From d36c032d0cd7f14052ddf2a72e7eb822b5429751 Mon Sep 17 00:00:00 2001
From: Jaroslav Bachorik <jaroslav.bachorik@datadoghq.com>
Date: Wed, 26 Aug 2026 13:09:24 +0200
Subject: [PATCH 1/2] Claude eval runs in a container seeded from managed
 settings

Managed settings (managed-settings.json) are the highest-precedence scope
and cannot be overridden by env vars or --settings, so drydock could not
add an x-target-account: eval header to them. The previous approach marked
the session id with the host's omlx_proxy, which injected the header per
request -- but it depended on omlx_proxy running and on session-id
correlation, and it left the header source outside drydock's control.

An eval session now runs inside a container (docker on Linux, colima on
macOS) where there is no managed-settings file, so a settings file drydock
seeds in CLAUDE_CONFIG_DIR is the only source of truth. The seed is copied
from the host's managed settings with three edits: ANTHROPIC_BASE_URL is
rewritten to host.docker.internal so the container still reaches the
host's omlx_proxy, x-target-account: eval is appended to
ANTHROPIC_CUSTOM_HEADERS, and apiKeyHelper is dropped (the token is
resolved on the host and passed in as ANTHROPIC_API_KEY). The auth token
is written to an owner-only file in the mounted config dir and the
entrypoint exports it from there -- it never appears in `ps` or the
command preview the UI shows.

A git worktree's .git is a file pointing back into the main repo's object
store via an absolute path, so for git to work inside the container both
the worktree and the main repo root are bind-mounted at their original
host paths. The activity-hook script, the activity state directory, and
the per-session MCP config file are mounted at their host paths too, so
the existing --settings/--mcp-config flags resolve unchanged and the
host-side activity watcher keeps reading the same files.

The auth token is a JWT; its exp claim is decoded (no signature
verification -- display only) so the UI shows a countdown in the session
tooltip. The token's real TTL is 6h (not the 2h CLAUDE_CODE_API_KEY_HELPER_TTL_MS,
which is claude's own re-invocation cache for the helper script).

The ddtool command that resolves the token is behind an
EvalTokenResolver SPI; the only implementation is DtoolEvalTokenResolver
(DataDog-specific). Once drydock grows plugin support it is intended to
move behind a DD plugin so the eval integration is not bound to a single
credential source.

The image is built on demand: `./gradlew claudeEvalImage`. evalAvailable()
probes both that the daemon answers and that the image is present, so the
UI checkbox is honestly gated. Non-eval sessions are unchanged: they keep
launching claude directly on the host.

Verified end-to-end: built the image, generated the docker run command,
ran it under a real PTY -- the entrypoint executed inside the container
and the token was read from the file, not the argv. The ClaudeEvalProxy
(omlx marking) is deleted; nothing references it.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 app/build.gradle.kts                          |  12 +
 app/src/main/docker/claude-eval/Dockerfile    |  32 ++
 .../app/drydock/agent/api/AgentRegistry.java  |  10 +
 .../drydock/agent/api/EvalTokenResolver.java  |  38 ++
 .../providers/claude/ClaudeAgentProvider.java |  84 +++-
 .../claude/internal/ClaudeEvalContainer.java  | 435 ++++++++++++++++++
 .../claude/internal/ClaudeEvalProxy.java      | 144 ------
 .../internal/DtoolEvalTokenResolver.java      |  85 ++++
 .../app/drydock/agent/spi/AgentProvider.java  |  13 +
 .../app/drydock/ui/RepositorySidebar.java     |  22 +-
 .../main/java/app/drydock/ui/UiFormats.java   |  20 +
 .../claude/ClaudeAgentProviderTest.java       |  43 ++
 .../internal/ClaudeEvalContainerTest.java     | 168 +++++++
 .../internal/DtoolEvalTokenResolverTest.java  |  38 ++
 14 files changed, 983 insertions(+), 161 deletions(-)
 create mode 100644 app/src/main/docker/claude-eval/Dockerfile
 create mode 100644 app/src/main/java/app/drydock/agent/api/EvalTokenResolver.java
 create mode 100644 app/src/main/java/app/drydock/agent/providers/claude/internal/ClaudeEvalContainer.java
 delete mode 100644 app/src/main/java/app/drydock/agent/providers/claude/internal/ClaudeEvalProxy.java
 create mode 100644 app/src/main/java/app/drydock/agent/providers/claude/internal/DtoolEvalTokenResolver.java
 create mode 100644 app/src/test/java/app/drydock/agent/providers/claude/internal/ClaudeEvalContainerTest.java
 create mode 100644 app/src/test/java/app/drydock/agent/providers/claude/internal/DtoolEvalTokenResolverTest.java

diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index 5e8a49ed..67f78f00 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -372,6 +372,18 @@ tasks.named<Javadoc>("javadoc") {
     (options as StandardJavadocDocletOptions).addStringOption("Xdoclint:none", "-quiet")
 }
 
+// The container image used for Claude eval sessions (see
+// ClaudeEvalContainer). Built on demand -- `./gradlew claudeEvalImage` --
+// against whatever `docker` context is active (Colima on macOS, a local or
+// remote daemon on Linux). Not wired into the regular build: it is a host
+// setup step, not a per-checkout artifact, and it needs a running daemon.
+tasks.register<Exec>("claudeEvalImage") {
+    group = "build"
+    description = "Builds the drydock-claude-eval Docker image for Claude eval sessions."
+    workingDir = file("src/main/docker/claude-eval")
+    commandLine("docker", "build", "-t", "drydock-claude-eval:latest", ".")
+}
+
 // Central Portal Publisher API transport + signing for the custom `drydock`
 // publication created above. Credentials come from Gradle properties / env
 // (ORG_GRADLE_PROJECT_mavenCentralUsername/Password) and the in-memory GPG key
diff --git a/app/src/main/docker/claude-eval/Dockerfile b/app/src/main/docker/claude-eval/Dockerfile
new file mode 100644
index 00000000..b586dd9d
--- /dev/null
+++ b/app/src/main/docker/claude-eval/Dockerfile
@@ -0,0 +1,32 @@
+# The container image used for Claude eval sessions (see
+# ClaudeEvalContainer). Runs Claude Code's native Linux build inside a
+# container so a seeded local settings file can carry the eval-specific
+# x-target-account header, which the host's managed settings (locked to
+# the highest precedence scope) forbid us from adding.
+#
+# Build on demand:  ./gradlew claudeEvalImage
+# (uses whatever `docker` context is active -- Colima on macOS, a local or
+# remote daemon on Linux).
+
+FROM debian:bookworm-slim
+
+# git: Claude's own Bash tool calls `git`; the worktree's .git points back
+#       into the main repo object store, both mounted from the host.
+# curl + ca-certificates: the native installer downloads over HTTPS.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates curl git \
+    && rm -rf /var/lib/apt/lists/*
+
+# Claude Code native build. The install script places the launcher at
+# ~/.local/bin/claude and the versioned binary under ~/.local/share/claude.
+# Runs as root in this image, so HOME=/root.
+RUN curl -fsSL https://claude.ai/install.sh | bash
+
+ENV PATH="/root/.local/bin:${PATH}"
+
+# The inner `claude ...` command arrives as an entrypoint script mounted from
+# the host (ClaudeEvalContainer.wrap writes it into the config-dir mount).
+# This image's ENTRYPOINT is `sh`, so `docker run <img> <script>` becomes
+# `sh <script>` -- the launcher MUST NOT prepend an extra `sh`, or it would
+# be `sh sh <script>` and fail with "cannot open sh".
+ENTRYPOINT ["sh"]
diff --git a/app/src/main/java/app/drydock/agent/api/AgentRegistry.java b/app/src/main/java/app/drydock/agent/api/AgentRegistry.java
index 9dc4f1cc..3b3516ab 100644
--- a/app/src/main/java/app/drydock/agent/api/AgentRegistry.java
+++ b/app/src/main/java/app/drydock/agent/api/AgentRegistry.java
@@ -4,6 +4,7 @@
 
 import java.lang.System.Logger;
 import java.lang.System.Logger.Level;
+import java.time.Instant;
 import java.util.ArrayList;
 import java.util.EnumMap;
 import java.util.List;
@@ -141,6 +142,15 @@ public boolean evalAvailable(AgentKind kind) {
         return provider(kind).map(AgentProvider::evalAvailable).orElse(false);
     }
 
