Under the hood
No documentation found
Eval sandbox children get credentials via file descriptor, or a temp snapshot file on Windows, rather than env vars.
Eval sandbox subprocesses now receive OAuth and gateway credentials through a new vf() helper instead of directly via environment variables. On non-Windows this uses CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR (or the gateway equivalent); on Windows it writes a snapshot.json under a claude-eval-auth- temp directory and points CLAUDE_BG_AUTH_SNAPSHOT_PATH at it. Stale snapshot directories older than 2 hours are cleaned up automatically on startup.
Names in the bundleCLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTORCLAUDE_BG_AUTH_SNAPSHOT_PATH