providers: google/anthropic list_models overrides don't trim whitespace API keys
Author: LearningCircuitCreated Sep 18, 2026Updated Sep 18, 2026
Follow-up from PR #6578.
PR #6578 fixed the paste-with-whitespace failure mode in openai_base.list_models_for_api (keys are now stripped like create_llm's resolve_api_key). Two overrides still send the raw key:
google.pylist_models_for_api:x-goog-api-keyheader with the untrimmed key; a whitespace-only key is truthy → sent → guaranteed 401anthropic.py(~line 193, inherited bycustom_anthropic_endpoint.py): passesapi_key or OPTIONAL_API_KEY_PLACEHOLDERuntrimmed; same whitespace-only hazard
Result today: research works (create_llm strips) while model discovery silently fails auth — the exact asymmetry the openai_base fix closed.
Source: LearningCircuit/local-deep-research