diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index 5e8a49ed..67f78f00 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -372,6 +372,18 @@ tasks.named<Javadoc>("javadoc") {
     (options as StandardJavadocDocletOptions).addStringOption("Xdoclint:none", "-quiet")
 }
 
+// The container image used for Claude eval sessions (see
+// ClaudeEvalContainer). Built on demand -- `./gradlew claudeEvalImage` --
+// against whatever `docker` context is active (Colima on macOS, a local or
+// remote daemon on Linux). Not wired into the regular build: it is a host
+// setup step, not a per-checkout artifact, and it needs a running daemon.
+tasks.register<Exec>("claudeEvalImage") {
+    group = "build"
+    description = "Builds the drydock-claude-eval Docker image for Claude eval sessions."
+    workingDir = file("src/main/docker/claude-eval")
+    commandLine("docker", "build", "-t", "drydock-claude-eval:latest", ".")
+}
+
 // Central Portal Publisher API transport + signing for the custom `drydock`
 // publication created above. Credentials come from Gradle properties / env
 // (ORG_GRADLE_PROJECT_mavenCentralUsername/Password) and the in-memory GPG key
diff --git a/app/src/main/docker/claude-eval/Dockerfile b/app/src/main/docker/claude-eval/Dockerfile
new file mode 100644
index 00000000..b586dd9d
--- /dev/null
+++ b/app/src/main/docker/claude-eval/Dockerfile
@@ -0,0 +1,32 @@
+# The container image used for Claude eval sessions (see
+# ClaudeEvalContainer). Runs Claude Code's native Linux build inside a
+# container so a seeded local settings file can carry the eval-specific
+# x-target-account header, which the host's managed settings (locked to
+# the highest precedence scope) forbid us from adding.
+#
+# Build on demand:  ./gradlew claudeEvalImage
+# (uses whatever `docker` context is active -- Colima on macOS, a local or
+# remote daemon on Linux).
+
+FROM debian:bookworm-slim
+
+# git: Claude's own Bash tool calls `git`; the worktree's .git points back
+#       into the main repo object store, both mounted from the host.
+# curl + ca-certificates: the native installer downloads over HTTPS.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates curl git \
+    && rm -rf /var/lib/apt/lists/*
+
+# Claude Code native build. The install script places the launcher at
+# ~/.local/bin/claude and the versioned binary under ~/.local/share/claude.
+# Runs as root in this image, so HOME=/root.
+RUN curl -fsSL https://claude.ai/install.sh | bash
+
+ENV PATH="/root/.local/bin:${PATH}"
+
+# The inner `claude ...` command arrives as an entrypoint script mounted from
+# the host (ClaudeEvalContainer.wrap writes it into the config-dir mount).
+# This image's ENTRYPOINT is `sh`, so `docker run <img> <script>` becomes
+# `sh <script>` -- the launcher MUST NOT prepend an extra `sh`, or it would
+# be `sh sh <script>` and fail with "cannot open sh".
+ENTRYPOINT ["sh"]
diff --git a/app/src/main/java/app/drydock/agent/api/AgentRegistry.java b/app/src/main/java/app/drydock/agent/api/AgentRegistry.java
index 9dc4f1cc..3b3516ab 100644
--- a/app/src/main/java/app/drydock/agent/api/AgentRegistry.java
+++ b/app/src/main/java/app/drydock/agent/api/AgentRegistry.java
@@ -4,6 +4,7 @@
 
 import java.lang.System.Logger;
 import java.lang.System.Logger.Level;
+import java.time.Instant;
 import java.util.ArrayList;
 import java.util.EnumMap;
 import java.util.List;
@@ -141,6 +142,15 @@ public boolean evalAvailable(AgentKind kind) {
         return provider(kind).map(AgentProvider::evalAvailable).orElse(false);
     }
 
+    /**
+     * When the eval session's auth token expires, for display only. Delegates
+     * to the provider; safe to read on the FX thread (it reads an in-memory
+     * snapshot, no I/O).
+     */
+    public Optional<Instant> evalTokenExpiry(AgentKind kind, String sessionKey) {
+        return provider(kind).flatMap(p -> p.evalTokenExpiry(sessionKey));
+    }
+
     /**
      * Whether {@code kind}'s provider reports remote-session support, per
      * {@link app.drydock.agent.spi.AgentProvider#supportsRemote()}. Cached
diff --git a/app/src/main/java/app/drydock/agent/api/EvalTokenResolver.java b/app/src/main/java/app/drydock/agent/api/EvalTokenResolver.java
new file mode 100644
index 00000000..67071fae
--- /dev/null
+++ b/app/src/main/java/app/drydock/agent/api/EvalTokenResolver.java
@@ -0,0 +1,38 @@
+package app.drydock.agent.api;
+
+import java.time.Instant;
+import java.util.Optional;
+
+/**
+ * Resolves an auth token for the eval account, plus its expiry when
+ * knowable. The token charges a session's model traffic to the eval
+ * account instead of the user's.
+ *
+ * <p>This is an SPI rather than a hardcoded command so the resolution
+ * mechanism is swappable: the default implementation runs a host-side
+ * credential helper ({@code ddtool}), but once Drydock grows plugin
+ * support a provider-specific plugin can supply this so the eval
+ * integration is not bound to a single credential source.</p>
+ *
+ * <p>Implementations may block (process spawn, network) and MUST be called
+ * off the JavaFX application thread. {@link #resolveToken()} is repeatable:
+ * a long-running eval session may outlive the first token's TTL, so callers
+ * re-invoke this to refresh (e.g. on resume).</p>
+ */
+public interface EvalTokenResolver {
+
+    /** A resolved auth token and, when the credential carries it, the instant it expires. */
+    record ResolvedToken(String token, Optional<Instant> expiry) {
+        public ResolvedToken {
+            java.util.Objects.requireNonNull(token, "token");
+            java.util.Objects.requireNonNull(expiry, "expiry");
+        }
+    }
+
+    /**
+     * Resolves a fresh token. Empty when the credential is unavailable
+     * (helper missing, refused, malformed): the caller fails the launch
+     * loudly rather than silently shipping an unauthenticated session.
+     */
+    Optional<ResolvedToken> resolveToken();
+}
diff --git a/app/src/main/java/app/drydock/agent/providers/claude/ClaudeAgentProvider.java b/app/src/main/java/app/drydock/agent/providers/claude/ClaudeAgentProvider.java
index 564c2196..403bd924 100644
--- a/app/src/main/java/app/drydock/agent/providers/claude/ClaudeAgentProvider.java
+++ b/app/src/main/java/app/drydock/agent/providers/claude/ClaudeAgentProvider.java
@@ -16,13 +16,16 @@
 import app.drydock.agent.spi.AgentProvider;
 import app.drydock.agent.providers.claude.internal.ClaudeCapabilities;
 import app.drydock.agent.providers.claude.internal.ClaudeCapabilityService;
-import app.drydock.agent.providers.claude.internal.ClaudeEvalProxy;
+import app.drydock.agent.providers.claude.internal.ClaudeEvalContainer;
+import app.drydock.agent.providers.claude.internal.ClaudeEvalContainer.EvalSetup;
 import app.drydock.agent.providers.claude.internal.ClaudeExecutableLocator;
 import app.drydock.agent.providers.claude.internal.ClaudeHookInstaller;
 import app.drydock.agent.providers.claude.internal.ConversationCatalog;
 import app.drydock.process.SshCommandBuilder;
 
+import java.io.IOException;
 import java.nio.file.Path;
+import java.time.Instant;
 import java.util.Optional;
 
 /**
@@ -40,18 +43,27 @@ public final class ClaudeAgentProvider implements AgentProvider {
     private ClaudeCapabilityService capabilityService;
     private ClaudeConversationSource conversationSource;
     private ClaudeActivityReporter activityReporter;
-    private final ClaudeEvalProxy evalProxy = new ClaudeEvalProxy();
+    /** The eval container; a test stub from the constructor, or the real one built at {@link #init}. */
+    private ClaudeEvalContainer evalContainer;
+    /** The activity state-word dir, needed to mount it into the eval container. Set at {@link #init}. */
+    private Path activityDirectory;
     /** Set once by the background probe at {@link #init}; read by {@link #evalAvailable()} on the FX thread. */
     private volatile boolean evalAvailable;
 
