2.1.113 untested · changelog-derived

Claude Code 2.1.113

**Native binary spawn + sandbox network filtering** — Claude Code now runs as a native platform binary instead of bundled JavaScript, and administrators/users can surgically block specific domains even under broad `allowedDomains` wildcards. This shifts CLI performance and security policy control to fine-grained network isolation on each platform.

10 new primitives 2 workflow recipes 28 fixes

New primitives

sandbox.network.deniedDomainssetting

Block specific domains even when a broader `allowedDomains` wildcard would permit them

Added `sandbox.network.deniedDomains` setting to block specific domains even when a broader `allowedDomains` wildcard would otherwise permit them
Native Claude Code binaryinfrastructure

CLI spawns native per-platform binary instead of bundled JavaScript

Changed the CLI to spawn a native Claude Code binary (via a per-platform optional dependency) instead of bundled JavaScript
Fullscreen Shift+↑/↓ selection scrollingcapability

Shift+↑/↓ now scrolls viewport when extending selection past visible edge

Fullscreen mode: Shift+↑/↓ now scrolls the viewport when extending a selection past the visible edge
Ctrl+A / Ctrl+E multiline readline behaviorkeybinding

Move to start/end of current logical line in multiline input, matching readline

`Ctrl+A` and `Ctrl+E` now move to the start/end of the current logical line in multiline input, matching readline behavior
Windows Ctrl+Backspace word deletionkeybinding

Delete previous word on Windows

Windows: `Ctrl+Backspace` now deletes the previous word
URL clickability across wrapped linescapability

Long URLs stay clickable when wrapped in terminals with OSC 8 hyperlinks

Long URLs in responses and bash output stay clickable when they wrap across lines (in terminals with OSC 8 hyperlinks)
/loop Esc cancellationcommand enhancement

Pressing Esc cancels pending `/loop` wakeups and shows "Claude resuming /loop wakeup" for clarity

Improved `/loop`: pressing Esc now cancels pending wakeups, and wakeups display as "Claude resuming /loop wakeup" for clarity
/extra-usage on Remote Controlcommand availability

`/extra-usage` now works from Remote Control (mobile/web) clients

`/extra-usage` now works from Remote Control (mobile/web) clients
@-file autocomplete on Remote Controlquery capability

Remote Control clients can query `@`-file autocomplete suggestions

Remote Control clients can now query `@`-file autocomplete suggestions
/ultrareview parallelized launchcommand enhancement

Faster `/ultrareview` launch with parallelized checks, diffstat in dialog, and animated state

Improved `/ultrareview`: faster launch with parallelized checks, diffstat in the launch dialog, and animated launching state

Workflow recipes

Restricted Remote Agent Orchestration
sandbox.network.deniedDomains + /extra-usage on Remote Control + Bash wrapper-matching security rules

Multi-tier agent sandboxing now possible on remote (mobile/web) clients — a desktop session can spawn subagents running against filtered network surfaces, with explicit /extra-usage provisioning visible to remote operators, and deny rules that catch sophistication attempts (wrapped sudo/env escapes).

Build a remote agent-monitoring dashboard on a phone or tablet that queries @-file autocomplete to discover available subagent specs, provisions /extra-usage for long-context runs, and watches Bash denials in real-time as subagents attempt wrapped-command escapes. The deniedDomains setting enforces organizational firewall rules even when parent wildcard rules are broad, letting a central admin block internal APIs while subagents run against public surfaces.

Full-Screen Responsive Selection Prompting
Fullscreen Shift+↑/↓ selection scrolling + Ctrl+A/Ctrl+E readline behavior + slash/@ menu flush positioning

Multiline prompt composition in fullscreen mode now responds to readline keybindings and viewport-aware selection, matching muscle memory from terminal shells and closing the UX gap for agents drafting complex prompts without intermediate escapes to the terminal.

An agent or human composing a multi-step prompt in fullscreen mode can use Ctrl+A/Ctrl+E to jump to logical-line boundaries (useful when constructing prompts with multiple @-references across separate paragraphs), Shift+↑/↓ to extend selections while the viewport scrolls, and rely on / and @ completion menus sitting flush against the prompt edge for immediate scanability. This is particularly useful for workflow agents that iteratively refine prompts based on previous runs.

Agentic relevance

The native binary shift enables platform-specific optimizations and sandboxing at startup time rather than runtime JIT. The `deniedDomains` setting and Bash wrapper-matching security improvements give agents finer control over sandboxed resource access — particularly relevant for long-running agents that bridge multiple external APIs and need to enforce strict network boundaries. The Remote Control `/extra-usage` and autocomplete availability extend agent-managed workflows to mobile/web clients, though full agentic composition still requires desktop Claude Code.

Hardening & fixes (28)

