You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
Cross-Session MessagingArea: what it touches
New FeaturesKind: in v2.1.228,
New FeaturesSection of the release
What
Each session now mints two random tokens for its local message inbox. The child token is passed to processes Claude Code spawns as CLAUDE_CODE_MESSAGING_TOKEN, and the peer token is published in a key file so other sessions can connect. On Windows the auth handshake is mandatory and connections that never send an auth frame are dropped; on macOS and Linux it is optional, and a failed key publish degrades to unauthenticated with the warning "peers will send unauthenticated".
Details
Two tokens per session: a peer token for other sessions, a child token for spawned processes.
Dropped connections are recorded under cross_session_inbox_auth with an unauthed_drop marker.
CLAUDE_CODE_MESSAGING_TOKEN was added to the environment propagation allow and strip lists, so it reaches children deliberately rather than by accident.
The startup hint line was rewritten to describe the auth handshake.
Evidence
CLAUDE_CODE_MESSAGING_TOKEN
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