     /** Public no-arg constructor required by {@link java.util.ServiceLoader}. */
     public ClaudeAgentProvider() {
-        this(new ClaudeExecutableLocator());
+        this(new ClaudeExecutableLocator(), null);
     }
 
     /** For tests: inject a locator (e.g. a nonexistent path to force conservative caps). */
     public ClaudeAgentProvider(ClaudeExecutableLocator locator) {
+        this(locator, null);
+    }
+
+    /** For tests: inject the eval container (e.g. a stub that reports unavailable). */
+    public ClaudeAgentProvider(ClaudeExecutableLocator locator, ClaudeEvalContainer evalContainer) {
         this.locator = locator;
+        this.evalContainer = evalContainer;
     }
 
     @Override
@@ -69,11 +81,11 @@ public void init(AgentContext ctx) {
         this.capabilityService = new ClaudeCapabilityService(locator, ctx.backgroundExecutor());
         this.conversationSource = new ClaudeConversationSource(new ConversationCatalog());
         this.activityReporter = new ClaudeActivityReporter(new ClaudeHookInstaller(ctx.stateDirectory()));
-        // Probe omlx_proxy off the FX thread; the result is cached so the
-        // UI's evalAvailable() read never blocks. omlx_proxy may start later
-        // than drydock -- re-probe on the next launch via markEvalSession's
-        // own probe is not done; restart drydock if the proxy comes up after.
-        ctx.backgroundExecutor().execute(() -> evalAvailable = evalProxy.probe());
+        this.activityDirectory = ctx.activityDirectory();
+        if (evalContainer == null) {
+            evalContainer = new ClaudeEvalContainer(ctx.stateDirectory());
+        }
+        ctx.backgroundExecutor().execute(() -> evalAvailable = evalContainer.probe());
     }
 
     @Override
@@ -125,6 +137,12 @@ public LaunchPlan buildCreateCommand(CreateContext c) {
         }
         command.append(activitySettingsFlag(caps));
         command.append(mcpConfigFlag(caps, c.mcp().flatMap(McpAccess::credentialFile)));
+        if (c.evalMode()) {
+            return LaunchPlan.of(
+                    wrapEval(command.toString(), c.sessionId(), c.workingDirectory(),
+                            c.mcp().flatMap(McpAccess::credentialFile)),
+                    sessionIdUsed);
+        }
         return LaunchPlan.of(command.toString(), sessionIdUsed);
     }
 
@@ -141,13 +159,24 @@ public LaunchPlan buildResumeCommand(ResumeContext r) {
         }
         ClaudeCapabilities caps = detectCaps();
         String suffix = activitySettingsFlag(caps) + mcpConfigFlag(caps, r.mcp().flatMap(McpAccess::credentialFile));
+        String inner;
         if (r.agentSessionId().isPresent()) {
-            return LaunchPlan.of(ENV_CLEANUP_PREFIX + "claude --resume " + AgentCommands.shellQuote(r.agentSessionId().get()) + suffix, false);
+            inner = ENV_CLEANUP_PREFIX + "claude --resume " + AgentCommands.shellQuote(r.agentSessionId().get()) + suffix;
+        } else if (r.agentSessionName().isPresent()) {
+            inner = ENV_CLEANUP_PREFIX + "claude --resume " + AgentCommands.shellQuote(r.agentSessionName().get()) + suffix;
+        } else {
+            inner = ENV_CLEANUP_PREFIX + "claude --resume" + suffix;
         }
-        if (r.agentSessionName().isPresent()) {
-            return LaunchPlan.of(ENV_CLEANUP_PREFIX + "claude --resume " + AgentCommands.shellQuote(r.agentSessionName().get()) + suffix, false);
+        if (r.evalMode()) {
+            // Resume key is the agent session id; for PRESET it equals the
+            // --session-id drydock minted at create, so the seeded config
+            // dir (keyed by it) persists across resumes and mark() refreshes
+            // the token.
+            String key = r.agentSessionId().orElse("");
+            return LaunchPlan.of(wrapEval(inner, key, r.workingDirectory(),
+                    r.mcp().flatMap(McpAccess::credentialFile)), false);
         }
-        return LaunchPlan.of(ENV_CLEANUP_PREFIX + "claude --resume" + suffix, false);
+        return LaunchPlan.of(inner, false);
     }
 
     @Override
@@ -177,12 +206,17 @@ public boolean evalAvailable() {
 
     @Override
     public void markEvalSession(String sessionKey) {
-        evalProxy.mark(sessionKey);
+        evalContainer.mark(sessionKey);
     }
 
     @Override
     public void unmarkEvalSession(String sessionKey) {
-        evalProxy.unmark(sessionKey);
+        evalContainer.unmark(sessionKey);
+    }
+
+    @Override
+    public Optional<Instant> evalTokenExpiry(String sessionKey) {
+        return evalContainer.setupFor(sessionKey).map(EvalSetup::tokenExpiry);
     }
 
     /** Uncached, like the pre-seam code: every launch/resume re-probes. Runs on the caller's (background) thread. */
@@ -195,6 +229,28 @@ private ClaudeCapabilities detectCaps() {
         }
     }
 
