Claude Code v2.1.230 to v2.1.232 Major Updates - Sub-agent Fork Defaults and Cross-session Mentions

This is Ishikawa from the Cloud Business Division. I'd like to summarize the Claude Code updates for v2.1.231 ~ v2.1.232 (2026-08-13). With 50 changes across 2 versions, this feels like one of the larger releases recently. We're also trying out enabling subagent forking by default.

The previous update article is here.

https://dev.classmethod.jp/articles/20260813-cc-updates-v2-1-228/

Update Summary

This covers 2 versions (v2.1.231 / v2.1.232, both released 2026-08-13) with a total of 50 changes. The breakdown is: 17 fixes, 12 improvements, 12 security, 6 new features, 2 performance, and 1 breaking change. In addition to new features around subagents and cross-session communication, multiple fixes related to permission bypass and sandboxing are included.

Note that v2.1.230 was not published to the npm registry, so this article covers only v2.1.231 and v2.1.232.

Notable Updates

Subagent Forking Enabled by Default (v2.1.232)

Subagent forking is now on by default. Subagents with subagent_type: "fork" inherit the full conversation and prompt cache. Additionally, launching agents other than teammates in interactive sessions now defaults to background execution. If you want the previous behavior, you can change it via an environment variable like export CLAUDE_CODE_FORK_SUBAGENT=0.

If you've been rewriting context every time you delegate investigation to a subagent, it feels worth restructuring how you hand off tasks with fork in mind.

Mention Another Claude Session with @ (v2.1.232)

You can now type @ in a prompt to mention another Claude session by name. When mentioned, Claude uses SendMessage to contact that session directly.

For those who split work into separate sessions for tasks and research, this feels like a change that reduces the hassle of switching between terminals.

Plugin Marketplace Now Supports GitLab (v2.1.232)

The plugin marketplace now supports GitLab. Plain repository URLs from gitlab.com (including nested subgroups) can be cloned just like URLs from github.com. When clone authentication fails, the hint now shows the actual git hostname being used.

For organizations primarily using GitLab, this feels like it removes the need to route internal plugin distribution through GitHub.

Two Permission Bypass Fixes for Windows Environments (v2.1.232)

A permission bypass in PowerShell was fixed where a parameter writing to a variable could silently overwrite $PSDefaultParameterValues, allowing subsequent commands to redirect file access. Also fixed was a permission bypass on Windows where Git Bash followed Cygwin-style symbolic links while path validation treated them as regular files — writes through these paths now require permission approval.

For those using Claude Code on Windows, this feels like something to prioritize updating, as there will be places where operations revert to requiring permission confirmation.

Fixed Trust Inheritance in Nested Git Repositories (v2.1.232)

An issue where nested git repositories inherited trust settings from parent directories has been fixed. Trust confirmation is now required individually for each repository.

For those with separate repositories inside monorepos or vendor directories, it's worth expecting an increase in the number of trust confirmations.

Fixed MCP OAuth Sign-in Failure (v2.1.231)

An issue has been fixed where OAuth sign-in failed due to redirect URI mismatch in MCP servers that use pre-registered OAuth clients, such as Slack.

For those who were stuck unable to sign in with the Slack MCP server, it feels worth updating first and then retrying.

Fixed 30-Second MCP Connection Hang (v2.1.232)

An issue has been fixed where a connection would hang up to the full 30-second timeout when an MCP server didn't respond to a protocol version probe or returned an invalid response.

For those who were being made to wait on every startup, this feels like a fix that will make a noticeable difference in perceived speed.

Fixed Stream Idle Timeout for Bedrock and Vertex (v2.1.232)

An issue has been fixed where stream idle timeout errors in Bedrock, Vertex, and gateway deployments were not recovering, causing request failures.

For those handling long responses via Bedrock, this feels like a fix that will reduce requests dropping midway.

Target Versions and Period

New Features

• Subagent forking enabled by default. Subagents with subagent_type: "fork" inherit the full conversation and prompt cache, and launching agents other than teammates in interactive sessions now defaults to background execution (v2.1.232)
• You can now type @ in a prompt to mention another Claude session by name. Claude contacts that session directly via SendMessage (v2.1.232)
• Lines for "Dialog expiry" and "Messages from your other sessions" (controlling cross-session reception with accept / hold / refuse) have been added to /config (v2.1.232)
• Plugin marketplace now supports GitLab. Plain repository URLs from gitlab.com (including nested subgroups) can now be cloned just like github.com URLs, and clone authentication failure hints now show the actual git hostname (v2.1.232)
• additionalMarketplaces / allowedMarketplaces are now accepted in settings as aliases for extraKnownMarketplaces / strictKnownMarketplaces respectively (v2.1.232)
• Fable 5 is once again available as an advisor in /advisor for organizations with access to Fable. Usage credit consent is configured via /model fable (v2.1.232)

