feat(setup): Anthropic OAuth onboarding with setup-token support

[serrrfirat]

Summary

• Adds Anthropic OAuth support to the onboarding wizard (API key or OAuth token from claude login / claude setup-token)
• New AnthropicOAuthProvider sends Authorization: Bearer + anthropic-beta: oauth-2025-04-20 (rig-core hardcodes x-api-key, so OAuth needs a custom HTTP provider)
• Auto-detects existing OAuth tokens from OS credential stores (macOS Keychain, Linux ~/.claude/.credentials.json)
• Deferred config resolution: providers return None instead of hard-erroring when credentials aren't available at startup, then re-resolve after secrets injection
• All 4 provider backends (OpenAI, Anthropic, OpenAI-compatible, Tinfoil) defer gracefully

Motivation

Supersedes #113 and #143 which are stale (merge conflicts, based on old config.rs before module split). Key differences:

Feature	#113	#143	This PR
Custom OAuth provider (Bearer auth)	Yes (947 lines)	No (sends as x-api-key → 401)	Yes (580 lines)
anthropic-beta: oauth-2025-04-20 header	Yes	Wizard model-fetch only	Yes (runtime)
OS credential store extraction	No	No	Yes (Keychain + credentials.json)
Deferred config resolution	No (hard-error)	No (hard-error)	Yes
Works without secrets DB / master key	No	No	Yes
Model selection respects wizard choice	No	No	Yes
Based on current codebase	No (stale)	No (stale)	Yes
Provider resolution tests	No	No	20 tests

Credit to @LucaDeLeo (#113) for the native provider approach and AnthropicAuth enum pattern, and @bigguybobby (#143) for the wizard auth selector UX and token validation ideas.

Changes

• src/llm/anthropic_oauth.rs (new) — Direct HTTP provider: Authorization: Bearer + anthropic-beta: oauth-2025-04-20 + anthropic-version: 2023-06-01. Follows the NearAiChatProvider pattern.
• src/setup/wizard.rs — Anthropic auth offers "API Key" or "OAuth Token (from claude login)". Auto-detects tokens, retry flow, fallback to API key.
• src/config/llm.rs — oauth_token field on AnthropicDirectConfig, deferred resolution for all providers, selected_model respected in resolution chain.
• src/config/mod.rs — inject_os_credentials() loads Anthropic OAuth from OS stores even without secrets DB. Split from inject_llm_keys_from_secrets().
• src/app.rs — OS credential injection + config re-resolution in no-master-key startup path.
• src/llm/mod.rs — Routes to AnthropicOAuthProvider when oauth_token is present.
• .env.example — Documents ANTHROPIC_OAUTH_TOKEN.

VPS / Headless usage

Set ANTHROPIC_OAUTH_TOKEN=<token> from claude setup-token (1-year validity). No browser needed on the server.

Test plan

• cargo fmt — clean
• cargo clippy --all --benches --tests --examples --all-features — zero warnings
• cargo test — all pass
• 20 provider resolution tests (all backends: deferred, API key, OAuth, selected_model)
• 6 Anthropic OAuth provider tests (message conversion, system extraction, tool calls, response parsing)
• Manual: wizard OAuth flow with existing claude login token → auto-detected, model selection works
• Manual: claude-opus-4-6 via OAuth → successful chat
• Manual: REPL, web gateway, Telegram all functional

Closes #113
Closes #143

Co-Authored-By: LucaDeLeo 46697542+LucaDeLeo@users.noreply.github.com
Co-Authored-By: bigguybobby 203908353+bigguybobby@users.noreply.github.com

🤖 Generated with Claude Code

[gemini-code-assist]

Summary of Changes

Hello @serrrfirat, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the authentication and configuration mechanisms for Large Language Model (LLM) providers, particularly for Anthropic. It introduces a more flexible and robust way to handle Anthropic credentials by supporting OAuth tokens and integrating with OS-level credential stores. Furthermore, it refines the application's startup process by implementing deferred configuration resolution, ensuring that LLM providers can be configured even when secrets are loaded asynchronously. These changes aim to streamline the setup experience and improve the reliability of LLM integrations.

