Major stability pass resolves parallel auth races, cross-session /effort bleed, Remote Control cancel, and MCP OAuth proxy gaps; worktree.baseRef reverts v2.1.128 default.
worktree.baseRef setting (fresh | head) to choose whether --worktree, EnterWorktree, and agent-isolation worktrees branch from origin/<default> or local HEAD. **Note:** the default fresh changes EnterWorktree's base back to origin/<default> (it has been local HEAD since 2.1.128) — set worktree.baseRef: "head" to keep unpushed commits in new worktreessandbox.bwrapPath and sandbox.socatPath managed settings (Linux/WSL) to specify custom bubblewrap and socat binary locationsparentSettingsBehavior admin-tier key ('first-wins' | 'merge') to let admins opt SDK managedSettings (parent tier) into the policy mergeEdit/Write allow rules scoped to a drive root (C:\) or POSIX / matching incorrectly and always promptingECOMPROMISED) when a history or session-log file lock is compromised by clock skew or slow diskHTTP(S)_PROXY / NO_PROXY / mTLS not being respected for the full MCP OAuth flow including discovery, dynamic client registration, token exchange, and token refresh--add-dir / SDK additionalDirectories/effort in one session unexpectedly changing the effort level of other concurrent sessions, and a related issue where an IDE effort change could be silently droppedeffort.level JSON input field and the $CLAUDE_EFFORT environment variable, and Bash tool commands can read $CLAUDE_EFFORTclaude --help now lists --remote-control alongside --remote-control-session-name-prefixclaudeCode.claudeProcessWrapper failing with "Unsupported platform" when the extension build doesn't bundle a Claude binary