Bridge-spawned child sessions no longer inherit your credential environment variables.
What's wrong with this entry?
Child processes started by the bridge now inherit an explicit allowlist of environment variables plus an explicit clear-list, and several credential carriers that used to be passed through are unset: OAuth and API-key file descriptors, the background auth snapshot path (CLAUDE_BG_AUTH_SNAPSHOT_PATH), account, org and email identifiers, the session ingress URL and the exit-after-stop delay.
- Lowercase duplicates of every cleared name are deleted too, so a lowercase shadow cannot smuggle a value through.
- Unconditional for bridge-spawned sessions.
CLAUDE_BG_AUTH_SNAPSHOT_PATH
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.247
Snapshot restore checks file mode, not just content
Both mention snapshot
-
v2.1.235
Remote settings can be primed from local storage instead of probing disk
Both mention path