Agent Viewer environment bleed: resume/fork inherits another session's ANTHROPIC_* provider env, silently changing /model aliases and saved default (2.1.168)

Environment

• Claude Code 2.1.168
• macOS
• Multiple concurrent sessions launched with differing ANTHROPIC_* provider configurations
• Agent Viewer used to switch between sessions

Summary

Visiting a session in Agent Viewer that uses different ANTHROPIC_* provider env (ANTHROPIC_BASE_URL, ANTHROPIC_CUSTOM_HEADERS, ANTHROPIC_DEFAULT_*_MODEL) appears to cause a resume/fork of another session to inherit the wrong provider environment — silently changing the /model aliases shown and the saved default model.

Repro steps

1. Have a session B already running, configured for a different provider via ANTHROPIC_BASE_URL + ANTHROPIC_CUSTOM_HEADERS + ANTHROPIC_DEFAULT_*_MODEL (a gateway/proxy presenting non-Anthropic aliases).
2. Launch session A with provider env vars explicitly unset (clean native-Anthropic launch), e.g. env -u ANTHROPIC_BASE_URL -u ANTHROPIC_CUSTOM_HEADERS -u ANTHROPIC_DEFAULT_*_MODEL claude.
3. Confirm /model in session A shows native Claude aliases (e.g. Opus 4.8).
4. From session A, open Agent Viewer, then navigate back to session A. (This round trip is the trigger — not the creation of session B, which already existed.)
5. Open /model in session A.

Expected behavior

• Session A continues to reflect only the environment it was originally launched with (clean / native aliases).
• Switching sessions in Agent Viewer has no effect on another session's provider, model aliases, or saved default.
• A resume/fork of session A preserves session A's original launch environment.

Actual behavior

• After visiting session B in the viewer and returning, session A's /model showed the other provider's aliases (GPT-style) and saved a non-native model as the default.
• A subprocess spawned from session A then showed the unrelated ANTHROPIC_* env vars present — vars session A was explicitly launched without.
• The parent Claude process for session A appeared to have been resumed/forked with --fork-session --resume, and the resumed process appeared to inherit the viewer/daemon/current process environment instead of session A's original clean launch environment.

Impact

• Silent provider switch. A session can be redirected to a different model provider without any user model action — just by navigating the viewer.
• Persisted wrong default. The incorrect alias was saved as the default, so the contamination outlives the session view.
• Trust/correctness risk. Users reasonably believe a session stays pinned to the provider/model it was launched with. Cross-session env bleed breaks that and could route prompts/data to an unintended provider/endpoint.
• Hard to detect. /model shows aliases without indicating their source, so a swapped provider looks like a normal model list.

Requested mitigations

1. Preserve the original launch environment on resume/fork. A resumed/forked session should restore the environment captured at original launch (including explicitly-unset vars), not inherit the viewer/daemon/current process env.
2. Isolate Agent Viewer sessions by session/provider. Add per-session (or per-provider) buckets so viewing one session cannot mutate another's environment or saved defaults.
3. Warn on provider-affecting env change across resume. If ANTHROPIC_BASE_URL / ANTHROPIC_CUSTOM_HEADERS / ANTHROPIC_DEFAULT_*_MODEL differ between the original launch and the resume/fork, surface a warning and require confirmation before adopting them or saving a default.
4. Show alias source in /model. Display where each alias comes from (native vs. ANTHROPIC_BASE_URL/gateway/ANTHROPIC_DEFAULT_*) and confirm the source before persisting a default.

User workarounds (soft → medium)

• Soft: Before relying on a session, open /model and confirm the aliases match what you launched with; re-set the default explicitly if it looks wrong.
• Soft: Avoid switching between sessions of different providers in Agent Viewer when one is mid-task.
• Medium: Run provider-distinct sessions in separate launches/terminals and avoid resume/fork across them; prefer a fresh claude launch over resume when provider env matters.
• Medium: Pin the provider explicitly at launch (set the ANTHROPIC_* vars you want rather than relying on unset) so a re-inherited environment is at least the intended one.

_Note: env var names only are referenced above — no values, headers, endpoints, or secrets are included._