+    /**
+     * When the eval session's auth token expires, for display only. Delegates
+     * to the provider; safe to read on the FX thread (it reads an in-memory
+     * snapshot, no I/O).
+     */
+    public Optional<Instant> evalTokenExpiry(AgentKind kind, String sessionKey) {
+        return provider(kind).flatMap(p -> p.evalTokenExpiry(sessionKey));
+    }
+
     /**
      * Whether {@code kind}'s provider reports remote-session support, per
      * {@link app.drydock.agent.spi.AgentProvider#supportsRemote()}. Cached
diff --git a/app/src/main/java/app/drydock/agent/api/EvalTokenResolver.java b/app/src/main/java/app/drydock/agent/api/EvalTokenResolver.java
new file mode 100644
index 00000000..67071fae
--- /dev/null
+++ b/app/src/main/java/app/drydock/agent/api/EvalTokenResolver.java
@@ -0,0 +1,38 @@
+package app.drydock.agent.api;
+
+import java.time.Instant;
+import java.util.Optional;
+
+/**
+ * Resolves an auth token for the eval account, plus its expiry when
+ * knowable. The token charges a session's model traffic to the eval
+ * account instead of the user's.
+ *
+ * <p>This is an SPI rather than a hardcoded command so the resolution
+ * mechanism is swappable: the default implementation runs a host-side
+ * credential helper ({@code ddtool}), but once Drydock grows plugin
+ * support a provider-specific plugin can supply this so the eval
+ * integration is not bound to a single credential source.</p>
+ *
+ * <p>Implementations may block (process spawn, network) and MUST be called
+ * off the JavaFX application thread. {@link #resolveToken()} is repeatable:
+ * a long-running eval session may outlive the first token's TTL, so callers
+ * re-invoke this to refresh (e.g. on resume).</p>
+ */
+public interface EvalTokenResolver {
+
+    /** A resolved auth token and, when the credential carries it, the instant it expires. */
+    record ResolvedToken(String token, Optional<Instant> expiry) {
+        public ResolvedToken {
+            java.util.Objects.requireNonNull(token, "token");
+            java.util.Objects.requireNonNull(expiry, "expiry");
+        }
+    }
+
+    /**
+     * Resolves a fresh token. Empty when the credential is unavailable
+     * (helper missing, refused, malformed): the caller fails the launch
+     * loudly rather than silently shipping an unauthenticated session.
+     */
+    Optional<ResolvedToken> resolveToken();
+}
diff --git a/app/src/main/java/app/drydock/agent/providers/claude/ClaudeAgentProvider.java b/app/src/main/java/app/drydock/agent/providers/claude/ClaudeAgentProvider.java
index 564c2196..403bd924 100644
--- a/app/src/main/java/app/drydock/agent/providers/claude/ClaudeAgentProvider.java
+++ b/app/src/main/java/app/drydock/agent/providers/claude/ClaudeAgentProvider.java
@@ -16,13 +16,16 @@
 import app.drydock.agent.spi.AgentProvider;
 import app.drydock.agent.providers.claude.internal.ClaudeCapabilities;
 import app.drydock.agent.providers.claude.internal.ClaudeCapabilityService;
-import app.drydock.agent.providers.claude.internal.ClaudeEvalProxy;
+import app.drydock.agent.providers.claude.internal.ClaudeEvalContainer;
+import app.drydock.agent.providers.claude.internal.ClaudeEvalContainer.EvalSetup;
 import app.drydock.agent.providers.claude.internal.ClaudeExecutableLocator;
 import app.drydock.agent.providers.claude.internal.ClaudeHookInstaller;
 import app.drydock.agent.providers.claude.internal.ConversationCatalog;
 import app.drydock.process.SshCommandBuilder;
 
+import java.io.IOException;
 import java.nio.file.Path;
+import java.time.Instant;
 import java.util.Optional;
 
 /**
@@ -40,18 +43,27 @@ public final class ClaudeAgentProvider implements AgentProvider {
     private ClaudeCapabilityService capabilityService;
     private ClaudeConversationSource conversationSource;
     private ClaudeActivityReporter activityReporter;
-    private final ClaudeEvalProxy evalProxy = new ClaudeEvalProxy();
+    /** The eval container; a test stub from the constructor, or the real one built at {@link #init}. */
+    private ClaudeEvalContainer evalContainer;
+    /** The activity state-word dir, needed to mount it into the eval container. Set at {@link #init}. */
+    private Path activityDirectory;
     /** Set once by the background probe at {@link #init}; read by {@link #evalAvailable()} on the FX thread. */
     private volatile boolean evalAvailable;
 
     /** Public no-arg constructor required by {@link java.util.ServiceLoader}. */
     public ClaudeAgentProvider() {
-        this(new ClaudeExecutableLocator());
+        this(new ClaudeExecutableLocator(), null);
     }
 
     /** For tests: inject a locator (e.g. a nonexistent path to force conservative caps). */
     public ClaudeAgentProvider(ClaudeExecutableLocator locator) {
+        this(locator, null);
+    }
+
+    /** For tests: inject the eval container (e.g. a stub that reports unavailable). */
+    public ClaudeAgentProvider(ClaudeExecutableLocator locator, ClaudeEvalContainer evalContainer) {
         this.locator = locator;
+        this.evalContainer = evalContainer;
     }
 
     @Override
@@ -69,11 +81,11 @@ public void init(AgentContext ctx) {
         this.capabilityService = new ClaudeCapabilityService(locator, ctx.backgroundExecutor());
         this.conversationSource = new ClaudeConversationSource(new ConversationCatalog());
         this.activityReporter = new ClaudeActivityReporter(new ClaudeHookInstaller(ctx.stateDirectory()));
-        // Probe omlx_proxy off the FX thread; the result is cached so the
-        // UI's evalAvailable() read never blocks. omlx_proxy may start later
-        // than drydock -- re-probe on the next launch via markEvalSession's
-        // own probe is not done; restart drydock if the proxy comes up after.
-        ctx.backgroundExecutor().execute(() -> evalAvailable = evalProxy.probe());
+        this.activityDirectory = ctx.activityDirectory();
+        if (evalContainer == null) {
+            evalContainer = new ClaudeEvalContainer(ctx.stateDirectory());
+        }
+        ctx.backgroundExecutor().execute(() -> evalAvailable = evalContainer.probe());
     }
 
     @Override
@@ -125,6 +137,12 @@ public LaunchPlan buildCreateCommand(CreateContext c) {
         }
         command.append(activitySettingsFlag(caps));
         command.append(mcpConfigFlag(caps, c.mcp().flatMap(McpAccess::credentialFile)));
+        if (c.evalMode()) {
+            return LaunchPlan.of(
+                    wrapEval(command.toString(), c.sessionId(), c.workingDirectory(),
+                            c.mcp().flatMap(McpAccess::credentialFile)),
+                    sessionIdUsed);
+        }
         return LaunchPlan.of(command.toString(), sessionIdUsed);
     }
 
@@ -141,13 +159,24 @@ public LaunchPlan buildResumeCommand(ResumeContext r) {
         }
         ClaudeCapabilities caps = detectCaps();
         String suffix = activitySettingsFlag(caps) + mcpConfigFlag(caps, r.mcp().flatMap(McpAccess::credentialFile));
+        String inner;
         if (r.agentSessionId().isPresent()) {
-            return LaunchPlan.of(ENV_CLEANUP_PREFIX + "claude --resume " + AgentCommands.shellQuote(r.agentSessionId().get()) + suffix, false);
+            inner = ENV_CLEANUP_PREFIX + "claude --resume " + AgentCommands.shellQuote(r.agentSessionId().get()) + suffix;
+        } else if (r.agentSessionName().isPresent()) {
+            inner = ENV_CLEANUP_PREFIX + "claude --resume " + AgentCommands.shellQuote(r.agentSessionName().get()) + suffix;
+        } else {
+            inner = ENV_CLEANUP_PREFIX + "claude --resume" + suffix;
         }
-        if (r.agentSessionName().isPresent()) {
-            return LaunchPlan.of(ENV_CLEANUP_PREFIX + "claude --resume " + AgentCommands.shellQuote(r.agentSessionName().get()) + suffix, false);
+        if (r.evalMode()) {
+            // Resume key is the agent session id; for PRESET it equals the
+            // --session-id drydock minted at create, so the seeded config
+            // dir (keyed by it) persists across resumes and mark() refreshes
+            // the token.
+            String key = r.agentSessionId().orElse("");
+            return LaunchPlan.of(wrapEval(inner, key, r.workingDirectory(),
+                    r.mcp().flatMap(McpAccess::credentialFile)), false);
         }
-        return LaunchPlan.of(ENV_CLEANUP_PREFIX + "claude --resume" + suffix, false);
+        return LaunchPlan.of(inner, false);
     }
 
     @Override
@@ -177,12 +206,17 @@ public boolean evalAvailable() {
 
     @Override
     public void markEvalSession(String sessionKey) {
-        evalProxy.mark(sessionKey);
+        evalContainer.mark(sessionKey);
     }
 
     @Override
     public void unmarkEvalSession(String sessionKey) {
-        evalProxy.unmark(sessionKey);
+        evalContainer.unmark(sessionKey);
+    }
+
+    @Override
+    public Optional<Instant> evalTokenExpiry(String sessionKey) {
+        return evalContainer.setupFor(sessionKey).map(EvalSetup::tokenExpiry);
     }
 
     /** Uncached, like the pre-seam code: every launch/resume re-probes. Runs on the caller's (background) thread. */
@@ -195,6 +229,28 @@ private ClaudeCapabilities detectCaps() {
         }
     }
 