+    /**
+     * Wraps the bare {@code claude ...} command in a {@code docker run} that
+     * runs it inside the eval container. Throws if the container setup is
+     * missing (ddtool or docker unavailable): an eval session that cannot
+     * be containerized fails loudly rather than silently shipping an
+     * unauthenticated host launch.
+     */
+    private String wrapEval(String innerCommand, String sessionKey, Path worktree, Optional<Path> mcpConfig) {
+        EvalSetup setup = evalContainer.setupFor(sessionKey).orElseThrow(() -> new IllegalStateException(
+                "Eval session " + sessionKey + " has no container setup; ddtool or docker unavailable"));
+        Optional<Path> settingsFile = activityReporter.settingsFile();
+        if (settingsFile.isEmpty() || activityDirectory == null) {
+            throw new IllegalStateException("Eval container needs the activity hook dirs, which are not installed");
+        }
+        try {
+            return evalContainer.wrap(setup, innerCommand, worktree, mcpConfig,
+                    settingsFile.get().getParent(), activityDirectory);
+        } catch (IOException e) {
+            throw new IllegalStateException("Could not write eval entrypoint: " + e.getMessage(), e);
+        }
+    }
+
     private String activitySettingsFlag(ClaudeCapabilities caps) {
         Optional<Path> settings = activityReporter.settingsFile();
         if (!caps.supportsSettings() || settings.isEmpty()) {
diff --git a/app/src/main/java/app/drydock/agent/providers/claude/internal/ClaudeEvalContainer.java b/app/src/main/java/app/drydock/agent/providers/claude/internal/ClaudeEvalContainer.java
new file mode 100644
index 00000000..a3034fc4
--- /dev/null
+++ b/app/src/main/java/app/drydock/agent/providers/claude/internal/ClaudeEvalContainer.java
@@ -0,0 +1,438 @@
+package app.drydock.agent.providers.claude.internal;
+
+import java.io.IOException;
+import java.lang.System.Logger;
+import java.lang.System.Logger.Level;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
+import java.nio.file.attribute.FileAttribute;
+import java.nio.file.attribute.PosixFilePermissions;
+import java.nio.file.attribute.PosixFilePermission;
+import java.time.Instant;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import app.drydock.agent.api.EvalTokenResolver;
+import app.drydock.process.ProcessResult;
+import app.drydock.process.ProcessRunner;
+import app.drydock.state.json.JsonParseException;
+import app.drydock.state.json.JsonParser;
+import app.drydock.state.json.JsonValue;
+import app.drydock.state.json.JsonValue.JsonObject;
+import app.drydock.state.json.JsonValue.JsonString;
+import app.drydock.state.json.JsonWriter;
+
+/**
+ * Runs an eval-mode Claude session inside a container so the eval-specific
+ * {@code x-target-account: eval} request header can be carried in a local
+ * settings file, instead of injected through the host's omlx_proxy.
+ *
+ * <p><b>Why a container at all.</b> Claude Code's managed settings
+ * ({@code /Library/Application Support/ClaudeCode/managed-settings.json} on
+ * macOS, {@code /etc/claude-code/managed-settings.json} on Linux) are the
+ * highest-precedence scope and cannot be overridden by env vars or
+ * {@code --settings}. They pin {@code ANTHROPIC_BASE_URL} at the host
+ * omlx_proxy and carry {@code ANTHROPIC_CUSTOM_HEADERS}; drydock cannot add
+ * a header to them. But inside a container there is no managed-settings
+ * file, so a settings file drydock seeds in {@code CLAUDE_CONFIG_DIR} is the
+ * only source of truth. That seed is copied from the host's managed
+ * settings (so auth, base URL, and telemetry stay the same) with two
+ * edits: the base URL is rewritten to {@code host.docker.internal} so the
+ * container can still reach the host's omlx_proxy, and
+ * {@code x-target-account: eval} is appended to
+ * {@code ANTHROPIC_CUSTOM_HEADERS}. The auth token is resolved on the host
+ * (where {@code ddtool} lives) and passed in as {@code ANTHROPIC_API_KEY},
+ * so {@code apiKeyHelper} is dropped from the seed.</p>
+ *
+ * <p><b>Container runtime.</b> Targets the {@code docker} CLI against
+ * whatever context is active -- Colima on macOS, a local or remote daemon
+ * on Linux. The image is built once by the {@code claudeEvalImage} Gradle
+ * task; {@link #probe} checks both that the daemon answers and that the
+ * image is present, so {@code evalAvailable()} honestly gates the UI
+ * checkbox.</p>
+ *
+ * <p><b>Mounts.</b> A git worktree's {@code .git} is a file pointing back
+ * into the main repo's object store via an absolute path, so for git to
+ * work inside the container both the worktree and the main repo root are
+ * bind-mounted at their original host paths (option 4a). The activity-hook
+ * script, the activity state directory, and the per-session MCP config
+ * file are likewise mounted at their host paths, so the existing
+ * {@code --settings}/{@code --mcp-config} flags resolve unchanged and the
+ * host-side activity watcher keeps reading the same files.</p>
+ *
+ * <p>All methods are blocking and must be called off the JavaFX application
+ * thread. {@link #probe} is run once at provider init (background) and its
+ * result cached.</p>
+ */
+public class ClaudeEvalContainer {
+
+    private static final Logger LOG = System.getLogger(ClaudeEvalContainer.class.getName());
+
+    /** The image tag built by the {@code claudeEvalImage} Gradle task. */
+    private static final String IMAGE = System.getProperty(
+            "app.drydock.eval.claude.image", "drydock-claude-eval:latest");
+
+    /**
+     * Managed-settings locations, in precedence order (macOS first, then Linux).
+     * Resolved per call (not cached at class-load) so a test can point the
+     * {@code app.drydock.eval.claude.managedSettings} system property at a
+     * fixture before calling {@link #seedSettings}.
+     */
+    private static List<Path> managedSettingsPaths() {
+        String override = System.getProperty("app.drydock.eval.claude.managedSettings");
+        if (override != null && !override.isBlank()) {
+            return List.of(Path.of(override));
+        }
+        return List.of(
+                Path.of("/Library/Application Support/ClaudeCode/managed-settings.json"),
+                Path.of("/etc/claude-code/managed-settings.json"));
+    }
+
+    /** The header that routes traffic to the eval account. */
+    private static final String EVAL_HEADER = "x-target-account: eval";
+
+    /** Base URL rewritten to reach the host's omlx_proxy from inside the container. */
+    private static final String CONTAINER_BASE_URL = "http://host.docker.internal:4000";
+
+    private static final String AUTH_TOKEN_ENV = "ANTHROPIC_API_KEY";
+    private static final String CONFIG_DIR_ENV = "CLAUDE_CONFIG_DIR";
+    private static final String CUSTOM_HEADERS_KEY = "ANTHROPIC_CUSTOM_HEADERS";
+    private static final String BASE_URL_KEY = "ANTHROPIC_BASE_URL";
+    private static final String API_KEY_HELPER_KEY = "apiKeyHelper";
+    private static final String HELPER_TTL_KEY = "CLAUDE_CODE_API_KEY_HELPER_TTL_MS";
+
+    private static final FileAttribute<Set<PosixFilePermission>> OWNER_ONLY =
+            PosixFilePermissions.asFileAttribute(PosixFilePermissions.fromString("rw-------"));
+
+    /** {@code gitdir: <path>} in a worktree's {@code .git} file. */
+    private static final Pattern GITDIR_LINE = Pattern.compile("^gitdir:\\s+(.+)$");
+
+    private final Path stateDirectory;
+    private final EvalTokenResolver tokenResolver;
+    /** sessionKey -> setup; populated by {@link #mark}, read by the command builder, cleared by {@link #unmark}. */
+    private final Map<String, EvalSetup> setups = new ConcurrentHashMap<>();
+
+    public ClaudeEvalContainer(Path stateDirectory) {
+        this(stateDirectory, new app.drydock.agent.providers.claude.internal.DtoolEvalTokenResolver());
+    }
+
+    /** For tests: inject the token resolver (e.g. a stub returning a fixed token). */
+    public ClaudeEvalContainer(Path stateDirectory, EvalTokenResolver tokenResolver) {
+        this.stateDirectory = Objects.requireNonNull(stateDirectory, "stateDirectory");
+        this.tokenResolver = Objects.requireNonNull(tokenResolver, "tokenResolver");
+    }
+
+    /** The per-session eval setup: the resolved auth token, its JWT expiry, and the seeded config dir. */
+    public record EvalSetup(String token, Instant tokenExpiry, Path configDir) { }
+
+    /**
+     * Whether the container runtime is reachable and the eval image is
+     * present. Best-effort: any failure (refused, timeout, non-zero,
+     * missing image) is {@code false}, so eval mode is disabled rather than
+     * half-working.
+     */
+    public boolean probe() {
+        try {
+            ProcessResult res = ProcessRunner.run(
+                    List.of("docker", "image", "inspect", IMAGE),
+                    null, java.time.Duration.ofSeconds(5));
+            if (res.exitCode() != 0) {
+                LOG.log(Level.DEBUG, () -> "eval image probe failed (exit " + res.exitCode()
+                        + "); run ./gradlew claudeEvalImage. stderr: "
+                        + ProcessRunner.excerpt(res.stderr()));
+                return false;
+            }
+            return true;
+        } catch (Exception e) {
+            LOG.log(Level.DEBUG, () -> "docker probe failed: " + e.getMessage());
+            return false;
+        }
+    }
+
+    /**
+     * Seeds the config dir for {@code sessionKey}: writes a settings.json
+     * derived from the host's managed settings (with the eval header and
+     * rewritten base URL), resolves a fresh auth token, and stashes the
+     * result for the command builder. Idempotent -- re-resolves a fresh
+     * token on every call (so a resume refreshes an expiring token).
+     *
+     * @return the setup, or {@code Optional#empty()} if the token could not
+     *         be resolved (the launch will then fail loudly in the command
+     *         builder rather than silently shipping an unauthenticated
+     *         container)
+     */
+    public Optional<EvalSetup> mark(String sessionKey) {
+        if (sessionKey == null || sessionKey.isBlank()) {
+            return Optional.empty();
+        }
+        Path configDir = stateDirectory.resolve("eval").resolve(sessionKey);
+        try {
+            Files.createDirectories(configDir);
+            seedSettings(configDir);
+        } catch (IOException e) {
+            LOG.log(Level.WARNING, () -> "Could not seed eval config dir " + configDir + ": " + e.getMessage());
+            return Optional.empty();
+        }
+        Optional<EvalTokenResolver.ResolvedToken> resolved = tokenResolver.resolveToken();
+        if (resolved.isEmpty()) {
+            return Optional.empty();
+        }
+        EvalTokenResolver.ResolvedToken token = resolved.get();
+        EvalSetup setup = new EvalSetup(token.token(), token.expiry().orElse(null), configDir);
+        setups.put(sessionKey, setup);
+        return Optional.of(setup);
+    }
+
+    /** Reverses {@link #mark}: deletes the per-session config dir and drops the stash. Idempotent. */
+    public void unmark(String sessionKey) {
+        if (sessionKey == null || sessionKey.isBlank()) {
+            return;
+        }
+        setups.remove(sessionKey);
+        Path configDir = stateDirectory.resolve("eval").resolve(sessionKey);
