claudekit / updates / claude-code-2-1-232
[ PATCH · ]

Claude Code 2.1.232

Subagent forking is now enabled by default: a `subagent_type: "fork"` subagent inherits the full conversation and prompt cache, and non-teammate agent spawns in interactive sessions run in the background by default. Type `@` in the prompt to mention another Claude session by name, and interactive sessions on one machine now keep unique names. Plugin marketplaces accept bare `gitlab.com` repo URLs the way they accept `github.com` URLs, and GitLab token families are now redacted. The fixes cluster around permission bypasses and Remote Control: a PowerShell bypass through `$PSDefaultParameterValues`, a Windows bypass through Cygwin-style symlinks followed by Git Bash, and nested git repositories inheriting trust from a parent directory — each repository now requires its own trust confirmation.

Claude Code
Official announcement →

This article is a summary based on official documentation.

What changed

Claude Code 2.1.232 shipped on August 13, 2026. It’s a large release — 49 entries. The additions cluster around cross-session messaging and GitLab support; the fixes cluster around permission bypasses and Remote Control. Several changes alter existing behavior: subagent forking and background spawns are now defaults, Bash input redirections are permission-checked, and nested git repositories no longer inherit trust.

New features

  • Subagent forking on by default

    A subagent started detached from the conversation so far, so whatever context it needed had to be restated in its prompt — and re-sending the same prefix meant re-paying for the prompt cache. A subagent_type: "fork" subagent now inherits the full conversation and prompt cache. Non-teammate agent spawns in interactive sessions also run in the background by default.

  • Mention another Claude session with @

    Reaching another session meant calling SendMessage yourself and naming the target. You can now type @ in the prompt to mention another Claude session by name; Claude then uses SendMessage to reach that session directly. SendMessage also delivers to a bare name that exactly matches one live session, instead of asking to confirm with a ref first.

  • GitLab repositories in plugin marketplaces

    Only github.com repo URLs could be given to a marketplace as-is. Bare gitlab.com repo URLs — including nested subgroups — now clone like github.com URLs, and clone auth-failure hints name your actual git host.

  • GitLab secret redaction

    GitLab tokens could surface unredacted. Secret redaction now covers the GitLab token families (glrt-, gloas-, glptt-, glagent-, glimt-, glsoat-, glcbt-, glft-, glffct-), with full redaction of routable glpat-/gldt- tokens. The glab CLI config store gets the same sandbox and credential-path protection as gh.

  • /config rows for dialog expiry and cross-session messages

    /config gained rows for “Dialog expiry” and “Messages from your other sessions” — the second controls cross-session inbound handling (accept/hold/refuse).

  • Fable 5 in /advisor again

    Fable 5 is offered as an advisor in /advisor again for organizations with Fable access, with usage-credits consent set up through /model fable.

Key improvements

  • Unique session names on one machine

    Interactive sessions on the same machine could end up sharing a name, which makes a bare name useless for addressing one. Sessions now keep unique names: starting or renaming a session to a name another live session already uses gives it a name-word-word variant and tells you.

  • Marketplace setting aliases and blocking policy

    extraKnownMarketplaces and strictKnownMarketplaces don’t read as what they do. additionalMarketplaces and allowedMarketplaces are now accepted as friendlier aliases for them. In enterprise policy, a url-typed blockedMarketplaces entry for a bare repo URL keeps blocking that URL when the CLI classifies it as a git clone.

  • The gateway desktop: overlay accepts every released Desktop setting

    The overlay accepted 11 hand-listed keys, so a newly released Desktop setting couldn’t be set through it. It now accepts every released Desktop setting, validated at boot against Desktop’s own schema; unknown or invalid keys fail boot.

  • Gateway validation of managed policy values

    Empty managed.policies[].match.groups/admin.admin_groups entries and malformed email_domain values (empty, or containing @, whitespace, or commas) could silently match no one — or grant admin access. They now fail at boot instead.

  • Fullscreen streaming stays responsive

    The whole conversation was re-normalized on every update while streaming in fullscreen, so long sessions got slower as they grew. That re-normalization is gone, and long sessions stay responsive.

  • A clearer managed settings approval dialog

    The dialog now shows endpoint URLs, uses clearer wording for telemetry-only changes, skips routine OpenTelemetry options, and requires approval for server-managed sandbox binary overrides (sandbox.bwrapPath, sandbox.socatPath, sandbox.ripgrep).

  • /plugin install refreshes the marketplace first

    A newly published plugin couldn’t be installed until the marketplace was updated by hand. /plugin install plugin@marketplace now refreshes the marketplace first, so newly published plugins install without a manual marketplace update.

  • /code-review at high effort runs in the background

    /code-review at high, xhigh, and max effort was the one path that stayed in the foreground. It now runs in a background agent like the other levels.

  • /feedback and /bug open immediately

    Invoking either while Claude was responding meant waiting for the turn to finish. They now open immediately.

