[alphasafal]

_ALL_ENV in tests/lib/test_credentials.py is meant to mirror the ENV_* constants in lib/credentials/_constants.py, but it's missing ANTHROPIC_BASE_URL. CredentialsFile fills a profile's missing base_url from that variable, so if it's set in your shell (e.g. behind a gateway), token exchanges go to your host instead of the one the tests mock.

Running tests/lib/test_credentials.py with ANTHROPIC_BASE_URL=https://gateway.example:

• before: 49 failed, 48 errors
• after: 291 passed

It also breaks 4 tests when set to https://api.anthropic.com. This only changes the tests, so runtime behaviour is untouched. The full tests/lib suite passes with the variable set, and ruff and pyright are clean.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chrikrah]

@alphasafal this is right as it stands at 941c0a1. Your before counts reproduce in a clean environment (after, I get 292 passed against your 291), and fill(config, "base_url", ENV_BASE_URL) at _providers.py:101 is the read that leaks the shell value into the profile.

$ env -i HOME=<empty> ANTHROPIC_BASE_URL=https://gateway.example python -m pytest tests/lib/test_credentials.py -q -n 4
2a53eaa (base):  49 failed, 243 passed, 2 skipped, 48 errors
941c0a1:         292 passed, 2 skipped

$ env -i HOME=<empty> ANTHROPIC_BASE_URL=https://api.anthropic.com python -m pytest tests/lib/test_credentials.py -q -n 4   # 2a53eaa
4 failed, 288 passed, 2 skipped, 3 errors

$ env -i HOME=<empty> ANTHROPIC_BASE_URL=https://gateway.example python -m pytest tests/lib -q -n 4   # 941c0a1
2161 passed, 10 skipped, 1 xfailed

non-blocking: the list missed ANTHROPIC_BASE_URL from the start. Building it from the module keeps it in step with _constants.py:

from anthropic.lib.credentials import _constants as _credential_constants

_ALL_ENV = [v for k, v in vars(_credential_constants).items() if k.startswith("ENV_")]

That yields the same 12 names, and the file gives 292 passed, 2 skipped with the gateway variable set. The list came from 3be1e89 without BASE_URL, and 119e123 later added WORKSPACE_ID to both files by hand.

@dtmeadows-ant I'd merge the one-line version now and leave the derived list as a follow-up, since it touches nothing outside the test file. Is that fine on your side?

[alphasafal]

Thanks for reproducing it, @chrikrah. Your clean-env counts are the ones to go by; I'll use env -i for numbers from now on. Merging the one-line version works for me, and I'm happy to send the derived _ALL_ENV list as a follow-up once this lands.

Checking the rest of tests/lib the same way turned up the same leak in the AWS-side tests (AWS_PROFILE, AWS_REGION, ANTHROPIC_BEDROCK_MANTLE_BASE_URL, …), so I've opened #2030 with the same kind of fix.