Highlights

• Anthropic OAuth Onboarding: Added comprehensive support for Anthropic OAuth tokens in the onboarding wizard, allowing users to authenticate via API key or OAuth token obtained from claude login or claude setup-token.
• Dedicated Anthropic OAuth Provider: Introduced a new AnthropicOAuthProvider to handle Authorization: Bearer authentication and the anthropic-beta: oauth-2025-04-20 header, as the existing rig-core client only supports x-api-key.
• OS Credential Store Integration: Implemented auto-detection and extraction of existing Anthropic OAuth tokens from OS credential stores (macOS Keychain, Linux ~/.claude/.credentials.json), improving user experience and token freshness.
• Deferred LLM Config Resolution: Enhanced LLM provider configuration to gracefully defer resolution when credentials are not immediately available at startup, allowing re-resolution after secrets injection and preventing hard errors.
• Claude Code Sandbox Support: Integrated Claude Code sandbox mode, enabling the agent to delegate tasks to Claude CLI within sandboxed Docker containers, leveraging Anthropic credentials.

Changelog

• .env.example
  • Documented ANTHROPIC_OAUTH_TOKEN for OAuth authentication.
• src/app.rs
  • Added logic to inject OS credentials and re-resolve the configuration when no master key is available, ensuring tokens from OS stores are utilized.
• src/config/llm.rs
  • Introduced OAUTH_PLACEHOLDER sentinel value for Anthropic API keys when only an OAuth token is present.
  • Added oauth_token field to AnthropicDirectConfig to store OAuth tokens.
  • Modified LlmConfig::resolve to implement deferred resolution for OpenAI, Anthropic, OpenAI-compatible, and Tinfoil providers, returning None if credentials are not yet available.
  • Added new test cases for Anthropic, OpenAI, and Tinfoil provider resolution, including scenarios for deferred resolution and OAuth token handling.
• src/config/mod.rs
  • Made the llm module public to allow external access.
  • Included llm_anthropic_oauth_token in the secrets mapping for inject_llm_keys_from_secrets.
  • Added inject_os_credentials and inject_os_credential_store_tokens functions to load tokens from OS credential stores independently of the secrets database.
• src/llm/anthropic_oauth.rs
  • Added a new module defining AnthropicOAuthProvider for direct HTTP communication with Anthropic using Bearer tokens and specific beta headers.
  • Implemented LlmProvider trait for AnthropicOAuthProvider, including methods for complete and complete_with_tools.
  • Included message conversion logic to adapt internal ChatMessage format to Anthropic's API requirements, handling system messages and tool calls/results.
  • Added unit tests for message conversion and response content extraction.
• src/llm/mod.rs
  • Imported the new anthropic_oauth module.
  • Modified create_anthropic_provider to route to AnthropicOAuthProvider if an OAuth token is present in the configuration.
• src/main.rs
  • Updated comments to clarify that initial config loading can occur before the DB is available and that LlmConfig::resolve() defers gracefully.
• src/settings.rs
  • Added claude_code_enabled boolean field to SandboxSettings to control Claude Code sandbox mode.
• src/setup/wizard.rs
  • Modified setup_anthropic to present users with a choice between API Key and OAuth Token authentication.
  • Introduced setup_anthropic_oauth to guide users through OAuth token setup, including auto-detection from OS stores, retry mechanisms, and manual input fallback.
  • Added save_anthropic_oauth_token to store OAuth tokens securely and set environment variables.
  • Updated setup_api_key_provider to set environment variables for immediate use during the wizard.
  • Added step_claude_code_sandbox to enable and configure Claude Code sandbox mode, checking for Anthropic credentials.
  • Updated write_bootstrap_env to include CLAUDE_CODE_ENABLED if enabled and clarified that credentials are not written to the bootstrap environment.

