fix(llm): trim whitespace from secrets loaded via Secret Manager

Secrets stored without an explicit printf may carry a trailing newline,
which Go's net/http rejects as an invalid header field value.

Author: cbullinger

CHANGELOG.md

@@ -6,6 +6,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+### Fixed
+
+- **Anthropic API key trailing newline** — secrets loaded from Secret Manager are now trimmed of surrounding whitespace before use, preventing `invalid header field value` errors when the secret was stored with a trailing newline.
+
 ## [v0.4.0] - 2026-05-02
 
 ### Added

services/github_auth.go

@@ -9,6 +9,7 @@ import (
 	"io"
 	"net/http"
 	"os"
+	"strings"
 	"time"
 
 	secretmanager "cloud.google.com/go/secretmanager/apiv1"
@@ -124,7 +125,7 @@ func getWebhookSecretFromSecretManager(ctx context.Context, secretName string) (
 	if err != nil {
 		return "", fmt.Errorf("%w: %v", ErrSecretAccess, err)
 	}
-	return string(result.Payload.Data), nil
+	return strings.TrimSpace(string(result.Payload.Data)), nil
 }
 
 // LoadWebhookSecret loads the webhook secret from Secret Manager or environment variable
@@ -200,7 +201,7 @@ func getSecretFromSecretManager(ctx context.Context, secretName, envVarName stri
 	if err != nil {
 		return "", fmt.Errorf("%w: %v", ErrSecretAccess, err)
 	}
-	return string(result.Payload.Data), nil
+	return strings.TrimSpace(string(result.Payload.Data)), nil
 }
 
 // getInstallationAccessToken exchanges a JWT for a GitHub App installation access token.

services/llm_anthropic.go

@@ -48,7 +48,7 @@ func newAnthropicClient(baseURL, model, apiKey string) *anthropicClient {
 	return &anthropicClient{
 		baseURL: strings.TrimSuffix(baseURL, "/"),
 		model:   model,
-		apiKey:  apiKey,
+		apiKey:  strings.TrimSpace(apiKey),
 		http:    &http.Client{Timeout: 60 * time.Second},
 	}
 }