Security

• Fixed a permission bypass in PowerShell where a parameter writing to a variable could silently overwrite $PSDefaultParameterValues, allowing subsequent commands to redirect file access (v2.1.232)
• Fixed a permission bypass on Windows where Git Bash followed Cygwin-style symbolic links while path validation treated them as regular files. Writes through these paths now require permission approval (v2.1.232)
• Fixed an issue where nested git repositories inherited trust settings from parent directories. Trust confirmation is now required individually for each repository (v2.1.232)
• Bash input redirection (< file) is now permission-checked on all platforms the same way as when written as an argument (v2.1.232)
• The Linux filesystem sandbox has been hardened against bypasses of protected paths (v2.1.232)
• Secret masking has been added for GitLab token types (glrt-, gloas-, glptt-, glagent-, glimt-, glsoat-, glcbt-, glft-, glffct-), and routable glpat- / gldt- tokens are now fully masked. Additionally, the glab CLI configuration store is now subject to the same sandbox protection and credential path protection as gh (v2.1.232)
• Fixed an issue where Remote Control sessions hosted by a bridge within a cloud session were inheriting that session's transcript and credentials (v2.1.232)
• The auto-generated socket directory for cross-session messaging on shared /tmp has been hardened to reject and not use pre-planted symbolic links or directories owned by other users (v2.1.232)
• Cowork sessions no longer inline-expand external @-imports from user-scoped memory files (v2.1.232)
• The managed settings approval dialog has been improved with endpoint URL display, clarified wording for telemetry-only changes, and omission of boilerplate OpenTelemetry options. Approval is now required for server-managed sandbox binary overrides (sandbox.bwrapPath, sandbox.socatPath, sandbox.ripgrep) (v2.1.232)
• Enterprise policy blockedMarketplaces entries of type url for plain repository URLs now continue to block those URLs when the CLI classifies them as git clones (v2.1.232)
• Gateway now fails at startup instead of exhibiting behaviors such as matching nobody or granting admin rights for empty managed.policies[].match.groups / admin.admin_groups entries and invalid email_domain values (empty, or containing @, whitespace, or commas) (v2.1.232)

Improvements

• SendMessage now delivers directly to a bare name that exactly matches exactly one active session without asking for ref confirmation (v2.1.232)
• Interactive session names on the same machine are now kept unique. Starting or renaming to a name already in use by another active session assigns an alternate name in name-word-word format with a notification (v2.1.232)
• /plugin install plugin@marketplace now updates the marketplace first, allowing newly published plugins to be installed without a manual update (v2.1.232)
• /code-review at high, xhigh, and max effort levels now runs in background agents, just like other levels (v2.1.232)
• /feedback and /bug invoked while Claude is responding now open immediately without waiting for the turn to end (v2.1.232)
• Remote Control now continues trying to reconnect for approximately 30 minutes after a network blip, preventing disconnection from a few brief outages within an hour (v2.1.232)
• Resuming a conversation in Remote Control no longer silently steals control from another Claude Code instance on the same machine that holds Remote Control. Use /remote-control on that instance to transfer it (v2.1.232)
• Remote Control now informs the terminal whether a session was taken over by another device, terminated from another app, or deleted, and no longer suggests reconnecting in ways that would undo that (v2.1.232)
• The agent panel has been updated so completed subagents are immediately hidden with a /tasks footer hint, and the "↓ N more" overflow indicator has moved left for better visibility (v2.1.232)
• The message shown when resuming a completed background agent has been shortened (v2.1.232)
• The Gateway desktop: overlay now accepts all released Desktop settings rather than a handwritten set of 11 keys, and is validated against Desktop's own schema at startup. Unknown or invalid keys cause startup to fail (v2.1.232)
• The startup hint encouraging creation of custom subagents and the corresponding guidance in the /powerup tour have been removed (v2.1.232)

Performance

• Full-screen streaming has been improved to no longer re-normalize the entire conversation on each update, maintaining responsiveness even in long sessions (v2.1.232)
• Loading pasted and clipboard images no longer blocks the event loop (v2.1.232)

Fixes (Key Items)

A selection of fixes related to stability and usability.