Activity

• The pull request description indicates that this PR supersedes feat: native Anthropic provider with Claude Max OAuth support #113 and Add Anthropic setup-token + Codex OAuth token onboarding flows #143, which were stale due to merge conflicts and an outdated codebase.
• The PR acknowledges and credits @LucaDeLeo for the native provider approach and AnthropicAuth enum pattern from feat: native Anthropic provider with Claude Max OAuth support #113.
• Credit is also given to @bigguybobby for the wizard auth selector UX and token validation ideas from Add Anthropic setup-token + Codex OAuth token onboarding flows #143.
• The PR was co-authored by LucaDeLeo and bigguybobby, indicating collaborative development.
• The PR includes a detailed test plan with checks for cargo fmt, clippy, cargo test, specific provider resolution tests (20), Anthropic OAuth provider tests (6), and manual verification steps for wizard flow, chat functionality, REPL, web gateway, and Telegram.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces significant enhancements for Anthropic integration, including OAuth support, deferred configuration resolution, and an improved setup wizard. My review focuses on improving error handling consistency by propagating potential ConfigErrors, increasing robustness against unexpected inputs by explicitly handling None cases, and refactoring for better maintainability by consolidating repeated logic into reusable methods, all in line with repository guidelines.

[gemini-code-assist]

The error handling for ANTHROPIC_MODEL and ANTHROPIC_BASE_URL is inconsistent with other providers like OpenAI. Using .ok().flatten() silently ignores potential ConfigErrors (e.g., for invalid UTF-8 in environment variables). It would be more robust and consistent to propagate these errors using the ? operator, similar to how OPENAI_MODEL is handled. This aligns with the practice of using specialized helper functions for environment variable resolution to ensure consistency and proper error handling.

Suggested change

	.flatten()
	.or_else(|| settings.selected_model.clone())
	.unwrap_or_else(|| "claude-sonnet-4-20250514".to_string());
	let base_url = optional_env("ANTHROPIC_BASE_URL").ok().flatten();
	AnthropicDirectConfig {
	api_key,
	let model = optional_env("ANTHROPIC_MODEL")?
	.or_else(|| settings.selected_model.clone())
	.unwrap_or_else(|| "claude-sonnet-4-20250514".to_string());
	let base_url = optional_env("ANTHROPIC_BASE_URL")?;

References

1. Use specialized helper functions like parse_option_env<T> when resolving environment variables into Option<T> fields to minimize boilerplate and maintain consistency across configuration files.

[ilblackdragon]

Already resolved — the code now uses the registry-based resolve_registry_provider() which calls optional_env() with ? propagation throughout.

[gemini-code-assist]

Using unwrap_or_default() on tool_call_id could result in an empty string for tool_use_id if a ChatMessage with Role::Tool is ever constructed without a tool_call_id. This would likely cause an API error from Anthropic. It's safer to handle the None case explicitly, for example by skipping the message and logging a warning.

            Role::Tool => {
                let Some(tool_call_id) = msg.tool_call_id else {
                    tracing::warn!("Skipping Tool message without tool_call_id");
                    continue;
                };
                // Tool results go into a user message with tool_result blocks
                let block = AnthropicContentBlock::ToolResult {
                    tool_use_id: tool_call_id,
                    content: msg.content,
                };
                // If the last message is already a user message with blocks,
                // append to it (Anthropic requires consecutive tool results
                // in one user message).
                if let Some(last) = anthropic_msgs.last_mut()
                    && last.role == "user"
                    && let AnthropicContent::Blocks(ref mut blocks) = last.content
                {
                    blocks.push(block);
                    continue;
                }
                anthropic_msgs.push(AnthropicMessage {
                    role: "user".to_string(),
                    content: AnthropicContent::Blocks(vec![block]),
                });
            }

[ilblackdragon]

Already resolved — the code already uses let Some(tool_call_id) = msg.tool_call_id else { continue } with a warning log, exactly as suggested.

[gemini-code-assist]

The logic for checking for Anthropic credentials is repeated. To improve maintainability and reduce code duplication, you can define a closure to encapsulate this check, aligning with the practice of consolidating related operations into reusable methods.

