consult -m claude bills metered Opus API instead of the Claude subscription (ANTHROPIC_API_KEY shadows CLAUDE_CODE_OAUTH_TOKEN)

[waleedkadous]

BUGFIX. consult -m claude runs CMAP/review traffic on the metered Opus API instead of the Claude subscription, because it forwards ANTHROPIC_API_KEY into the Agent SDK env, which shadows CLAUDE_CODE_OAUTH_TOKEN in the SDK's auth priority. Reported by a downstream Codev adopter (~$150/day on their org key on a heavy dev day).

Root cause (verified in source on current main)

packages/codev/src/commands/consult/index.ts, the claude path:

• Lines ~504-509 build the env passed to claudeQuery by copying all of process.env — which includes ANTHROPIC_API_KEY (and ANTHROPIC_AUTH_TOKEN) when present in the architect's environment.
• The Agent SDK prioritizes ANTHROPIC_API_KEY over CLAUDE_CODE_OAUTH_TOKEN, so the subprocess authenticates as a metered API key rather than the subscription/OAuth token.
• the reporter verified: with ANTHROPIC_API_KEY + CLAUDECODE unset, an OAuth subscription token authenticates the Agent SDK fine.
• Adjacent (NOT the focus): line ~519 hardcodes model: 'claude-opus-4-6'. Note it, but keep this fix to the auth issue unless trivial.

Prescribed fix (scoped to consult's claude subprocess ONLY)

• When CLAUDE_CODE_OAUTH_TOKEN is set, delete ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN from the local env object built at ~504 before passing it to claudeQuery — NOT from global process.env. Other callers that need the API key (persona, dev:local) are unaffected because the deletion is scoped to consult's subprocess env.
• When CLAUDE_CODE_OAUTH_TOKEN is NOT set, leave behavior unchanged (fall back to the API key) — so CI / key-only environments still work.
• Regression test: with CLAUDE_CODE_OAUTH_TOKEN set, the env passed to claudeQuery must NOT contain ANTHROPIC_API_KEY/ANTHROPIC_AUTH_TOKEN; with it unset, the key is preserved.

Effect & caveat

• CMAP/review traffic runs on the Claude subscription instead of metered Opus API — material saving (~$150/day reported on a heavy day).
• Caveat (document, do not block): dedicated Agent-SDK subscription credit starts 2026-06-15; before then, subscription auth draws from the interactive Max quota. Worth a note in the consult docs, but it doesn't change the fix.

Scope

Isolated change in consult/index.ts (claude-path env) + a regression test. area/consult. Distinct from the agy/Gemini auth work (#778) — this is the Claude lane. Reported by a downstream Codev adopter; full change spec available from them on request.

[waleedkadous]

On it! Working on a fix now.