+        try {
+            deleteRecursively(configDir);
+        } catch (IOException e) {
+            LOG.log(Level.DEBUG, () -> "Could not delete eval config dir " + configDir + ": " + e.getMessage());
+        }
+    }
+
+    /** The stashed setup for {@code sessionKey}, or empty if {@link #mark} has not run (or failed). */
+    public Optional<EvalSetup> setupFor(String sessionKey) {
+        return Optional.ofNullable(setups.get(sessionKey));
+    }
+
+    /**
+     * Writes the inner claude command to {@code <configDir>/entrypoint.sh}
+     * and builds the {@code docker run} wrapper that executes it inside the
+     * container. The inner command is written to a file (not passed as a
+     * docker CMD argument) to avoid nested shell-quoting: the inner command
+     * already single-quotes its own arguments, and embedding it inside
+     * another {@code sh -c '...'} would require escaping those quotes.
+     *
+     * @param innerCommand   the bare {@code claude ...} command string the
+     *                       provider would normally run on the host
+     * @param worktree       the session's working directory (a worktree or
+     *                       a repo root), mounted at its own path
+     * @param mcpConfigFile  the per-session {@code --mcp-config} file, if any
+     * @param hooksDir       the activity-hook script + settings dir
+     *                       ({@code <stateDir>/hooks})
+     * @param activityDir    the activity state-word dir ({@code <stateDir>/activity})
+     */
+    public String wrap(EvalSetup setup, String innerCommand, Path worktree, Optional<Path> mcpConfigFile,
+                       Path hooksDir, Path activityDir) throws IOException {
+        // The auth token is written to an owner-only file in the mounted
+        // config dir, and the entrypoint exports it from there -- it never
+        // appears in `ps` on the host or in the command preview the UI
+        // shows. A 6-hour-lived credential on the argv would be a real
+        // exposure (AGENTS.md: "a credential must never be a command-line
+        // argument"), and the command string is reachable from log lines
+        // and the preview pane.
+        Path tokenFile = setup.configDir().resolve("auth-token");
+        writeOwnerOnly(tokenFile, setup.token());
+
+        // The entrypoint reads the token from the file, exports it, then
+        // runs the bare `claude ...` command. The image's ENTRYPOINT is
+        // `sh`, so `docker run <img> <entrypoint>` becomes
+        // `sh <entrypoint>` -- no extra `sh` here, or it would be
+        // `sh sh <entrypoint>` and fail with "cannot open sh".
+        Path entrypoint = setup.configDir().resolve("entrypoint.sh");
+        Files.writeString(entrypoint,
+                "#!/bin/sh\n"
+                + "export " + AUTH_TOKEN_ENV + "=\"$(cat " + shellQuote(tokenFile.toString()) + ")\"\n"
+                + innerCommand + "\n",
+                StandardCharsets.UTF_8);
+        try {
+            Files.setPosixFilePermissions(entrypoint, PosixFilePermissions.fromString("rwx------"));
+        } catch (UnsupportedOperationException ignored) {
+            // Non-POSIX FS: the container's sh will still read it; the exec bit is cosmetic then.
+        }
+
+        Path mainRepoRoot = resolveMainRepoRoot(worktree);
+        StringBuilder cmd = new StringBuilder("docker run --rm -it");
+        cmd.append(" --add-host=host.docker.internal:host-gateway");
+        cmd.append(" -e ").append(CONFIG_DIR_ENV).append('=').append(shellQuote(setup.configDir().toString()));
+        cmd.append(" -v ").append(shellQuote(setup.configDir().toString()))
+                .append(':').append(shellQuote(setup.configDir().toString()));
+        cmd.append(" -v ").append(shellQuote(mainRepoRoot.toString()))
+                .append(':').append(shellQuote(mainRepoRoot.toString()));
+        if (!mainRepoRoot.equals(worktree)) {
+            cmd.append(" -v ").append(shellQuote(worktree.toString()))
+                    .append(':').append(shellQuote(worktree.toString()));
+        }
+        cmd.append(" -v ").append(shellQuote(hooksDir.toString()))
+                .append(':').append(shellQuote(hooksDir.toString()));
+        cmd.append(" -v ").append(shellQuote(activityDir.toString()))
+                .append(':').append(shellQuote(activityDir.toString()));
+        mcpConfigFile.ifPresent(f -> cmd.append(" -v ").append(shellQuote(f.toString()))
+                .append(':').append(shellQuote(f.toString())));
+        cmd.append(" -w ").append(shellQuote(worktree.toString()));
+        cmd.append(' ').append(IMAGE);
+        cmd.append(' ').append(shellQuote(entrypoint.toString()));
+        return cmd.toString();
+    }
+
+    /**
+     * Reads the host's managed settings, applies the eval edits, and writes
+     * {@code <configDir>/settings.json}. If no managed-settings file is
+     * present, seeds from an empty object (the container then runs with only
+     * the eval header and the token drydock passes). Package-private for
+     * unit testing.
+     *
+     * <p>Mutates the parsed {@link JsonObject} in place: {@link #readManagedSettings}
+     * returns a fresh parse on every call, so the mutation is local. If that
+     * ever stops being true, this method would corrupt shared state.
+     */
+    void seedSettings(Path configDir) throws IOException {
+        JsonObject root = readManagedSettings().orElseGet(JsonObject::empty);
+        JsonObject env = root.members().containsKey("env")
+                ? asObject(root.members().get("env"))
+                : new JsonObject(new LinkedHashMap<>());
+        // Rewrite base URL so the container reaches the host's omlx_proxy.
+        putMember(env, BASE_URL_KEY, new JsonString(CONTAINER_BASE_URL));
+        // Append the eval header to the custom-headers block.
+        String headers = env.members().containsKey(CUSTOM_HEADERS_KEY)
+                ? asString(env.members().get(CUSTOM_HEADERS_KEY)) : "";
+        if (!headers.isEmpty() && !headers.endsWith("\n")) {
+            headers += "\n";
+        }
+        if (!containsHeader(headers, EVAL_HEADER)) {
+            headers += EVAL_HEADER + "\n";
+        }
+        putMember(env, CUSTOM_HEADERS_KEY, new JsonString(headers));
+        // The token is passed as ANTHROPIC_API_KEY env, so the helper is dead weight.
+        env.members().remove(HELPER_TTL_KEY);
+        putMember(root, "env", env);
+        root.members().remove(API_KEY_HELPER_KEY);
+
+        Path target = configDir.resolve("settings.json");
+        writeAtomically(target, JsonWriter.write(root));
+    }
+
+    /** True if {@code headers} already names the {@code name: value} header line. */
+    private static boolean containsHeader(String headers, String header) {
+        String name = header.substring(0, header.indexOf(':'));
+        for (String line : headers.split("\n")) {
+            int colon = line.indexOf(':');
+            if (colon > 0 && line.substring(0, colon).trim().equalsIgnoreCase(name)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private static void putMember(JsonObject obj, String key, JsonValue value) {
+        obj.members().put(key, value);
+    }
+
+    private static JsonObject asObject(JsonValue v) {
+        return v instanceof JsonObject o ? o : new JsonObject(new LinkedHashMap<>());
+    }
+
+    private static String asString(JsonValue v) {
+        return v instanceof JsonString s ? s.value() : "";
+    }
+
+    private Optional<JsonObject> readManagedSettings() {
+        for (Path p : managedSettingsPaths()) {
+            try {
+                if (Files.isReadable(p)) {
+                    String content = Files.readString(p, StandardCharsets.UTF_8);
+                    JsonValue parsed = JsonParser.parse(content);
+                    return parsed instanceof JsonObject o ? Optional.of(o) : Optional.empty();
+                }
+            } catch (IOException | JsonParseException e) {
+                LOG.log(Level.WARNING, () -> "Could not read managed settings " + p + ": " + e.getMessage());
+            }
+        }
+        return Optional.empty();
+    }
+
+    /**
+     * Resolves the main repo root backing a worktree. A worktree's {@code .git}
+     * is a file reading {@code gitdir: <mainRepo>/.git/worktrees/<name>}; the
+     * main repo root is three {@code getParent()} calls up from that path. If
+     * {@code .git} is a directory (not a worktree), the worktree itself is
+     * the repo root.
+     */
+    static Path resolveMainRepoRoot(Path worktree) {
+        Path git = worktree.resolve(".git");
+        if (Files.isDirectory(git)) {
+            return worktree;
+        }
+        try {
+            String content = Files.readString(git, StandardCharsets.UTF_8).strip();
+            Matcher m = GITDIR_LINE.matcher(content);
+            if (m.matches()) {
+                Path gitdir = Path.of(m.group(1).trim());
+                // <mainRepo>/.git/worktrees/<name> -> up three levels -> <mainRepo>
+                Path mainRepo = gitdir.getParent() != null ? gitdir.getParent().getParent() : null;
+                if (mainRepo != null && mainRepo.getParent() != null) {
+                    mainRepo = mainRepo.getParent();
+                }
+                if (mainRepo != null && Files.isDirectory(mainRepo.resolve(".git"))) {
+                    return mainRepo;
+                }
+            }
+        } catch (IOException e) {
+            LOG.log(Level.DEBUG, () -> "Could not read worktree .git file at " + git + ": " + e.getMessage());
+        }
+        // Fallback: mount only the worktree. git operations inside the
+        // container may fail, but the working directory is correct.
+        LOG.log(Level.WARNING, () -> "Eval container: could not resolve the main repo root backing worktree "
+                + worktree + "; mounting only the worktree. Git operations inside the container may fail.");
+        return worktree;
+    }
+
+    private static void deleteRecursively(Path dir) throws IOException {
+        if (!Files.exists(dir)) {
+            return;
+        }
+        try (var stream = Files.walk(dir)) {
+            var paths = stream.sorted(java.util.Comparator.reverseOrder()).toList();
+            for (Path p : paths) {
+                Files.deleteIfExists(p);
+            }
+        }
+    }
+
+    /** Writes {@code content} to an owner-only file (the auth token). */
+    private static void writeOwnerOnly(Path target, String content) throws IOException {
+        Path temp = target.resolveSibling(target.getFileName() + ".tmp");
+        Files.writeString(temp, content, StandardCharsets.UTF_8);
+        try {
+            Files.setPosixFilePermissions(temp, PosixFilePermissions.fromString("rw-------"));
+        } catch (UnsupportedOperationException ignored) {
+            // Non-POSIX FS: best-effort; the file is in an owner-only dir.
+        }
+        try {
+            Files.move(temp, target, StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.ATOMIC_MOVE);
+        } catch (IOException e) {
+            Files.move(temp, target, StandardCopyOption.REPLACE_EXISTING);
+        }
+    }
+
+    private static void writeAtomically(Path target, String content) throws IOException {
+        Path temp = target.resolveSibling(target.getFileName() + ".tmp");
