fix: build the reflection candidates in one shot, and resync the generated types

Assigning to a Final inside the loop that walked the rendered and percent-decoded
candidates was a type error, and it is the reason lint went red. The candidates are
built in one shot now, which is the shape the rest of this module already uses.

The federation disable sentinel also needed its two registrations following through:
the key-set test pins the registered set deliberately so a new key cannot be added
without being exercised, and declaring the field on the params model changed the
proxy's OpenAPI spec, so the dashboard's generated types are regenerated to match.

litellm/llms/base_llm/auth/token_exchange.py

@@ -170,14 +170,14 @@ def _shares_a_credential_run(rendered: str, compacted_secret: str) -> bool:
     """``unquote`` covers a credential sent form-encoded, without every caller enumerating that
     shape for itself: percent-escaping is reversible and applies to any field, query string
     included."""
-    for candidate in (rendered, unquote(rendered)):
-        compacted: Final = _CREDENTIAL_CHARS.sub("", candidate)
-        if any(
-            compacted[start : start + _REFLECTION_MIN_RUN] in compacted_secret
-            for start in range(len(compacted) - _REFLECTION_MIN_RUN + 1)
-        ):
-            return True
-    return False
+    compacted_candidates: Final = tuple(
+        _CREDENTIAL_CHARS.sub("", candidate) for candidate in (rendered, unquote(rendered))
+    )
+    return any(
+        compacted[start : start + _REFLECTION_MIN_RUN] in compacted_secret
+        for compacted in compacted_candidates
+        for start in range(len(compacted) - _REFLECTION_MIN_RUN + 1)
+    )
 
 
 def _redact_body_text(body_text: str) -> str:

tests/test_litellm/litellm_core_utils/test_get_litellm_params.py

@@ -300,6 +300,8 @@ class TestAnthropicWifIdentitySourceKeys:
         "anthropic_keycloak_auth_method": "client_secret_basic",
         "anthropic_keycloak_client_secret_ref": "oidc/env/KC_SECRET",
         "anthropic_keycloak_scope": "anthropic-wif",
+        # Server-set when a client redirects api_base; carried here so it is not dropped in transit
+        "anthropic_disable_workload_identity_federation": True,
     }
 
     def test_new_keys_are_exactly_the_non_legacy_registered_set(self):

ui/litellm-dashboard/src/lib/http/schema.d.ts

@@ -27463,6 +27463,8 @@ export interface components {
             allow_client_keepalive_override: boolean | null;
             /** Annotation Cost Per Page */
             annotation_cost_per_page?: number | null;
+            /** Anthropic Disable Workload Identity Federation */
+            anthropic_disable_workload_identity_federation?: boolean | null;
             /** Anthropic Federation Rule Id */
             anthropic_federation_rule_id?: string | null;
             /** Anthropic Identity Source */
@@ -36781,6 +36783,8 @@ export interface components {
             allow_client_keepalive_override: boolean | null;
             /** Annotation Cost Per Page */
             annotation_cost_per_page?: number | null;
+            /** Anthropic Disable Workload Identity Federation */
+            anthropic_disable_workload_identity_federation?: boolean | null;
             /** Anthropic Federation Rule Id */
             anthropic_federation_rule_id?: string | null;
             /** Anthropic Identity Source */