Claude Code 2.1.232 - リリースノート

日本語サマリー

以下は、提供された Claude Code リリースノートの日本語要約です。

⚠️ 破壊的変更・セキュリティ修正（優先対応推奨）

• PowerShellの権限バイパス修正: 変数書き込みパラメータによる $PSDefaultParameterValues の上書きを防止。
• Windowsの権限バイパス修正: Git BashにおけるCygwin形式のシンボリックリンクを通じたファイルアクセスを権限承認必須に変更。
• セキュリティ強化:
  • GitLabの各種トークン（glpat- や glrt- など）をシークレット対象として自動マスキング（Redaction）。
  • 共有 /tmp 上のソケットディレクトリや、Linuxファイルシステムサンドボックスの保護を強化し、保護対象パスのバイパスを防止。
  • sandbox.ripgrep 設定を user, managed, --settings のみに限定し、project設定による上書きを禁止。

🚀 新機能・重要な変更点

• Subagent forking のデフォルト有効化: subagent_type: "fork" を指定したサブエージェントは、会話履歴とプロンプトキャッシュを引き継ぎます。また、インタラクティブセッションでのエージェント生成はデフォルトでバックグラウンド動作するようになりました。
• 他セッションへの直接メッセージ送信: プロンプトで @ を入力することで、他の稼働中の Claude セッションをメンションし、SendMessage で直接メッセージを送信できるようになりました。
• GitLab プラグインマーケットプレースのサポート: github.com と同様に、gitlab.com のリポジトリURL（ネストされたサブグループを含む）から直接プラグインをクローンできるようになりました。
• マーケットプレース設定の追加: extraKnownMarketplaces および strictKnownMarketplaces の、より直感的なエイリアスとして additionalMarketplaces と allowedMarketplaces が追加されました。
• セッション名の重複回避: 同一マシン内で同一のセッション名が使われた場合、自動的に name-word-word 形式の一意な名前に変更されるようになりました。

🐛 バグ修正・その他の改善

• Remote Control の安定性向上: ネットワークの瞬断発生時の再接続持続時間を約30分に延長。また、接続が切れる原因を明確にターミナルへ表示するよう改善しました。
• MCP接続のハングアップ解消: サーバーが応答しない、または不正な応答を返した際の30秒間の接続タイムアウトによるハングアップを修正しました。
• 各種クラウド・ゲートウェイ・APIの改善:
  • Bedrock, Vertex, gateway におけるストリームアイドルタイムアウト発生時の復帰処理を修正。
  • mTLSクライアント証明書のローテーション時に自動で再読み込みするように修正（再起動不要化）。
  • desktop: オーバーレイの全設定キーと、起動時のスキーマ検証をサポート。
• ネストされた git リポジトリの信頼度継承を修正: 親ディレクトリの信頼状態を自動で継承せず、各リポジトリごとに信頼確認を要求するように変更しました。
• UI/UXの最適化: 長時間のストリーミング時の応答性を向上させ、バックグラウンドエージェントの完了メッセージや絵文字途中の文字化け表示などを修正しました。

