Claude Code v2.1.211 fixes approval-prompt spoofing and several stability bugs

Claude Code 2.1.211 adds a `--forward-subagent-text` flag (and matching environment variable) that includes a subagent's text and thinking output in stream-json output. On the security side, permission previews relayed to chat channels previously failed to strip bidirectional-override characters, zero-width characters, and look-alike quote characters, meaning tool inputs could visually distort the approval message a user sees before granting permission; that gap is now closed.

Another fix stops auto mode from silently overriding a PreToolUse hook's "ask" decision for unsandboxed Bash commands — a hook that requests confirmation now always forces a prompt. Additional fixes address parallel sessions sharing one credential store all logging out simultaneously after the machine wakes from sleep, plugin MCP servers failing to reconnect after an idle web session wakes (leaving MCP calls broken until the next message), Claude Code on Vertex and Bedrock needlessly trying the default Opus model and printing a fallback notice even when a model was explicitly configured, subagents with an explicit model override reverting to the parent's model after being resumed or sent a follow-up, and nested `.claude/rules/*.md` files still loading even when project settings sources were excluded.

File upload validation now accepts filenames ending in a DOS device suffix like `.prn` or a trailing dot, while rejecting files with multiple hard links; uploading files to Claude in Chrome from remote and CLI sessions is also fixed. Lastly, edits that leave the input as just "?" no longer get silently swallowed while toggling the shortcuts panel.