Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.228 Home All releases ←olderv2.1.227 v2.1.229newer→
Claude Code v2.1.228

Cross-session messaging between Claude Code sessions is now authenticated

You'll notice
Useful3 Signal3
Cross-Session Messaging not in their notes

Messages between your Claude Code sessions are now token-authenticated, strictly on Windows and best-effort elsewhere.

CLAUDE_CODE_MESSAGING_TOKEN
What

Each session now mints two random tokens for its local message inbox. The child token is passed to processes Claude Code spawns as CLAUDE_CODE_MESSAGING_TOKEN, and the peer token is published in a key file so other sessions can connect. On Windows the auth handshake is mandatory and connections that never send an auth frame are dropped; on macOS and Linux it is optional, and a failed key publish degrades to unauthenticated with the warning "peers will send unauthenticated".

Details
  • Two tokens per session: a peer token for other sessions, a child token for spawned processes.
  • Dropped connections are recorded under cross_session_inbox_auth with an unauthed_drop marker.
  • CLAUDE_CODE_MESSAGING_TOKEN was added to the environment propagation allow and strip lists, so it reaches children deliberately rather than by accident.
  • The startup hint line was rewritten to describe the auth handshake.
Evidence

CLAUDE_CODE_MESSAGING_TOKEN

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.228 →