Claude Code v2.1.113: A Native Binary, Three Bash Permission Hardenings, and 22 Fixes

Claude Code v2.1.113 has 38 changelog entries, 22 of them fixes. Three are security hardenings to Bash permission rules, and one changes how the CLI is distributed.

What’s New

The CLI now spawns a native Claude Code binary through a per-platform optional dependency, instead of bundled JavaScript.
sandbox.network.deniedDomains blocks specific domains even when a broader allowedDomains wildcard would otherwise permit them.

Permission and Security Hardening

Four entries tighten what a Bash allow rule actually permits. If you rely on allowlists, read these.

Exec wrappers no longer bypass deny rules. Bash deny rules now match commands wrapped in env, sudo, watch, ionice, setsid, and similar.
Bash(find:*) no longer auto-approves find -exec or -delete.
On macOS, /private/{etc,var,tmp,home} are treated as dangerous removal targets under Bash(rm:*) allow rules.
A UI-spoofing vector is closed. Multi-line commands whose first line is a comment now show the full command in the transcript.
dangerouslyDisableSandbox no longer ran commands outside the sandbox without a permission prompt.

Input and Terminal Behaviour

Ctrl+A and Ctrl+E move to the start and end of the current logical line in multiline input, matching readline.
Windows: Ctrl+Backspace deletes the previous word.
Fullscreen: Shift+↑/↓ scrolls the viewport when a selection extends past the visible edge.
Long URLs stay clickable when they wrap across lines, in terminals with OSC 8 hyperlinks.
Cmd+Backspace and Ctrl+U again delete from the cursor to the start of the line, and the prompt cursor no longer disappears when NO_COLOR is set.

Agents, Loop, and Remote Control

Subagents that stall mid-stream now fail with a clear error after 10 minutes instead of hanging silently.
/loop: Esc cancels pending wakeups, and wakeups display as “Claude resuming /loop wakeup”.
Remote Control gained /extra-usage and @-file autocomplete, and now streams subagent transcripts and archives sessions when Claude Code exits.
/ultrareview launches faster with parallelized checks, a diffstat in the launch dialog, and an animated launching state.
Messages typed while viewing a running subagent are no longer hidden from its transcript or misattributed to the parent.

Providers and Context

CLAUDE_CODE_EXTRA_BODY with output_config.effort caused 400 errors on subagent calls to models without effort support, and on Vertex AI.
A thinking.type.enabled is not supported 400 error when using Opus 4.7 through a Bedrock Application Inference Profile ARN.
Compacting a resumed long-context session failed with “Extra usage is required for long context requests”.

Smaller Fixes

MCP concurrent-call timeout handling where one tool call’s message could disarm another’s watchdog; markdown tables breaking on an inline code span containing a pipe; session recap auto-firing while unsent text sat in the prompt; /copy “Full response” not aligning table columns for GitHub, Notion, or Slack; /effort auto confirmation wording; the “copied N chars” toast overcounting emoji; /insights crashing with EBUSY on Windows; the exit dialog mislabeling one-shot scheduled tasks as recurring; the completion menu not sitting flush against the prompt border in fullscreen; ToolSearch ranking for pasted MCP tool names; plugin install succeeding on a dependency version conflict, which now reports range-conflict; “Refine with Ultraplan” not showing the remote session URL; and SDK image content blocks that fail to process now degrade to a text placeholder instead of crashing the session.

The full list is in the official changelog.

How to Update

Check your installed version: claude --version
Update in place: claude update