Claude Code v2.1.187: Sandbox Credential Protection and Org Model Restrictions

The Claude Code development team has released version 2.1.187, focusing on security hardening and enterprise controls. This update adds credential protection for sandboxed commands and organization-level model restrictions, alongside usability improvements like mouse click support in menus and an extensive set of fixes for structured output, MCP, Remote Control, and subagent management.

What’s New

Sandbox Credential Protection

A new sandbox.credentials setting blocks sandboxed commands from reading credential files and secret environment variables, adding an extra layer of defense for sensitive data when commands run inside the sandbox.

Organization-Configured Model Restrictions

Org-configured model restrictions now apply across the model picker, --model, /model, and ANTHROPIC_MODEL. When a restricted model is selected, Claude Code shows a clear “restricted by your organization’s settings” message, giving administrators consistent enforcement across every model selection path.

Mouse Click Support in Menus

Select menus — including permission prompts, /model, and /config — now support mouse clicks in fullscreen mode, making navigation faster for users who prefer pointing over keyboard-only interaction.

Structured Output and MCP Reliability

Structured output via --json-schema and workflow agent({schema}) has been fixed: the model can no longer re-call StructuredOutput indefinitely after a successful call, and follow-up turns now reliably return structured output. Remote MCP tool calls that hang with no response now abort with an error after 5 minutes instead of blocking indefinitely, with the timeout overridable via CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT.

Remote Control and Background Session Fixes

Several remote and background workflow issues have been resolved:

Claude Code Remote sessions no longer take ~2.7s longer to start after the agent proxy CA system-trust install was added
/update over Remote Control no longer hangs when a startup trust dialog would have shown
Background jobs in the agents view no longer get stuck in “working” indefinitely when the agent ended a turn without producing structured output
Channel connections no longer drop after navigating to the agents view and back, or after /bg, /tui, or /update
Agent stop notifications now correctly attribute who stopped the agent, with improved wording (“finished”/“stopped” instead of “came to rest”)

Subagent and Worktree Management

Subagent depth tracking has been corrected: resumed subagents now restore their original spawn depth, and forked subagents now count toward the depth cap. Leaked agent worktree registrations are also handled — locked .git/worktrees/ entries from killed agents are now cleaned up automatically.

Terminal and Input Fixes

This release resolves several terminal-level issues:

Pasted Korean/CJK text no longer turns into mojibake in terminals that deliver paste as per-byte extended-key events
Cmd+click now opens URLs in fullscreen mode in Ghostty on macOS
Esc, Ctrl-C, and Ctrl-D now work while /share is uploading
--resume no longer fails with “No conversation found” when the original -p run produced no model turns
claude --help now lists the --bg/--background flag

Command Improvements

/install-github-app now makes GitHub Actions workflow setup optional — you can install just the GitHub App and skip the workflow/secret steps
/btw gains ←/→ arrow navigation to step through earlier answers
/plugin now surfaces plugins you haven’t used recently so you can clean them up

VSCode Extension

The VSCode extension no longer becomes unresponsive when resuming a large session.

How to Update

To update to Claude Code v2.1.187:

Check your current version: claude --version
Update using your preferred method:
- Package manager: Follow your distribution’s update process
- Direct download: Visit the release page for platform-specific binaries
Consider enabling the new sandbox.credentials setting if you run sandboxed commands with sensitive credentials nearby
Administrators can review org-level model restrictions, which are now enforced across all model selection paths