{"record":{"id":"2730d5879108b1a4","repo":"stablyai/orca","slug":"this-claude-launch-defines-explicit-anthropic-auth","errorCode":null,"errorMessage":"This Claude launch defines explicit Anthropic auth environment variables. Remove those overrides before using a managed Claude account.","messagePattern":"This Claude launch defines explicit Anthropic auth environment variables\\. Remove those overrides before using a managed Claude account\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/main/ipc/pty.ts","lineNumber":4560,"sourceCode":"            providerSession: args.resumeProviderSession,\n            target: codexSelectionTarget,\n            launchEnv: args.env,\n            workspacePath: cwd\n          })\n      const codexResumeLaunch = codexResumePreparation\n        ? await resolveCodexResumeLaunch(args.command, codexResumePreparation)\n        : noCodexResumeLaunch(preAdoptedStablePane ? undefined : args.command)\n      const codexResumeHome = codexResumeLaunch.codexResumeHome\n      // Why: the drop still applies here, but this controller's result has no field for\n      // notifyResumeUnavailable — runtime/relay panes start fresh without the notice.\n      const launchCommand = codexResumeLaunch.command\n      const claudeAuth =\n        isClaudeLaunch && prepareClaudeAuth ? await prepareClaudeAuth(codexSelectionTarget) : null\n      if (isClaudeLaunch && isClaudeAuthSwitchInProgress()) {\n        throw new Error('A Claude account switch is in progress. Try again after it finishes.')\n      }\n      if (claudeAuth?.stripAuthEnv && hasClaudeAuthEnvConflict(args.env)) {\n        throw new Error(\n          'This Claude launch defines explicit Anthropic auth environment variables. Remove those overrides before using a managed Claude account.'\n        )\n      }\n\n      const shouldPersistHostSessionBinding = args.persistHostSessionBinding === true\n      let hostSessionBinding: {\n        store: NonNullable<typeof store>\n        worktreeId: string\n        tabId: string\n        leafId: string\n        expectedSourceBinding?: PtyBindingSourceExpectation\n      } | null = null\n      if (shouldPersistHostSessionBinding) {\n        if (\n          !store ||\n          typeof args.worktreeId !== 'string' ||\n          typeof args.tabId !== 'string' ||\n          !isValidTerminalTabId(args.tabId) ||","sourceCodeStart":4542,"sourceCodeEnd":4578,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/src/main/ipc/pty.ts#L4542-L4578","documentation":"Thrown when claudeAuth.stripAuthEnv is true (managed Claude account in use, which needs to remove ambient Anthropic env) AND hasClaudeAuthEnvConflict(args.env) is true. The conflict list per environment.ts: ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, CLAUDE_CODE_OAUTH_TOKEN, AWS_BEARER_TOKEN_BEDROCK, or an ANTHROPIC_CUSTOM_HEADERS value matching /authorization|x-api-key|api-key|bearer/i. Refusing the launch prevents a managed account from being silently overridden by user-supplied credentials.","triggerScenarios":"Spawning a Claude launch with env containing one of CLAUDE_AUTH_ENV_VARS (or auth-like custom headers) while a managed Claude account is selected. prepareClaudeAuth returned stripAuthEnv:true, so the launch is being routed through managed credentials that the explicit env would override.","commonSituations":"User has ANTHROPIC_API_KEY set in shell profile (.zshrc/.bashrc) and selects a managed Claude account; workspace .env with ANTHROPIC_AUTH_TOKEN loaded into the terminal env; AWS_BEARER_TOKEN_BEDROCK from a Bedrock config; ANTHROPIC_CUSTOM_HEADERS carrying a bearer token.","solutions":["Remove the Anthropic auth env vars (ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, CLAUDE_CODE_OAUTH_TOKEN, AWS_BEARER_TOKEN_BEDROCK) from the launch env or shell profile, then retry.","Strip auth-like values from ANTHROPIC_CUSTOM_HEADERS (no 'authorization', 'x-api-key', 'api-key', or 'bearer' tokens).","Switch the launch to an unmanaged account so the explicit env is honored instead of conflicting with managed credentials.","Use the terminal's env override UI to unset the conflicting keys for this pane only."],"exampleFix":"// before — ambient env conflicts with managed Claude account\nconst env = {\n  ...process.env,\n  ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY // inherited from .zshrc\n}\nawait spawnPty({ command: 'claude', env })\n\n// after — drop the conflicting vars before a managed launch\nimport { CLAUDE_AUTH_ENV_VARS } from '../claude-accounts/environment'\nconst env = { ...process.env }\nfor (const key of CLAUDE_AUTH_ENV_VARS) delete env[key]\ndelete env.ANTHROPIC_CUSTOM_HEADERS\nawait spawnPty({ command: 'claude', env })","handlingStrategy":"validation","validationCode":"import { CLAUDE_AUTH_ENV_VARS, hasClaudeAuthEnvConflict } from '../claude-accounts/environment'\n\nfunction stripClaudeAuthEnvForManagedLaunch(env: Record<string, string>): Record<string, string> {\n  if (!hasClaudeAuthEnvConflict(env)) return env\n  const next = { ...env }\n  for (const key of CLAUDE_AUTH_ENV_VARS) delete next[key]\n  delete next.ANTHROPIC_CUSTOM_HEADERS\n  return next\n}","typeGuard":"function isClaudeAuthEnvConflict(err: unknown): boolean {\n  return (\n    err instanceof Error &&\n    err.message === 'This Claude launch defines explicit Anthropic auth environment variables. Remove those overrides before using a managed Claude account.'\n  )\n}","tryCatchPattern":"try {\n  await spawnPty(args)\n} catch (err) {\n  if (isClaudeAuthEnvConflict(err)) {\n    surfaceUserAction('Remove ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN / CLAUDE_CODE_OAUTH_TOKEN / AWS_BEARER_TOKEN_BEDROCK and auth-like ANTHROPIC_CUSTOM_HEADERS from the pane env, then retry.')\n    return\n  }\n  throw err\n}","preventionTips":["Do not set ANTHROPIC_API_KEY/ANTHROPIC_AUTH_TOKEN/CLAUDE_CODE_OAUTH_TOKEN/AWS_BEARER_TOKEN_BEDROCK in shell profiles when using a managed Claude account.","Audit workspace .env files for Anthropic auth keys before enabling a managed account.","Strip auth-like ANTHROPIC_CUSTOM_HEADERS (anything matching authorization|x-api-key|api-key|bearer) when routing through managed credentials."],"tags":["claude","auth","env-conflict","managed-account","anthropic","validation"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}