fix: apply managed Claude auth to Agent Teams (#21356)

* fix: apply managed Claude auth to agent teams

* test: update agent teams auth launch expectation

* refactor: derive agent teams auth deletions

src/main/runtime/orca-runtime-resolve-terminal-split-source-authority.ts

@@ -14,6 +14,7 @@ import {
   ensureClaudeAgentTeamsShimDir,
   resolveClaudeAgentTeamsShimBin
 } from './claude-agent-teams-shim-env'
+import { applyClaudeEnvPatch } from '../claude-accounts/environment'
 
 export class OrcaRuntimeWithResolveTerminalSplitSourceAuthority extends OrcaRuntimeWithSplitPtyBackedTerminal {
   protected resolveTerminalSplitSourceAuthority(
@@ -109,6 +110,7 @@ export class OrcaRuntimeWithResolveTerminalSplitSourceAuthority extends OrcaRunt
   async prepareClaudeAgentTeamsLeader(args: {
     paneKey: string
     baseEnv?: Record<string, string>
+    prepareAuth?: boolean
   }): Promise<{ env: Record<string, string> }> {
     const handle = this.getTerminalHandleForPaneKey(args.paneKey)
     if (!handle) {
@@ -116,26 +118,38 @@ export class OrcaRuntimeWithResolveTerminalSplitSourceAuthority extends OrcaRunt
     }
     return await this.prepareClaudeAgentTeamsLeaderForHandle({
       handle,
-      baseEnv: args.baseEnv
+      baseEnv: args.baseEnv,
+      prepareAuth: args.prepareAuth
     })
   }
 
   async prepareClaudeAgentTeamsLeaderForHandle(args: {
     handle: string
     baseEnv?: Record<string, string>
-  }): Promise<{ env: Record<string, string> }> {
+    prepareAuth?: boolean
+  }): Promise<{ env: Record<string, string>; envToDelete?: string[] }> {
     const baseEnv = {
       ...process.env,
       ...args.baseEnv
     }
+    const inheritedEnvKeys = new Set(Object.keys(baseEnv))
+    const auth = args.prepareAuth && this.prepareClaudeAuth ? await this.prepareClaudeAuth() : null
+    if (auth) {
+      applyClaudeEnvPatch(baseEnv, auth.envPatch, { stripAuthEnv: auth.stripAuthEnv })
+    }
+    const envToDelete = auth?.stripAuthEnv
+      ? [...inheritedEnvKeys].filter((key) => !(key in baseEnv))
+      : undefined
     const shimDir = await ensureClaudeAgentTeamsShimDir()
     const shimBin = resolveClaudeAgentTeamsShimBin(baseEnv)
-    return this.claudeAgentTeams.createLaunchEnv({
+    const launch = this.claudeAgentTeams.createLaunchEnv({
       leaderHandle: args.handle,
       baseEnv,
       shimDir,
       shimBin
     })
+    const env = auth ? { ...auth.envPatch, ...launch.env } : launch.env
+    return envToDelete ? { env, envToDelete } : { env }
   }
 
   // Why: a leader handle that never binds to a PTY (lost pane race) has no exit

src/main/runtime/orca-runtime-state-fields.ts

@@ -3,6 +3,7 @@ import { OrcaRuntimeWithLinearCommands } from './orca-runtime-linear-commands'
 import type { RuntimeStore } from './runtime-store-contract'
 import type { StatsCollector } from '../stats/collector'
 import type { IPtyProvider } from '../providers/types'
+import type { PrepareClaudeAuth } from '../ipc/pty/host-env/types'
 import type { RuntimeTerminalAgentStatusEvent } from './runtime-terminal-contracts'
 import type { TerminalSideEffectBatch } from '../../shared/terminal-side-effect-facts'
 import type { AgentStatusIpcPayload } from '../../shared/agent-status-types'
@@ -41,12 +42,15 @@ import { registerConptyDa1OverrideInstaller } from './terminal-model-query-autho
 import { registerTerminalViewAttributesApplier } from './terminal-view-attribute-store'
 
 export class OrcaRuntimeWithStateFields extends OrcaRuntimeWithLinearCommands {
+  protected readonly prepareClaudeAuth?: PrepareClaudeAuth
+
   constructor(
     store: RuntimeStore | null = null,
     stats?: StatsCollector,
     deps?: {
       getLocalProvider?: () => IPtyProvider
       getSshProvider?: (connectionId: string) => IPtyProvider | undefined
+      prepareClaudeAuth?: PrepareClaudeAuth
       onPtyStopped?: (ptyId: string) => void
       onTerminalAgentStatus?: (event: RuntimeTerminalAgentStatusEvent) => void
       onTerminalSideEffects?: (batch: TerminalSideEffectBatch) => void
@@ -103,6 +107,7 @@ export class OrcaRuntimeWithStateFields extends OrcaRuntimeWithLinearCommands {
   ) {
     super()
     this.store = store
+    this.prepareClaudeAuth = deps?.prepareClaudeAuth
     store?.onSettingsChanged?.((updates) => {
       if ('experimentalStructuredNativeChat' in updates) {
         this.notifyMobileSessionTabsChanged()

src/main/runtime/rpc/methods/terminal/terminal-lifecycle-methods.ts

@@ -189,7 +189,8 @@ export const TERMINAL_LIFECYCLE_METHODS = [
     handler: async (params, { runtime }) => ({
       launch: await runtime.prepareClaudeAgentTeamsLeader({
         paneKey: params.paneKey,
-        baseEnv: params.env
+        baseEnv: params.env,
+        prepareAuth: params.prepareAuth
       })
     })
   })