Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.227 Home All releases ←olderv2.1.226 v2.1.228newer→
Claude Code v2.1.227

Two memory-API environment variables are hidden from commands Claude runs

You'll notice
Useful4 Signal3
Permissions not in their notes

Your memory API base URL and token are now hidden from every command Claude runs.

CLAUDE_CODE_MEMORY_API_BASE_URLCLAUDE_CODE_MEMORY_API_TOKEN
What

CLAUDE_CODE_MEMORY_API_BASE_URL and CLAUDE_CODE_MEMORY_API_TOKEN are now stripped from the environment given to every subprocess Claude Code spawns, the same way CLAUDE_CODE_OAUTH_TOKEN and CLAUDE_CODE_ARTIFACTS_API_TOKEN already were. A bash command or tool cannot read your memory API token.

Details
  • Both names are new in this build.
  • The code that would use the token sends it as an Authorization: Bearer header, but only when an override host is set, and the function that supplies that host currently returns nothing. So the memory-API override is not reachable yet; the scrubbing is the part that is live.
Evidence

CLAUDE_CODE_MEMORY_API_TOKEN

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.227 →