Blog

v2.1.221 closes a Bash permission-check bypass where zsh could run hidden commands in [[ ]] regex conditionals, and adds a sandbox credential mode that hands sandboxed commands a masked sentinel file while the proxy substitutes the real secret only on egress. A new MCP_PROTOCOL_NEGOTIATION variable lets Claude Code probe servers for a newer protocol revision. The binary also carries an unannounced feature: artifact comment threads, where Claude publishes a prototype as a live artifact and reads, replies, and edits in response to human comments, all gated off by default.

The first Codex CLI release tracked since the 0.144.3 baseline. Conversations become managed threads you can name with /new or /clear, pin, and fork (including temporary forks kept out of listings), on top of 0.145.0's paginated history with resume, search, and memories. Agent Plugins gain manifests, workspace publishing, and marketplaces for Amazon Bedrock and Claude Code, while 0.145.0's /import migrates settings, MCP servers, plugins, and memories from Cursor and Claude Code. The app-server reaches remote Code Mode hosts over WebSocket, and 563 commits from 59 authors in nine days went almost entirely into codex-rs.

Claude Code v2.1.219 promotes Claude Opus 5 (claude-opus-5) to the default Opus model over claude-opus-4-8, with a native 1M-token context window and $10/$50-per-Mtok pricing. Beyond the model, it clears a run of fixes daily users feel: claude -p no longer drops an answer on a mid-stream error, copy-on-select works again in GNU screen, Vim's left-arrow escapes to the agent view, and screen-reader mode stops rewriting the whole input line.

Claude Code v2.1.218 is mostly cleanup that lands where you feel it. /code-review now runs as a background subagent so it stops flooding your conversation, the left-arrow key can no longer wipe a session with no undo, and a retry loop that re-sent doomed requests after a context overflow is closed. The build also carries four new environment variables the changelog never names: CLAUDE_CODE_AUTO_MODE_CLASSIFIER_QUEUE queues auto mode's per-turn model router, and CLAUDE_CODE_DISABLE_MEMORY_MASS_DELETE_HOLD switches off a default brake that stops one bulk delete from clearing a team's shared memory.

Claude Code v2.1.217 adds twelve environment variables since v2.1.215. The headline pair caps how many subagents run at once (CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS, default 20) and stops subagents spawning their own subagents (CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH, default 1). They are the only additions the changelog names; a FleetView render toggle, an Explore-agent model cap, a transcript garbage-collector, and five codename rollout gates all ship silent inside a 239 MB Bun-compiled binary.

Claude Code v2.1.215 adds five environment variables over v2.1.212: CLAUDE_CODE_USE_ANTHROPIC_GOOGLE_CLOUD (a sixth first-party backend, an Anthropic-operated inference plane on Google Cloud) with its own skip-auth flag, CLAUDE_CODE_NO_MODEL_FALLBACK (pins a session to the exact model you chose, even blocking compaction that would swap models), CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH (60 KB telemetry content cap), and CLAUDE_PID (a shim that stops the agent's own pkill from killing Claude Code). The changelog adds a permission-check hardening pass, a background-session lifecycle cleanup, reasoning effort in the subagent status line, and stops /verify and /code-review from auto-running.

Claude Code v2.1.212 adds eleven environment variables over v2.1.210. The headline additions are two per-session budget caps — CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION and CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION (both default 200) — that halt runaway delegation and search loops, plus a new /bug command wired to a first-party feedback relay (CLAUDE_CODE_SEND_FEEDBACK, gate tengu_juniper_relay) and a Windows-only sandbox gate (CLAUDE_CODE_NANKEEN_KESTREL) that the changelog never names. The official notes confirm the caps and close two quiet security fixes in plan mode and worktree symlinks.