+    /**
+     * Wraps the bare {@code claude ...} command in a {@code docker run} that
+     * runs it inside the eval container. Throws if the container setup is
+     * missing (ddtool or docker unavailable): an eval session that cannot
+     * be containerized fails loudly rather than silently shipping an
+     * unauthenticated host launch.
+     */
+    private String wrapEval(String innerCommand, String sessionKey, Path worktree, Optional<Path> mcpConfig) {
+        EvalSetup setup = evalContainer.setupFor(sessionKey).orElseThrow(() -> new IllegalStateException(
+                "Eval session " + sessionKey + " has no container setup; ddtool or docker unavailable"));
+        Optional<Path> settingsFile = activityReporter.settingsFile();
+        if (settingsFile.isEmpty() || activityDirectory == null) {
+            throw new IllegalStateException("Eval container needs the activity hook dirs, which are not installed");
+        }
+        try {
+            return evalContainer.wrap(setup, innerCommand, worktree, mcpConfig,
+                    settingsFile.get().getParent(), activityDirectory);
+        } catch (IOException e) {
+            throw new IllegalStateException("Could not write eval entrypoint: " + e.getMessage(), e);
+        }
+    }
+
     private String activitySettingsFlag(ClaudeCapabilities caps) {
         Optional<Path> settings = activityReporter.settingsFile();
         if (!caps.supportsSettings() || settings.isEmpty()) {
diff --git a/app/src/main/java/app/drydock/agent/providers/claude/internal/ClaudeEvalContainer.java b/app/src/main/java/app/drydock/agent/providers/claude/internal/ClaudeEvalContainer.java
new file mode 100644
index 00000000..e24ca176
--- /dev/null
+++ b/app/src/main/java/app/drydock/agent/providers/claude/internal/ClaudeEvalContainer.java
@@ -0,0 +1,435 @@
+package app.drydock.agent.providers.claude.internal;
+
+import java.io.IOException;
+import java.lang.System.Logger;
+import java.lang.System.Logger.Level;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
+import java.nio.file.attribute.FileAttribute;
+import java.nio.file.attribute.PosixFilePermissions;
+import java.nio.file.attribute.PosixFilePermission;
+import java.time.Instant;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import app.drydock.agent.api.EvalTokenResolver;
+import app.drydock.process.ProcessResult;
+import app.drydock.process.ProcessRunner;
+import app.drydock.state.json.JsonParseException;
+import app.drydock.state.json.JsonParser;
+import app.drydock.state.json.JsonValue;
+import app.drydock.state.json.JsonValue.JsonObject;
+import app.drydock.state.json.JsonValue.JsonString;
+import app.drydock.state.json.JsonWriter;
+
+/**
+ * Runs an eval-mode Claude session inside a container so the eval-specific
+ * {@code x-target-account: eval} request header can be carried in a local
+ * settings file, instead of injected through the host's omlx_proxy.
+ *
+ * <p><b>Why a container at all.</b> Claude Code's managed settings
+ * ({@code /Library/Application Support/ClaudeCode/managed-settings.json} on
+ * macOS, {@code /etc/claude-code/managed-settings.json} on Linux) are the
+ * highest-precedence scope and cannot be overridden by env vars or
+ * {@code --settings}. They pin {@code ANTHROPIC_BASE_URL} at the host
+ * omlx_proxy and carry {@code ANTHROPIC_CUSTOM_HEADERS}; drydock cannot add
+ * a header to them. But inside a container there is no managed-settings
+ * file, so a settings file drydock seeds in {@code CLAUDE_CONFIG_DIR} is the
+ * only source of truth. That seed is copied from the host's managed
+ * settings (so auth, base URL, and telemetry stay the same) with two
+ * edits: the base URL is rewritten to {@code host.docker.internal} so the
+ * container can still reach the host's omlx_proxy, and
+ * {@code x-target-account: eval} is appended to
+ * {@code ANTHROPIC_CUSTOM_HEADERS}. The auth token is resolved on the host
+ * (where {@code ddtool} lives) and passed in as {@code ANTHROPIC_API_KEY},
+ * so {@code apiKeyHelper} is dropped from the seed.</p>
+ *
+ * <p><b>Container runtime.</b> Targets the {@code docker} CLI against
+ * whatever context is active -- Colima on macOS, a local or remote daemon
+ * on Linux. The image is built once by the {@code claudeEvalImage} Gradle
+ * task; {@link #probe} checks both that the daemon answers and that the
+ * image is present, so {@code evalAvailable()} honestly gates the UI
+ * checkbox.</p>
+ *
+ * <p><b>Mounts.</b> A git worktree's {@code .git} is a file pointing back
+ * into the main repo's object store via an absolute path, so for git to
+ * work inside the container both the worktree and the main repo root are
+ * bind-mounted at their original host paths (option 4a). The activity-hook
+ * script, the activity state directory, and the per-session MCP config
+ * file are likewise mounted at their host paths, so the existing
+ * {@code --settings}/{@code --mcp-config} flags resolve unchanged and the
+ * host-side activity watcher keeps reading the same files.</p>
+ *
+ * <p>All methods are blocking and must be called off the JavaFX application
+ * thread. {@link #probe} is run once at provider init (background) and its
+ * result cached.</p>
+ */
+public class ClaudeEvalContainer {
+
+    private static final Logger LOG = System.getLogger(ClaudeEvalContainer.class.getName());
+
+    /** The image tag built by the {@code claudeEvalImage} Gradle task. */
+    private static final String IMAGE = System.getProperty(
+            "app.drydock.eval.claude.image", "drydock-claude-eval:latest");
+
+    /** Managed-settings locations, in precedence order (macOS first, then Linux). */
+    private static final List<Path> MANAGED_SETTINGS_PATHS = managedSettingsPaths();
+
+    private static List<Path> managedSettingsPaths() {
+        String override = System.getProperty("app.drydock.eval.claude.managedSettings");
+        if (override != null && !override.isBlank()) {
+            return List.of(Path.of(override));
+        }
+        return List.of(
+                Path.of("/Library/Application Support/ClaudeCode/managed-settings.json"),
+                Path.of("/etc/claude-code/managed-settings.json"));
+    }
+
+    /** The header that routes traffic to the eval account. */
+    private static final String EVAL_HEADER = "x-target-account: eval";
+
+    /** Base URL rewritten to reach the host's omlx_proxy from inside the container. */
+    private static final String CONTAINER_BASE_URL = "http://host.docker.internal:4000";
+
+    private static final String AUTH_TOKEN_ENV = "ANTHROPIC_API_KEY";
+    private static final String CONFIG_DIR_ENV = "CLAUDE_CONFIG_DIR";
+    private static final String CUSTOM_HEADERS_KEY = "ANTHROPIC_CUSTOM_HEADERS";
+    private static final String BASE_URL_KEY = "ANTHROPIC_BASE_URL";
+    private static final String API_KEY_HELPER_KEY = "apiKeyHelper";
+    private static final String HELPER_TTL_KEY = "CLAUDE_CODE_API_KEY_HELPER_TTL_MS";
+
+    private static final FileAttribute<Set<PosixFilePermission>> OWNER_ONLY =
+            PosixFilePermissions.asFileAttribute(PosixFilePermissions.fromString("rw-------"));
+
+    /** {@code gitdir: <path>} in a worktree's {@code .git} file. */
+    private static final Pattern GITDIR_LINE = Pattern.compile("^gitdir:\\s+(.+)$");
+
+    private final Path stateDirectory;
+    private final EvalTokenResolver tokenResolver;
+    /** sessionKey -> setup; populated by {@link #mark}, read by the command builder, cleared by {@link #unmark}. */
+    private final Map<String, EvalSetup> setups = new ConcurrentHashMap<>();
+
+    public ClaudeEvalContainer(Path stateDirectory) {
+        this(stateDirectory, new app.drydock.agent.providers.claude.internal.DtoolEvalTokenResolver());
+    }
+
+    /** For tests: inject the token resolver (e.g. a stub returning a fixed token). */
+    public ClaudeEvalContainer(Path stateDirectory, EvalTokenResolver tokenResolver) {
+        this.stateDirectory = Objects.requireNonNull(stateDirectory, "stateDirectory");
+        this.tokenResolver = Objects.requireNonNull(tokenResolver, "tokenResolver");
+    }
+
+    /** The per-session eval setup: the resolved auth token, its JWT expiry, and the seeded config dir. */
+    public record EvalSetup(String token, Instant tokenExpiry, Path configDir) { }
+
+    /**
+     * Whether the container runtime is reachable and the eval image is
+     * present. Best-effort: any failure (refused, timeout, non-zero,
+     * missing image) is {@code false}, so eval mode is disabled rather than
+     * half-working.
+     */
+    public boolean probe() {
+        try {
+            ProcessResult res = ProcessRunner.run(
+                    List.of("docker", "image", "inspect", IMAGE),
+                    null, java.time.Duration.ofSeconds(5));
+            if (res.exitCode() != 0) {
+                LOG.log(Level.DEBUG, () -> "eval image probe failed (exit " + res.exitCode()
+                        + "); run ./gradlew claudeEvalImage. stderr: "
+                        + ProcessRunner.excerpt(res.stderr()));
+                return false;
+            }
+            return true;
+        } catch (Exception e) {
+            LOG.log(Level.DEBUG, () -> "docker probe failed: " + e.getMessage());
+            return false;
+        }
+    }
+
+    /**
+     * Seeds the config dir for {@code sessionKey}: writes a settings.json
+     * derived from the host's managed settings (with the eval header and
+     * rewritten base URL), resolves a fresh auth token, and stashes the
+     * result for the command builder. Idempotent -- re-resolves a fresh
+     * token on every call (so a resume refreshes an expiring token).
+     *
+     * @return the setup, or {@code Optional#empty()} if the token could not
+     *         be resolved (the launch will then fail loudly in the command
+     *         builder rather than silently shipping an unauthenticated
+     *         container)
+     */
+    public Optional<EvalSetup> mark(String sessionKey) {
+        if (sessionKey == null || sessionKey.isBlank()) {
+            return Optional.empty();
+        }
+        Path configDir = stateDirectory.resolve("eval").resolve(sessionKey);
+        try {
+            Files.createDirectories(configDir);
+            seedSettings(configDir);
+        } catch (IOException e) {
+            LOG.log(Level.WARNING, () -> "Could not seed eval config dir " + configDir + ": " + e.getMessage());
+            return Optional.empty();
+        }
+        Optional<EvalTokenResolver.ResolvedToken> resolved = tokenResolver.resolveToken();
+        if (resolved.isEmpty()) {
+            return Optional.empty();
+        }
+        EvalTokenResolver.ResolvedToken token = resolved.get();
+        EvalSetup setup = new EvalSetup(token.token(), token.expiry().orElse(null), configDir);
+        setups.put(sessionKey, setup);
+        return Optional.of(setup);
+    }
+
+    /** Reverses {@link #mark}: deletes the per-session config dir and drops the stash. Idempotent. */
+    public void unmark(String sessionKey) {
+        if (sessionKey == null || sessionKey.isBlank()) {
+            return;
+        }
+        setups.remove(sessionKey);
+        Path configDir = stateDirectory.resolve("eval").resolve(sessionKey);
+        try {
+            deleteRecursively(configDir);
+        } catch (IOException e) {
+            LOG.log(Level.DEBUG, () -> "Could not delete eval config dir " + configDir + ": " + e.getMessage());
+        }
+    }
+
+    /** The stashed setup for {@code sessionKey}, or empty if {@link #mark} has not run (or failed). */
+    public Optional<EvalSetup> setupFor(String sessionKey) {
+        return Optional.ofNullable(setups.get(sessionKey));
+    }
+
+    /**
+     * Writes the inner claude command to {@code <configDir>/entrypoint.sh}
+     * and builds the {@code docker run} wrapper that executes it inside the
+     * container. The inner command is written to a file (not passed as a
+     * docker CMD argument) to avoid nested shell-quoting: the inner command
+     * already single-quotes its own arguments, and embedding it inside
+     * another {@code sh -c '...'} would require escaping those quotes.
+     *
+     * @param innerCommand   the bare {@code claude ...} command string the
+     *                       provider would normally run on the host
+     * @param worktree       the session's working directory (a worktree or
+     *                       a repo root), mounted at its own path
+     * @param mcpConfigFile  the per-session {@code --mcp-config} file, if any
+     * @param hooksDir       the activity-hook script + settings dir
+     *                       ({@code <stateDir>/hooks})
+     * @param activityDir    the activity state-word dir ({@code <stateDir>/activity})
+     */
+    public String wrap(EvalSetup setup, String innerCommand, Path worktree, Optional<Path> mcpConfigFile,
+                       Path hooksDir, Path activityDir) throws IOException {
+        // The auth token is written to an owner-only file in the mounted
+        // config dir, and the entrypoint exports it from there -- it never
+        // appears in `ps` on the host or in the command preview the UI
+        // shows. A 6-hour-lived credential on the argv would be a real
+        // exposure (AGENTS.md: "a credential must never be a command-line
+        // argument"), and the command string is reachable from log lines
+        // and the preview pane.
+        Path tokenFile = setup.configDir().resolve("auth-token");
+        writeOwnerOnly(tokenFile, setup.token());
+
+        // The entrypoint reads the token from the file, exports it, then
+        // runs the bare `claude ...` command. The image's ENTRYPOINT is
+        // `sh`, so `docker run <img> <entrypoint>` becomes
+        // `sh <entrypoint>` -- no extra `sh` here, or it would be
+        // `sh sh <entrypoint>` and fail with "cannot open sh".
+        Path entrypoint = setup.configDir().resolve("entrypoint.sh");
+        Files.writeString(entrypoint,
+                "#!/bin/sh\n"
+                + "export " + AUTH_TOKEN_ENV + "=\"$(cat " + shellQuote(tokenFile.toString()) + ")\"\n"
+                + innerCommand + "\n",
+                StandardCharsets.UTF_8);
+        try {
+            Files.setPosixFilePermissions(entrypoint, PosixFilePermissions.fromString("rwx------"));
+        } catch (UnsupportedOperationException ignored) {
+            // Non-POSIX FS: the container's sh will still read it; the exec bit is cosmetic then.
+        }
+
+        Path mainRepoRoot = resolveMainRepoRoot(worktree);
+        StringBuilder cmd = new StringBuilder("docker run --rm -it");
+        cmd.append(" --add-host=host.docker.internal:host-gateway");
+        cmd.append(" -e ").append(CONFIG_DIR_ENV).append('=').append(shellQuote(setup.configDir().toString()));
+        cmd.append(" -v ").append(shellQuote(setup.configDir().toString()))
+                .append(':').append(shellQuote(setup.configDir().toString()));
+        cmd.append(" -v ").append(shellQuote(mainRepoRoot.toString()))
+                .append(':').append(shellQuote(mainRepoRoot.toString()));
+        if (!mainRepoRoot.equals(worktree)) {
+            cmd.append(" -v ").append(shellQuote(worktree.toString()))
+                    .append(':').append(shellQuote(worktree.toString()));
+        }
+        cmd.append(" -v ").append(shellQuote(hooksDir.toString()))
+                .append(':').append(shellQuote(hooksDir.toString()));
+        cmd.append(" -v ").append(shellQuote(activityDir.toString()))
+                .append(':').append(shellQuote(activityDir.toString()));
+        mcpConfigFile.ifPresent(f -> cmd.append(" -v ").append(shellQuote(f.toString()))
+                .append(':').append(shellQuote(f.toString())));
+        cmd.append(" -w ").append(shellQuote(worktree.toString()));
+        cmd.append(' ').append(IMAGE);
+        cmd.append(' ').append(shellQuote(entrypoint.toString()));
+        return cmd.toString();
+    }
+
+    /**
+     * Reads the host's managed settings, applies the eval edits, and writes
+     * {@code <configDir>/settings.json}. If no managed-settings file is
+     * present, seeds from an empty object (the container then runs with only
+     * the eval header and the token drydock passes). Package-private for
+     * unit testing.
+     *
+     * <p>Mutates the parsed {@link JsonObject} in place: {@link #readManagedSettings}
+     * returns a fresh parse on every call, so the mutation is local. If that
+     * ever stops being true, this method would corrupt shared state.
+     */
+    void seedSettings(Path configDir) throws IOException {
+        JsonObject root = readManagedSettings().orElseGet(JsonObject::empty);
+        JsonObject env = root.members().containsKey("env")
+                ? asObject(root.members().get("env"))
+                : new JsonObject(new LinkedHashMap<>());
+        // Rewrite base URL so the container reaches the host's omlx_proxy.