        let has_credentials = || {
            let has_api_key = std::env::var("ANTHROPIC_API_KEY")
                .is_ok_and(|v| !v.is_empty() && v != OAUTH_PLACEHOLDER);
            let has_oauth = crate::config::ClaudeCodeConfig::extract_oauth_token().is_some()
                || std::env::var("ANTHROPIC_OAUTH_TOKEN").is_ok_and(|v| !v.is_empty());
            has_api_key || has_oauth
        };

        if has_credentials() {
            self.settings.sandbox.claude_code_enabled = true;
            print_success("Claude Code sandbox enabled");
        } else {
            print_error("No Anthropic credentials found.");
            print_info(
                "Claude Code needs ANTHROPIC_API_KEY or an OAuth token from `claude login`.",
            );
            println!();

            if confirm("Retry after setting up credentials?", false).map_err(SetupError::Io)? {
                if has_credentials() {
                    self.settings.sandbox.claude_code_enabled = true;
                    print_success("Claude Code sandbox enabled");
                } else {
                    self.settings.sandbox.claude_code_enabled = false;
                    print_info("No credentials found. Claude Code disabled for now.");
                    print_info("Set ANTHROPIC_API_KEY or run `claude login` and enable later.");
                }
            } else {
                self.settings.sandbox.claude_code_enabled = false;
                print_info("Claude Code disabled. Enable with CLAUDE_CODE_ENABLED=true later.");
            }
        }

References

1. Consolidate related sequences of operations, such as creating, persisting, and scheduling a job, into a single reusable method to improve code consistency and maintainability.

[ilblackdragon]

Already resolved — the code already uses a has_credentials closure as suggested. Additionally, in 898e841 the closure was updated to use optional_env() instead of raw std::env::var.

[zmanian]

Review: Anthropic OAuth Onboarding with Setup-Token Support

Good feature addition -- the AnthropicOAuthProvider is well-implemented, the OS credential extraction is sensible, and the deferred resolution approach is sound. Test coverage for config resolution is solid. However, there are several issues.

Blocker: OnceLock Race Between Credential Injection Paths

Both inject_os_credentials() and inject_llm_keys_from_secrets() call INJECTED_VARS.set(injected), but INJECTED_VARS is a OnceLock<HashMap<...>> -- whichever runs first wins; the second call silently drops its data.

In AppBuilder::init_secrets(), when master_key() returns None, inject_os_credentials() is called (setting INJECTED_VARS), then it returns early. If the code paths ever change ordering, credentials will silently vanish.

Fix: Replace OnceLock with a Mutex<HashMap> that supports merge semantics, or ensure at the type level that only one injection path can be called.

High

1. No token expiry/refresh: OAuth tokens from claude login expire in ~8-12 hours. The AnthropicOAuthProvider stores the token once and never refreshes it. For IronClaw (a daemon), this means guaranteed auth failures after ~8 hours with no recovery path. At minimum, on 401 errors attempt to re-extract from the OS credential store. Ideally, use the refresh token. Can be a follow-up, but document the limitation.

2. Comment/code path mismatch: Comment says ~/.codex/auth.json but code reads ~/.claude/.credentials.json. Fix the comment.

3. OAUTH_PLACEHOLDER sentinel value: Storing "oauth-placeholder" in api_key when only an OAuth token is present is fragile. Any new code that reads config.anthropic.api_key without being aware of the sentinel will silently use an invalid key. Consider using Option<SecretString> for api_key instead.

Medium

4. Deferred resolution changes error behavior for ALL providers: Previously, LLM_BACKEND=openai without OPENAI_API_KEY produced a clear startup error. Now it silently defers and fails at runtime with a less informative error. Add a post-init validation step that checks "if backend == X and config.X.is_none(), emit a clear error."

5. unsafe { std::env::set_var } in wizard code: The comment says "single-threaded wizard context" but the wizard is async and Tokio's runtime is multi-threaded. Use the INJECTED_VARS overlay mechanism instead of set_var.

6. No validation of extracted OAuth tokens: parse_oauth_access_token accepts any string. Add at least a prefix check (sk-ant-oat01-) and non-empty validation. Optionally check expiresAt.

Low

7. claude_code_enabled in SandboxSettings: Somewhat tangential to OAuth onboarding -- increases review surface but there's a connection.

What's Good

• No new dependencies added
• Token stored in memory only (never written to .env)
• Uses mask_api_key() for display -- no token leakage in logs
• Clean AnthropicOAuthProvider with proper Authorization: Bearer header
• 10+ unit tests for config resolution scenarios
• No database schema changes needed -- both backends unaffected

Recommendation

Fix the OnceLock race condition before merge. Document the token expiry limitation and file an issue for follow-up refresh support. The other items can be addressed in follow-up PRs.

