diff --git a/src/services/api-proxy-env-config.ts b/src/services/api-proxy-env-config.ts
index f8d285932..6b09133b1 100644
--- a/src/services/api-proxy-env-config.ts
+++ b/src/services/api-proxy-env-config.ts
@@ -52,7 +52,7 @@ export function buildProviderTargetEnv(config: WrapperConfig): Record<string, st
   return env;
 }
 
-export function resolveProviderSessionId(config: WrapperConfig): string | undefined {
+function resolveProviderSessionId(config: WrapperConfig): string | undefined {
   // Auto-derivation from GITHUB_RUN_ID was removed because the Copilot
   // `session_id`/`x-session-id` convention causes strict OpenAI-compatible
   // BYOK targets (e.g. Azure OpenAI) to reject every request with HTTP 400.
diff --git a/src/services/api-proxy-service-split.test.ts b/src/services/api-proxy-service-split.test.ts
index ceaa0fc37..a04832747 100644
--- a/src/services/api-proxy-service-split.test.ts
+++ b/src/services/api-proxy-service-split.test.ts
@@ -78,6 +78,23 @@ describe('API proxy split builders', () => {
     expect(env.AWF_PROVIDER_SESSION_ID).toBe('session-123');
   });
 
+  it('buildProviderTargetEnv trims AWF_PROVIDER_SESSION_ID from process.env', () => {
+    const savedSessionId = process.env.AWF_PROVIDER_SESSION_ID;
+    process.env.AWF_PROVIDER_SESSION_ID = ' session-from-env ';
+
+    try {
+      const env = buildProviderTargetEnv({
+        ...baseConfig,
+        workDir: '/tmp/awf-test',
+      });
+
+      expect(env.AWF_PROVIDER_SESSION_ID).toBe('session-from-env');
+    } finally {
+      if (savedSessionId !== undefined) process.env.AWF_PROVIDER_SESSION_ID = savedSessionId;
+      else delete process.env.AWF_PROVIDER_SESSION_ID;
+    }
+  });
+
   it('buildAgentCredentialEnv builds isolated agent credentials', () => {
     const agentEnvAdditions = buildAgentCredentialEnv({
       config: {