Claude Code v2.1.232: Subagent Forking, GitLab Support, and Security Fixes

Claude Code v2.1.232 is out, and it brings a few significant changes: subagent forking is now default, GitLab support lands in plugin marketplaces, and several security patches address permission bypasses. If you're using Claude Code for multi-session workflows or in enterprise environments, this update is worth a look.

Subagent Forking On by Default

The headline feature: subagent_type: "fork" is now enabled by default. Forked subagents inherit the full conversation and prompt cache, which means they start with all the context you've built. Also, non-teammate agent spawns in interactive sessions now run in the background by default — no more blocking the main session.

Cross-Session Messaging via @

You can now type @ in the prompt to mention another Claude session by name. Claude uses SendMessage to reach that session directly. Bare names that exactly match a live session are delivered immediately (no confirmation prompt with a ref). Session names are also enforced to be unique on a machine; if you try to start or rename to a name already in use, you'll get a name-word-word variant and a notification.

New /config rows let you control "Dialog expiry" and "Messages from your other sessions" — the latter offers accept/hold/refuse for cross-session inbound requests.

GitLab Everywhere

Secret redaction now covers a whole family of GitLab tokens: glrt-, gloas-, glptt-, glagent-, glimt-, glsoat-, glcbt-, glft-, glffct-, plus full redaction of routable glpat-/gldt- tokens. The glab CLI config store gets the same sandbox and credential-path protection as gh.

Plugin marketplaces now support GitLab: bare gitlab.com repo URLs (including nested subgroups) clone just like GitHub URLs, and clone auth-failure hints name your actual Git host.

Settings and Enterprise Policy

• additionalMarketplaces and allowedMarketplaces are accepted as friendlier aliases for extraKnownMarketplaces and strictKnownMarketplaces.
• A URL-typed blockedMarketplaces entry for a bare repo URL continues to block that URL when the CLI classifies it as a Git clone.
• Gateway: the desktop: overlay now accepts every released Desktop setting (was 11 hand-listed keys), validated at boot against Desktop's own schema. Unknown or invalid keys fail boot.
• Gateway: empty managed.policies[].match.groups / admin.admin_groups entries and malformed email_domain values (empty, or containing @, whitespace, or commas) now fail at boot instead of silently matching no one or granting admin access.

Security Fixes

• Fixed a PowerShell permission bypass where variable-writing parameters could silently overwrite $PSDefaultParameterValues and redirect later commands' file access.
• Fixed a Windows permission bypass where Git Bash followed Cygwin-style symlinks that path validation saw as regular files; writes through them now require permission approval.
• Fixed nested git repositories inheriting trust from a parent directory; each repository now requires its own trust confirmation.

Other Notable Fixes

• MCP connections no longer hang for the full 30-second connect timeout when a server fails to answer or sends a malformed reply to the protocol-version probe.
• Remote Control: sessions hosted by a bridge inside a cloud session no longer inherit that session's transcript or credentials; sessions started from Desktop/IDE reattach to the existing claude.ai session; idle sessions are reachable; bridge sessions restore conversation history on worker restart; resuming a deleted session starts a replacement instead of failing.
• Cloud gateway /login shows the reason when managed settings fail to load, instead of exiting silently or leaving an unresponsive terminal.
• Voice mode on native builds shows rejection immediately when the voice service rejects the connection.
• mTLS client certificate rotation no longer requires a restart; Claude Code reloads the rotated cert and key automatically on connection errors.
• Malformed AWS or Vertex region values fall back to the default region instead of being used to build request URLs.
• Stream idle timeout errors recover properly on Bedrock, Vertex, and gateway deployments.
• Overlay rendering fixed for content-sized overlays with truncated text.

Also, Fable 5 is back as an advisor in /advisor for organizations with Fable access, with usage-credits consent set up through /model fable.

If you're running Claude Code in enterprise or multi-session setups, this release tightens security and improves cross-session interactions. Update and check your configurations.