Claude Code v2.1.210 adds 4 new environment variables over v2.1.209. Three wire up a new organization-scoped memory-sync subsystem (CLAUDE_CODE_DISABLE_ORG_MEMORY, CLAUDE_CODE_DISABLE_MEMORY_STREAM_LIST) gated behind two brand-new server gates, tengu_haze_glass and tengu_memory_stream_list, plus remote session-reference propagation (CLAUDE_CODE_SYNC_SESSION_REFS). CLAUDE_CODE_FORCE_WINDOWS_CREDMAN pins credential storage to the Windows Credential Manager. All four ship in this build and none appear in the official changelog.

We analyze every Amp release to document environment variables, model roster, and feature changes, extracted from each distributed binary and paired with Amp's public news feed.

A catch-up on the Claude Code binary from v2.1.143 to v2.1.209. One thing stands out of the environment-variable surface: Auto mode stopped being an experiment. Fourteen new CLAUDE_CODE_AUTO_MODE_ variables lay out its safety architecture in unusual detail — an editor model gated by a separate, cheaper classifier, with deletion caps, repo-visibility awareness, external-permission hooks, and structured outcomes. Plus what actually reached users in the last ten releases: Opus 4.8 as the managed default, a safer 'Manual' permission posture, tunable workflows, and a real screen-reader mode.

CLAUDE_CODE_EXPERIMENTAL_OBSERVER_AGENTS is an undocumented Claude Code flag that pairs one agent with a background observer agent. The observer watches the first agent's turns through a read-only digest and can report back through a single ObserverReport tool. First shipped in v2.1.200, it stays silent by default, cannot chain observers, and a server-side gate can still switch it off.

The first tracked snapshot of OpenAI's Codex CLI, read from the open source at tag rust-v0.144.3. The Rust source carries 178 environment-variable names and 40 model-ID strings, with the largest clusters covering sandboxing, a credential-brokering network proxy, cloud task execution, an app and connector marketplace, and a managed-config layer for enterprise fleets. This is the baseline every later Codex CLI post will diff against.

The first tracked release of Google's Gemini CLI. Version 0.47.0 carries 288 environment-variable literals, 39 model-ID strings, and 25 experimental feature flags in its source, and more than half of the variables are telemetry attributes rather than real settings. The configuration knobs that remain cover model routing, multiple auth backends, an extension registry, and a container sandbox; this post is the baseline every later post diffs against.

We analyze every Gemini CLI release to document environment variables, model IDs, and feature changes, grounded in the open-source diff between release tags.

The first tracked snapshot of OpenCode, SST's open-source terminal coding agent, at v1.17.19. The source exposes 120 OPENCODE_ environment variables, 20 of them experimental flags that preview background subagents, parallel execution, workspaces, a native LLM runtime, and LSP-backed code intelligence. A hosted console with orgs, an S3 storage backend, and a control plane sit above the CLI, and this post is the reference every later OpenCode post will diff against.

We analyze every Codex CLI release to document environment variables, model IDs, and feature changes, grounded in the open-source diff between release tags.

We analyze every OpenCode release to document environment variables, config-schema keys, and experimental flags, grounded in the open-source diff between release tags.

27 new env vars, 2 removed across 15 releases. /goal ships a real completion tracker for agentic work. Fast mode silently upgraded to Opus 4.7 at no extra cost. CLAUDE_CODE_MAX_TURNS hard-caps turns; CLAUDE_CODE_SUPERVISED tells Claude a human is watching — the agentic safety pair that was missing. Agent View replaces Agents Fleet naming. Hook args exec form for shell-less subprocess spawning. MCP servers survive /clear. Plugin marketplace shows context cost before install. CLAUDE_CODE_STOP_HOOK_BLOCK_CAP ends the Ctrl+C hang. Three new BG session vars document the failure modes.