  • Subagents that stall mid-stream now fail with clear error after 10 minutes instead of hanging silently
  • Bash tool: multi-line commands with comment first line now show full command in transcript (UI-spoofing vector closed)
  • Running `cd <current-directory> && git …` no longer triggers permission prompt when `cd` is a no-op
  • Security: on macOS, `/private/{etc,var,tmp,home}` paths now treated as dangerous removal targets under `Bash(rm:*)` allow rules
  • Security: Bash deny rules now match commands wrapped in `env`/`sudo`/`watch`/`ionice`/`setsid` and similar exec wrappers
  • Security: `Bash(find:*)` allow rules no longer auto-approve `find -exec`/`-delete`
  • Fixed MCP concurrent-call timeout handling where a message for one tool call could silently disarm another call's watchdog
  • Fixed Cmd-backspace / `Ctrl+U` to delete from cursor to start of line
  • Fixed markdown tables breaking when a cell contains inline code span with pipe character
  • Fixed session recap auto-firing while composing unsent text in prompt
  • Fixed `/copy` "Full response" markdown table column alignment for GitHub/Notion/Slack pasting
  • Fixed messages typed while viewing running subagent being hidden from transcript and misattributed to parent AI
  • Fixed Bash `dangerouslyDisableSandbox` running commands outside sandbox without permission prompt
  • Fixed `/effort auto` confirmation label to say "Effort level set to max"
  • Fixed "copied N chars" toast overcounting emoji and multi-code-unit characters
  • Fixed `/insights` crashing with `EBUSY` on Windows
  • Fixed exit confirmation dialog mislabeling one-shot scheduled tasks as recurring
  • Fixed slash/@ completion menu not sitting flush against prompt border in fullscreen mode
  • Fixed `CLAUDE_CODE_EXTRA_BODY` `output_config.effort` causing 400 errors on subagent calls to models that don't support effort and on Vertex AI
  • Fixed prompt cursor disappearing when `NO_COLOR` is set
  • Fixed `ToolSearch` ranking so pasted MCP tool names surface actual tool instead of description-matching siblings
  • Fixed compacting resumed long-context session failing with "Extra usage is required for long context requests"
  • Fixed `plugin install` succeeding when dependency version conflicts with already-installed plugin — now reports `range-conflict`
  • Fixed "Refine with Ultraplan" not showing remote session URL in transcript
  • Fixed SDK image content blocks that fail to process crashing session — now degrades to text placeholder
  • Fixed Remote Control sessions not streaming subagent transcripts
  • Fixed Remote Control sessions not being archived when Claude Code exits
  • Fixed `thinking.type.enabled is not supported` 400 error when using Opus 4.7 via Bedrock Application Inference Profile ARN

Raw changelog

## 2.1.113

- Changed the CLI to spawn a native Claude Code binary (via a per-platform optional dependency) instead of bundled JavaScript
- Added `sandbox.network.deniedDomains` setting to block specific domains even when a broader `allowedDomains` wildcard would otherwise permit them
- Fullscreen mode: Shift+↑/↓ now scrolls the viewport when extending a selection past the visible edge
- `Ctrl+A` and `Ctrl+E` now move to the start/end of the current logical line in multiline input, matching readline behavior
- Windows: `Ctrl+Backspace` now deletes the previous word
- Long URLs in responses and bash output stay clickable when they wrap across lines (in terminals with OSC 8 hyperlinks)
- Improved `/loop`: pressing Esc now cancels pending wakeups, and wakeups display as "Claude resuming /loop wakeup" for clarity
- `/extra-usage` now works from Remote Control (mobile/web) clients
- Remote Control clients can now query `@`-file autocomplete suggestions
- Improved `/ultrareview`: faster launch with parallelized checks, diffstat in the launch dialog, and animated launching state
- Subagents that stall mid-stream now fail with a clear error after 10 minutes instead of hanging silently
- Bash tool: multi-line commands whose first line is a comment now show the full command in the transcript, closing a UI-spoofing vector
- Running `cd <current-directory> && git …` no longer triggers a permission prompt when the `cd` is a no-op
- Security: on macOS, `/private/{etc,var,tmp,home}` paths are now treated as dangerous removal targets under `Bash(rm:*)` allow rules
- Security: Bash deny rules now match commands wrapped in `env`/`sudo`/`watch`/`ionice`/`setsid` and similar exec wrappers
- Security: `Bash(find:*)` allow rules no longer auto-approve `find -exec`/`-delete`
- Fixed MCP concurrent-call timeout handling where a message for one tool call could silently disarm another call's watchdog
- Fixed Cmd-backspace / `Ctrl+U` to once again delete from the cursor to the start of the line
- Fixed markdown tables breaking when a cell contains an inline code span with a pipe character
- Fixed session recap auto-firing while composing unsent text in the prompt
- Fixed `/copy` "Full response" not aligning markdown table columns for pasting into GitHub, Notion, or Slack
- Fixed messages typed while viewing a running subagent being hidden from its transcript and misattributed to the parent AI
- Fixed Bash `dangerouslyDisableSandbox` running commands outside the sandbox without a permission prompt
- Fixed `/effort auto` confirmation — now says "Effort level set to max" to match the status bar label
- Fixed the "copied N chars" toast overcounting emoji and other multi-code-unit characters
- Fixed `/insights` crashing with `EBUSY` on Windows
- Fixed exit confirmation dialog mislabeling one-shot scheduled tasks as recurring — now shows a countdown
- Fixed slash/@ completion menu not sitting flush against the prompt border in fullscreen mode
- Fixed `CLAUDE_CODE_EXTRA_BODY` `output_config.effort` causing 400 errors on subagent calls to models that don't support effort and on Vertex AI
- Fixed prompt cursor disappearing when `NO_COLOR` is set
- Fixed `ToolSearch` ranking so pasted MCP tool names surface the actual tool instead of description-matching siblings
- Fixed compacting a resumed long-context session failing with "Extra usage is required for long context requests"
- Fixed `plugin install` succeeding when a dependency version conflicts with an already-installed plugin — now reports `range-conflict`
- Fixed "Refine with Ultraplan" not showing the remote session URL in the transcript
- Fixed SDK image content blocks that fail to process crashing the session — now degrade to a text placeholder
- Fixed Remote Control sessions not streaming subagent transcripts
- Fixed Remote Control sessions not being archived when Claude Code exits
- Fixed `thinking.type.enabled is not supported` 400 error when using Opus 4.7 via a Bedrock Application Inference Profile ARN
All 395 primitives Book a call