原文（Release Notes）

What's changed

• Subagent forking is now on by default: a subagent_type: "fork" subagent inherits the full conversation and prompt cache, and non-teammate agent spawns in interactive sessions now run in the background by default
• Type @ in the prompt to mention another Claude session by name; Claude then uses SendMessage to reach that session directly
• SendMessage now delivers to a bare name that exactly matches one live session, instead of asking to confirm with a ref first
• Interactive sessions on one machine now keep unique names: starting or renaming a session to a name another live session already uses gives it a name-word-word variant and tells you
• Added /config rows for "Dialog expiry" and "Messages from your other sessions" (cross-session inbound accept/hold/refuse)
• Added secret redaction for GitLab token families (glrt-, gloas-, glptt-, glagent-, glimt-, glsoat-, glcbt-, glft-, glffct-) and full redaction of routable glpat-/gldt- tokens; the glab CLI config store gets the same sandbox and credential-path protection as gh
• Added GitLab support to plugin marketplaces: bare gitlab.com repo URLs (including nested subgroups) now clone like github.com URLs, and clone auth-failure hints name your actual git host
• Settings: additionalMarketplaces and allowedMarketplaces are now accepted as friendlier aliases for extraKnownMarketplaces and strictKnownMarketplaces
• Enterprise policy: a url-typed blockedMarketplaces entry for a bare repo URL keeps blocking that URL when the CLI classifies it as a git clone
• Gateway: the desktop: overlay now accepts every released Desktop setting (was 11 hand-listed keys), validated at boot against Desktop's own schema; unknown or invalid keys fail boot
• Gateway: empty managed.policies[].match.groups/admin.admin_groups entries and malformed email_domain values (empty, or containing @, whitespace, or commas) now fail at boot instead of silently matching no one or granting admin access
• Fable 5 is offered as an advisor in /advisor again for organizations with Fable access, with usage-credits consent set up through /model fable
• Fixed a PowerShell permission bypass where variable-writing parameters could silently overwrite $PSDefaultParameterValues and redirect later commands' file access
• Fixed a Windows permission bypass where Git Bash followed Cygwin-style symlinks that path validation saw as regular files; writes through them now require permission approval
• Fixed nested git repositories inheriting trust from a parent directory; each repository now requires its own trust confirmation
• Fixed MCP connections hanging for the full 30-second connect timeout when a server fails to answer or sends a malformed reply to the protocol-version probe
• Fixed Remote Control sessions hosted by a bridge inside a cloud session inheriting that session's transcript or credentials
• Fixed Remote Control sessions started from Claude Desktop or an IDE appearing as a new claude.ai session each time the local session was resumed; they now reattach to the existing one
• Fixed Remote Control sessions appearing unreachable to newly attached clients while idle
• Fixed Remote Control bridge sessions not restoring conversation history when the session worker restarts
• Remote Control: resuming a conversation whose session was deleted from claude.ai or the app now starts a replacement instead of failing with a message about your login (regressed in v2.1.227)
• Fixed Cloud gateway /login exiting silently or leaving an unresponsive terminal after "Press Enter to continue" when managed settings failed to load; the reason is now shown
• Fixed voice mode on native builds getting stuck on "listening…" when the voice service rejected the connection; the rejection is now shown immediately
• Fixed mTLS client certificate rotation requiring a restart; Claude Code now reloads the rotated cert and key automatically on connection errors
• Fixed malformed AWS or Vertex region values being used to build request URLs; they now fall back to the default region
• Fixed stream idle timeout errors failing the request instead of recovering on Bedrock, Vertex, and gateway deployments
• Fixed content-sized overlays containing truncated text rendering one column too wide, and start-truncated text collapsing to an ellipsis
• Fixed a stray garbled character where a long shell-command or agent-description preview was cut off mid-emoji
• Fixed a startup race that could silently unregister a plugin marketplace due to concurrent writes to known_marketplaces.json
• Fixed /update and /tui refusing to restart while work that survives the relaunch was running
• Fixed usage-limit guidance suggesting unavailable slash commands in SDK and remote sessions
• Fixed the consent message for interactive --advisor fable launches, which told you to run /model fable in an interactive session that had just exited
• Improved fullscreen streaming: long sessions stay responsive because the whole conversation is no longer re-normalized on every update
• Improved the managed settings approval dialog: shows endpoint URLs, uses clearer wording for telemetry-only changes, skips routine OpenTelemetry options, and requires approval for server-managed sandbox binary overrides (sandbox.bwrapPath, sandbox.socatPath, sandbox.ripgrep)
• /feedback and /bug now open immediately when invoked while Claude is responding, instead of waiting for the turn to finish
• /plugin install plugin@marketplace now refreshes the marketplace first, so newly published plugins install without a manual marketplace update
• /code-review at high, xhigh, and max effort now runs in a background agent like the other levels
• Pasted and clipboard images are read without blocking the event loop
• Remote Control now keeps reconnecting for about 30 minutes after a network blip and no longer drops after a few blips spread across an hour
• Remote Control: resuming a conversation no longer silently takes Remote Control away from another Claude Code on the same machine that still has it; run /remote-control there to move it
• Updated agent panel: completed subagents hide immediately with a /tasks footer hint, and the "↓ N more" overflow indicator moved left for visibility
• Remote Control: the terminal now says whether a session was taken over by another device, ended from another app, or deleted, and stops suggesting a reconnect that would undo it
• Bash input redirections (< file) are now permission-checked like their argument spellings on all platforms
• Shortened the message shown when resuming a completed background agent
• Cowork sessions no longer inline external @-imports from user-scope memory files
• Hardened the auto-generated cross-session messaging socket directory on shared /tmp: a pre-planted symlink or another user's directory is now refused instead of used
• Hardened the Linux filesystem sandbox against a protected-path bypass
• Changed sandbox.ripgrep to be honored only from user, managed, and --settings settings; project settings can no longer override the sandbox's ripgrep binary
• Removed the startup tip suggesting you create custom subagents, and the matching nudge in the /powerup tour