Claude Code 2.1.232: forked subagents are on by default

Claude Code 2.1.232 makes subagent forking the default: a subagent_type: "fork" subagent inherits the full conversation and the prompt cache, and non-teammate agent spawns in interactive sessions now run in the background by default. The change heads a long changelog in the release notes on Github, which also reworks cross-session messaging and closes several permission bypasses.

At a glance

• @ mentions in the prompt line address another Claude session by name, and messages reach it through SendMessage; /config adds rows for dialog expiry and for inbound messages from other sessions.
• Secret redaction now covers nine GitLab token families including glrt-, gloas- and glptt-, routable glpat- and gldt- tokens are fully redacted, and plugin marketplaces accept bare gitlab.com repository URLs.
• The release also closes a PowerShell permission bypass, a Git Bash symlink bypass on Windows, and trust inheritance by nested git repositories, each of which now requires its own trust confirmation.

Why it matters. Forking by default changes the economics of subagent work, since an inherited prompt cache appears to cut the setup cost of spawning helpers that previously started cold. The session-to-session layer reads as an attempt to make several Claude Code instances on one machine behave as one addressable group rather than isolated terminals. The permission fixes matter separately, since they close paths on Windows and in nested repositories where file access could slip past approval.

Forking is now the default path for spawning a subagent

A subagent declared with subagent_type: "fork" inherits the full conversation and the prompt cache, and forking is enabled by default. Non-teammate agent spawns in interactive sessions run in the background by default, and the startup tip suggesting custom subagents was removed along with its matching nudge in the /powerup tour.

SendMessage delivers to a bare name that exactly matches one live session, instead of asking for a ref to be confirmed first. Typing @ in the prompt brings up other Claude sessions by name, and Claude then routes the message to that session directly.

Interactive sessions on a single machine are now kept unique: starting or renaming a session to a name another live session already uses produces a name-word-word variant. /config adds rows for dialog expiry and for messages from other sessions, where cross-session inbound traffic can be accepted, held or refused.

Two Windows permission bypasses and nested-repository trust inheritance are fixed

A PowerShell permission bypass allowed variable-writing parameters to silently overwrite $PSDefaultParameterValues and redirect the file access of later commands. On Windows, Git Bash followed Cygwin-style symlinks that path validation treated as regular files; writes through them now require permission approval.

Nested git repositories no longer inherit trust from a parent directory, and each one requires its own trust confirmation. Bash input redirections (< file) are permission-checked like their argument spellings on all platforms, the Linux filesystem sandbox was hardened against a protected-path bypass, and the auto-generated cross-session messaging socket directory on shared /tmp refuses a pre-planted symlink or another user's directory.

Secret redaction was extended to the GitLab token families glrt-, gloas-, glptt-, glagent-, glimt-, glsoat-, glcbt-, glft- and glffct-, with full redaction of routable glpat- and gldt- tokens. The glab CLI config store gets the same sandbox and credential-path protection as gh, and sandbox.ripgrep is honored only from user, managed and --settings settings.

Remote Control keeps reconnecting for about 30 minutes after a network blip

Remote Control now keeps reconnecting for roughly 30 minutes after a network blip and does not drop after a few blips spread across an hour. Sessions started from Claude Desktop or an IDE reattach to the existing claude.ai session on resume instead of appearing as a new one.

Bridge-hosted sessions inside a cloud session no longer inherit that session's transcript or credentials, and bridge sessions restore conversation history when the session worker restarts. Resuming a conversation whose session was deleted from claude.ai starts a replacement instead of failing with a login message, a regression from v2.1.227.

MCP connections no longer hang for the full 30-second connect timeout when a server fails to answer the protocol-version probe or sends a malformed reply. Rotated mTLS client certificates reload automatically on connection errors, malformed AWS or Vertex region values fall back to the default region, and stream idle timeout errors now recover on Bedrock, Vertex and gateway deployments.

What's next. Fable 5 is offered again as an advisor in /advisor for organizations with Fable access, with usage-credits consent set up through /model fable. On the gateway, the desktop: overlay now accepts every released Desktop setting rather than 11 hand-listed keys, validated at boot against Desktop's own schema, and unknown or invalid keys fail boot. Anthropic ships Claude Code builds without a fixed schedule, and no date is given for the next one.