+        Files.writeString(temp, content, StandardCharsets.UTF_8);
+        try {
+            Files.move(temp, target, StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.ATOMIC_MOVE);
+        } catch (IOException e) {
+            Files.move(temp, target, StandardCopyOption.REPLACE_EXISTING);
+        }
+    }
+
+    /** POSIX single-quote, so paths with spaces (e.g. "Application Support") survive the shell. */
+    private static String shellQuote(String s) {
+        return "'" + s.replace("'", "'\\''") + "'";
+    }
+}
diff --git a/app/src/main/java/app/drydock/agent/providers/claude/internal/ClaudeEvalProxy.java b/app/src/main/java/app/drydock/agent/providers/claude/internal/ClaudeEvalProxy.java
deleted file mode 100644
index 45102947..00000000
--- a/app/src/main/java/app/drydock/agent/providers/claude/internal/ClaudeEvalProxy.java
+++ /dev/null
@@ -1,144 +0,0 @@
-package app.drydock.agent.providers.claude.internal;
-
-import java.lang.System.Logger;
-import java.lang.System.Logger.Level;
-import java.net.URI;
-import java.net.URLEncoder;
-import java.net.http.HttpClient;
-import java.net.http.HttpRequest;
-import java.net.http.HttpResponse;
-import java.nio.charset.StandardCharsets;
-import java.time.Duration;
-import java.util.Objects;
-
-/**
- * Talks to the local omlx_proxy that sits between Claude Code and the AI
- * gateway, to route an eval session's traffic to the eval account.
- *
- * <p>Claude Code's {@code ANTHROPIC_*} env is locked to user/managed scope, so
- * drydock cannot inject an {@code x-target-account: eval} header (or a custom
- * base URL, or an auth token) per session. But claude is already proxied
- * through omlx_proxy at {@code 127.0.0.1:4000}, and every request -- parent and
- * sub-agent -- carries {@code x-claude-code-session-id}, which equals the
- * {@code --session-id} drydock passes. omlx_proxy can therefore add the header
- * for a session id drydock marks here, covering the whole session including
- * model-pinned subagents (the {@code --model} sentinel could not).</p>
- *
- * <p>All methods are blocking and must be called off the JavaFX application
- * thread. {@link #probe} is run once at provider init (background) and its
- * result cached, so the UI's {@code evalAvailable()} read never blocks.</p>
- */
-public final class ClaudeEvalProxy {
-
-    private static final Logger LOG = System.getLogger(ClaudeEvalProxy.class.getName());
-
-    /** Where omlx_proxy listens. Overridable for tests / non-standard setups. */
-    private static final String BASE_URL = System.getProperty(
-            "app.drydock.eval.claude.proxyBaseUrl", "http://127.0.0.1:4000");
-
-    private static final String HEADER = "x-target-account";
-    private static final String HEADER_VALUE = "eval";
-
-    private final String baseUrl;
-    private final HttpClient client = HttpClient.newBuilder()
-            .connectTimeout(Duration.ofSeconds(2)).build();
-
-    public ClaudeEvalProxy() {
-        this(BASE_URL);
-    }
-
-    /** For tests: an explicit base URL. */
-    ClaudeEvalProxy(String baseUrl) {
-        this.baseUrl = Objects.requireNonNull(baseUrl, "baseUrl").endsWith("/")
-                ? baseUrl.substring(0, baseUrl.length() - 1) : baseUrl;
-    }
-
-    /** The header omlx_proxy injects for a marked session. */
-    public static String headerName() {
-        return HEADER;
-    }
-
-    public static String headerValue() {
-        return HEADER_VALUE;
-    }
-
-    /**
-     * Whether omlx_proxy is reachable and answering its health endpoint.
-     * Best-effort: any failure (refused, timeout, non-OK, malformed) is
-     * {@code false}, so eval mode is disabled rather than half-working.
-     */
-    public boolean probe() {
-        try {
-            HttpResponse<String> res = client.send(
-                    HttpRequest.newBuilder(URI.create(baseUrl + "/health"))
-                            .timeout(Duration.ofSeconds(2)).GET().build(),
-                    HttpResponse.BodyHandlers.ofString());
-            if (res.statusCode() != 200) {
-                return false;
-            }
-            // The body is JSON with "status":"ok"; accept it loosely.
-            return res.body().contains("\"status\":\"ok\"")
-                    || res.body().contains("\"status\": \"ok\"");
-        } catch (Exception e) {
-            LOG.log(Level.DEBUG, () -> "omlx_proxy probe failed: " + e.getMessage());
-            return false;
-        }
-    }
-
-    /**
-     * Marks {@code sessionKey} as eval. Idempotent on the proxy side. Never
-     * throws: a failure only means the eval header will not be injected for
-     * this session (degraded, not fatal).
-     */
-    public void mark(String sessionKey) {
-        if (sessionKey == null || sessionKey.isBlank()) {
-            return;
-        }
-        post("/omlx/eval-session", "{\"session_id\":\"" + jsonEscape(sessionKey) + "\"}");
-    }
-
-    /** Reverses {@link #mark}. Idempotent; never throws. */
-    public void unmark(String sessionKey) {
-        if (sessionKey == null || sessionKey.isBlank()) {
-            return;
-        }
-        try {
-            URI uri = URI.create(baseUrl + "/omlx/eval-session?session_id="
-                    + URLEncoder.encode(sessionKey, StandardCharsets.UTF_8));
-            client.send(HttpRequest.newBuilder(uri)
-                            .timeout(Duration.ofSeconds(2)).DELETE().build(),
-                    HttpResponse.BodyHandlers.discarding());
-        } catch (Exception e) {
-            LOG.log(Level.DEBUG, () -> "omlx_proxy unmark failed for " + sessionKey + ": " + e.getMessage());
-        }
-    }
-
-    private void post(String path, String jsonBody) {
-        try {
-            client.send(HttpRequest.newBuilder(URI.create(baseUrl + path))
-                            .header("content-type", "application/json")
-                            .timeout(Duration.ofSeconds(2))
-                            .POST(HttpRequest.BodyPublishers.ofString(jsonBody, StandardCharsets.UTF_8))
-                            .build(),
-                    HttpResponse.BodyHandlers.discarding());
-        } catch (Exception e) {
-            LOG.log(Level.WARNING, () -> "omlx_proxy mark failed (" + path + "): " + e.getMessage());
-        }
-    }
-
-    private static String jsonEscape(String s) {
-        StringBuilder sb = new StringBuilder(s.length() + 8);
-        for (int i = 0; i < s.length(); i++) {
-            char c = s.charAt(i);
-            switch (c) {
-                case '"' -> sb.append("\\\"");
-                case '\\' -> sb.append("\\\\");
-                case '\n' -> sb.append("\\n");
-                case '\r' -> sb.append("\\r");
-                case '\t' -> sb.append("\\t");
-                default -> sb.append(c);
-            }
-        }
-        return sb.toString();
-    }
-}
\ No newline at end of file
diff --git a/app/src/main/java/app/drydock/agent/providers/claude/internal/DtoolEvalTokenResolver.java b/app/src/main/java/app/drydock/agent/providers/claude/internal/DtoolEvalTokenResolver.java
new file mode 100644
index 00000000..800b63bf
--- /dev/null
+++ b/app/src/main/java/app/drydock/agent/providers/claude/internal/DtoolEvalTokenResolver.java
@@ -0,0 +1,85 @@
+package app.drydock.agent.providers.claude.internal;
+
+import app.drydock.agent.api.EvalTokenResolver;
+import app.drydock.process.ProcessResult;
+import app.drydock.process.ProcessRunner;
+import app.drydock.state.json.JsonParseException;
+import app.drydock.state.json.JsonParser;
+import app.drydock.state.json.JsonValue;
+import app.drydock.state.json.JsonValue.JsonObject;
+
+import java.lang.System.Logger;
+import java.lang.System.Logger.Level;
+import java.nio.charset.StandardCharsets;
+import java.time.Instant;
+import java.util.Base64;
+import java.util.List;
+import java.util.Optional;
+
+/**
+ * Resolves the eval-account auth token by running {@code ddtool} on the
+ * host. DataDog-specific: the command audience and datacenter are pinned
+ * to the AI gateway's {@code rapid-ai-platform} service at
+ * {@code us1.ddbuild.io}.
+ *
+ * <p>This is the default {@link EvalTokenResolver}, wired in directly for
+ * now. Once Drydock grows plugin support it is intended to move behind a
+ * DataDog-specific plugin so the eval integration is not bound to a
+ * single credential source -- the SPI is the seam that makes that move
+ * a drop-in.</p>
+ *
+ * <p>The token is a JWT; its {@code exp} claim is decoded (without
+ * signature verification -- display only, not auth) so the UI can show
+ * a countdown. Blocking; must be called off the FX thread.</p>
+ */
+public final class DtoolEvalTokenResolver implements EvalTokenResolver {
+
+    private static final Logger LOG = System.getLogger(DtoolEvalTokenResolver.class.getName());
+
+    /** ddtool command that yields the eval-account auth token on stdout. */
+    private static final List<String> DTOOL_TOKEN_CMD = List.of(
+            "ddtool", "auth", "token", "rapid-ai-platform", "--datacenter", "us1.ddbuild.io");
+
+    @Override
+    public Optional<ResolvedToken> resolveToken() {
+        try {
+            ProcessResult res = ProcessRunner.run(DTOOL_TOKEN_CMD, null, java.time.Duration.ofSeconds(15));
+            if (res.exitCode() != 0) {
+                LOG.log(Level.WARNING, () -> "ddtool auth token failed (exit " + res.exitCode() + "): "
+                        + ProcessRunner.excerpt(res.stderr()));
+                return Optional.empty();
+            }
+            String token = res.stdout().strip();
+            if (token.isEmpty()) {
+                return Optional.empty();
+            }
+            return Optional.of(new ResolvedToken(token, decodeJwtExpiry(token)));
+        } catch (Exception e) {
+            LOG.log(Level.WARNING, () -> "ddtool auth token unavailable: " + e.getMessage());
+            return Optional.empty();
+        }
+    }
+
+    /**
+     * Decodes the {@code exp} claim from the JWT payload (middle segment)
+     * without verifying the signature: this is for display only, not auth.
+     */
+    static Optional<Instant> decodeJwtExpiry(String jwt) {
+        String[] parts = jwt.split("\\.");
+        if (parts.length < 2) {
+            return Optional.empty();
+        }
+        try {
+            byte[] payload = Base64.getUrlDecoder().decode(parts[1]);
+            JsonValue parsed = JsonParser.parse(new String(payload, StandardCharsets.UTF_8));
+            if (parsed instanceof JsonObject o && o.members().get("exp") instanceof JsonValue v) {
+                long exp = v instanceof JsonValue.JsonString s ? Long.parseLong(s.value())
+                        : v instanceof JsonValue.JsonNumber n ? n.asLong() : 0L;
+                return exp > 0 ? Optional.of(Instant.ofEpochSecond(exp)) : Optional.empty();
+            }
+        } catch (IllegalArgumentException | JsonParseException e) {
+            LOG.log(Level.DEBUG, () -> "Could not decode JWT exp: " + e.getMessage());
+        }
+        return Optional.empty();
+    }
+}
diff --git a/app/src/main/java/app/drydock/agent/spi/AgentProvider.java b/app/src/main/java/app/drydock/agent/spi/AgentProvider.java
index 28b332be..f93890a7 100644
--- a/app/src/main/java/app/drydock/agent/spi/AgentProvider.java
+++ b/app/src/main/java/app/drydock/agent/spi/AgentProvider.java
@@ -13,6 +13,7 @@
 import app.drydock.agent.api.SessionIdStrategy;
 