[Copilot]

Pull request overview

Adds first-class Anthropic OAuth support (Claude CLI tokens) across config resolution, onboarding, and runtime provider creation, including OS credential-store token extraction for headless/no-secrets-DB startup paths.

Changes:

• Introduces a direct HTTP Anthropic OAuth provider using Authorization: Bearer + required anthropic-beta header.
• Extends the setup wizard to offer Anthropic API key vs OAuth token onboarding, plus an optional “Claude Code sandbox” toggle.
• Adds OAuth token plumbing to config resolution and startup credential injection (secrets DB + OS credential stores), with updated env docs.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/setup/wizard.rs	Adds Anthropic OAuth onboarding flow, env/secrets persistence, and Claude Code sandbox sub-step.
src/settings.rs	Persists a claude_code_enabled toggle in sandbox settings.
src/main.rs	Clarifies that LLM config may defer until secrets are injected and config is re-resolved.
src/llm/mod.rs	Routes Anthropic provider creation to the OAuth provider when an OAuth token is present.
src/llm/anthropic_oauth.rs	New direct HTTP provider implementing Anthropic Messages API with Bearer auth.
src/config/mod.rs	Injects Anthropic OAuth from secrets + OS credential stores into the config overlay.
src/config/llm.rs	Adds oauth_token to RegistryProviderConfig and an OAUTH_PLACEHOLDER sentinel.
src/app.rs	Injects OS credentials and re-resolves config when no secrets master key is available.
.env.example	Documents ANTHROPIC_OAUTH_TOKEN usage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

self.llm_api_key is reused here to store an OAuth token, but later fetch_anthropic_models() sends the cached value as x-api-key (not Authorization: Bearer + anthropic-beta), so model listing will always fail for OAuth and fall back to static defaults (after a 401). Consider either (a) teaching the model-fetch path to use the OAuth headers when ANTHROPIC_OAUTH_TOKEN is configured, or (b) storing OAuth separately from llm_api_key so the callsite can choose the right auth scheme.

Suggested change

	// Cache for model fetching
	self.llm_api_key = Some(SecretString::from(token.to_string()));

[ilblackdragon]

Fixed in 898e841. fetch_anthropic_models() now detects OAuth tokens (via optional_env) and uses Bearer auth + anthropic-beta header. Also filters out OAUTH_PLACEHOLDER from the API key lookup.

[Copilot]

create_anthropic_from_registry() routes to AnthropicOAuthProvider whenever oauth_token is set, which will also trigger when an API key is present (your LlmConfig::resolve test keeps oauth_token populated even when ANTHROPIC_API_KEY is set). This contradicts the intended “API key takes priority” behavior and will cause API-key users with ANTHROPIC_OAUTH_TOKEN set to unexpectedly use Bearer auth. Consider routing to OAuth only when api_key is missing or equals OAUTH_PLACEHOLDER, or clearing oauth_token when a real API key is present.

[ilblackdragon]

Fixed in 898e841. OAuth routing now only triggers when api_key is None or equals OAUTH_PLACEHOLDER. When both an API key and OAuth token are set, the API key takes priority.

[Copilot]

unsafe { std::env::set_var(...) } is called while the program is running on a multi-threaded Tokio runtime (see main.rs uses new_multi_thread()), so the “single-threaded wizard context” safety comment doesn’t hold and this can be UB if any other thread reads env concurrently. Instead of mutating process env, consider passing the key via self.llm_api_key (already used by model listing) or using the INJECTED_VARS overlay (or a wizard-local overlay) that optional_env() reads.

Suggested change

	// Set env var for immediate use (model selection step)
	// SAFETY: Single-threaded wizard context.
	unsafe {
	std::env::set_var("ANTHROPIC_OAUTH_TOKEN", token);
	}
	// Cache for model fetching
	// Cache for model fetching / immediate use during model selection

[ilblackdragon]

Fixed in 898e841. Replaced unsafe { std::env::set_var } with crate::config::inject_single_var(), which merges into the thread-safe INJECTED_VARS overlay. No more UB risk on multi-threaded runtimes.

