{"version":"2.1.228","anchor":"cross-session-messaging-between-claude-code-sessions-is-now-","canonical_anchor":"cross-session-messaging-between-claude-code-sessions-is-now-","heading":"Cross-session messaging between Claude Code sessions is now authenticated","tier":"notice","area":"Cross-Session Messaging","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.228\/e\/cross-session-messaging-between-claude-code-sessions-is-now-","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.228","markdown":"### Cross-session messaging between Claude Code sessions is now authenticated\n\nMessages between your Claude Code sessions are now token-authenticated, strictly on Windows and best-effort elsewhere.\n\n**What**\n\nEach session now mints two random tokens for its local message inbox. The child token is passed to processes Claude Code spawns as `CLAUDE_CODE_MESSAGING_TOKEN`, and the peer token is published in a key file so other sessions can connect. On Windows the auth handshake is mandatory and connections that never send an auth frame are dropped; on macOS and Linux it is optional, and a failed key publish degrades to unauthenticated with the warning \"peers will send unauthenticated\".\n\n**Details**\n\n- Two tokens per session: a peer token for other sessions, a child token for spawned processes.\n- Dropped connections are recorded under `cross_session_inbox_auth` with an `unauthed_drop` marker.\n- `CLAUDE_CODE_MESSAGING_TOKEN` was added to the environment propagation allow and strip lists, so it reaches children deliberately rather than by accident.\n- The startup hint line was rewritten to describe the auth handshake.\n\n**Evidence**\n\n`CLAUDE_CODE_MESSAGING_TOKEN`\n\n- Area: Cross-Session Messaging\n- Names: `CLAUDE_CODE_MESSAGING_TOKEN`\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}