When managedByHostFlag is true (i.e., CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST is explicitly set), auth-related settings such as apiKeyHelper and awsAuthRefresh are now stripped from the configuration overlay that the host applies. Previously only a narrower set of settings was filtered. This prevents host-controlled auth helpers from being inadvertently overridden by project or user-level settings when the host is fully managing the provider.
Evidence
additional continue branch in the settings-filter loop that skips xF7-listed keys when Lb$.managedByHostFlag is true (search for "managedByHostFlag")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.