Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.221 Home All releases ←olderv2.1.220 v2.1.222newer→
Claude Code v2.1.221

Artifact credentials and artifact base URLs are stripped from child process environments

You'll notice
Useful3 Signal0
Permissions

Artifact tokens and artifact base URLs no longer leak into processes Claude spawns.

CLAUDE_CODE_OAUTH_TOKENANTHROPIC_API_KEY
What

The environment handed to spawned processes now drops the artifacts API token and any artifact base URL variable, alongside the OAuth token and subscription vars it already removed.

Details
  • A new predicate matches any variable that starts with CLAUDE_CODE_ARTIFACT and ends with _BASE_URL, and those are deleted.
  • The presence of such a variable alone is now enough to force the sanitizing path instead of returning process.env untouched.
  • The artifacts token was added to the sensitive-variable list alongside ANTHROPIC_API_KEY and CLAUDE_CODE_OAUTH_TOKEN, and to the set stripped from config-derived env.
  • Applies to everyone on this build.
Evidence

return e.startsWith("CLAUDE_CODE_ARTIFACT") && e.endsWith("_BASE_URL");

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.221 →