+        putMember(env, BASE_URL_KEY, new JsonString(CONTAINER_BASE_URL));
+        // Append the eval header to the custom-headers block.
+        String headers = env.members().containsKey(CUSTOM_HEADERS_KEY)
+                ? asString(env.members().get(CUSTOM_HEADERS_KEY)) : "";
+        if (!headers.isEmpty() && !headers.endsWith("\n")) {
+            headers += "\n";
+        }
+        if (!containsHeader(headers, EVAL_HEADER)) {
+            headers += EVAL_HEADER + "\n";
+        }
+        putMember(env, CUSTOM_HEADERS_KEY, new JsonString(headers));
+        // The token is passed as ANTHROPIC_API_KEY env, so the helper is dead weight.
+        env.members().remove(HELPER_TTL_KEY);
+        putMember(root, "env", env);
+        root.members().remove(API_KEY_HELPER_KEY);
+
+        Path target = configDir.resolve("settings.json");
+        writeAtomically(target, JsonWriter.write(root));
+    }
+
+    /** True if {@code headers} already names the {@code name: value} header line. */
+    private static boolean containsHeader(String headers, String header) {
+        String name = header.substring(0, header.indexOf(':'));
+        for (String line : headers.split("\n")) {
+            int colon = line.indexOf(':');
+            if (colon > 0 && line.substring(0, colon).trim().equalsIgnoreCase(name)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private static void putMember(JsonObject obj, String key, JsonValue value) {
+        obj.members().put(key, value);
+    }
+
+    private static JsonObject asObject(JsonValue v) {
+        return v instanceof JsonObject o ? o : new JsonObject(new LinkedHashMap<>());
+    }
+
+    private static String asString(JsonValue v) {
+        return v instanceof JsonString s ? s.value() : "";
+    }
+
+    private Optional<JsonObject> readManagedSettings() {
+        for (Path p : MANAGED_SETTINGS_PATHS) {
+            try {
+                if (Files.isReadable(p)) {
+                    String content = Files.readString(p, StandardCharsets.UTF_8);
+                    JsonValue parsed = JsonParser.parse(content);
+                    return parsed instanceof JsonObject o ? Optional.of(o) : Optional.empty();
+                }
+            } catch (IOException | JsonParseException e) {
+                LOG.log(Level.WARNING, () -> "Could not read managed settings " + p + ": " + e.getMessage());
+            }
+        }
+        return Optional.empty();
+    }
+
+    /**
+     * Resolves the main repo root backing a worktree. A worktree's {@code .git}
+     * is a file reading {@code gitdir: <mainRepo>/.git/worktrees/<name>}; the
+     * main repo root is three {@code getParent()} calls up from that path. If
+     * {@code .git} is a directory (not a worktree), the worktree itself is
+     * the repo root.
+     */
+    static Path resolveMainRepoRoot(Path worktree) {
+        Path git = worktree.resolve(".git");
+        if (Files.isDirectory(git)) {
+            return worktree;
+        }
+        try {
+            String content = Files.readString(git, StandardCharsets.UTF_8).strip();
+            Matcher m = GITDIR_LINE.matcher(content);
+            if (m.matches()) {
+                Path gitdir = Path.of(m.group(1).trim());
+                // <mainRepo>/.git/worktrees/<name> -> up three levels -> <mainRepo>
+                Path mainRepo = gitdir.getParent() != null ? gitdir.getParent().getParent() : null;
+                if (mainRepo != null && mainRepo.getParent() != null) {
+                    mainRepo = mainRepo.getParent();
+                }
+                if (mainRepo != null && Files.isDirectory(mainRepo.resolve(".git"))) {
+                    return mainRepo;
+                }
+            }
+        } catch (IOException e) {
+            LOG.log(Level.DEBUG, () -> "Could not read worktree .git file at " + git + ": " + e.getMessage());
+        }
+        // Fallback: mount only the worktree. git operations inside the
+        // container may fail, but the working directory is correct.
+        LOG.log(Level.WARNING, () -> "Eval container: could not resolve the main repo root backing worktree "
+                + worktree + "; mounting only the worktree. Git operations inside the container may fail.");
+        return worktree;
+    }
+
+    private static void deleteRecursively(Path dir) throws IOException {
+        if (!Files.exists(dir)) {
+            return;
+        }
+        try (var stream = Files.walk(dir)) {
+            var paths = stream.sorted(java.util.Comparator.reverseOrder()).toList();
+            for (Path p : paths) {
+                Files.deleteIfExists(p);
+            }
+        }
+    }
+
+    /** Writes {@code content} to an owner-only file (the auth token). */
+    private static void writeOwnerOnly(Path target, String content) throws IOException {
+        Path temp = target.resolveSibling(target.getFileName() + ".tmp");
+        Files.writeString(temp, content, StandardCharsets.UTF_8);
+        try {
+            Files.setPosixFilePermissions(temp, PosixFilePermissions.fromString("rw-------"));
+        } catch (UnsupportedOperationException ignored) {
+            // Non-POSIX FS: best-effort; the file is in an owner-only dir.
+        }
+        try {
+            Files.move(temp, target, StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.ATOMIC_MOVE);
+        } catch (IOException e) {
+            Files.move(temp, target, StandardCopyOption.REPLACE_EXISTING);
+        }
+    }
+
+    private static void writeAtomically(Path target, String content) throws IOException {
+        Path temp = target.resolveSibling(target.getFileName() + ".tmp");
+        Files.writeString(temp, content, StandardCharsets.UTF_8);
+        try {
+            Files.move(temp, target, StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.ATOMIC_MOVE);
+        } catch (IOException e) {
+            Files.move(temp, target, StandardCopyOption.REPLACE_EXISTING);
+        }
+    }
+
+    /** POSIX single-quote, so paths with spaces (e.g. "Application Support") survive the shell. */
+    private static String shellQuote(String s) {
+        return "'" + s.replace("'", "'\\''") + "'";
+    }
+}
diff --git a/app/src/main/java/app/drydock/agent/providers/claude/internal/ClaudeEvalProxy.java b/app/src/main/java/app/drydock/agent/providers/claude/internal/ClaudeEvalProxy.java
deleted file mode 100644
index 45102947..00000000
--- a/app/src/main/java/app/drydock/agent/providers/claude/internal/ClaudeEvalProxy.java
+++ /dev/null
@@ -1,144 +0,0 @@
-package app.drydock.agent.providers.claude.internal;
-
-import java.lang.System.Logger;
-import java.lang.System.Logger.Level;
-import java.net.URI;
-import java.net.URLEncoder;
-import java.net.http.HttpClient;
-import java.net.http.HttpRequest;
-import java.net.http.HttpResponse;
-import java.nio.charset.StandardCharsets;
-import java.time.Duration;
-import java.util.Objects;
-
-/**
- * Talks to the local omlx_proxy that sits between Claude Code and the AI
- * gateway, to route an eval session's traffic to the eval account.
- *
- * <p>Claude Code's {@code ANTHROPIC_*} env is locked to user/managed scope, so
- * drydock cannot inject an {@code x-target-account: eval} header (or a custom
- * base URL, or an auth token) per session. But claude is already proxied
- * through omlx_proxy at {@code 127.0.0.1:4000}, and every request -- parent and
- * sub-agent -- carries {@code x-claude-code-session-id}, which equals the
- * {@code --session-id} drydock passes. omlx_proxy can therefore add the header
- * for a session id drydock marks here, covering the whole session including
- * model-pinned subagents (the {@code --model} sentinel could not).</p>
- *
- * <p>All methods are blocking and must be called off the JavaFX application
- * thread. {@link #probe} is run once at provider init (background) and its
- * result cached, so the UI's {@code evalAvailable()} read never blocks.</p>
- */
-public final class ClaudeEvalProxy {
-
-    private static final Logger LOG = System.getLogger(ClaudeEvalProxy.class.getName());
-
-    /** Where omlx_proxy listens. Overridable for tests / non-standard setups. */
-    private static final String BASE_URL = System.getProperty(
-            "app.drydock.eval.claude.proxyBaseUrl", "http://127.0.0.1:4000");
-
-    private static final String HEADER = "x-target-account";
-    private static final String HEADER_VALUE = "eval";
-
-    private final String baseUrl;
-    private final HttpClient client = HttpClient.newBuilder()
-            .connectTimeout(Duration.ofSeconds(2)).build();
-
-    public ClaudeEvalProxy() {
-        this(BASE_URL);
-    }
-
-    /** For tests: an explicit base URL. */
-    ClaudeEvalProxy(String baseUrl) {
-        this.baseUrl = Objects.requireNonNull(baseUrl, "baseUrl").endsWith("/")
-                ? baseUrl.substring(0, baseUrl.length() - 1) : baseUrl;
-    }
-
-    /** The header omlx_proxy injects for a marked session. */
-    public static String headerName() {
-        return HEADER;
-    }
-
-    public static String headerValue() {
-        return HEADER_VALUE;
-    }
-
-    /**
-     * Whether omlx_proxy is reachable and answering its health endpoint.
-     * Best-effort: any failure (refused, timeout, non-OK, malformed) is
-     * {@code false}, so eval mode is disabled rather than half-working.
-     */
-    public boolean probe() {
-        try {
-            HttpResponse<String> res = client.send(
-                    HttpRequest.newBuilder(URI.create(baseUrl + "/health"))
-                            .timeout(Duration.ofSeconds(2)).GET().build(),
-                    HttpResponse.BodyHandlers.ofString());
-            if (res.statusCode() != 200) {
-                return false;
-            }
-            // The body is JSON with "status":"ok"; accept it loosely.
-            return res.body().contains("\"status\":\"ok\"")
-                    || res.body().contains("\"status\": \"ok\"");
-        } catch (Exception e) {
-            LOG.log(Level.DEBUG, () -> "omlx_proxy probe failed: " + e.getMessage());
-            return false;
-        }
-    }
-
-    /**
-     * Marks {@code sessionKey} as eval. Idempotent on the proxy side. Never
-     * throws: a failure only means the eval header will not be injected for
-     * this session (degraded, not fatal).
-     */
-    public void mark(String sessionKey) {
-        if (sessionKey == null || sessionKey.isBlank()) {
-            return;
-        }
-        post("/omlx/eval-session", "{\"session_id\":\"" + jsonEscape(sessionKey) + "\"}");
-    }
-
-    /** Reverses {@link #mark}. Idempotent; never throws. */
-    public void unmark(String sessionKey) {
-        if (sessionKey == null || sessionKey.isBlank()) {
-            return;
-        }
-        try {
-            URI uri = URI.create(baseUrl + "/omlx/eval-session?session_id="
-                    + URLEncoder.encode(sessionKey, StandardCharsets.UTF_8));
-            client.send(HttpRequest.newBuilder(uri)
-                            .timeout(Duration.ofSeconds(2)).DELETE().build(),
-                    HttpResponse.BodyHandlers.discarding());
-        } catch (Exception e) {
-            LOG.log(Level.DEBUG, () -> "omlx_proxy unmark failed for " + sessionKey + ": " + e.getMessage());
-        }
-    }
-
-    private void post(String path, String jsonBody) {
-        try {
-            client.send(HttpRequest.newBuilder(URI.create(baseUrl + path))
-                            .header("content-type", "application/json")
-                            .timeout(Duration.ofSeconds(2))
-                            .POST(HttpRequest.BodyPublishers.ofString(jsonBody, StandardCharsets.UTF_8))
-                            .build(),
-                    HttpResponse.BodyHandlers.discarding());
-        } catch (Exception e) {
-            LOG.log(Level.WARNING, () -> "omlx_proxy mark failed (" + path + "): " + e.getMessage());
-        }
-    }
-
-    private static String jsonEscape(String s) {
-        StringBuilder sb = new StringBuilder(s.length() + 8);
-        for (int i = 0; i < s.length(); i++) {
-            char c = s.charAt(i);
-            switch (c) {
-                case '"' -> sb.append("\\\"");
-                case '\\' -> sb.append("\\\\");
-                case '\n' -> sb.append("\\n");
-                case '\r' -> sb.append("\\r");
-                case '\t' -> sb.append("\\t");
-                default -> sb.append(c);
-            }
-        }
-        return sb.toString();
-    }
-}
\ No newline at end of file
diff --git a/app/src/main/java/app/drydock/agent/providers/claude/internal/DtoolEvalTokenResolver.java b/app/src/main/java/app/drydock/agent/providers/claude/internal/DtoolEvalTokenResolver.java
new file mode 100644
index 00000000..800b63bf
--- /dev/null
+++ b/app/src/main/java/app/drydock/agent/providers/claude/internal/DtoolEvalTokenResolver.java
@@ -0,0 +1,85 @@
+package app.drydock.agent.providers.claude.internal;
+
+import app.drydock.agent.api.EvalTokenResolver;
+import app.drydock.process.ProcessResult;
+import app.drydock.process.ProcessRunner;
+import app.drydock.state.json.JsonParseException;
+import app.drydock.state.json.JsonParser;
+import app.drydock.state.json.JsonValue;
+import app.drydock.state.json.JsonValue.JsonObject;
+
+import java.lang.System.Logger;
+import java.lang.System.Logger.Level;
+import java.nio.charset.StandardCharsets;
+import java.time.Instant;
+import java.util.Base64;
+import java.util.List;
+import java.util.Optional;
+
+/**
+ * Resolves the eval-account auth token by running {@code ddtool} on the
+ * host. DataDog-specific: the command audience and datacenter are pinned
+ * to the AI gateway's {@code rapid-ai-platform} service at
+ * {@code us1.ddbuild.io}.
+ *
+ * <p>This is the default {@link EvalTokenResolver}, wired in directly for
+ * now. Once Drydock grows plugin support it is intended to move behind a
+ * DataDog-specific plugin so the eval integration is not bound to a
+ * single credential source -- the SPI is the seam that makes that move
+ * a drop-in.</p>
+ *
+ * <p>The token is a JWT; its {@code exp} claim is decoded (without
+ * signature verification -- display only, not auth) so the UI can show
+ * a countdown. Blocking; must be called off the FX thread.</p>
+ */
+public final class DtoolEvalTokenResolver implements EvalTokenResolver {
+
+    private static final Logger LOG = System.getLogger(DtoolEvalTokenResolver.class.getName());
+
+    /** ddtool command that yields the eval-account auth token on stdout. */
+    private static final List<String> DTOOL_TOKEN_CMD = List.of(
+            "ddtool", "auth", "token", "rapid-ai-platform", "--datacenter", "us1.ddbuild.io");
+
+    @Override
+    public Optional<ResolvedToken> resolveToken() {
+        try {
+            ProcessResult res = ProcessRunner.run(DTOOL_TOKEN_CMD, null, java.time.Duration.ofSeconds(15));
+            if (res.exitCode() != 0) {
+                LOG.log(Level.WARNING, () -> "ddtool auth token failed (exit " + res.exitCode() + "): "
+                        + ProcessRunner.excerpt(res.stderr()));
+                return Optional.empty();
+            }
+            String token = res.stdout().strip();
+            if (token.isEmpty()) {
+                return Optional.empty();
+            }
+            return Optional.of(new ResolvedToken(token, decodeJwtExpiry(token)));
+        } catch (Exception e) {
+            LOG.log(Level.WARNING, () -> "ddtool auth token unavailable: " + e.getMessage());
+            return Optional.empty();
+        }
+    }
+
+    /**
+     * Decodes the {@code exp} claim from the JWT payload (middle segment)
+     * without verifying the signature: this is for display only, not auth.
+     */
+    static Optional<Instant> decodeJwtExpiry(String jwt) {
+        String[] parts = jwt.split("\\.");
+        if (parts.length < 2) {
+            return Optional.empty();
+        }
+        try {
+            byte[] payload = Base64.getUrlDecoder().decode(parts[1]);
+            JsonValue parsed = JsonParser.parse(new String(payload, StandardCharsets.UTF_8));
+            if (parsed instanceof JsonObject o && o.members().get("exp") instanceof JsonValue v) {
+                long exp = v instanceof JsonValue.JsonString s ? Long.parseLong(s.value())
+                        : v instanceof JsonValue.JsonNumber n ? n.asLong() : 0L;
+                return exp > 0 ? Optional.of(Instant.ofEpochSecond(exp)) : Optional.empty();
+            }
+        } catch (IllegalArgumentException | JsonParseException e) {
+            LOG.log(Level.DEBUG, () -> "Could not decode JWT exp: " + e.getMessage());
+        }
+        return Optional.empty();
+    }
+}
diff --git a/app/src/main/java/app/drydock/agent/spi/AgentProvider.java b/app/src/main/java/app/drydock/agent/spi/AgentProvider.java
index 28b332be..f93890a7 100644
--- a/app/src/main/java/app/drydock/agent/spi/AgentProvider.java
+++ b/app/src/main/java/app/drydock/agent/spi/AgentProvider.java
@@ -13,6 +13,7 @@
 import app.drydock.agent.api.SessionIdStrategy;
 