 import java.nio.file.Path;
+import java.time.Instant;
 import java.util.Optional;
 
 /**
@@ -126,4 +127,16 @@ default void markEvalSession(String sessionKey) { }
      * {@code markEvalSession} never ran for {@code sessionKey}.
      */
     default void unmarkEvalSession(String sessionKey) { }
+
+    /**
+     * When the eval session's auth token expires, for display only. Empty
+     * for a provider that does not resolve a token with a knowable expiry
+     * (or before {@link #markEvalSession} has run). The value is a snapshot
+     * from the token resolved at launch; it is not refreshed live, so a
+     * long-running session may outlive it -- the UI shows it as a hint, not
+     * a hard deadline.
+     */
+    default Optional<Instant> evalTokenExpiry(String sessionKey) {
+        return Optional.empty();
+    }
 }
diff --git a/app/src/main/java/app/drydock/ui/RepositorySidebar.java b/app/src/main/java/app/drydock/ui/RepositorySidebar.java
index 6f274926..fdb21212 100644
--- a/app/src/main/java/app/drydock/ui/RepositorySidebar.java
+++ b/app/src/main/java/app/drydock/ui/RepositorySidebar.java
@@ -2490,15 +2490,31 @@ private Optional<Label> findingsBadge(Path checkoutRoot, Runnable onReview) {
             });
         }
 
