In remote/CCR environments, OAuth tokens and API keys are now persisted to well-known file paths (/home/claude/.claude/remote/.oauth_token, /home/claude/.claude/remote/.api_key) so that subprocesses can access credentials without inheriting file descriptors.
Evidence
Remote credential paths (search for "/.oauth_token") and persistence function (search for "Failed to persist")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
