fix: apply managed Claude auth to Agent Teams (#21356)

* fix: apply managed Claude auth to agent teams

* test: update agent teams auth launch expectation

* refactor: derive agent teams auth deletions

src/cli/handlers/core.test.ts

@@ -130,4 +130,50 @@ describe('orca claude-teams CLI handler', () => {
       expect(spawnEnv.PATH).toBe('/shim:/usr/bin')
     }
   )
+
+  it.skipIf(isWindows)('removes managed auth variables before spawning Claude', async () => {
+    const previousApiKey = process.env.ANTHROPIC_API_KEY
+    process.env.ANTHROPIC_API_KEY = 'sk-ant-inherited'
+    callMock.mockResolvedValueOnce({
+      result: {
+        launch: {
+          env: {
+            CLAUDE_CONFIG_DIR: '/managed/claude',
+            CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS: '1'
+          },
+          envToDelete: ['ANTHROPIC_API_KEY']
+        }
+      }
+    })
+    try {
+      await runClaudeTeams()
+    } finally {
+      if (previousApiKey === undefined) {
+        delete process.env.ANTHROPIC_API_KEY
+      } else {
+        process.env.ANTHROPIC_API_KEY = previousApiKey
+      }
+    }
+
+    const spawnEnv = spawnMock.mock.calls.at(-1)?.[2].env as SpawnEnv
+    expect(spawnEnv.ANTHROPIC_API_KEY).toBeUndefined()
+    expect(spawnEnv.CLAUDE_CONFIG_DIR).toBe('/managed/claude')
+  })
+
+  it.skipIf(isWindows)('preserves API-key auth when no managed deletion is requested', async () => {
+    const previousApiKey = process.env.ANTHROPIC_API_KEY
+    process.env.ANTHROPIC_API_KEY = 'sk-ant-system'
+    try {
+      await runClaudeTeams()
+    } finally {
+      if (previousApiKey === undefined) {
+        delete process.env.ANTHROPIC_API_KEY
+      } else {
+        process.env.ANTHROPIC_API_KEY = previousApiKey
+      }
+    }
+
+    const spawnEnv = spawnMock.mock.calls.at(-1)?.[2].env as SpawnEnv
+    expect(spawnEnv.ANTHROPIC_API_KEY).toBe('sk-ant-system')
+  })
 })

src/cli/handlers/core.ts

@@ -73,16 +73,20 @@ export const CORE_HANDLERS: Record<string, CommandHandler> = {
         'orca claude-teams must be run inside an Orca terminal.'
       )
     }
-    const response = await client.call<{ launch: { env: Record<string, string> } }>(
-      'agentTeams.prepareLaunch',
-      {
-        paneKey,
-        env: envRecord()
-      }
-    )
+    const inheritedEnv = envRecord()
+    const response = await client.call<{
+      launch: { env: Record<string, string>; envToDelete?: string[] }
+    }>('agentTeams.prepareLaunch', {
+      paneKey,
+      env: inheritedEnv,
+      prepareAuth: true
+    })
+    for (const key of response.result.launch.envToDelete ?? []) {
+      delete inheritedEnv[key]
+    }
     process.exitCode = await runClaudeAgentTeams(
       {
-        ...envRecord(),
+        ...inheritedEnv,
         ...response.result.launch.env
       },
       rawArgs ?? []

src/cli/index-worktree-selector-resolution.test.ts

@@ -153,6 +153,7 @@ describe('orca cli worktree awareness', () => {
 
       expect(callMock).toHaveBeenCalledWith('agentTeams.prepareLaunch', {
         paneKey: 'tab-1:11111111-1111-4111-8111-111111111111',
+        prepareAuth: true,
         env: expect.objectContaining({
           ORCA_PANE_KEY: 'tab-1:11111111-1111-4111-8111-111111111111'
         })