Claude Code v2.1.233: GitLab MR support, per-user spend attribution, and Linux memory limits for Bash

Claude Code v2.1.233 has shipped, and while it is a point release, it carries four additions that matter to distinct groups of users: GitLab teams, enterprise administrators, Linux developers running heavy builds, and anyone who uses the WebFetch tool regularly. Here is what changed and what it means in practice.

GitLab merge request URLs now work in --worktree and the agents view

Until now, Claude Code’s --worktree flag and the claude agents view worked cleanly with GitHub pull request URLs but left GitLab users with a gap. Version 2.1.233 closes that gap by adding GitLab merge request URL support to both surfaces. When you pass a GitLab MR URL to --worktree, Claude Code knows how to handle it. In the agents view, merge requests appear using GitLab’s canonical !N notation rather than the #N format used for GitHub PRs.

This is part of a broader pattern. Earlier releases had already added secret redaction for GitLab token families and GitLab support in plugin marketplaces. The codebase is steadily moving towards genuine parity between GitHub and GitLab workflows, so if your team runs on GitLab, the experience will keep improving.

Per-user spend attribution via forward_user_identity

Enterprise deployments of Claude Code often route requests through a proxy so organisations can centralise access, apply policies, or track costs. The problem with shared deployments has been that all traffic looks the same to a downstream proxy: there is no signal about which user triggered which request.

The new forward_user_identity gateway setting, available as an opt-in on Anthropic upstreams, addresses this directly. When enabled, the apps gateway injects the signed-in user’s identity as request headers. A proxy sitting behind the gateway can read those headers and attribute spend per user, making per-seat billing, cost allocation, or audit logging straightforward to implement.

This is opt-in, so nothing changes for existing deployments unless an administrator explicitly enables it. But for organisations that need granular cost visibility across a shared Claude Code rollout, it removes what would otherwise be a manual instrumentation problem.

Linux memory cgroup limits for Bash tool commands

The Bash tool in Claude Code lets the agent run shell commands as part of completing tasks. That is useful for builds, tests, and installs, but it creates a risk: a runaway process could consume enough memory to stall or destabilise the Claude session itself.

The new CLAUDE_CODE_TOOL_MEMORY_LIMIT environment variable opts Linux users into memory cgroup v2 limits scoped specifically to Bash tool subprocesses. Set the variable to a memory limit, and the kernel will enforce it on any command the Bash tool spawns. The session itself is not affected if a subprocess hits the ceiling.

This is Linux-only and opt-in, so it requires no changes from users who do not need it. For anyone regularly running compilation jobs, dependency installs, or data processing pipelines through Claude Code, it is a meaningful safety net.

Configurable WebFetch cache TTL

Claude Code caches fetched URLs within a session to avoid redundant network requests. The default TTL has always been 15 minutes, but until now that was hardcoded with no way to override it.

The new CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS environment variable lets you set any positive integer in milliseconds. The default remains 15 minutes, so existing behaviour is unchanged unless you set the variable. If your workflow involves frequently updated pages or, conversely, rarely changing documentation where a longer cache would reduce noise, you can now tune the TTL to match.

Security fix worth noting: Windows path validation

A security fix in this release closes a credential-leak vector on Windows. Paths using the NT \?\ device prefix were bypassing UNC path validation, which could have allowed NTLM credentials to leak. The fix tightens the validation to cover those paths. If you run Claude Code on Windows, this is a good reason to update promptly.

MCP reliability continues to improve

The fix to MCP v2 connections endlessly reopening the subscriptions/listen stream is the seventh MCP reliability improvement across the last ten releases. If you use Claude Code with MCP servers that terminate long-held streams on a fixed timeout, this will stop the reconnection loop that was causing unnecessary overhead.

Other fixes and quality-of-life changes

A few other things worth knowing about in this release:

• Bundled skill aliases like /checkup and /review were reporting “Unknown command” when run in -p mode. That is fixed.
• Skill and command argument substitution was re-expanding argument values as template markers in some cases, which could produce unexpected results. Fixed.
• The GitHub app setup tip no longer appears in repositories whose origin remote is on gitlab.com or bitbucket.org.
• “Always allow” permission rules now save at the repository root, so approvals granted in a git worktree persist across sessions and other worktrees.
• Integer environment variables for timeouts, token budgets, and retry counts now accept scientific notation and digit-separator spellings like 1e6 and 64_000.
• Cloud sessions that were occasionally marked as lost when the environment shut down during a permission prompt will no longer trigger that false positive.

The bottom line

No single change in v2.1.233 is a dramatic shift, but taken together they address real friction points for three distinct groups. GitLab teams get the MR URL support they have been waiting for. Enterprise administrators get a practical tool for cost attribution in shared deployments. Linux developers get a safety mechanism for memory-intensive Bash commands. And the ongoing MCP and Windows fixes reflect a release cadence that is clearly prioritising reliability alongside new features.

You can find the full release notes on the Claude Code GitHub releases page.