claude-mem 13.25.3 blocks changes to the Claude CLI executable path over HTTP

claude-mem released version 13.25.3 on September 21, tightening rules for local settings writes and telemetry error redaction. The tool preserves memory across sessions for coding agents, connecting model-generated summaries, historical data, and a web-based settings interface to a background worker. These changes directly affect which executable that process can launch. The release notes also state that npm package publishing is handled separately, so a GitHub tag alone does not mean every installation channel has been updated. [Release notes](https://github.com/thedotmack/claude-mem/releases/tag/v13.25.3)

The maintainers noted that the settings endpoint, which did not require authentication, previously allowed writes to `CLAUDE_CODE_PATH`. The worker would subsequently use that value as the Claude CLI executable path. The release removes this field from the HTTP write allowlist, preventing changes even when the frontend sends back the settings it read without modification. This closes the route by which changing a setting could change the program being launched. [Patch explanation](https://github.com/thedotmack/claude-mem/pull/4166)

Users who need a custom path must now set it through a configuration file or environment variable; the field in the web interface is now read-only. The official configuration documentation also explicitly states that the worker binds to the loopback address by default and has no general request authentication. This change therefore restricts a sensitive field within the existing local trust model and should not be treated as complete access-control isolation for a multiuser service. [Configuration documentation](https://docs.claude-mem.ai/configuration)

Browser writes also gain an origin check that rejects settings requests when the origin and destination use different local ports. Command-line and hook calls without an `Origin` header retain their existing behavior. Gemini and OpenRouter keys remain writable to support web-based configuration. Alongside checking the version, deployers therefore still need to verify that the actual listening address and forwarding setup are consistent with the assumption of local use. [Patch details](https://github.com/thedotmack/claude-mem/pull/4166)

Telemetry processing now removes query parameters and credentials from URLs before shortening paths, reducing the chance that the processing order leaves secrets behind. However, an automated review also reported that quoted credential assignment strings might escape redaction. The discussion found so far is insufficient to confirm that this concern has been addressed, so error text cannot be described as fully safe. [Review record](https://github.com/thedotmack/claude-mem/pull/4166)

The official documentation provides `CLAUDE_MEM_TELEMETRY_ERRORS=0` to disable error tracking independently, along with a debug mode that prints the content that would be sent without making network requests. Engineering teams can use test errors containing no real credentials to check the redaction results and installed version before deciding whether to enable error telemetry. [Telemetry documentation](https://docs.claude-mem.ai/telemetry)