From 903dabd29ba001a7576a07c74397aa6fedae239a Mon Sep 17 00:00:00 2001 From: nesquena-hermes Date: Fri, 26 Jun 2026 15:44:15 +0000 Subject: [PATCH] fix(providers): strip Anthropic env values so whitespace-only OAuth tokens don't false-positive (#4995 gate finding) --- api/config.py | 2 +- .../test_issue4770_anthropic_oauth_detection.py | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/api/config.py b/api/config.py index 5e63a2d4..9c2ec86e 100644 --- a/api/config.py +++ b/api/config.py @@ -5739,7 +5739,7 @@ def get_available_models(*, prefer_cache: bool = False, force_refresh: bool = Fa "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", ): - val = _thread_local_env_value(k) + val = _thread_local_env_value(k).strip() if val: all_env[k] = val if any(all_env.get(env_var) for env_var in _anthropic_env_vars): diff --git a/tests/test_issue4770_anthropic_oauth_detection.py b/tests/test_issue4770_anthropic_oauth_detection.py index 7262bcbd..edebacfb 100644 --- a/tests/test_issue4770_anthropic_oauth_detection.py +++ b/tests/test_issue4770_anthropic_oauth_detection.py @@ -92,6 +92,22 @@ def test_anthropic_token_env_var_surfaces_anthropic_models(monkeypatch, tmp_path assert groups["anthropic"]["models"], "Anthropic fallback should include model entries" +def test_whitespace_only_anthropic_oauth_env_vars_do_not_surface_anthropic(monkeypatch, tmp_path): + """A whitespace-only ANTHROPIC_TOKEN / CLAUDE_CODE_OAUTH_TOKEN must NOT + false-positive the Anthropic provider (env values are stripped before the + availability check).""" + for ws_var in ("ANTHROPIC_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN"): + _clear_provider_env(monkeypatch) + _force_env_fallback(monkeypatch) + monkeypatch.setenv(ws_var, " \t ") + + result = _run_available_models_with_cfg(monkeypatch, tmp_path, {"model": {}}) + groups = _provider_groups(result) + assert "anthropic" not in groups, ( + f"a whitespace-only {ws_var} must not surface the Anthropic provider" + ) + + def test_claude_code_oauth_token_env_var_surfaces_anthropic_models(monkeypatch, tmp_path): """CLAUDE_CODE_OAUTH_TOKEN should detect the Anthropic provider through fallback.""" _clear_provider_env(monkeypatch)