Under the hoodTier: how much it should matter to you
3Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
Remote ControlArea: what it touches
ImprovementsKind: in v2.1.238,
ImprovementsSection of the release
What
Child processes started by the bridge now inherit an explicit allowlist of environment variables plus an explicit clear-list, and several credential carriers that used to be passed through are unset: OAuth and API-key file descriptors, the background auth snapshot path (CLAUDE_BG_AUTH_SNAPSHOT_PATH), account, org and email identifiers, the session ingress URL and the exit-after-stop delay.
Details
Lowercase duplicates of every cleared name are deleted too, so a lowercase shadow cannot smuggle a value through.
