claudekit / updates / claude-code-2-1-187
[ PATCH · ]

Claude Code 2.1.187

A security- and stability-focused release. A new sandbox.credentials setting blocks sandboxed commands from reading credential files and secret environment variables, org-configured model restrictions now apply to the model picker, --model, /model, and ANTHROPIC_MODEL, and select menus gain mouse click support in fullscreen mode. Remote MCP tool calls that hung with no response for 5 minutes now abort with an error instead of blocking indefinitely, alongside fixes for mojibake on pasted Korean/CJK text, --resume failing on empty -p runs, and a batch of resume, remote, and terminal stability issues.

Claude Code
Official announcement →

This article is a summary based on official documentation.

What changed

Claude Code 2.1.187 shipped on June 23, 2026. It adds security controls — sandboxed-credential protection and org-configured model restrictions — and cleans up a large batch of resume, remote, and terminal stability issues, including remote MCP tool calls that hung with no response, mojibake on pasted Korean/CJK text, and --resume failures.

New features

  • sandbox.credentials setting

    Commands running in the sandbox could still read credential files and secret environment variables, leaving sensitive values exposed to those commands. The new sandbox.credentials setting blocks sandboxed commands from reading credential files and secret environment variables.

  • Org-configured model restrictions

    Allowed-model policies weren’t enforced consistently across every model-selection path. Org-configured model restrictions now apply to the model picker, --model, /model, and ANTHROPIC_MODEL, with a “restricted by your organization’s settings” message when a restricted model is selected.

  • Mouse click support in select menus (fullscreen mode)

    In fullscreen mode, select menus such as permission prompts, /model, and /config could only be driven from the keyboard. You can now click to pick an item in those select menus.

Key improvements

  • /install-github-app: workflow setup is now optional

    /install-github-app bundled GitHub App installation with GitHub Actions workflow setup, forcing the workflow and secret steps even on users who only needed the App. You can now install just the GitHub App and skip the workflow/secret steps.

  • /btw answer navigation

    Revisiting earlier /btw answers was awkward. You can now step through earlier answers with ←/→ arrow navigation.

  • /plugin surfaces unused plugins

    Finding plugins you no longer use to clean them up took manual effort. /plugin now surfaces plugins you haven’t used recently so you can clean them up.

Bug fixes

Sessions & resume

  • --resume failing with “No conversation found” — happened when the original -p run produced no model turns. Resume now works.
  • [VSCode] Extension becoming unresponsive when resuming a large session — fixed.

Agents & structured output

  • --json-schema and workflow agent({schema}) structured output — the model could re-call StructuredOutput indefinitely after a successful call, and follow-up turns didn’t reliably return structured output. Both fixed.
  • Background jobs in the agents view getting stuck in “working” indefinitely — happened when the agent ended a turn without producing structured output. Fixed.
  • Subagent depth tracking — resumed subagents now restore their original spawn depth, and forked subagents now count toward the depth cap.
  • Leaked agent worktree registrations — locked .git/worktrees/ entries from killed agents are now cleaned up automatically.

Remote & MCP

  • Remote MCP tool calls hanging with no response for 5 minutes — they now abort with an error instead of blocking indefinitely (override with CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT).
  • Claude Code Remote sessions taking ~2.7s longer to start after the agent proxy CA system-trust install was added — fixed.
  • /update over Remote Control hanging when a startup trust dialog would have shown — fixed.
  • Channel connections dropping after navigating to the agents view and back, and after /bg, /tui, or /update — fixed.

Notifications & terminal

  • Agent stop notifications not correctly attributing who stopped the agent — fixed, with improved wording (“finished”/“stopped” instead of “came to rest”).
  • Pasted Korean/CJK text turning into mojibake in terminals that deliver paste as per-byte extended-key events — fixed.
  • Cmd+click not opening URLs in fullscreen mode in Ghostty on macOS — fixed.
  • claude --help not listing the --bg/--background flag — fixed.
  • Esc, Ctrl-C, and Ctrl-D not working while /share is uploading — fixed.

Notes

  • sandbox.credentials is opt-in — turn the setting on to block sandboxed commands from reading credential files and secret environment variables.
  • Remote MCP tool timeout is configurable — the 5-minute default for aborting unresponsive calls can be changed with the CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT environment variable.
  • Korean/CJK paste mojibake resolved — pasted text no longer garbles in affected terminals; users who worked around it can confirm normal behavior after upgrading.
  • Check the --bg/--background flag — the background-run flag that was missing from claude --help now appears in the list.