Claude Code cloud can now invent a repo's environment: deps, network hosts, and API keys Claude never sees

Claude Code cloud sessions on Pro, Max and Ultra can now set up a repository's runtime for you. Anthropic's @ClaudeDevs account posted on November 6 that Claude "figures out what dependencies, network access, and API keys it needs, then saves the environment for next time," with the keys stored so "Claude never sees them":

That is a change on top of the cloud-environment machinery Anthropic already documented. Each cloud session (Desktop, mobile, claude.ai/code, claude --cloud, scheduled tasks, Claude Tag) runs in a cloud environment with a network-access level, optional environment variables, an optional setup script, and — separately — network secrets.

What "Claude never sees them" actually means

A network secret is not an ordinary env var. The docs say Anthropic's agent proxy attaches the key to outbound requests for the hosts you list after the request leaves the session VM, so the value never sits in the VM's environment or files. Env vars, by contrast, are readable by anyone who uses that environment; the docs warn against putting secrets there.

Network secrets are listed for Pro, Max, Ultra, Team and Enterprise. The ClaudeDevs post names automatic setup only for Pro, Max and Ultra; Team/Enterprise already had the secret storage path, but the auto-detection claim is not confirmed for those plans in the announcement.

What the docs still don't say about the auto path

The cloud-environments page, read today, still describes manual configuration: you pick Trusted / Custom / Full / None network access, paste a setup script (cached as a filesystem snapshot when it finishes within about five minutes), and add secrets one host list at a time. It does not yet spell out which files Claude reads to invent that config, whether the user must approve the hosts and keys it proposes, or how auto-setup interacts with an existing Default environment.

So the concrete engineering detail is the secret path; the new behavior is that Claude will try to fill that path (and deps / network) without you writing the setup script first. Worth opening the saved environment and checking hosts and secrets before pointing a production repo at it.

Cloud sessions still share your plan's usage limits with the rest of Claude and Claude Code; there is no separate VM fee.