It Stopped Assuming One Terminal

Here's the deal: between August 13 and 18, Claude Code shipped five versions, v2.1.231 through v2.1.235. Item by item they look like housekeeping. Grouped together, they point one direction.

Claude Code has been a tool where one person talks to one terminal window. This batch changes that premise. Multiple sessions running at once, aware of each other, continuing while nobody is at the keyboard is now treated as the normal case.

The headline addition: type @ in a prompt and you can address another session by name. Claude uses SendMessage to reach it directly. Sessions on remote machines and sessions running in the cloud are both valid targets.

Context helps here. Claude Code started as a local-terminal-only product. Remote Control arrived this year, letting the desktop app, IDEs, and claude.ai web pick up the same session, and then cloud-hosted sessions joined. So one person running a session on a laptop terminal, another on an office desktop, and a third in a browser became routine. More than half the fixes in this batch land on Remote Control — a fair indication of how many things that structure was breaking.

What Cross-Session Messaging Actually Changes

The plumbing arrived earlier, in v2.1.224 in late July, when SendMessage and ListAgents let sessions discover each other and exchange messages on macOS and Linux. ListAgents began marking disconnected Remote Control sessions offline and cloud sessions cloud.

What v2.1.232 added is the human entry point. Type @, get a list of sessions, pick one, and the message goes there. SendMessage now delivers to a bare name that matches exactly one live session instead of demanding a reference ID for confirmation. To keep names unambiguous, interactive sessions on one machine are now forced unique — start or rename into a name that's already live and you get a name-word-word variant.

The receiving side got controls too. /config gained a "Messages from your other sessions" row: accept, hold, or refuse inbound cross-session traffic.

Why this matters in practice: people running several sessions have been moving results by hand. Copy the conclusion out of window A, paste it into window B. Now A can address B directly. Splitting work across two repos, or researching in one place while implementing in another, gets meaningfully less manual.

Picture the failure mode, not just the success. A research session reads documents and hands its summary to an implementation session; the human reviews output instead of shuttling text. That's fine until the implementation session starts from a wrong premise — and now tracing which session it came from is a new task. Keeping logs matters more than it did.

It also opens a genuine risk surface. A message from another session is still text entering a prompt. A session that read untrusted content now has a path to issue instructions to another session. Shipping the /config inbound policy row alongside the feature looks like a direct acknowledgment of that.

What Actually Landed This Week

Area Version Change
Cross-session messaging 2.1.232 @ mention in prompt, unique session names, /config inbound policy
Remote Control 2.1.232 No more duplicate claude.ai conversations, reachable while idle, history restored on worker restart
Remote Control 2.1.232 ~30 minutes of reconnection after network blips, no silent takeover
Remote Control 2.1.235 claude rc applies the same enterprise-gateway check as interactive startup
GitLab 2.1.234 MR !N badge in footer and statusline with draft/pending/green states
GitLab 2.1.232 MR URLs in --worktree and claude agents, GitLab token redaction
Usage 2.1.234 Session continues automatically when a claude.ai usage limit resets (can be disabled)
Security 2.1.235 Windows NT-namespace paths rejected (NTLM credential-leak vector)
Security 2.1.232 PowerShell and Git Bash permission bypasses closed, nested repo trust separated

Remote Control absorbed the most repair. Sessions appearing as brand-new conversations on claude.ai every time they resumed, sessions unreachable to newly attached clients while idle, conversation history vanishing when the session worker restarted — all fixed. Reconnecting for about 30 minutes after a network blip, instead of dropping after a few attempts, is the one users will feel most.

On the security side, bridge session isolation stands out: a Remote Control session hosted inside a cloud session no longer inherits that session's transcript or credentials. And nested git repositories no longer inherit trust from a parent directory — each repo requires its own confirmation. That matters for the common pattern of cloning someone else's repo into a subdirectory.

One easily-missed permission fix deserves a callout: pressing Shift+Tab inside the permission prompt's comment field used to approve the edit and grant session-wide permission instead of closing the field. A single slipped keystroke hardened into a standing allowance for the rest of the session. In permission UI, that class of misfire is worse than a missing feature.

Related: permission previews relayed into chat channels now neutralize bidirectional-override characters, zero-width characters, and look-alike quotes — the classic trick of making the command that runs differ from the string you read.

Who Gets What Out of This

GitLab teams get the most. Claude Code's repo integration has been GitHub-shaped. Now a repo with a GitLab remote and an authenticated glab CLI shows a merge request badge in the footer and statusline, and MR URLs work in the --worktree flag and the claude agents view. Plugin marketplaces clone bare gitlab.com URLs like GitHub ones — including nested subgroups, so deep enterprise group structures work.

Secret redaction shipped with it. The glrt-, gloas-, glptt-, glagent-, glimt-, glsoat-, glcbt-, glft-, and glffct- families are redacted, with full redaction for routable glpat- and gldt- tokens. The glab CLI config store gets the same sandbox and credential-path protection as gh.

