Privacy fix
Browser setup no longer uploads your prompts to cmem.ai without asking. Fixes #5176.
The browser setup opened by npx claude-mem install (since v15.2.0) scanned local agent histories and uploaded the full text of the last 30 days of prompts, with session IDs, project names, folder paths and timestamps, without asking.
What changed (#5220)
- The scan now reads local history only, then stops and asks. Nothing leaves the machine until you answer.
- A new consent panel states what is sent and lists each detected tool with its prompt count. Only ticked tools are uploaded.
- "Keep everything local", or unticking every tool, uploads nothing.
- The analytics box is optional, off by default, and separate from upload consent.
- A second start request while the question is open, or during an upload, joins the current state instead of starting a second upload.
- New
POST /api/setup/scan/consentroute: loopback-only and origin-guarded.
Not covered by this release
- Prompts already uploaded by earlier versions are not removed by this update.
- Server-side handling at cmem.ai and privacy-policy wording are outside this change.
Full Changelog: v15.8.2...v15.8.3