 import java.nio.file.Path;
+import java.time.Instant;
 import java.util.Optional;
 
 /**
@@ -126,4 +127,16 @@ default void markEvalSession(String sessionKey) { }
      * {@code markEvalSession} never ran for {@code sessionKey}.
      */
     default void unmarkEvalSession(String sessionKey) { }
+
+    /**
+     * When the eval session's auth token expires, for display only. Empty
+     * for a provider that does not resolve a token with a knowable expiry
+     * (or before {@link #markEvalSession} has run). The value is a snapshot
+     * from the token resolved at launch; it is not refreshed live, so a
+     * long-running session may outlive it -- the UI shows it as a hint, not
+     * a hard deadline.
+     */
+    default Optional<Instant> evalTokenExpiry(String sessionKey) {
+        return Optional.empty();
+    }
 }
diff --git a/app/src/main/java/app/drydock/ui/RepositorySidebar.java b/app/src/main/java/app/drydock/ui/RepositorySidebar.java
index 6f274926..fdb21212 100644
--- a/app/src/main/java/app/drydock/ui/RepositorySidebar.java
+++ b/app/src/main/java/app/drydock/ui/RepositorySidebar.java
@@ -2490,15 +2490,31 @@ private Optional<Label> findingsBadge(Path checkoutRoot, Runnable onReview) {
             });
         }
 
