[Bug] Claude Code injects GITHUB_TOKEN PAT into Bash environment, conflicting with gh CLI OAuth token

Bug Description
Title: Claude Code injects GITHUB_TOKEN (ghp_ PAT) into Bash tool environment, conflicting with gh CLI

Describe the bug:
Claude Code injects a GITHUB_TOKEN environment variable (a ghp_ Personal Access Token) into every Bash tool shell. This overrides the gh CLI's own OAuth token (gho_)
stored in macOS Keychain via gh auth login, causing gh commands to fail or behave incorrectly.

Steps to reproduce:

1. Authenticate gh CLI via gh auth login (OAuth, stored in keychain)
2. Ask Claude Code to run any gh command
3. Claude Code's Bash shell has GITHUB_TOKEN=[REDACTED] set, which gh prioritizes over keychain

Investigation findings:

• GITHUB_TOKEN is NOT set in user's shell dotfiles (.zshrc, .zshenv, etc.)
• NOT set via launchctl
• NOT present in Claude Code's shell snapshot files (~/.claude/shell-snapshots/)
• The token is injected at the Node.js process level by Claude Code's runtime itself

Expected behavior: GITHUB_TOKEN should not be injected, or gh CLI invocations should unset it automatically.

Workaround: Prefix every gh command with unset GITHUB_TOKEN &&

Platform: macOS (darwin 25.3.0), Claude Code, gh CLI with keyring auth

Environment Info

• Platform: darwin
• Terminal: iTerm.app
• Version: 2.1.70
• Feedback ID: 45cb5408-65a4-4cd4-8bb2-87fc553e8c13

Errors

[{"error":"Error\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:79:11035)\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:83:10177)\n    at emitError (node:events:43:23)\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:82:3470)\n    at emitError (node:events:43:23)\n    at <anonymous> (node:_http_client:253:22)\n    at processTicksAndRejections (native:7:39)\n    at request (/$bunfs/root/src/entrypoints/cli.js:85:2149)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-06T15:14:35.696Z"},{"error":"Error\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:79:11035)\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:83:10177)\n    at emitError (node:events:43:23)\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:82:3470)\n    at emitError (node:events:43:23)\n    at <anonymous> (node:_http_client:253:22)\n    at processTicksAndRejections (native:7:39)\n    at request (/$bunfs/root/src/entrypoints/cli.js:85:2149)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-06T15:15:29.750Z"},{"error":"Error\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:79:11035)\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:83:10177)\n    at emitError (node:events:43:23)\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:82:3470)\n    at emitError (node:events:43:23)\n    at <anonymous> (node:_http_client:253:22)\n    at processTicksAndRejections (native:7:39)\n    at request (/$bunfs/root/src/entrypoints/cli.js:85:2149)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-06T15:17:04.188Z"},{"error":"Error\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:79:11035)\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:83:10177)\n    at emitError (node:events:43:23)\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:82:3470)\n    at emitError (node:events:43:23)\n    at <anonymous> (node:_http_client:253:22)\n    at processTicksAndRejections (native:7:39)\n    at request (/$bunfs/root/src/entrypoints/cli.js:85:2149)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-06T15:17:20.141Z"},{"error":"Error\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:79:11035)\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:83:10177)\n    at emitError (node:events:43:23)\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:82:3470)\n    at emitError (node:events:43:23)\n    at <anonymous> (node:_http_client:253:22)\n    at processTicksAndRejections (native:7:39)\n    at request (/$bunfs/root/src/entrypoints/cli.js:85:2149)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-06T15:17:36.352Z"},{"error":"Error\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:79:11035)\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:83:10177)\n    at emitError (node:events:43:23)\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:82:3470)\n    at emitError (node:events:43:23)\n    at <anonymous> (node:_http_client:253:22)\n    at processTicksAndRejections (native:7:39)\n    at request (/$bunfs/root/src/entrypoints/cli.js:85:2149)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-06T15:18:20.900Z"},{"error":"Error\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:79:11035)\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.…

Note: Content was truncated.