Claude Code 2.1.187: Tighter permissions and upgraded sandbox security

Release notes

FEATURE

Tighter permissions and upgraded sandbox security

We've rolled out major upgrades for security and administrative control. You can now use the new sandbox.credentials setting to explicitly block commands running inside the sandbox (an isolated secure environment) from peeking at your credential files or secret environment variables. For enterprise users, the model picker now respects organization-configured restrictions and will clearly tell you if a model is "restricted by your organization's settings" rather than letting you guess why it failed. Additionally, if an external MCP tool server goes silent and hangs, the system will no longer wait around forever; it will automatically abort the call and throw an error after 5 minutes (a timeout you can adjust). It's like installing a vault door on the company lab to prevent rogue experiments from stealing passwords, and implementing a strict five-minute rule on hold times so an unresponsive vendor doesn't tie up the phone line all day.

BUGFIX

Agent management is more precise, avoiding endless spinning

Coordinating multiple AI agents is now much more stable. When you require an agent to produce structured output (like a JSON schema), it will no longer get stuck in an endless loop re-calling the output tool after already succeeding. If a background agent ends its turn without producing the requested structure, it won't deceptively stay stuck displaying a 'working' status forever. For spawned subagents, the system now accurately tracks how deep the chain goes, ensuring agents don't infinitely spawn subagents and violate the depth cap. When an agent gets halted, the notification now correctly attributes who stopped it and uses clearer wording like 'finished' or 'stopped' instead of cryptic phrasing. Also, if you kill an agent, any locked entries it left behind in your Git worktree are now automatically cleaned up. It's like factory robots that used to mindlessly spin in circles after finishing a job, or endlessly build clones of themselves until the floor ran out of space; now they properly clock out, report exactly who shut them off, and perfectly tidy up their workstations before they leave.

BUGFIX

UI overhauled with mouse support and CJK text fixes

The interactive experience has received a major polish! When running in fullscreen mode, you can now use your mouse to click on select menus directly (like the /model picker or permission prompts). For users of CJK (Chinese/Japanese/Korean) languages, pasting multi-byte characters in certain terminals used to result in a garbled mess of mojibake; this is fixed and your text will paste perfectly. We've also resolved a host of crash and hang bugs: running /update over Remote Control no longer hangs waiting for a startup trust dialog, navigating back and forth from the agents view won't spontaneously drop your connection, and the VS Code extension will no longer freeze when trying to resume an exceptionally massive session. Finally, if you change your mind while uploading a session via /share, hitting Esc or Ctrl+C will now successfully abort the upload. It's like an old vending machine that only took stiff button presses upgrading to a modern touchscreen; it no longer jams when you insert foreign coins, and the cancel button actually works if you change your mind mid-purchase.

FEATURE

Handy feature upgrades make cleanup and setup easier

We've added a handful of thoughtful quality-of-life improvements. When setting up a GitHub App (/install-github-app), generating the automated workflows and secrets is now completely optional, letting you install just the App itself without forcing you through a heavy CI/CD setup process. When reviewing past answers using /btw, you can now effortlessly step through history using the left and right ←/→ arrow keys. The plugin manager (/plugin) got smarter too: it now explicitly surfaces add-ons you haven't used recently, making it much easier to do some spring cleaning. Finally, when you ask for the manual (claude --help), it finally lists the --bg flag instead of keeping background mode an undocumented secret. It's like your digital toolbox got a sensible upgrade: you can now buy a power drill without being forced to buy the 100-piece bit set, flipping through history is as easy as swiping on your phone, and your drawers automatically push dusty, forgotten tools to the front so you can finally throw them out.

Original changelog

Original changelogTighter permissions and upgraded sandbox security

Added `sandbox.credentials` setting to block sandboxed commands from reading credential files and secret environment variables
Added org-configured model restrictions to the model picker, `--model`, `/model`, and `ANTHROPIC_MODEL`, with a "restricted by your organization's settings" message when a restricted model is selected
Fixed remote MCP tool calls that hang with no response for 5 minutes — they now abort with an error instead of blocking indefinitely (override with `CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT`)

Original changelogAgent management is more precise, avoiding endless spinning

Fixed `--json-schema` and workflow `agent({schema})` structured output: the model can no longer re-call `StructuredOutput` indefinitely after a successful call, and follow-up turns now reliably return structured output
Fixed background jobs in the agents view getting stuck in "working" indefinitely when the agent ended a turn without producing structured output
Fixed agent stop notifications not correctly attributing who stopped the agent, and improved wording ("finished"/"stopped" instead of "came to rest")
Fixed subagent depth tracking: resumed subagents now restore their original spawn depth, and forked subagents now count toward the depth cap
Fixed leaked agent worktree registrations: locked `.git/worktrees/` entries from killed agents are now cleaned up automatically

Original changelogUI overhauled with mouse support and CJK text fixes

Added mouse click support to select menus (permission prompts, `/model`, `/config`, etc.) in fullscreen mode
Fixed pasted Korean/CJK text turning into mojibake in terminals that deliver paste as per-byte extended-key events
Fixed Claude Code Remote sessions taking ~2.7s longer to start after the agent proxy CA system-trust install was added
Fixed `/update` over Remote Control hanging when a startup trust dialog would have shown
Fixed channel connections dropping after navigating to the agents view and back, and after `/bg`, `/tui`, or `/update`
Fixed Cmd+click not opening URLs in fullscreen mode in Ghostty on macOS
Fixed Esc, Ctrl-C, and Ctrl-D not working while `/share` is uploading
Fixed `--resume` failing with "No conversation found" when the original `-p` run produced no model turns
[VSCode] Fixed extension becoming unresponsive when resuming a large session

Original changelogHandy feature upgrades make cleanup and setup easier

Improved `/install-github-app`: GitHub Actions workflow setup is now optional — you can install just the GitHub App and skip the workflow/secret steps
Improved `/btw` with ←/→ arrow navigation to step through earlier answers
Improved `/plugin` to surface plugins you haven't used recently so you can clean them up
Fixed `claude --help` not listing the `--bg`/`--background` flag