-        /** The eval-mode tooltip line, honest per provider: Pi reroutes, Claude and Codex are marked but not rerouted. */
-        private static String evalTooltipLine(ManagedAgentSession session) {
+        /**
+         * The eval-mode tooltip line, honest per provider. Claude now runs in a
+         * container with a seeded settings file (the header rides the request
+         * directly, no omlx_proxy marking); Pi reroutes via its bridge
+         * extension; Codex is not rerouted. For Claude the resolved token's
+         * JWT expiry is shown as a hint -- it is a snapshot from launch, not
+         * refreshed live, so a long session may outlive it.
+         */
+        private String evalTooltipLine(ManagedAgentSession session) {
             return switch (session.agentKind()) {
                 case PI -> "Eval mode: on (x-target-account: eval via the Pi bridge extension)";
-                case CLAUDE -> "Eval mode: on (x-target-account: eval via omlx_proxy)";
+                case CLAUDE -> "Eval mode: on (x-target-account: eval via the eval container)"
+                        + claudeEvalTokenLine(session);
                 case CODEX -> "Eval mode: on (not supported for Codex; requests are NOT rerouted)";
             };
         }
 
+        private String claudeEvalTokenLine(ManagedAgentSession session) {
+            return session.agentSessionId()
+                    .flatMap(id -> agentRegistry.evalTokenExpiry(session.agentKind(), id))
+                    .map(expiry -> "\nEval token expires: " + UiFormats.timeOfDay(expiry)
+                            + " (" + UiFormats.timeUntil(expiry) + ")")
+                    .orElse("");
+        }
+
         private StackPane buildSessionRow(ManagedAgentSession session, Repository repository) {
             boolean live = SessionStatusStyles.isRunning(session.status());
             Region dot = SessionStatusStyles.createDot(8, session.status(), live);
diff --git a/app/src/main/java/app/drydock/ui/UiFormats.java b/app/src/main/java/app/drydock/ui/UiFormats.java
index 0e483e88..95065ef9 100644
--- a/app/src/main/java/app/drydock/ui/UiFormats.java
+++ b/app/src/main/java/app/drydock/ui/UiFormats.java
@@ -37,6 +37,26 @@ public static String relativeTime(Instant instant) {
         return (seconds / 86400) + "d ago";
     }
 