-        /** The eval-mode tooltip line, honest per provider: Pi reroutes, Claude and Codex are marked but not rerouted. */
-        private static String evalTooltipLine(ManagedAgentSession session) {
+        /**
+         * The eval-mode tooltip line, honest per provider. Claude now runs in a
+         * container with a seeded settings file (the header rides the request
+         * directly, no omlx_proxy marking); Pi reroutes via its bridge
+         * extension; Codex is not rerouted. For Claude the resolved token's
+         * JWT expiry is shown as a hint -- it is a snapshot from launch, not
+         * refreshed live, so a long session may outlive it.
+         */
+        private String evalTooltipLine(ManagedAgentSession session) {
             return switch (session.agentKind()) {
                 case PI -> "Eval mode: on (x-target-account: eval via the Pi bridge extension)";
-                case CLAUDE -> "Eval mode: on (x-target-account: eval via omlx_proxy)";
+                case CLAUDE -> "Eval mode: on (x-target-account: eval via the eval container)"
+                        + claudeEvalTokenLine(session);
                 case CODEX -> "Eval mode: on (not supported for Codex; requests are NOT rerouted)";
             };
         }
 
+        private String claudeEvalTokenLine(ManagedAgentSession session) {
+            return session.agentSessionId()
+                    .flatMap(id -> agentRegistry.evalTokenExpiry(session.agentKind(), id))
+                    .map(expiry -> "\nEval token expires: " + UiFormats.timeOfDay(expiry)
+                            + " (" + UiFormats.timeUntil(expiry) + ")")
+                    .orElse("");
+        }
+
         private StackPane buildSessionRow(ManagedAgentSession session, Repository repository) {
             boolean live = SessionStatusStyles.isRunning(session.status());
             Region dot = SessionStatusStyles.createDot(8, session.status(), live);
diff --git a/app/src/main/java/app/drydock/ui/UiFormats.java b/app/src/main/java/app/drydock/ui/UiFormats.java
index 0e483e88..95065ef9 100644
--- a/app/src/main/java/app/drydock/ui/UiFormats.java
+++ b/app/src/main/java/app/drydock/ui/UiFormats.java
@@ -37,6 +37,26 @@ public static String relativeTime(Instant instant) {
         return (seconds / 86400) + "d ago";
     }
 
+    /** Wall-clock time of day, e.g. {@code 16:40}, in the local time zone. */
+    public static String timeOfDay(Instant instant) {
+        return java.time.LocalTime.ofInstant(instant, java.time.ZoneId.systemDefault())
+                .format(java.time.format.DateTimeFormatter.ofPattern("HH:mm"));
+    }
+
+    /** Rough remaining time until a future instant, e.g. {@code ~5h 0m}; {@code expired} if past. */
+    public static String timeUntil(Instant instant) {
+        long seconds = java.time.Duration.between(Instant.now(), instant).getSeconds();
+        if (seconds <= 0) {
+            return "expired";
+        }
+        if (seconds < 60) {
+            return "<1m";
+        }
+        long hours = seconds / 3600;
+        long minutes = (seconds % 3600) / 60;
+        return "~" + (hours > 0 ? hours + "h " : "") + minutes + "m";
+    }
+
     /** Display text for a checkout's branch state: the branch name, or {@code detached@<short-oid>}. */
     public static String branchText(GitStatus status) {
         if (status.branch() instanceof GitBranchState.OnBranch onBranch) {
diff --git a/app/src/test/java/app/drydock/agent/providers/claude/ClaudeAgentProviderTest.java b/app/src/test/java/app/drydock/agent/providers/claude/ClaudeAgentProviderTest.java
index bbce190d..7652c5b5 100644
--- a/app/src/test/java/app/drydock/agent/providers/claude/ClaudeAgentProviderTest.java
+++ b/app/src/test/java/app/drydock/agent/providers/claude/ClaudeAgentProviderTest.java
@@ -3,13 +3,18 @@
 import app.drydock.agent.api.AgentContext;
 import app.drydock.agent.api.AgentKind;
 import app.drydock.agent.api.CreateContext;
+import app.drydock.agent.api.EvalTokenResolver;
 import app.drydock.agent.api.LaunchPlan;
 import app.drydock.agent.api.ResumeContext;
 import app.drydock.agent.api.SessionIdStrategy;
+import app.drydock.agent.providers.claude.internal.ClaudeEvalContainer;
+import app.drydock.agent.providers.claude.internal.ClaudeEvalContainer.EvalSetup;
 import app.drydock.agent.providers.claude.internal.ClaudeExecutableLocator;
 import org.junit.jupiter.api.Test;
 
+import java.nio.file.Files;
 import java.nio.file.Path;
+import java.time.Instant;
 import java.util.Optional;
 import java.util.concurrent.Executors;
 
