# Claude Code v2.1.211: Hardening Permission Preview Spoofing and Adding a Subagent Text Output Flag!

Hey, it's Shiichan! I checked out the newest Claude Code release today, and it includes a security fix along with a new option for subagents, so let me walk through it.

## What was announced?

According to the Claude Code Release notes, **v2.1.211** just shipped. It brings a new flag, a security fix for permission previews, and a broad batch of other bug fixes.

## The story so far

Three issues stood out to me:

- Permission previews relayed to chat channels didn't neutralize bidirectional-override, zero-width, and look-alike quote characters, so crafted tool input could visually alter what the approval message showed
- Auto mode could override a PreToolUse hook's `ask` decision for unsandboxed Bash
- There was no way to include a subagent's own text or thinking content when working with subagent output through stream-json

## What changes

First, the permission preview security fix: bidirectional-override, zero-width, and look-alike quote characters are now properly neutralized before a preview is relayed to a chat channel. This closes off a way tool input could be used to manipulate how the approval message looks.

Auto mode's behavior is fixed too. When a hook returns `ask`, that decision now always acts as a floor requiring confirmation — Auto mode can no longer override it.

As for the new feature, the `--forward-subagent-text` flag and the `CLAUDE_CODE_FORWARD_SUBAGENT_TEXT` environment variable let you include a subagent's text and thinking content in stream-json output. That's a nice option if you want external tooling to observe what your subagents are doing.

## Dive Deep

Here are a few more fixes worth calling out:

- Fixed multiple sessions sharing one credential store all logging out simultaneously after waking from sleep
- Fixed plugin-provided MCP servers not reconnecting after an idle web session woke, leaving MCP calls failing until the next message
- Fixed Claude Code on Vertex and Bedrock attempting the default Opus model at startup and printing a spurious fallback notice even when a model was explicitly configured
- Fixed subagents spawned with an explicit model override reverting to the parent's model when resumed or sent a follow-up message
- Fixed nested `.claude/rules/*.md` files loading even when setting sources exclude project settings
- Fixed filenames ending in a DOS device suffix (like `.prn`) or a trailing dot being wrongly rejected on upload, and fixed files with multiple hard links now being correctly refused
- Fixed edits that leave the input as "?" being silently swallowed and toggling the shortcuts panel

One more small but handy change: integer environment variables (timeouts, token budgets, retry counts) now accept scientific notation and digit-separator spellings like `1e6` and `64_000`.

## Wrap-up

- Permission previews now neutralize bidirectional-override, zero-width, and look-alike quote characters before being relayed to chat channels
- Auto mode no longer overrides a PreToolUse hook's `ask` decision for unsandboxed Bash
- The new `--forward-subagent-text` flag lets you include subagent text and thinking in stream-json output
- Many smaller bugs are fixed too, including simultaneous session logouts from shared credentials and MCP servers failing to reconnect
- Integer environment variables now accept scientific notation and digit separators

Since this release includes a real security fix, if you relay permission previews to a chat channel, it's worth updating sooner rather than later!