fix(execution): strip claudecode in remaining claude paths

- sanitize Copilot profile Claude launch environment

- sanitize auth create isolated instance launch environment

- sanitize doctor Claude CLI version check spawn environment

Refs #588

src/auth/commands/create-command.ts

@@ -7,7 +7,7 @@
 import { spawn, ChildProcess } from 'child_process';
 import { initUI, header, color, fail, warn, info, infoBox, warnBox } from '../../utils/ui';
 import { getClaudeCliInfo } from '../../utils/claude-detector';
-import { escapeShellArg } from '../../utils/shell-executor';
+import { escapeShellArg, stripClaudeCodeEnv } from '../../utils/shell-executor';
 import { isUnifiedMode } from '../../config/unified-config-loader';
 import { exitWithError } from '../../errors';
 import { ExitCode } from '../../errors/exit-codes';
@@ -82,6 +82,7 @@ export async function handleCreate(ctx: CommandContext, args: string[]): Promise
     }
 
     const { path: claudeCli, needsShell } = claudeInfo;
+    const childEnv = stripClaudeCodeEnv({ ...process.env, CLAUDE_CONFIG_DIR: instancePath });
 
     // Execute Claude in isolated instance (will auto-prompt for login if no credentials)
     // On Windows, .cmd/.bat/.ps1 files need shell: true to execute properly
@@ -92,13 +93,13 @@ export async function handleCreate(ctx: CommandContext, args: string[]): Promise
         stdio: 'inherit',
         windowsHide: true,
         shell: true,
-        env: { ...process.env, CLAUDE_CONFIG_DIR: instancePath },
+        env: childEnv,
       });
     } else {
       child = spawn(claudeCli, [], {
         stdio: 'inherit',
         windowsHide: true,
-        env: { ...process.env, CLAUDE_CONFIG_DIR: instancePath },
+        env: childEnv,
       });
     }
 

src/copilot/copilot-executor.ts

@@ -15,6 +15,7 @@ import { CopilotStatus } from './types';
 import { fail, info, ok } from '../utils/ui';
 import { getWebSearchHookEnv } from '../utils/websearch-manager';
 import { getImageAnalysisHookEnv } from '../utils/hooks';
+import { stripClaudeCodeEnv } from '../utils/shell-executor';
 
 /**
  * Get full copilot status (auth + daemon).
@@ -138,14 +139,14 @@ export async function executeCopilotProfile(
   // Merge with current environment (global env first, copilot overrides, then hook env vars)
   const webSearchEnv = getWebSearchHookEnv();
   const imageAnalysisEnv = getImageAnalysisHookEnv('copilot');
-  const env = {
+  const env = stripClaudeCodeEnv({
     ...process.env,
     ...globalEnv,
     ...copilotEnv,
     ...webSearchEnv,
     ...imageAnalysisEnv,
     CCS_PROFILE_TYPE: 'copilot',
-  };
+  });
 
   console.log(info(`Using GitHub Copilot proxy (model: ${config.model})`));
   console.log('');

src/management/checks/system-check.ts

@@ -5,7 +5,7 @@
 import * as fs from 'fs';
 import { spawn } from 'child_process';
 import { getClaudeCliInfo } from '../../utils/claude-detector';
-import { escapeShellArg } from '../../utils/shell-executor';
+import { escapeShellArg, stripClaudeCodeEnv } from '../../utils/shell-executor';
 import { ok, fail } from '../../utils/ui';
 import { HealthCheck, IHealthChecker, createSpinner } from './types';
 import { getCcsDir } from '../../utils/config-manager';
@@ -48,10 +48,12 @@ export class ClaudeCliChecker implements IHealthChecker {
               stdio: 'pipe',
               timeout: 5000,
               shell: true,
+              env: stripClaudeCodeEnv(process.env),
             })
           : spawn(claudeCli, ['--version'], {
               stdio: 'pipe',
               timeout: 5000,
+              env: stripClaudeCodeEnv(process.env),
             });
 
         let output = '';