The plugin ecosystem gets a distribution path. Publishing a Claude Code plugin effectively required GitHub. Now that gitlab.com repos clone identically, organizations running only internal GitLab can stand up their own marketplace. For anyone who can't push code to the public internet, that was the adoption blocker.

Anyone who hits usage limits gets time back. Sessions now continue automatically when a claude.ai usage limit resets, toggleable via "Continue automatically at usage limit" in /config. Useful if you queue long work and step away; arguably worth disabling if you're managing spend tightly.

Enterprise admins get a control point. claude rc now runs the same enterprise-gateway availability check as interactive startup, closing a path that let Remote Control skip the gateway. Permission dialogs were reworked too: display text and "don't ask again" options now always match what a grant actually covers, and "don't ask again" is withheld entirely when the contents can't be fully displayed.

Windows users get their credentials back. Windows NT-namespace (\??\) paths could bypass UNC path validation, a route to NTLM credential leakage. They're now rejected in remote file reads, session restore, CLAUDE.md includes, workflow scripts, and file uploads.

If you compress all five versions into one sentence: this isn't a feature release, it's a release that checks whether the remote and multi-session architecture already built actually holds, and patches where it didn't. Eight Remote Control items and six bypass closures against roughly two new features. That's the classic signature of a product moving from expansion into stabilization.

Tools That Went This Direction Before

GitHub Copilot Workspace walked this path first, growing from in-editor completion into autonomous execution that takes an issue, cuts a branch, and opens a PR. But it pinned execution to GitHub's cloud, and the gap with local development environments stayed a persistent problem. Claude Code runs the other way — local as the reference point, remote attached to it — which narrows that gap.

Cursor's background agents took a different angle, focusing on parallelism: isolated environments per agent, results merged afterward. Parallelism worked; inter-agent communication still had to route through a human. Claude Code's cross-session messaging is an attempt to wire that link directly.

Devin (Cognition) led with autonomy from day one — throw work over the wall, collect results. The lesson there was that higher autonomy raises verification cost. Time saved on execution often got eaten by time spent re-reading output. That's part of why Claude Code keeps autonomous and interactive modes side by side.

The early CI/CD era rhymes structurally. Running builds automatically was easy; orchestration became the real problem once jobs started depending on each other. Cross-session messaging is likely on the same curve. Two sessions talking is convenient. Five sessions calling each other makes "who did what and why" a fresh problem.

How the Competitive Picture Moves

OpenAI Codex shipped a major speed and memory overhaul in mid-August, aimed at the same thing: handling long-running work without a human attached. Both tools are solving the same problem in a different order — Codex took execution-environment control first, Claude Code took session orchestration first.

Google is in via Antigravity and the Gemini CLI. Layering a cheap model like Gemini 3.7 Flash underneath creates a cost advantage on high-volume repetitive work. The operational layer — session management, remote control — is still thin.

Platform vendors like GitLab and Atlassian are embedding AI inside their own products. Claude Code strengthening GitLab support reads as a move to hold the neutral-tool position: a client that isn't bound to any one platform.

Editor-based tools like Cursor and Windsurf still lead on UI. Terminal-based tools carry a real onboarding cost. But for multi-machine, multi-task work — remote control, cross-session coordination — the terminal side has the structural advantage.

So What Actually Changes

If you run multiple sessions, start with @ mentions, and name your sessions deliberately. Check the inbound policy in /config first: left on auto-accept, instructions from another session flow straight into your prompt.

If you're a GitLab team, authenticate glab and the badges and MR integration light up. Workflows that were GitHub-only have largely been matched.

If you own enterprise security, verify two things: that Remote Control isn't bypassing your gateway policy, and that clients are on 2.1.235 or later. The Windows credential-leak path exists in everything before it.

If you're on Windows, don't defer the update. The PowerShell default-parameter manipulation and the Git Bash symlink bypass were both closed in this batch.

If you queue long-running work, decide deliberately about auto-resume. It's convenient, and it can also spend more tokens than you expected.

If you're a solo developer, the only urgent item is updating. Session naming rules changed, so if you keep several windows open you'll see auto-generated name variants. Naming them explicitly makes @ mentions considerably more useful.

🥄 Three Things You're Probably Wondering

— Isn't cross-session messaging a security risk? There's real exposure. A message from another session still lands in a prompt, so a session that consumed untrusted content has a path to relay instructions. That's why the accept/hold/refuse row shipped in /config at the same time. Check your default.

— Is GitLab support at parity with GitHub now? The major pieces line up: merge request badges, worktree integration, plugin marketplaces, token redaction. GitHub still has more features that landed there first, so calling it full parity is premature.

— How much will auto-resume cost me? That depends entirely on the work, so no honest number exists. What's certain is that a session parked at the limit starts running again at reset. If you manage spend strictly, leave it off and watch the limit notifications instead.

References

Numbers and criteria are as of announcement and may change.