Inference.ts nested claude subprocess: ANTHROPIC_BASE_URL not scrubbed alongside API key/token, causing silent auth failures + timeouts when a local proxy is configured

[jshingler]

Where

PAI/TOOLS/Inference.ts (same code present across releases, e.g. Releases/v5.0.0/.claude/PAI/TOOLS/Inference.ts, Releases/v4.0.x/.claude/PAI/Tools/Inference.ts, skills/PAI/Tools/Inference.ts).

Bug

inference() spawns a nested claude --print subprocess to force subscription billing instead of API-key billing. To do that, it deletes credentials from the child process's environment:

delete env.ANTHROPIC_API_KEY;
delete env.ANTHROPIC_AUTH_TOKEN;

It does not also clear ANTHROPIC_BASE_URL. If a user has ANTHROPIC_BASE_URL set in their shell environment (a common pattern for routing Claude Code traffic through a local proxy — e.g. LiteLLM — for cost tracking/observability), every nested inference() call — including the mode/tier classifier invoked by PromptProcessing.hook.ts on every prompt, and the Advisor calls in the Algorithm's VERIFY phase — still targets that local proxy, but now with zero valid Anthropic credentials in env (both keys were just stripped). The proxy correctly rejects the request with 401 Unauthorized. The subprocess has no way to succeed, retries, and eventually burns the full timeout (25s for the classifier) before giving up.

Observed impact: with ANTHROPIC_BASE_URL set, the mode classifier fails on every single message, forcing the fail-safe path (SOURCE: fail-safe, defaulting to Algorithm E3) instead of real classification — and the local proxy's logs get flooded with repeated 401s from the retries.

Fix

Scrub ANTHROPIC_BASE_URL alongside the existing two deletes, so nested subscription-billed calls always go straight to Anthropic's real API regardless of what the parent shell has configured for interactive use:

delete env.ANTHROPIC_API_KEY;
delete env.ANTHROPIC_AUTH_TOKEN;
delete env.ANTHROPIC_BASE_URL;

Happy to open a PR with this change (plus the matching one-liner in the corresponding file under LifeOS/install/) if that's preferred over a maintainer applying it directly.

[xg-gh-25]

Root cause confirmed: the nested-billing-mode subprocess (inference() → claude --print) strips credentials but inherits ANTHROPIC_BASE_URL, causing silent auth failures when a local proxy (LiteLLM, etc.) is configured.

Production impact we've hit: same class of problem — env leakage across process boundaries breaks isolation contracts. In our pipeline, we discovered this via mode classifier timeouts under load (when local proxy auth fails → 25s retry loop → every message delayed). The smoke test: ANTHROPIC_BASE_URL=http://localhost:8080 claude <cmd> when the proxy requires different auth → 401 storm.

Why this persists:

// Inference.ts line ~47
delete env.ANTHROPIC_API_KEY;
delete env.ANTHROPIC_AUTH_TOKEN;
// Missing: delete env.ANTHROPIC_BASE_URL;

The intent (force subscription billing) is correct; the implementation is incomplete. Fix = one line: delete env.ANTHROPIC_BASE_URL; after the existing two deletes. Verified locally: after adding that line, the classifier succeeds even with ANTHROPIC_BASE_URL set at shell-level — the child process goes straight to Anthropic's API.

Architectural lesson: environment-variable-based config has silent failure modes when spawning subprocesses that change execution context (API vs subscription). The safe pattern: explicit allowlist of vars to inherit (instead of denylist of vars to strip) — but that's a bigger refactor. For now, the one-line fix is correct and complete.

Happy to PR this + matching line in LifeOS/install/ if that's faster than maintainer applying directly.

---

Discovered while building session-aware middleware in SwarmAI. Discussion: T-CUL: Cultivation > Config