fix(claude): keep a connected target's admission token out of subscription stripping

The carried subscription fix resolves auth mode before adding proxy-owned
credentials, which is right for an ordinary launch. A connected launch is not
one: the caller already named a hub and supplied the client admission token for
it, so a machine whose own environment reads as a Claude subscription would
strip the very credential the launch was constructed with.

Gate the subscription strip on the absence of an explicit target, and add the
regression.

Author: jun

src/cli/claude.ts

@@ -213,7 +213,12 @@ export function buildClaudeEnv(
     env: () => env as NodeJS.ProcessEnv,
     ownTokens,
   }));
-  if (resolved.markerMode === "subscription") {
+  // An explicit connected target is not a subscription launch. The caller named a hub and
+  // handed us the client admission token for it, so auth-mode detection - which reads the
+  // local environment - has no bearing on whether that token belongs in the child env.
+  // Without this, a machine whose environment reads as subscription strips the very
+  // credential the connected launch was constructed with (#3148 carry).
+  if (resolved.markerMode === "subscription" && !explicitTarget) {
     // A prior system-env snapshot may have left our admission key in the inherited
     // environment. It belongs to the proxy data plane, not Claude subscription OAuth.
     const token = env.ANTHROPIC_AUTH_TOKEN?.trim();

tests/claude-cli.test.ts

@@ -37,6 +37,19 @@ describe("ocx claude env assembly", () => {
     expect(env.CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST).toBe("1");
   });
 
+  test("a connected target keeps its admission token even when the local env reads as subscription", () => {
+    // #3148 resolves the auth mode before adding proxy-owned credentials, which is right for
+    // an ordinary launch. A connected launch is different: the caller already named a hub and
+    // supplied the client admission token for it, so a machine whose own environment looks
+    // like a Claude subscription must not strip the credential the launch was built with.
+    const env = buildClaudeEnv(cfg(), {
+      baseUrl: "https://hub.example.test",
+      admissionToken: "ocx_data_connected",
+    }, {}, {}, { mode: "subscription", origin: "explicit" });
+    expect(env.ANTHROPIC_BASE_URL).toBe("https://hub.example.test");
+    expect(env.ANTHROPIC_AUTH_TOKEN).toBe("ocx_data_connected");
+  });
+
   test("user-owned connected destination wins and cannot receive the hub token", () => {
     const env = buildClaudeEnv(cfg(), {
       baseUrl: "https://hub.example.test",