A new environment variable CLAUDE_CODE_ARTIFACTS_API_BASE_URL is now included in the list of variables that are stripped when spawning sandboxed subprocesses, preventing the artifacts API endpoint from leaking into shell commands.
Evidence
Scrub list entry (search for "CLAUDE_CODE_ARTIFACTS_API_BASE_URL") — env scrub at line ~39753
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
