A host program can take over refreshing your login token, off unless an env var is set.
OAuth refresh delegation installs only when CLAUDE_CODE_SDK_HAS_OAUTH_REFRESH is set and the entrypoint matches.
What's wrong with this entry?
Instead of refreshing the login token itself, the client can hand that job to the program embedding it. This is installed only when CLAUDE_CODE_SDK_HAS_OAUTH_REFRESH is set and CLAUDE_CODE_ENTRYPOINT names one of a fixed set of entry points, so it is off by default.
- Whether the bridge was installed is reported as
oauth_bridgein the session-started event.
CLAUDE_CODE_SDK_HAS_OAUTH_REFRESH
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.247
AWS auth refresh accepts a structured command
Both mention refresh auth