[Bug]: stale loopback proxy credentials survive the ocx claude base-URL rewrite #3004

Client or integration

Claude Code

Area

CLI

Summary

buildClaudeEnv rewrites a stale loopback ANTHROPIC_BASE_URL to the current launch port but does not re-evaluate the Anthropic credential slots that were paired with the destination it just replaced.

The launcher already knows that a loopback ANTHROPIC_BASE_URL on a different port belongs to a previous opencodex launch: that is exactly the condition it logs and overwrites in src/cli/claude.ts (the Replacing stale opencodex ANTHROPIC_BASE_URL branch). An ANTHROPIC_AUTH_TOKEN inherited alongside it was minted by that other proxy, and after the rewrite it is carried into the new launch unchanged.

Two consequences, both on the subscription path:

1. The token is not valid admission for this proxy. When the previous proxy required an admission key and this one does not, the launch is not merely mis-authenticated, it is silently pushed out of subscription mode.
2. setDefault preserves any non-empty value, so this proxy's own configured key is never injected. hostOwnsAuthentication then evaluates against a foreign token, so CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST is decided on stale evidence.

The subscription-preserving default immediately below the rewrite is explicit that setting ANTHROPIC_AUTH_TOKEN "disables claude.ai connectors and overrides the user's Claude login". A stale token reaching the child does precisely that: Claude Code authenticates as a host-managed provider instead of using the caller's own claude.ai OAuth, so native claude models no longer pass through with the caller's credential (wantsNativePassthrough in src/server/claude-messages.ts requires an sk-ant- credential on the request).

The existing PROXY_MARKER cleanup at the top of buildClaudeEnv and the inheritedTokenIsOurs check below both handle other shapes of this problem, which is why this specific pairing has stayed open: neither is keyed on the destination rewrite.

A genuine user sk-ant- credential must keep surviving the rewrite, because that is the credential native passthrough authenticates with.

Reproduction

1. Start a proxy on port 19999 that requires an admission key, and launch ocx claude from it so the environment carries ANTHROPIC_BASE_URL=http://127.0.0.1:19999 plus that proxy's ANTHROPIC_AUTH_TOKEN.
2. From the same shell, start a second proxy on 10100 with no apiKeys configured and run ocx claude.
3. The launcher prints Replacing stale opencodex ANTHROPIC_BASE_URL http://127.0.0.1:19999 with http://127.0.0.1:10100.
4. Inspect the spawned environment: ANTHROPIC_AUTH_TOKEN still holds the 19999 proxy's key, even though this launch requires no admission key and should have stayed token-free in subscription mode.

Expected: credentials recognized as opencodex admission material are dropped when their paired destination is replaced, so the launch either injects this proxy's own key or stays token-free.

Version

2.36.0

Operating system

macOS 15.5 (platform-independent, env assembly only)

Provider and model

anthropic / claude-opus-5 (subscription OAuth path)

Logs or error output

Replacing stale opencodex ANTHROPIC_BASE_URL http://127.0.0.1:19999 with http://127.0.0.1:10100.

Screenshots and supporting files

No response

Redacted configuration

{
  "port": 10100,
  "apiKeys": []
}