What
CLAUDE_CODE_MEMORY_API_BASE_URL and CLAUDE_CODE_MEMORY_API_TOKEN are now stripped from the environment given to every subprocess Claude Code spawns, the same way CLAUDE_CODE_OAUTH_TOKEN and CLAUDE_CODE_ARTIFACTS_API_TOKEN already were. A bash command or tool cannot read your memory API token.
Details
- Both names are new in this build.
- The code that would use the token sends it as an
Authorization: Bearerheader, but only when an override host is set, and the function that supplies that host currently returns nothing. So the memory-API override is not reachable yet; the scrubbing is the part that is live.
Evidence
CLAUDE_CODE_MEMORY_API_TOKEN
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundleCLAUDE_CODE_MEMORY_API_BASE_URLCLAUDE_CODE_MEMORY_API_TOKEN