abhigyanpatwari/GitNexus · error · SandboxError

model auth token must not be blank

Error message

model auth token must not be blank

What it means

Raised by build_sandbox_environment when auth_token is not None but trims to empty. The sandbox injects the token as ANTHROPIC_API_KEY and treats an all-whitespace token as invalid because Claude's --bare mode would receive a blank key, producing confusing auth failures downstream.

Source

Thrown at eval/workflow_bench/proposer_sandbox.py:299

        "NO_COLOR": "1",
        "GIT_TERMINAL_PROMPT": "0",
        "GIT_CONFIG_NOSYSTEM": "1",
        "NPM_CONFIG_UPDATE_NOTIFIER": "false",
        "NPM_CONFIG_AUDIT": "false",
        "NPM_CONFIG_FUND": "false",
        "NPM_CONFIG_CACHE": f"{SANDBOX_TMP}/npm-cache",
        "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1",
        "DISABLE_AUTOUPDATER": "1",
        "CLAUDE_CODE_DISABLE_TELEMETRY": "1",
        "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB": "1",
        "CLAUDE_CODE_DONT_INHERIT_ENV": "1",
        "CLAUDE_CODE_SHELL_PREFIX": SANDBOX_SHELL_PREFIX,
        "CLAUDE_CONFIG_DIR": f"{SANDBOX_HOME}/.claude",
    }
    if auth_token is not None:
        token = auth_token.strip()
        if not token:
            raise SandboxError("model auth token must not be blank")
        # Every benchmark/proposer invocation uses Claude's --bare mode,
        # which intentionally ignores OAuth/keychain/AUTH_TOKEN credentials.
        env["ANTHROPIC_API_KEY"] = token
    if base_url is not None:
        env["ANTHROPIC_BASE_URL"] = _validated_base_url(base_url)
    return env


def build_claude_settings() -> str:
    """Inline settings: hooks/plugins are absent and every Bash stays sandboxed."""

    settings = {
        "sandbox": {
            "enabled": True,
            "failIfUnavailable": True,
            "autoAllowBashIfSandboxed": True,
            "allowUnsandboxedCommands": False,
            "enableWeakerNestedSandbox": True,

View on GitHub (pinned to d540b00184)

Solutions

1. Pass None when you have no token, rather than an empty string.
2. Source the token via the project's devkey/secrets flow and assert it is non-empty before calling.
3. Strip and validate upstream: token = token.strip() or None.
4. Fail fast at config load with a clear 'missing API key' message rather than at sandbox build.

Example fix

// before
env = build_sandbox_environment(auth_token=os.environ.get('ANTHROPIC_API_KEY', ''))
// after
raw = os.environ.get('ANTHROPIC_API_KEY')
env = build_sandbox_environment(auth_token=raw.strip() or None if raw else None)

def normalized_token(raw: str | None) -> str | None:
    if raw is None:
        return None
    stripped = raw.strip()
    return stripped or None

env = build_sandbox_environment(auth_token=normalized_token(os.environ.get('ANTHROPIC_API_KEY')))

def is_usable_token(value: object) -> bool:
    return value is None or (isinstance(value, str) and value.strip() != '')

try:
    env = build_sandbox_environment(auth_token=token)
except SandboxError as exc:
    if 'must not be blank' in str(exc):
        env = build_sandbox_environment(auth_token=None)
    raise

When it happens

Trigger: Calling build_sandbox_environment(auth_token='') or with a whitespace-only string (' ', '\t\n'). Passing None skips the check (no key set); a non-None blank value trips it.

Common situations: Token read from an env var that was set but empty; token sourced from a secrets manager that returned whitespace; a config file had 'ANTHROPIC_API_KEY: ' with trailing space; copy-paste introduced only whitespace; a pytest fixture passed '' as a sentinel.

Related errors

• sandbox_copy must be a list of nonblank repository-relative
• sandbox_copy must be a repository-relative path: {raw!r}
• sandbox_copy declarations overlap: {path} and {other}
• sandbox_dependencies must be a list
• sandbox_dependencies entries require only nonblank source an

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/02e795c17cb0d695. Report an issue: GitHub.