var, "   \t  ")
+
+        result = _run_available_models_with_cfg(monkeypatch, tmp_path, {"model": {}})
+        groups = _provider_groups(result)
+        assert "anthropic" not in groups, (
+            f"a whitespace-only {ws_var} must not surface the Anthropic provider"
+        )
+
+
 def test_claude_code_oauth_token_env_var_surfaces_anthropic_models(monkeypatch, tmp_path):
     """CLAUDE_CODE_OAUTH_TOKEN should detect the Anthropic provider through fallback."""
     _clear_provider_env(monkeypatch)