@@ -77,4 +82,42 @@ void resumeFallsBackToBare() {
     void claudeSupportsRemote() {
         assertTrue(newProviderNoExecutable().probeCapabilities().supportsRemote());
     }
+
+    @Test
+    void evalCreateWrapsInDockerWhenSetupExists() throws Exception {
+        Path stateDir = Files.createTempDirectory("drydock-eval-test");
+        EvalTokenResolver resolver = () -> Optional.of(
+                new EvalTokenResolver.ResolvedToken("tok", Optional.of(Instant.now().plusSeconds(3600))));
+        ClaudeEvalContainer container = new ClaudeEvalContainer(stateDir, resolver);
+        // mark() seeds the config dir and stashes the setup (resolves the token).
+        EvalSetup setup = container.mark("sess-eval").orElseThrow();
+        // Install the activity hook dirs the wrapper mounts + reads.
+        Files.createDirectories(stateDir.resolve("hooks"));
+        Files.createDirectories(stateDir.resolve("activity"));
+        Files.writeString(stateDir.resolve("hooks").resolve("settings.json"), "{}");
+        ClaudeAgentProvider provider = new ClaudeAgentProvider(
+                new ClaudeExecutableLocator(Path.of("/nonexistent/claude")), container);
+        provider.init(new AgentContext(stateDir, stateDir.resolve("activity"),
+                Executors.newVirtualThreadPerTaskExecutor()));
+        provider.activity().orElseThrow().install();   // writes hooks/settings.json
+        LaunchPlan plan = provider.buildCreateCommand(new CreateContext("S", "sess-eval", Path.of("/tmp"),
+                Optional.empty(), Optional.empty(), true));
+        String cmd = plan.command();
+        assertTrue(cmd.startsWith("docker run "), () -> "eval create wraps in docker: " + cmd);
+        assertTrue(cmd.contains("drydock-claude-eval:latest"));
+        // No double "sh": the image ENTRYPOINT is sh, so the command ends
+        // with the image tag then the entrypoint script path -- not "sh <path>".
+        String afterImage = cmd.substring(cmd.indexOf("drydock-claude-eval:latest"));
+        assertFalse(afterImage.contains(" sh "), "no extra sh after image: " + afterImage);
+        // The token must not leak into the command string.
+        assertFalse(cmd.contains("tok"), "token must not be on the argv: " + cmd);
+    }
+
+    @Test
+    void evalCreateThrowsWhenSetupMissing() {
+        ClaudeAgentProvider provider = newProviderNoExecutable();
+        org.junit.jupiter.api.Assertions.assertThrows(IllegalStateException.class, () ->
+                provider.buildCreateCommand(new CreateContext("S", "no-such-sess", Path.of("/tmp"),
+                        Optional.empty(), Optional.empty(), true)));
+    }
 }
diff --git a/app/src/test/java/app/drydock/agent/providers/claude/internal/ClaudeEvalContainerTest.java b/app/src/test/java/app/drydock/agent/providers/claude/internal/ClaudeEvalContainerTest.java
new file mode 100644
index 00000000..57835cc1
--- /dev/null
+++ b/app/src/test/java/app/drydock/agent/providers/claude/internal/ClaudeEvalContainerTest.java
@@ -0,0 +1,168 @@
+package app.drydock.agent.providers.claude.internal;
+
+import app.drydock.agent.api.EvalTokenResolver;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Instant;
+import java.util.Optional;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class ClaudeEvalContainerTest {
+
+    @TempDir
+    Path tmp;
+
+    /** A resolver that returns a fixed token with a known expiry. */
+    private static EvalTokenResolver fixedToken(String token, Instant expiry) {
+        return () -> Optional.of(new EvalTokenResolver.ResolvedToken(token, Optional.ofNullable(expiry)));
+    }
+
+    /** A resolver that returns empty (ddtool unavailable). */
+    private static EvalTokenResolver noToken() {
+        return () -> Optional.empty();
+    }
+
+    @Test
+    void markResolvesTokenAndStashesSetup() {
+        Instant expiry = Instant.now().plusSeconds(3600);
+        ClaudeEvalContainer c = new ClaudeEvalContainer(tmp, fixedToken("tok-1", expiry));
+        Optional<ClaudeEvalContainer.EvalSetup> setup = c.mark("sess");
+        assertTrue(setup.isPresent());
+        assertEquals("tok-1", setup.get().token());
+        assertEquals(expiry, setup.get().tokenExpiry());
+        assertTrue(Files.exists(setup.get().configDir().resolve("settings.json")));
+    }
+
+    @Test
+    void markEmptyWhenTokenUnavailable() {
+        ClaudeEvalContainer c = new ClaudeEvalContainer(tmp, noToken());
+        assertTrue(c.mark("sess").isEmpty());
+        assertFalse(c.setupFor("sess").isPresent());
+    }
+
+    @Test
+    void markIsIdempotentAndRefreshesToken() {
+        Instant t1 = Instant.now().plusSeconds(3600);
+        Instant t2 = Instant.now().plusSeconds(7200);
+        // Two calls return different tokens (resume refreshes).
+        ClaudeEvalContainer c = new ClaudeEvalContainer(tmp, new EvalTokenResolver() {
+            int n;
+            @Override public Optional<ResolvedToken> resolveToken() {
+                return Optional.of(new ResolvedToken("tok-" + (++n), Optional.of(n == 1 ? t1 : t2)));
+            }
+        });
+        c.mark("sess");
+        c.mark("sess");
+        assertEquals("tok-2", c.setupFor("sess").orElseThrow().token());
+    }
+
+    @Test
+    void resolveMainRepoRootFromWorktreeGitFile() throws Exception {
+        Path mainRepo = Files.createDirectories(tmp.resolve("mainRepo"));
+        Path worktrees = Files.createDirectories(mainRepo.resolve(".git").resolve("worktrees").resolve("sess"));
+        Path worktree = Files.createDirectories(tmp.resolve("worktree"));
+        Files.writeString(worktree.resolve(".git"), "gitdir: " + worktrees + "\n");
+        assertEquals(mainRepo, ClaudeEvalContainer.resolveMainRepoRoot(worktree));
+    }
+
+    @Test
+    void resolveMainRepoRootReturnsWorktreeWhenGitIsDir() throws Exception {
+        Path worktree = Files.createDirectories(tmp.resolve("repo"));
+        Files.createDirectories(worktree.resolve(".git"));
+        assertEquals(worktree, ClaudeEvalContainer.resolveMainRepoRoot(worktree));
+    }
+
+    @Test
+    void seedSettingsRewritesBaseUrlAppendsHeaderDropsHelper() throws Exception {
+        Path configDir = Files.createDirectories(tmp.resolve("eval").resolve("sess"));
+        Path managed = tmp.resolve("managed-settings.json");
+        Files.writeString(managed, """
+                {
+                  "apiKeyHelper": "ddtool auth token rapid-ai-platform",
+                  "model": "sonnet",
+                  "env": {
+                    "ANTHROPIC_BASE_URL": "http://127.0.0.1:4000",
+                    "ANTHROPIC_CUSTOM_HEADERS": "source: claude-code\\norg-id: 2",
+                    "CLAUDE_CODE_API_KEY_HELPER_TTL_MS": "7200000"
+                  }
+                }
+                """);
+        System.setProperty("app.drydock.eval.claude.managedSettings", managed.toString());
+        try {
+            new ClaudeEvalContainer(tmp, noToken()).seedSettings(configDir);
+        } finally {
+            System.clearProperty("app.drydock.eval.claude.managedSettings");
+        }
+
+        String seeded = Files.readString(configDir.resolve("settings.json"));
+        assertTrue(seeded.contains("host.docker.internal:4000"), "base URL rewritten for the container");
+        assertFalse(seeded.contains("127.0.0.1:4000"), "host base URL no longer present");
+        assertTrue(seeded.contains("x-target-account: eval"), "eval header appended");
+        assertTrue(seeded.contains("source: claude-code"), "original custom headers preserved");
+        assertTrue(seeded.contains("\"sonnet\""), "non-env settings preserved");
+        assertFalse(seeded.contains("apiKeyHelper"), "apiKeyHelper dropped (token passed as env)");
+        assertFalse(seeded.contains("CLAUDE_CODE_API_KEY_HELPER_TTL_MS"), "helper TTL dropped");
+    }
+
+    @Test
+    void seedSettingsIsIdempotentOnHeader() throws Exception {
+        Path configDir = Files.createDirectories(tmp.resolve("eval2").resolve("s"));
+        ClaudeEvalContainer c = new ClaudeEvalContainer(tmp, noToken());
+        c.seedSettings(configDir);
+        c.seedSettings(configDir);   // second pass must not duplicate the header
+        String seeded = Files.readString(configDir.resolve("settings.json"));
+        assertEquals(1, countOccurrences(seeded, "x-target-account: eval"));
+    }
+
+    @Test
+    void unmarkDeletesConfigDir() {
+        String key = "k";
+        ClaudeEvalContainer c = new ClaudeEvalContainer(tmp, noToken());
+        c.unmark(key);   // idempotent on missing
+        Path dir = tmp.resolve("eval").resolve(key);
+        try {
+            Files.createDirectories(dir);
+            Files.writeString(dir.resolve("settings.json"), "{}");
+        } catch (Exception ignored) { }
+        c.unmark(key);
+        assertFalse(Files.exists(dir));
+    }
+
+    @Test
+    void wrapWritesTokenToFileNotArgvAndDropsDoubleSh() throws Exception {
+        Instant expiry = Instant.now().plusSeconds(3600);
+        ClaudeEvalContainer c = new ClaudeEvalContainer(tmp, fixedToken("secret-tok", expiry));
+        ClaudeEvalContainer.EvalSetup setup = c.mark("sess").orElseThrow();
+        Path worktree = Files.createDirectories(tmp.resolve("wt"));
+        Path hooksDir = Files.createDirectories(tmp.resolve("hooks"));
+        Path activityDir = Files.createDirectories(tmp.resolve("activity"));
+
+        String cmd = c.wrap(setup, "claude --session-id 'abc'", worktree, Optional.empty(), hooksDir, activityDir);
+
+        // The token must NOT appear in the command string (it's in a file).
+        assertFalse(cmd.contains("secret-tok"), "token must not be on the argv");
+        // The token file exists and holds the token.
+        assertEquals("secret-tok", Files.readString(setup.configDir().resolve("auth-token")));
+        // The entrypoint exports the token from the file, then runs claude.
+        String entrypoint = Files.readString(setup.configDir().resolve("entrypoint.sh"));
+        assertTrue(entrypoint.contains("export ANTHROPIC_API_KEY=\"$(cat "), "entrypoint exports token from file");
+        assertTrue(entrypoint.contains("claude --session-id 'abc'"));
+        // No double "sh": the image ENTRYPOINT is already sh, so the command
+        // ends with "<image> '<entrypoint>'", not "<image> sh '<entrypoint>'".
+        String imageAndAfter = cmd.substring(cmd.indexOf("drydock-claude-eval:latest"));
+        assertFalse(imageAndAfter.contains(" sh "), "no extra 'sh' after the image (entrypoint is already sh)");
+        assertTrue(imageAndAfter.startsWith("drydock-claude-eval:latest '"));
+    }
+
+    private static int countOccurrences(String haystack, String needle) {
+        int count = 0, i = 0;
+        while ((i = haystack.indexOf(needle, i)) >= 0) { count++; i += needle.length(); }
+        return count;
+    }
+}
diff --git a/app/src/test/java/app/drydock/agent/providers/claude/internal/DtoolEvalTokenResolverTest.java b/app/src/test/java/app/drydock/agent/providers/claude/internal/DtoolEvalTokenResolverTest.java
new file mode 100644
index 00000000..6bf75671
--- /dev/null
+++ b/app/src/test/java/app/drydock/agent/providers/claude/internal/DtoolEvalTokenResolverTest.java
@@ -0,0 +1,38 @@
+package app.drydock.agent.providers.claude.internal;
+
+import org.junit.jupiter.api.Test;
+
+import java.time.Instant;
+import java.util.Base64;
+import java.util.Optional;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class DtoolEvalTokenResolverTest {
+
+    @Test
+    void decodeJwtExpiryReadsExpClaim() {
+        // payload: {"exp": 1787755205, "iat": 1787733605}
+        String payload = base64url("{\"exp\":1787755205,\"iat\":1787733605}");
+        String jwt = "header." + payload + ".sig";
+        assertEquals(Instant.ofEpochSecond(1787755205),
+                DtoolEvalTokenResolver.decodeJwtExpiry(jwt).orElseThrow());
+    }
+
+    @Test
+    void decodeJwtExpiryEmptyForNonJwt() {
+        assertTrue(DtoolEvalTokenResolver.decodeJwtExpiry("not-a-jwt").isEmpty());
+    }
+
+    @Test
+    void decodeJwtExpiryEmptyForMissingExp() {
+        String payload = base64url("{\"sub\":\"no-exp-here\"}");
+        String jwt = "h." + payload + ".s";
+        assertTrue(DtoolEvalTokenResolver.decodeJwtExpiry(jwt).isEmpty());
+    }
+
+    private static String base64url(String json) {
+        return Base64.getUrlEncoder().withoutPadding().encodeToString(json.getBytes());
+    }
+}