Several cloud SDK environment variables that were previously not forwarded to spawned subagents are now included in the forwarded set.
Newly forwarded variables:
GCLOUD_PROJECT,GOOGLE_CLOUD_QUOTA_PROJECTGCE_METADATA_HOST,GCE_METADATA_IP,METADATA_SERVER_DETECTIONAWS_CONTAINER_CREDENTIALS_FULL_URI,AWS_CONTAINER_CREDENTIALS_RELATIVE_URIAWS_CONTAINER_AUTHORIZATION_TOKEN,AWS_CONTAINER_AUTHORIZATION_TOKEN_FILEAWS_EC2_METADATA_SERVICE_ENDPOINT,AWS_EC2_METADATA_SERVICE_ENDPOINT_MODEAWS_REGION,AWS_DEFAULT_REGION
This fixes authentication failures when subagents attempt to use EC2 instance profiles, ECS task roles, GCE metadata server credentials, or custom metadata endpoints.
Evidence
Environment forwarding list (search for "METADATA_SERVER_DETECTION" and "AWS_EC2_METADATA_SERVICE_ENDPOINT")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.