  • Remote Control reconnection and ownership

    A network blip dropped Remote Control easily. It now keeps reconnecting for about 30 minutes after a blip and no longer drops after a few blips spread across an hour. Resuming a conversation no longer silently takes Remote Control away from another Claude Code on the same machine that still has it — run /remote-control there to move it. The terminal now says whether a session was taken over by another device, ended from another app, or deleted, and stops suggesting a reconnect that would undo it.

  • Permission checks and sandbox hardening

    Bash input redirections (< file) escaped the permission check that the argument spelling went through; they are now permission-checked like their argument spellings on all platforms. The auto-generated cross-session messaging socket directory on shared /tmp is hardened: a pre-planted symlink or another user’s directory is now refused instead of used. The Linux filesystem sandbox is hardened against a protected-path bypass, and sandbox.ripgrep is honored only from user, managed, and --settings settings — project settings can no longer override the sandbox’s ripgrep binary.

  • Agent panel and pasted images

    Completed subagents hide immediately with a /tasks footer hint, and the ”↓ N more” overflow indicator moved left for visibility. Pasted and clipboard images are read without blocking the event loop, and the message shown when resuming a completed background agent is shorter.

  • Cowork and user-scope memory imports

    Cowork sessions inlined external @-imports from user-scope memory files into the session. They no longer do.

  • Custom subagent tip removed

    The startup tip suggesting you create custom subagents is gone, along with the matching nudge in the /powerup tour.

Bug fixes

Permissions & trust

  • A PowerShell permission bypass — fixed; variable-writing parameters could silently overwrite $PSDefaultParameterValues and redirect later commands’ file access.
  • A Windows permission bypass — fixed; Git Bash followed Cygwin-style symlinks that path validation saw as regular files. Writes through them now require permission approval.
  • Nested git repositories inheriting trust from a parent directory — fixed; each repository now requires its own trust confirmation.

Remote Control

  • Remote Control sessions hosted by a bridge inside a cloud session inheriting that session’s transcript or credentials — fixed.
  • Remote Control sessions started from Claude Desktop or an IDE appearing as a new claude.ai session each time the local session was resumed — fixed; they now reattach to the existing one.
  • Remote Control sessions appearing unreachable to newly attached clients while idle — fixed.
  • Remote Control bridge sessions not restoring conversation history when the session worker restarts — fixed.
  • Resuming a conversation whose session was deleted from claude.ai or the app failing with a message about your login — fixed (regressed in v2.1.227); it now starts a replacement.

Model connections & network

  • MCP connections hanging for the full 30-second connect timeout — fixed; this happened when a server failed to answer or sent a malformed reply to the protocol-version probe.
  • mTLS client certificate rotation requiring a restart — fixed; Claude Code now reloads the rotated cert and key automatically on connection errors.
  • Malformed AWS or Vertex region values being used to build request URLs — fixed; they now fall back to the default region.
  • Stream idle timeout errors failing the request instead of recovering on Bedrock, Vertex, and gateway deployments — fixed.

Terminal rendering & commands

  • Cloud gateway /login exiting silently or leaving an unresponsive terminal after “Press Enter to continue” when managed settings failed to load — fixed; the reason is now shown.
  • Voice mode on native builds getting stuck on “listening…” when the voice service rejected the connection — fixed; the rejection is now shown immediately.
  • Content-sized overlays containing truncated text rendering one column too wide, and start-truncated text collapsing to an ellipsis — fixed.
  • A stray garbled character where a long shell-command or agent-description preview was cut off mid-emoji — fixed.
  • A startup race that could silently unregister a plugin marketplace due to concurrent writes to known_marketplaces.json — fixed.
  • /update and /tui refusing to restart while work that survives the relaunch was running — fixed.
  • Usage-limit guidance suggesting unavailable slash commands in SDK and remote sessions — fixed.
  • The consent message for interactive --advisor fable launches telling you to run /model fable in an interactive session that had just exited — fixed.

Notes

  • Forking and background spawns are now defaults — a subagent_type: "fork" subagent inherits the full conversation, so everything said so far goes with it. Non-teammate agent spawns in interactive sessions run in the background, which changes any flow that waited on their output in the foreground.
  • Bash < file redirections now prompt — reading a file through an input redirection is permission-checked like the argument spelling. Automations that use this form may pick up a new approval step.
  • Nested git repositories confirm trust separately — trusting a parent directory no longer covers repositories inside it, so submodules and stacked checkouts add confirmation steps.
  • sandbox.ripgrep can’t be set from project settings — it is honored only from user, managed, and --settings settings. An existing project-settings entry no longer applies.
  • Invalid gateway settings now fail boot — unknown or invalid desktop: overlay keys, empty managed policy groups, and malformed email_domain values fail at boot rather than being ignored. Worth checking existing config before updating.
  • Fable 5 in /advisor requires org access — it is offered only to organizations with Fable access, with usage-credits consent set up through /model fable.
  • Remote Control doesn’t transfer on its own — if another Claude Code on the same machine still holds it, resuming a conversation won’t take it; run /remote-control there to move it.