Claude Code v2.1.232 发布：默认启用子代理 Fork，强化跨会话协作与安全防护

更新内容

• 现默认启用子代理 Fork：subagent_type: "fork" 类型的子代理会继承完整对话和提示词缓存；交互式会话中启动的非队友代理现默认在后台运行。
• 可在提示词中输入 @，按名称提及另一 Claude 会话；Claude 随后会使用 SendMessage 直接联系该会话。
• SendMessage 现可直接投递给恰好匹配一个活动会话的裸名称，不再要求先通过 ref 确认。
• 同一台机器上的交互式会话现会保持唯一名称：若启动或重命名一个会话时使用了另一活动会话已有的名称，系统会为其生成 name-word-word 变体并提示用户。
• 在 /config 中新增“对话过期时间”和“来自其他会话的消息”配置行，后者可设置跨会话入站消息为接受、暂缓或拒绝。
• 新增对 GitLab token 家族的机密信息脱敏支持（glrt-、gloas-、glptt-、glagent-、glimt-、glsoat-、glcbt-、glft-、glffct-），并对可路由的 glpat-/gldt- token 进行完整脱敏；glab CLI 配置存储现获得与 gh 相同的沙箱和凭证路径保护。
• 插件市场新增 GitLab 支持：裸 gitlab.com 仓库 URL（包括嵌套子组）现可像 github.com URL 一样克隆；克隆认证失败提示会显示实际使用的 Git 主机。
• 设置项：additionalMarketplaces 和 allowedMarketplaces 现分别可作为 extraKnownMarketplaces 和 strictKnownMarketplaces 的更易用别名。
• 企业策略：当 CLI 将裸仓库 URL 识别为 Git 克隆时，URL 类型的 blockedMarketplaces 条目仍会阻止该 URL。
• Gateway：desktop: 覆盖层现接受所有已发布的 Desktop 设置项（此前仅列出 11 个键），并在启动时根据 Desktop 自身 schema 进行验证；未知或无效的键会导致启动失败。
• Gateway：managed.policies[].match.groups/admin.admin_groups 中的空条目，以及格式错误的 email_domain 值（空值、包含 @、空白字符或逗号），现会在启动时失败，而非静默地不匹配任何用户或授予管理员权限。
• 对于拥有 Fable 访问权限的组织，Fable 5 再次作为顾问出现在 /advisor 中；使用额度同意流程可通过 /model fable 设置。
• 修复了 PowerShell 权限绕过问题：可写入变量的参数此前可能静默覆盖 $PSDefaultParameterValues，并重定向后续命令的文件访问。
• 修复了 Windows 权限绕过问题：Git Bash 此前会跟随路径验证视为常规文件的 Cygwin 风格符号链接；现在通过这些链接进行写入需要权限审批。
• 修复嵌套 Git 仓库从父目录继承信任的问题；现在每个仓库都需要单独确认信任。
• 修复 MCP 连接问题：当服务器未响应协议版本探测或返回格式错误的回复时，连接此前会一直挂起至完整的 30 秒连接超时。
• 修复由云会话内 bridge 托管的 Remote Control 会话继承该云会话记录或凭证的问题。
• 修复从 Claude Desktop 或 IDE 启动的 Remote Control 会话：此前每次恢复本地会话时都显示为新的 claude.ai 会话；现在会重新附着到原有会话。
• 修复空闲状态下新连接的客户端将 Remote Control 会话显示为不可达的问题。
• 修复会话 worker 重启时，Remote Control bridge 会话未恢复对话历史的问题。