2 new env vars. CLAUDE_CODE_PROACTIVE disables the existing UI prompt on /resume and --resume that offers a /compact-equivalent before resuming long conversations — useful for non-interactive / scripted resume flows (the prompt itself has shipped for several versions; only the disable flag is new). CLAUDE_CODE_SIMPLE_SYSTEM_PROMPT strips the system prompt for background subagents, cutting the largest fixed per-turn token cost across parallel agent trees. Sonnet 4.6 takes over as the embedded default for Claude Code Remote. (Original framing of CLAUDE_CODE_PROACTIVE was wrong — see correction note on the post.)

v2.1.124–v2.1.125 were internal builds. v2.1.126 ships claude project purge for surgical cleanup of transcripts and config, a gateway-aware /model picker that queries your actual /v1/models endpoint, --dangerously-skip-permissions covering the last CI holdouts (.claude/, .git/, .vscode/), OAuth paste-in for WSL2/SSH/containers, and a security fix where managed sandbox restrictions silently dropped when the org policy had no sandbox block. Plus 7 bug fixes: stream timeout after sleep, image paste breaking sessions, Windows clipboard exposure, CJK garbled on Windows, Ctrl+L erasing input, deferred tools missing in fork subagents. CLAUDE_CODE_COLD_COMPACT enables safe session resumption after sleep or network drop.

30+ new env vars across five releases. The background daemon graduates from a single flag to a fully specified IPC contract (rendezvous socket, PTY recording, bridge reconnect protocol). Sessions become first-class addressable objects. An agent fleet layer takes shape with selection, auto-relaunch, and a kill switch. CoWork memory is the first inter-agent coordination primitive — a shared RAG layer with policy-governed writes. Daily wins: /config persists, alwaysLoad for MCP, PostToolUse hooks rewrite any tool output, claude ultrareview as a CLI subcommand, default effort raised to high for Pro/Max, three memory leaks fixed.

10 new env vars across four releases. Forked subagents enabled on external builds via CLAUDE_CODE_FORK_SUBAGENT=1 — Agent Teams multi-agent architecture leaves internal-only status. Subscription and rate-limit tier vars describe a runtime moving toward per-plan capability differentiation. Named proxy vars simplify corporate proxy setup. Bridge reconnection handshake and retry watchdog close the remaining silent-hang surface. Also covers Anthropic's April 23 postmortem on the March–April quality regression and usage limit reset.

Seven-release stretch from v2.1.107. Two headline shifts: v2.1.113's CLI now spawns a native per-platform binary instead of bundled JS (tighter supply chain, faster cold start). And v2.1.111's /fewer-permission-prompts skill scans transcripts to propose a prioritized settings allowlist — the first feature that actually cuts Claude Code's biggest daily friction. Plus fullscreen TUI, /ultrareview cloud PR review, Opus 4.7 xhigh effort, 1-hour prompt caching, proxy auth helper protocol for Kerberos/SSO (5 vars), Agent Teams scaffolding, experimental Advisor Tool. 20 new env vars, 1 new model ID, ~80 bug fixes.

6 new env vars, 0 removed. Multi-worktree orchestration: base ref overrides (CLAUDE_CODE_BASE_REFS), worktree storage paths (CLAUDE_CODE_REPO_CHECKOUTS), session chaining (CLAUDE_CODE_RESUME_FROM_SESSION). Away mode summaries for async agent supervision. Byte-level stream watchdog catches stalled API connections below SSE layer. PreCompact hooks, background plugin monitors, worktree reuse via path parameter.

4 new env vars, 0 removed. Limits reckoning: prompt cache TTL now user-configurable, rate limits vs plan limits get separate errors, startup warning if caching disabled, DISABLE_TELEMETRY → 5-min TTL bug fixed. REPL experimentation returns with CLAUDE_CODE_REPL and CLAUDE_REPL_VARIANT for A/B testing stateful execution. Skill discovery via Skill tool. /undo alias, /recap away summary, lazy-loaded grammars, 15+ bug fixes.

2 new env vars, 0 removed. Enterprise TLS certificate store control (CLAUDE_CODE_CERT_STORE) — OS CA store trusted by default, bundled reverts to Node.js CAs. SDK OAuth refresh coordination (CLAUDE_CODE_SDK_HAS_OAUTH_REFRESH) prevents double-refresh races in IDE extensions. /team-onboarding command. /ultraplan auto-provisioning. Command injection fix in LSP binary detection. Virtual scroller memory leak fix. Hardcoded 5-minute timeout removed.