+    /** Wall-clock time of day, e.g. {@code 16:40}, in the local time zone. */
+    public static String timeOfDay(Instant instant) {
+        return java.time.LocalTime.ofInstant(instant, java.time.ZoneId.systemDefault())
+                .format(java.time.format.DateTimeFormatter.ofPattern("HH:mm"));
+    }
+
+    /** Rough remaining time until a future instant, e.g. {@code ~5h 0m}; {@code expired} if past. */
+    public static String timeUntil(Instant instant) {
+        long seconds = java.time.Duration.between(Instant.now(), instant).getSeconds();
+        if (seconds <= 0) {
+            return "expired";
+        }
+        if (seconds < 60) {
+            return "<1m";
+        }
+        long hours = seconds / 3600;
+        long minutes = (seconds % 3600) / 60;
+        return "~" + (hours > 0 ? hours + "h " : "") + minutes + "m";
+    }
+
     /** Display text for a checkout's branch state: the branch name, or {@code detached@<short-oid>}. */
     public static String branchText(GitStatus status) {
         if (status.branch() instanceof GitBranchState.OnBranch onBranch) {
diff --git a/app/src/test/java/app/drydock/agent/providers/claude/ClaudeAgentProviderTest.java b/app/src/test/java/app/drydock/agent/providers/claude/ClaudeAgentProviderTest.java
index bbce190d..7652c5b5 100644
--- a/app/src/test/java/app/drydock/agent/providers/claude/ClaudeAgentProviderTest.java
+++ b/app/src/test/java/app/drydock/agent/providers/claude/ClaudeAgentProviderTest.java
@@ -3,13 +3,18 @@
 import app.drydock.agent.api.AgentContext;
 import app.drydock.agent.api.AgentKind;
 import app.drydock.agent.api.CreateContext;
+import app.drydock.agent.api.EvalTokenResolver;
 import app.drydock.agent.api.LaunchPlan;
 import app.drydock.agent.api.ResumeContext;
 import app.drydock.agent.api.SessionIdStrategy;
+import app.drydock.agent.providers.claude.internal.ClaudeEvalContainer;
+import app.drydock.agent.providers.claude.internal.ClaudeEvalContainer.EvalSetup;
 import app.drydock.agent.providers.claude.internal.ClaudeExecutableLocator;
 import org.junit.jupiter.api.Test;
 
+import java.nio.file.Files;
 import java.nio.file.Path;
+import java.time.Instant;
 import java.util.Optional;
 import java.util.concurrent.Executors;
 
@@ -77,4 +82,42 @@ void resumeFallsBackToBare() {
     void claudeSupportsRemote() {
         assertTrue(newProviderNoExecutable().probeCapabilities().supportsRemote());
     }
+
+    @Test
+    void evalCreateWrapsInDockerWhenSetupExists() throws Exception {
+        Path stateDir = Files.createTempDirectory("drydock-eval-test");
+        EvalTokenResolver resolver = () -> Optional.of(
+                new EvalTokenResolver.ResolvedToken("tok", Optional.of(Instant.now().plusSeconds(3600))));
+        ClaudeEvalContainer container = new ClaudeEvalContainer(stateDir, resolver);
+        // mark() seeds the config dir and stashes the setup (resolves the token).
+        EvalSetup setup = container.mark("sess-eval").orElseThrow();
+        // Install the activity hook dirs the wrapper mounts + reads.
+        Files.createDirectories(stateDir.resolve("hooks"));
+        Files.createDirectories(stateDir.resolve("activity"));
+        Files.writeString(stateDir.resolve("hooks").resolve("settings.json"), "{}");
+        ClaudeAgentProvider provider = new ClaudeAgentProvider(
+                new ClaudeExecutableLocator(Path.of("/nonexistent/claude")), container);
+        provider.init(new AgentContext(stateDir, stateDir.resolve("activity"),
+                Executors.newVirtualThreadPerTaskExecutor()));
+        provider.activity().orElseThrow().install();   // writes hooks/settings.json
+        LaunchPlan plan = provider.buildCreateCommand(new CreateContext("S", "sess-eval", Path.of("/tmp"),
+                Optional.empty(), Optional.empty(), true));
+        String cmd = plan.command();
+        assertTrue(cmd.startsWith("docker run "), () -> "eval create wraps in docker: " + cmd);
+        assertTrue(cmd.contains("drydock-claude-eval:latest"));
+        // No double "sh": the image ENTRYPOINT is sh, so the command ends
+        // with the image tag then the entrypoint script path -- not "sh <path>".
+        String afterImage = cmd.substring(cmd.indexOf("drydock-claude-eval:latest"));
+        assertFalse(afterImage.contains(" sh "), "no extra sh after image: " + afterImage);
+        // The token must not leak into the command string.
+        assertFalse(cmd.contains("tok"), "token must not be on the argv: " + cmd);
+    }
+
+    @Test
+    void evalCreateThrowsWhenSetupMissing() {
+        ClaudeAgentProvider provider = newProviderNoExecutable();
+        org.junit.jupiter.api.Assertions.assertThrows(IllegalStateException.class, () ->
+                provider.buildCreateCommand(new CreateContext("S", "no-such-sess", Path.of("/tmp"),
+                        Optional.empty(), Optional.empty(), true)));
+    }
 }
diff --git a/app/src/test/java/app/drydock/agent/providers/claude/internal/ClaudeEvalContainerTest.java b/app/src/test/java/app/drydock/agent/providers/claude/internal/ClaudeEvalContainerTest.java
new file mode 100644
index 00000000..57835cc1
--- /dev/null
+++ b/app/src/test/java/app/drydock/agent/providers/claude/internal/ClaudeEvalContainerTest.java
@@ -0,0 +1,168 @@
+package app.drydock.agent.providers.claude.internal;
+
+import app.drydock.agent.api.EvalTokenResolver;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Instant;
+import java.util.Optional;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class ClaudeEvalContainerTest {
+
+    @TempDir
+    Path tmp;
+
+    /** A resolver that returns a fixed token with a known expiry. */
+    private static EvalTokenResolver fixedToken(String token, Instant expiry) {
+        return () -> Optional.of(new EvalTokenResolver.ResolvedToken(token, Optional.ofNullable(expiry)));
+    }
+
+    /** A resolver that returns empty (ddtool unavailable). */
+    private static EvalTokenResolver noToken() {
+        return () -> Optional.empty();
+    }
+
+    @Test
+    void markResolvesTokenAndStashesSetup() {
+        Instant expiry = Instant.now().plusSeconds(3600);
+        ClaudeEvalContainer c = new ClaudeEvalContainer(tmp, fixedToken("tok-1", expiry));
+        Optional<ClaudeEvalContainer.EvalSetup> setup = c.mark("sess");
+        assertTrue(setup.isPresent());
+        assertEquals("tok-1", setup.get().token());
+        assertEquals(expiry, setup.get().tokenExpiry());
+        assertTrue(Files.exists(setup.get().configDir().resolve("settings.json")));
+    }
+
+    @Test
+    void markEmptyWhenTokenUnavailable() {
+        ClaudeEvalContainer c = new ClaudeEvalContainer(tmp, noToken());
+        assertTrue(c.mark("sess").isEmpty());
+        assertFalse(c.setupFor("sess").isPresent());
+    }
+
+    @Test
+    void markIsIdempotentAndRefreshesToken() {
+        Instant t1 = Instant.now().plusSeconds(3600);
+        Instant t2 = Instant.now().plusSeconds(7200);
+        // Two calls return different tokens (resume refreshes).
+        ClaudeEvalContainer c = new ClaudeEvalContainer(tmp, new EvalTokenResolver() {
+            int n;
+            @Override public Optional<ResolvedToken> resolveToken() {
+                return Optional.of(new ResolvedToken("tok-" + (++n), Optional.of(n == 1 ? t1 : t2)));
+            }
+        });
+        c.mark("sess");
+        c.mark("sess");
+        assertEquals("tok-2", c.setupFor("sess").orElseThrow().token());
+    }
+
+    @Test
+    void resolveMainRepoRootFromWorktreeGitFile() throws Exception {
+        Path mainRepo = Files.createDirectories(tmp.resolve("mainRepo"));
+        Path worktrees = Files.createDirectories(mainRepo.resolve(".git").resolve("worktrees").resolve("sess"));
+        Path worktree = Files.createDirectories(tmp.resolve("worktree"));
+        Files.writeString(worktree.resolve(".git"), "gitdir: " + worktrees + "\n");
+        assertEquals(mainRepo, ClaudeEvalContainer.resolveMainRepoRoot(worktree));
+    }
+
+    @Test
+    void resolveMainRepoRootReturnsWorktreeWhenGitIsDir() throws Exception {
+        Path worktree = Files.createDirectories(tmp.resolve("repo"));
+        Files.createDirectories(worktree.resolve(".git"));
+        assertEquals(worktree, ClaudeEvalContainer.resolveMainRepoRoot(worktree));
+    }
+
+    @Test
+    void seedSettingsRewritesBaseUrlAppendsHeaderDropsHelper() throws Exception {
+        Path configDir = Files.createDirectories(tmp.resolve("eval").resolve("sess"));
+        Path managed = tmp.resolve("managed-settings.json");
+        Files.writeString(managed, """
+                {
+                  "apiKeyHelper": "ddtool auth token rapid-ai-platform",
+                  "model": "sonnet",
+                  "env": {
+                    "ANTHROPIC_BASE_URL": "http://127.0.0.1:4000",
+                    "ANTHROPIC_CUSTOM_HEADERS": "source: claude-code\\norg-id: 2",
+                    "CLAUDE_CODE_API_KEY_HELPER_TTL_MS": "7200000"
+                  }
+                }
+                """);
+        System.setProperty("app.drydock.eval.claude.managedSettings", managed.toString());
+        try {
+            new ClaudeEvalContainer(tmp, noToken()).seedSettings(configDir);
+        } finally {
+            System.clearProperty("app.drydock.eval.claude.managedSettings");
+        }
+
+        String seeded = Files.readString(configDir.resolve("settings.json"));
+        assertTrue(seeded.contains("host.docker.internal:4000"), "base URL rewritten for the container");
+        assertFalse(seeded.contains("127.0.0.1:4000"), "host base URL no longer present");
+        assertTrue(seeded.contains("x-target-account: eval"), "eval header appended");
+        assertTrue(seeded.contains("source: claude-code"), "original custom headers preserved");
+        assertTrue(seeded.contains("\"sonnet\""), "non-env settings preserved");
+        assertFalse(seeded.contains("apiKeyHelper"), "apiKeyHelper dropped (token passed as env)");
+        assertFalse(seeded.contains("CLAUDE_CODE_API_KEY_HELPER_TTL_MS"), "helper TTL dropped");
+    }
+
+    @Test
+    void seedSettingsIsIdempotentOnHeader() throws Exception {
+        Path configDir = Files.createDirectories(tmp.resolve("eval2").resolve("s"));
+        ClaudeEvalContainer c = new ClaudeEvalContainer(tmp, noToken());
+        c.seedSettings(configDir);
+        c.seedSettings(configDir);   // second pass must not duplicate the header
+        String seeded = Files.readString(configDir.resolve("settings.json"));
+        assertEquals(1, countOccurrences(seeded, "x-target-account: eval"));
+    }
+
+    @Test
+    void unmarkDeletesConfigDir() {
+        String key = "k";
+        ClaudeEvalContainer c = new ClaudeEvalContainer(tmp, noToken());
+        c.unmark(key);   // idempotent on missing
+        Path dir = tmp.resolve("eval").resolve(key);
+        try {
+            Files.createDirectories(dir);
+            Files.writeString(dir.resolve("settings.json"), "{}");
+        } catch (Exception ignored) { }
+        c.unmark(key);
+        assertFalse(Files.exists(dir));
+    }
+
+    @Test
+    void wrapWritesTokenToFileNotArgvAndDropsDoubleSh() throws Exception {
+        Instant expiry = Instant.now().plusSeconds(3600);
+        ClaudeEvalContainer c = new ClaudeEvalContainer(tmp, fixedToken("secret-tok", expiry));
+        ClaudeEvalContainer.EvalSetup setup = c.mark("sess").orElseThrow();
+        Path worktree = Files.createDirectories(tmp.resolve("wt"));
+        Path hooksDir = Files.createDirectories(tmp.resolve("hooks"));
+        Path activityDir = Files.createDirectories(tmp.resolve("activity"));
+
+        String cmd = c.wrap(setup, "claude --session-id 'abc'", worktree, Optional.empty(), hooksDir, activityDir);
+
+        // The token must NOT appear in the command string (it's in a file).
+        assertFalse(cmd.contains("secret-tok"), "token must not be on the argv");
+        // The token file exists and holds the token.
+        assertEquals("secret-tok", Files.readString(setup.configDir().resolve("auth-token")));
+        // The entrypoint exports the token from the file, then runs claude.
+        String entrypoint = Files.readString(setup.configDir().resolve("entrypoint.sh"));
+        assertTrue(entrypoint.contains("export ANTHROPIC_API_KEY=\"$(cat "), "entrypoint exports token from file");
+        assertTrue(entrypoint.contains("claude --session-id 'abc'"));
+        // No double "sh": the image ENTRYPOINT is already sh, so the command
+        // ends with "<image> '<entrypoint>'", not "<image> sh '<entrypoint>'".
+        String imageAndAfter = cmd.substring(cmd.indexOf("drydock-claude-eval:latest"));
+        assertFalse(imageAndAfter.contains(" sh "), "no extra 'sh' after the image (entrypoint is already sh)");
+        assertTrue(imageAndAfter.startsWith("drydock-claude-eval:latest '"));
+    }
+
+    private static int countOccurrences(String haystack, String needle) {
+        int count = 0, i = 0;
+        while ((i = haystack.indexOf(needle, i)) >= 0) { count++; i += needle.length(); }
+        return count;
+    }
+}
diff --git a/app/src/test/java/app/drydock/agent/providers/claude/internal/DtoolEvalTokenResolverTest.java b/app/src/test/java/app/drydock/agent/providers/claude/internal/DtoolEvalTokenResolverTest.java
new file mode 100644
index 00000000..6bf75671
--- /dev/null
+++ b/app/src/test/java/app/drydock/agent/providers/claude/internal/DtoolEvalTokenResolverTest.java
@@ -0,0 +1,38 @@
+package app.drydock.agent.providers.claude.internal;
+
+import org.junit.jupiter.api.Test;
+
+import java.time.Instant;
+import java.util.Base64;
+import java.util.Optional;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class DtoolEvalTokenResolverTest {
+
+    @Test
+    void decodeJwtExpiryReadsExpClaim() {
+        // payload: {"exp": 1787755205, "iat": 1787733605}
+        String payload = base64url("{\"exp\":1787755205,\"iat\":1787733605}");
+        String jwt = "header." + payload + ".sig";
+        assertEquals(Instant.ofEpochSecond(1787755205),
+                DtoolEvalTokenResolver.decodeJwtExpiry(jwt).orElseThrow());
+    }
+
+    @Test
+    void decodeJwtExpiryEmptyForNonJwt() {
+        assertTrue(DtoolEvalTokenResolver.decodeJwtExpiry("not-a-jwt").isEmpty());
+    }
+
+    @Test
+    void decodeJwtExpiryEmptyForMissingExp() {
+        String payload = base64url("{\"sub\":\"no-exp-here\"}");
+        String jwt = "h." + payload + ".s";
+        assertTrue(DtoolEvalTokenResolver.decodeJwtExpiry(jwt).isEmpty());
+    }
+
+    private static String base64url(String json) {
+        return Base64.getUrlEncoder().withoutPadding().encodeToString(json.getBytes());
+    }
+}