• Remote Control：恢复一个已从 claude.ai 或应用中删除的会话时，现在会启动替代会话，而不是因登录相关消息而失败（该问题在 v2.1.227 中引入）。
• 修复 Cloud gateway /login 问题：当托管设置加载失败时，命令此前可能在“Press Enter to continue”后静默退出或留下无响应终端；现在会显示失败原因。
• 修复原生构建中的语音模式问题：当语音服务拒绝连接时，界面此前会停留在“listening…”；现在会立即显示拒绝原因。
• 修复 mTLS 客户端证书轮换必须重启的问题；Claude Code 现会在连接错误时自动重新加载轮换后的证书和密钥。
• 修复格式错误的 AWS 或 Vertex 区域值被用于构造请求 URL 的问题；现会回退到默认区域。
• 修复 Bedrock、Vertex 和 gateway 部署中流式传输空闲超时导致请求失败的问题；现在会尝试恢复。
• 修复内容尺寸覆盖层中截断文本渲染宽出一列，以及行首截断文本收缩为省略号的问题。
• 修复长 Shell 命令或代理描述预览在 emoji 中间截断时出现乱码字符的问题。
• 修复启动竞态条件：此前并发写入 known_marketplaces.json 可能导致插件市场被静默注销。
• 修复 /update 和 /tui 在仍有可跨重启保留的工作运行时拒绝重启的问题。
• 修复 SDK 和远程会话中使用额度限制指引推荐不可用斜杠命令的问题。
• 修复交互式 --advisor fable 启动时的同意消息：此前它会要求用户在刚刚退出的交互式会话中运行 /model fable。
• 改进全屏流式输出：由于不再在每次更新时重新规范化整段对话，长会话可保持响应流畅。
• 改进托管设置审批对话框：现会显示端点 URL，为仅遥测变更使用更清晰的措辞，跳过常规 OpenTelemetry 选项，并要求审批由服务器托管的沙箱二进制文件覆盖项（sandbox.bwrapPath、sandbox.socatPath、sandbox.ripgrep）。
• 当 Claude 正在响应时调用 /feedback 和 /bug，现会立即打开，而无需等待当前轮次结束。
• /plugin install plugin@marketplace 现会先刷新插件市场，因此新发布的插件无需手动更新市场即可安装。
• /code-review 在 high、xhigh 和 max 工作强度下现会像其他级别一样在后台代理中运行。
• 粘贴的图片和剪贴板图片现可被读取，而不会阻塞事件循环。
• Remote Control 现会在网络短暂中断后持续尝试重连约 30 分钟，并且不再因一小时内分散出现的几次短暂中断而断开。
• Remote Control：恢复对话不再会静默地从同一机器上仍在控制该会话的另一 Claude Code 实例夺取 Remote Control；请在该实例中运行 /remote-control 进行转移。
• 更新代理面板：已完成的子代理会立即隐藏，并在底部显示 /tasks 提示；“↓ N more”溢出指示器已向左移动以提高可见性。
• Remote Control：终端现会说明会话是否已被另一设备接管、被另一应用结束或已删除，并停止建议可能撤销该状态的重新连接操作。
• Bash 输入重定向（< file）现会在所有平台上像其参数写法一样进行权限检查。
• 缩短恢复已完成后台代理时显示的消息。
• Cowork 会话不再内联来自用户作用域记忆文件的外部 @ 导入内容。
• 强化共享 /tmp 上自动生成的跨会话消息 socket 目录：若发现预先植入的符号链接或其他用户的目录，现会拒绝使用，而不是继续使用。
• 强化 Linux 文件系统沙箱，以防范受保护路径绕过。
• 调整 sandbox.ripgrep：现在仅接受用户设置、托管设置和 --settings 设置中的值；项目设置不能再覆盖沙箱的 ripgrep 二进制文件。
• 移除启动提示中建议创建自定义子代理的内容，以及 /powerup 导览中的对应提示。