3 new env vars, 3 removed. Context token ceiling (CLAUDE_CODE_MAX_CONTEXT_TOKENS) with DISABLE_COMPACT interop. Perforce VCS mode — fail on read-only files with p4 edit hint. Script capability caps paired with PID namespace sandboxing. Google Vertex AI setup wizard. Focus view toggle. Monitor tool for background scripts. 30+ Bash permission security fixes. MCP memory leak fix. REPL experiment removed.

0 new env vars, 0 removed. Bedrock auth hotfix — fixed 403 "Authorization header is missing" regression from v2.1.94 when using AWS_BEARER_TOKEN_BEDROCK or CLAUDE_CODE_SKIP_BEDROCK_AUTH. Binary extraction byte-identical to v2.1.94. Mantle auth layer still stabilizing. v2.1.95 skipped.

5 new env vars, 0 removed. Mantle auth proxy for Amazon Bedrock (CLAUDE_CODE_USE_MANTLE) with skip flag. Sandbox state flag (CLAUDE_CODE_SANDBOXED). MCP server environment variable allowlist replaces all-or-nothing env inheritance. Team onboarding flows. --resume across worktrees. CJK text corruption fix. Write tool diff 60% faster.

5 new env vars, 0 removed. Proxy simulation without infrastructure (CLAUDE_CODE_SIMULATE_PROXY_USAGE). Fast mode org check bypass. Remote Control session name prefix for CI/CD observability. CLAUDE_CODE_EXECPATH for symlinked binary overrides. CLAUDE_BASE shorthand. Interactive Bedrock setup wizard. Per-model cost breakdowns. Policy-enforced remote settings refresh.

1 new env var, 2 removed. MCP 500K character tool result persistence override. Plugin bin/ executable support — native binaries in plugins. disableSkillShellExecution setting locks down skill shell access. Multi-line deep links. Edit tool token optimization with shorter old_string anchors. CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION replaces typo predecessor.

3 new env vars, 1 new command. Anthropic AWS as fifth API provider (CLAUDE_CODE_USE_ANTHROPIC_AWS) with IAM ambient auth skip. Offline-resilient marketplace plugin caching. /powerup interactive lessons. Prompt-cache regression fix since v2.1.69. Quadratic SSE transport and transcript write fixes. PowerShell security hardening. Auto mode now respects explicit user constraints.

4 new env vars, 2 removed. Agent cost steering for subagent delegation. Session resume thresholds by time and token count. Claude API skill disable flag. Deferred tool execution for headless sessions. StructuredOutput schema cache ~50% failure rate fixed. Autocompact thrash loop detection. Edit tool no longer requires prior Read. MCP non-blocking connections. Command injection check now mandatory.

2 new env vars, 2 removed. Net count flat at 202. OAuth console override completes the auth triptych. Trusted device token for persistent sessions. MCP server env vars removed after 2 versions. Cowork Dispatch delivery fix plus model selection. Boris Cherny's 15 hidden features thread. --bare default flip coming.

7 new env vars, 3 removed. Terminal UX overhaul: CLAUDE_CODE_NO_FLICKER for flicker-free rendering, granular mouse control (CLAUDE_CODE_DISABLE_MOUSE, CLAUDE_CODE_DISABLE_MOUSE_CLICKS), tunable scroll speed. REPL mode emergence with CLAUDE_CODE_REPL and CLAUDE_REPL_MODE for stateless scripting workflows. Policy skill suppression. v2.1.87 Cowork Dispatch hotfix. Prompt cache miss fix, structured output schema bug, memory leaks for 1 GiB+ files.

6 new env vars, 1 removed. MCP server multiplexing with CLAUDE_CODE_MCP_SERVER_NAME and CLAUDE_CODE_MCP_SERVER_URL. OAuth endpoint overrides for enterprise identity providers. PowerShell parse timeout. Binary shrank 7.15 MB by replacing WASM yoga-layout (yes, flexbox in your terminal) with pure TypeScript. Conditional hook if fields. Scheduled task timestamps. Memory leak patches.