[Copilot]

Same concern as above: setting env vars from inside the async wizard requires unsafe and is not sound under the multi-threaded runtime. Since later wizard steps already consult self.llm_api_key (and could consult optional_env() for the injected overlay), it would be safer to remove this env mutation and plumb credentials through wizard state instead.

Suggested change

	// Set env var so subsequent wizard steps (model selection) can use it
	// immediately. This is ephemeral — credentials are NOT written to the
	// bootstrap .env; they live only in the encrypted secrets DB.
	// SAFETY: Single-threaded wizard context.
	unsafe { std::env::set_var(env_var, key_str) };
	// Cache key in memory for model fetching later in the wizard
	// Cache key in memory so subsequent wizard steps (e.g. model selection)
	// can use it without mutating process-wide environment variables.

[ilblackdragon]

Fixed in 898e841. Same fix — both save_anthropic_oauth_token and setup_api_key_provider now use inject_single_var() instead of unsafe { std::env::set_var }.

[Copilot]

The Anthropic credential check here only looks at raw process env vars and ClaudeCodeConfig::extract_oauth_token(). If credentials are present only via the injected secrets overlay (inject_llm_keys_from_secrets + optional_env) or via wizard state (self.llm_api_key), this can incorrectly report “No Anthropic credentials found.” Consider using crate::config::helpers::optional_env() for env lookups and/or checking the wizard’s cached key/token state.

[ilblackdragon]

Fixed in 898e841. Credential check now uses optional_env() which reads both real env vars and the injected overlay.

[Copilot]

This comment mentions loading tokens from ~/.codex/auth.json, but inject_os_credentials() currently only injects Anthropic OAuth from Claude Code’s credential store. Either expand OS credential injection to include Codex (if intended) or update the comment to match current behavior.

Suggested change

	// OS credential stores (macOS Keychain, ~/.codex/auth.json).
	// OS/IDE credential stores (e.g., Anthropic OAuth via Claude Code's credential store).

[ilblackdragon]

Fixed in 898e841. Comment now accurately says "macOS Keychain / Linux ~/.claude/.credentials.json".

[ilblackdragon]

Review Fixes (898e841)

All items from @zmanian's review and bot comments have been addressed:

Blocker ✅

• OnceLock race: Replaced OnceLock<HashMap> with LazyLock<Mutex<HashMap>>. Both inject_os_credentials() and inject_llm_keys_from_secrets() now merge data via merge_injected_vars() instead of the second caller silently dropping its entries.

High ✅

1. Token expiry/refresh: AnthropicOAuthProvider now attempts to re-extract a fresh token from the OS credential store (macOS Keychain / Linux credentials file) on 401 errors and retries once. Full refresh token support can be a follow-up.
2. Comment mismatch: Fixed ~/.codex/auth.json → ~/.claude/.credentials.json in app.rs.
3. OAUTH_PLACEHOLDER: Kept by design (documented in code). The sentinel only exists so RegistryProviderConfig is Some; the factory always checks for it before use. Added routing guard so API key always takes priority when both are set.

Medium ✅

4. Deferred resolution error: Added post-init validation in AppBuilder::build_all() — fails early with a clear error when LLM_BACKEND is set but no credentials were resolved.
5. unsafe set_var: Replaced both instances with inject_single_var() which merges into the thread-safe INJECTED_VARS overlay. No more UB on multi-threaded runtimes.
6. Token validation: Added sk-ant-oat prefix check in parse_oauth_access_token() (was already validated in save_anthropic_oauth_token).
7. OAuth routing priority: Now only routes to AnthropicOAuthProvider when api_key is None or equals OAUTH_PLACEHOLDER.
8. Model listing with OAuth: fetch_anthropic_models() now uses Bearer auth + anthropic-beta header when only an OAuth token is available.

Low ✅

9. Credential check overlay: step_claude_code_sandbox() now uses optional_env() instead of raw std::env::var.

Already resolved (bot comments)

• Gemini: .ok().flatten() inconsistency — code uses registry-based resolution with ? propagation
• Gemini: unwrap_or_default() on tool_call_id — already uses let Some(...) else { continue }
• Gemini: credential check duplication — already using has_credentials closure

CI: 2476 tests pass, zero clippy warnings.

Fixed.