1. Releases
2. v2.1.232

Compare

Sorry, something went wrong.

No results found

What's changed

• Subagent forking is now on by default: a subagent_type: "fork" subagent inherits the full conversation and prompt cache, and non-teammate agent spawns in interactive sessions now run in the background by default
• Type @ in the prompt to mention another Claude session by name; Claude then uses SendMessage to reach that session directly
• SendMessage now delivers to a bare name that exactly matches one live session, instead of asking to confirm with a ref first
• Interactive sessions on one machine now keep unique names: starting or renaming a session to a name another live session already uses gives it a name-word-word variant and tells you
• Added /config rows for "Dialog expiry" and "Messages from your other sessions" (cross-session inbound accept/hold/refuse)
• Added secret redaction for GitLab token families (glrt-, gloas-, glptt-, glagent-, glimt-, glsoat-, glcbt-, glft-, glffct-) and full redaction of routable glpat-/gldt- tokens; the glab CLI config store gets the same sandbox and credential-path protection as gh
• Added GitLab support to plugin marketplaces: bare gitlab.com repo URLs (including nested subgroups) now clone like github.com URLs, and clone auth-failure hints name your actual git host
• Settings: additionalMarketplaces and allowedMarketplaces are now accepted as friendlier aliases for extraKnownMarketplaces and strictKnownMarketplaces
• Enterprise policy: a url-typed blockedMarketplaces entry for a bare repo URL keeps blocking that URL when the CLI classifies it as a git clone
• Gateway: the desktop: overlay now accepts every released Desktop setting (was 11 hand-listed keys), validated at boot against Desktop's own schema; unknown or invalid keys fail boot
• Gateway: empty managed.policies[].match.groups/admin.admin_groups entries and malformed email_domain values (empty, or containing @, whitespace, or commas) now fail at boot instead of silently matching no one or granting admin access
• Fable 5 is offered as an advisor in /advisor again for organizations with Fable access, with usage-credits consent set up through /model fable
• Fixed a PowerShell permission bypass where variable-writing parameters could silently overwrite $PSDefaultParameterValues and redirect later commands' file access
• Fixed a Windows permission bypass where Git Bash followed Cygwin-style symlinks that path validation saw as regular files; writes through them now require permission approval
• Fixed nested git repositories inheriting trust from a parent directory; each repository now requires its own trust confirmation
• Fixed MCP connections hanging for the full 30-second connect timeout when a server fails to answer or sends a malformed reply to the protocol-version probe
• Fixed Remote Control sessions hosted by a bridge inside a cloud session inheriting that session's transcript or credentials
• Fixed Remote Control sessions started from Claude Desktop or an IDE appearing as a new claude.ai session each time the local session was resumed; they now reattach to the existing one
• Fixed Remote Control sessions appearing unreachable to newly attached clients while idle
• Fixed Remote Control bridge sessions not restoring conversation history when the session worker restarts
• Remote Control: resuming a conversation whose session was deleted from claude.ai or the app now starts a replacement instead of failing with a message about your login (regressed in v2.1.227)
• Fixed Cloud gateway /login exiting silently or leaving an unresponsive terminal after "Press Enter to continue" when managed settings failed to load; the reason is now shown
• Fixed voice mode on native builds getting stuck on "listening…" when the voice service rejected the connection; the rejection is now shown immediately
• Fixed mTLS client certificate rotation requiring a restart; Claude Code now reloads the rotated cert and key automatically on connection errors
• Fixed malformed AWS or Vertex region values being used to build request URLs; they now fall back to the default region
• Fixed stream idle timeout errors failing the request instead of recovering on Bedrock, Vertex, and gateway deployments
• Fixed content-sized overlays containing truncated text rendering one column too wide, and start-truncated text collapsing to an ellipsis
• Fixed a stray garbled character where a long shell-command or agent-description preview was cut off mid-emoji
• Fixed a startup race that could silently unregister a plugin marketplace due to concurrent writes to known_marketplaces.json
• Fixed /update and /tui refusing to restart while work that survives the relaunch was running
• Fixed usage-limit guidance suggesting unavailable slash commands in SDK and remote sessions
• Fixed the consent message for interactive --advisor fable launches, which told you to run /model fable in an interactive session that had just exited
• Improved fullscreen streaming: long sessions stay responsive because the whole conversation is no longer re-normalized on every update
• Improved the managed settings approval dialog: shows endpoint URLs, uses clearer wording for telemetry-only changes, skips routine OpenTelemetry options, and requires approval for server-managed sandbox binary overrides (sandbox.bwrapPath, sandbox.socatPath, sandbox.ripgrep)
• /feedback and /bug now open immediately when invoked while Claude is responding, instead of waiting for the turn to finish
• /plugin install plugin@marketplace now refreshes the marketplace first, so newly published plugins install without a manual marketplace update
• /code-review at high, xhigh, and max effort now runs in a background agent like the other levels
• Pasted and clipboard images are read without blocking the event loop
• Remote Control now keeps reconnecting for about 30 minutes after a network blip and no longer drops after a few blips spread across an hour
• Remote Control: resuming a conversation no longer silently takes Remote Control away from another Claude Code on the same machine that still has it; run /remote-control there to move it
• Updated agent panel: completed subagents hide immediately with a /tasks footer hint, and the "↓ N more" overflow indicator moved left for visibility
• Remote Control: the terminal now says whether a session was taken over by another device, ended from another app, or deleted, and stops suggesting a reconnect that would undo it
• Bash input redirections (< file) are now permission-checked like their argument spellings on all platforms
• Shortened the message shown when resuming a completed background agent
• Cowork sessions no longer inline external @-imports from user-scope memory files
• Hardened the auto-generated cross-session messaging socket directory on shared /tmp: a pre-planted symlink or another user's directory is now refused instead of used
• Hardened the Linux filesystem sandbox against a protected-path bypass
• Changed sandbox.ripgrep to be honored only from user, managed, and --settings settings; project settings can no longer override the sandbox's ripgrep binary
• Removed the startup tip suggesting you create custom subagents, and the matching nudge in the /powerup tour

You can’t perform that action at this time.