From 7a7f35c27468000d73aa1d937a02e30d3a5b178d Mon Sep 17 00:00:00 2001
From: Jaroslav Bachorik <jaroslav.bachorik@datadoghq.com>
Date: Wed, 26 Aug 2026 13:30:53 +0200
Subject: [PATCH 2/2] Resolve managed-settings paths per call, not at
 class-load

MANAGED_SETTINGS_PATHS was a static final field initialized once at
class-load time, so the app.drydock.eval.claude.managedSettings system
property the seedSettings test sets was read too late -- the field had
already captured the default paths. The test passed on the dev machine
because /Library/Application Support/ClaudeCode/managed-settings.json
exists there, so readManagedSettings read the host's real managed
settings instead of the test fixture. On CI (no such file) the seed was
empty and the "source: claude-code" / "sonnet" assertions failed.

Drop the static field and resolve the paths inside readManagedSettings
each call, so a test (or a future runtime override) can redirect them
after the class is loaded.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../claude/internal/ClaudeEvalContainer.java          | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/app/src/main/java/app/drydock/agent/providers/claude/internal/ClaudeEvalContainer.java b/app/src/main/java/app/drydock/agent/providers/claude/internal/ClaudeEvalContainer.java
index e24ca176..a3034fc4 100644
--- a/app/src/main/java/app/drydock/agent/providers/claude/internal/ClaudeEvalContainer.java
+++ b/app/src/main/java/app/drydock/agent/providers/claude/internal/ClaudeEvalContainer.java
@@ -81,9 +81,12 @@ public class ClaudeEvalContainer {
     private static final String IMAGE = System.getProperty(
             "app.drydock.eval.claude.image", "drydock-claude-eval:latest");
 
-    /** Managed-settings locations, in precedence order (macOS first, then Linux). */
-    private static final List<Path> MANAGED_SETTINGS_PATHS = managedSettingsPaths();
-
+    /**
+     * Managed-settings locations, in precedence order (macOS first, then Linux).
+     * Resolved per call (not cached at class-load) so a test can point the
+     * {@code app.drydock.eval.claude.managedSettings} system property at a
+     * fixture before calling {@link #seedSettings}.
+     */
     private static List<Path> managedSettingsPaths() {
         String override = System.getProperty("app.drydock.eval.claude.managedSettings");
         if (override != null && !override.isBlank()) {
@@ -340,7 +343,7 @@ private static String asString(JsonValue v) {
     }
 
     private Optional<JsonObject> readManagedSettings() {
-        for (Path p : MANAGED_SETTINGS_PATHS) {
+        for (Path p : managedSettingsPaths()) {
             try {
                 if (Files.isReadable(p)) {
                     String content = Files.readString(p, StandardCharsets.UTF_8);