2 new env vars. CLAUDE_TRUSTED_DEVICE_TOKEN for enterprise SSO and CI/CD device trust. CLAUDE_LOCAL_OAUTH_CONSOLE_BASE completes the OAuth endpoint decomposition — every auth touchpoint now redirectable to corporate infrastructure. 20+ bug fixes: --resume tool_use ID errors, /feedback OOM, masked input token leaks, MCP startup stalls.

6 new env vars. Idle session management with configurable thresholds, stream watchdog timeout. Bedrock/Vertex/Foundry capability override env vars. TaskCreated and WorktreeCreate HTTP hooks. Deep links open in preferred terminal. PowerShell tool preview. MCP 2KB cap and deduplication. Stats screenshot (Ctrl+S in /stats). Windows drive root protection.

8 new env vars, 40+ bug fixes, v2.1.82 skipped. managed-settings.d/ drop-in directories for enterprise policy, CLAUDE_CODE_SUBPROCESS_ENV_SCRUB for credential scrubbing, transcript search, plugin keychain storage, CwdChanged/FileChanged hook events. macOS exit hang fixed, startup latency cuts, MCP policy bypass closed.

The --bare flag strips Claude Code to its core for scripted -p calls — no hooks, LSP, plugins, or auto-memory. Concurrent OAuth fix ends the multi-session re-auth nightmare (#24317). Channels permission relay, /btw pasted text fix, ! bash mode discoverability. Plan mode hides clear context. 17 bug fixes.

Channels research preview turns Claude Code into a persistent agent reachable from Telegram and Discord. Simplified plugin install, inline settings declarations, 80MB memory reduction for large repos. Fine-grained streaming fix retires the CLAUDE_CODE_ENABLE_FINE_GRAINED_TOOL_STREAMING=0 workaround. 7 bug fixes.

3 new env vars, 2 removed: subprocess environment scrubbing for security, extra API metadata for enterprise routing, refactored init path saving 18MB startup memory. Console auth for API billing, non-streaming fallback timeout, 10+ bug fixes.

1 new env var and 1 renamed slash command: cowork memory extra guidelines for multi-agent teammate sessions, /branch (renamed from /fork), and /copy N index. Largest stabilization release tracked — 25+ bug fixes spanning terminal rendering, tmux, teammate sessions, and memory management.

2 new env vars: plugin persistent state directory and custom model picker entries. StopFailure hook event, plugin agent frontmatter expansion (effort, maxTurns, disallowedTools), line-by-line streaming. Security hardening: sandbox bypass fixes, MCP deny rule enforcement, protected directory prompts.

3 new env vars and 1 new slash command: account tagged IDs for multi-tenant billing, fast-mode network error resilience, workspace host path mappings for containers, and /effort for interactive effort level control. Headline feature: MCP elicitation support for bidirectional server communication.

2 new env vars and 1 new slash command: auto-compact window threshold for 1M context windows, plugin option prefix for CI/CD configuration, and /color for session-level prompt-bar customization.

Small release with 2 new env vars and 1 removal: frame timing diagnostics, session-end hooks timeout, and the two-stage classifier flag graduated to default.

Maintenance release with no env var changes. First version where we tracked the full slash command inventory built into the Claude Code binary — 22 commands established as our baseline.

Minor release with 6 new env vars: brief mode controls, debug log level, cron disable, virtual scroll toggle, and two-stage classifier. Continuing the binary extraction series.

Minor release with 3 new env vars: CCR v2 bridge protocol toggle, force-enable effort level, and delta MCP instruction updates. Plus one removal. Continuing the binary extraction series.

I reran my binary extraction on Claude Code v2.1.69 — 50 versions after the original v2.1.19 analysis. The count nearly doubled: 165 env vars, 16 model IDs, 41 feature gates. New plugin system, mTLS support, background tasks, context compaction controls, and multi-provider auth.

I found 83 undocumented environment variables in Claude Code 2.1.19's binary. None are in the official docs. Highlights include Agent Swarms, Plan v2 agent controls, debug/profiling flags, and ways to disable features like CLAUDE.md loading.