• Fixed MCP OAuth sign-in failure: Sign-in was failing due to redirect URI mismatch in MCP servers using pre-registered OAuth clients such as Slack (v2.1.231)
• Fixed 30-second MCP connection hang: Connections were hanging up to the full timeout when MCP servers didn't respond to the protocol version probe or returned invalid responses (v2.1.232)
• Fixed Remote Control session resume failure: Resuming a conversation tied to a session deleted from claude.ai or the app was failing with a login-related message (regression from v2.1.227). An alternate session is now started instead (v2.1.232)
• Fixed Bedrock/Vertex stream idle timeout: Stream idle timeout errors in Bedrock, Vertex, and gateway deployments were not recovering, causing request failures (v2.1.232)
• Fixed Remote Control session display and history restoration: Fixed issues where sessions started from Claude Desktop or IDE appeared as new sessions on claude.ai each time a local session was resumed, idle sessions appeared unreachable to newly connected clients, and bridge sessions did not restore conversation history on session worker restart (v2.1.232)
• Fixed mTLS client certificate rotation: Rotation previously required a restart, but certificates and keys are now automatically reloaded after connection errors (v2.1.232)
• Fixed invalid region values for AWS and Vertex: Malformed region values were being used in request URL construction; they now fall back to the default region (v2.1.232)
• Fixed plugin marketplace deregistration: Concurrent writes to known_marketplaces.json were silently deregistering marketplaces due to a race condition at startup (v2.1.232)
• A quietly welcome fix: /update and /tui no longer refuse to restart when a persistent operation is running. Not being made to wait before updating while background work is running is a small but welcome change (v2.1.232)
• Many other minor issues have been fixed including Cloud gateway /login, voice mode, overlay rendering, usage limit messaging, --advisor fable consent messages, and more.

Breaking Changes / Deprecations

• sandbox.ripgrep has been changed to only take effect from user, managed, and --settings configurations. The sandbox ripgrep binary can no longer be overridden from project settings (v2.1.232)

The CHANGELOG does not include specific configuration examples, so the following are provided to help assess impact.

Before (up to v2.1.231):

// .claude/settings.json (project settings)
{
  "sandbox": {
    "ripgrep": "./tools/rg"
  }
}

After (v2.1.232 onward): The project settings above are ignored. To continue specifying this, move it to user settings, managed settings, or --settings.

// ~/.claude/settings.json (user settings)
{
  "sandbox": {
    "ripgrep": "./tools/rg"
  }
}

Note that approval is now required for server-managed sandbox binary overrides (sandbox.bwrapPath, sandbox.socatPath, sandbox.ripgrep) — worth confirming alongside this change.

Trying Out Subagent Fork Enabled by Default

The Problem Being Solved

Without forking, subagents — borrowing the tool definition's wording — start a fresh agent with no memory of prior runs. This created three issues:

1. Re-entering context — Having to rewrite "which files are being touched" and "what decisions were made" into every prompt
2. Prompt cache misses — A new agent has a different prefix, so the parent conversation's cache doesn't apply. Fork explicitly states it inherits the full conversation and prompt cache, which directly addresses this
3. Lost context — Off-target responses caused by forgotten context

The Concrete Difference Before and After the Update

The key observable difference before and after the update is that the Agent tool's description passed to the model itself is replaced. The following is the original text obtained from actual measurement.

Before (fork disabled — v2.1.231 default)

When using the Agent tool, specify a subagent_type parameter to select which
agent type to use. If omitted, the general-purpose agent is used.

After (fork enabled — v2.1.232 interactive session default)

When using the Agent tool, specify a subagent_type to select an agent:
`"fork"` forks yourself (the fork inherits your full conversation context and
always runs on your model — a `model` override is ignored); any other type —
or omitting it — starts a fresh agent (general-purpose by default).

Additionally, only when fork is enabled, the following block is additionally inserted (in the disabled case, it was replaced with an empty string in the implementation).

A fork runs in the background and keeps its tool output out of your context.
If you are the fork, execute directly — don't re-delegate. Subagents run in
the background; you'll be notified when one completes.

The presence or absence of this second block was also confirmed through actual measurement. Sending the same question and checking whether Subagents run in the background... is included shows NO for the default print mode and YES with CLAUDE_CODE_FORK_SUBAGENT=1.

This explains why the CHANGELOG combines "fork enabled by default" and "background execution by default" into a single line. Since the background execution instruction text is toggled under the same condition as the fork flag, it effectively behaves as a single unified change.

Trying It Out

We verify this by checking whether a subagent can answer a passphrase that only the parent session could know. First, launch Claude and use the following prompt to share the passphrase "himawari0814".

We'll now set a passphrase. The passphrase is "himawari0814".
Remember it for a later verification. Just reply with "Understood."

At this point, the passphrase exists only within the parent session's conversation history.

Next, use the following prompt to launch a fork subagent and confirm it can answer the passphrase.

Please launch the Agent tool with subagent_type: "fork".
The only instruction to the subagent should be "Please tell me the passphrase."
Do not include the passphrase itself in the prompt under any circumstances.
Report back exactly what the subagent returned.

The result was as follows — the fork subagent successfully answered the passphrase "himawari0814".

Closing

v2.1.231~v2.1.232 is a large release at 50 changes, and among them, the default enablement of subagent forking and cross-session mentions feel like the biggest impacts on day-to-day work. At the same time, with multiple permission bypass and sandbox fixes included, I see this as a release where the reason to update is stronger for security reasons than for features.

If you have sandbox.ripgrep specified in your project settings, it's worth checking where to move that configuration beforehand. If any changes catch your eye, update and try them out.

References

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

https://code.claude.com/docs/en/changelog

https://dev.classmethod.jp/articles/20260813-cc-updates-v2-1-228/