Claude Code v2.1.211: Hardening Permission Preview Spoofing and Adding a Subagent Text Output Flag!

Hey, it's Shiichan! I checked out the newest Claude Code release today, and it includes a security fix along with a new option for subagents, so let me walk through it.

Claude Code Release github.com

What was announced?

According to the Claude Code Release notes, v2.1.211 just shipped. It brings a new flag, a security fix for permission previews, and a broad batch of other bug fixes.

The story so far

Three issues stood out to me:

• Permission previews relayed to chat channels didn't neutralize bidirectional-override, zero-width, and look-alike quote characters, so crafted tool input could visually alter what the approval message showed
• Auto mode could override a PreToolUse hook's ask decision for unsandboxed Bash
• There was no way to include a subagent's own text or thinking content when working with subagent output through stream-json

What changes

First, the permission preview security fix: bidirectional-override, zero-width, and look-alike quote characters are now properly neutralized before a preview is relayed to a chat channel. This closes off a way tool input could be used to manipulate how the approval message looks.

Auto mode's behavior is fixed too. When a hook returns ask, that decision now always acts as a floor requiring confirmation — Auto mode can no longer override it.

As for the new feature, the --forward-subagent-text flag and the CLAUDE_CODE_FORWARD_SUBAGENT_TEXT environment variable let you include a subagent's text and thinking content in stream-json output. That's a nice option if you want external tooling to observe what your subagents are doing.

Dive Deep

Here are a few more fixes worth calling out:

• Fixed multiple sessions sharing one credential store all logging out simultaneously after waking from sleep
• Fixed plugin-provided MCP servers not reconnecting after an idle web session woke, leaving MCP calls failing until the next message
• Fixed Claude Code on Vertex and Bedrock attempting the default Opus model at startup and printing a spurious fallback notice even when a model was explicitly configured
• Fixed subagents spawned with an explicit model override reverting to the parent's model when resumed or sent a follow-up message
• Fixed nested .claude/rules/*.md files loading even when setting sources exclude project settings
• Fixed filenames ending in a DOS device suffix (like .prn) or a trailing dot being wrongly rejected on upload, and fixed files with multiple hard links now being correctly refused
• Fixed edits that leave the input as "?" being silently swallowed and toggling the shortcuts panel

One more small but handy change: integer environment variables (timeouts, token budgets, retry counts) now accept scientific notation and digit-separator spellings like 1e6 and 64_000.

Wrap-up

• Permission previews now neutralize bidirectional-override, zero-width, and look-alike quote characters before being relayed to chat channels
• Auto mode no longer overrides a PreToolUse hook's ask decision for unsandboxed Bash
• The new --forward-subagent-text flag lets you include subagent text and thinking in stream-json output
• Many smaller bugs are fixed too, including simultaneous session logouts from shared credentials and MCP servers failing to reconnect
• Integer environment variables now accept scientific notation and digit separators

Since this release includes a real security fix, if you relay permission previews to a chat channel, it's worth updating sooner rather than later!