Claude Code v2.1.260 and v2.1.261 Are a Quiet Operational Upgrade. The 128K Command Output Cap, /skill-doctor, and the Auto-Mode Diagram-Renderer URL Fix Are the Parts Worth Reading.

Hey guys, Mr. Technology here.

Anthropic shipped two Claude Code releases in the last 24 hours. v2.1.260 (September 3, 2026 at 23:48 UTC) added a single feature: a diff panel that opens beside the conversation in fullscreen mode with a /diff toggle. v2.1.261 (September 4, 2026 at 19:58 UTC) is the larger of the two — about 60 changelog items, with three new user-facing capabilities (a bashOutputMaxChars/taskOutputMaxChars setting that lifts inline command output to up to 128K characters, /skill-doctor that shows which loaded skills go unused and what they cost in context, and --append-subagent-system-prompt-file for prompts too large to pass on the command line), plus an "Organization policy" line in /status and claude doctor, plus two security-relevant behavioral changes (the dangerous-rm safety prompt now catches rm -rf on positional parameters and inside double-quoted sh -c scripts; auto mode treats a link that packs content into a public diagram renderer's URL as an upload that is no longer auto-approved unless asked), plus the API-timeout default raised from 3 minutes to 10 minutes. For builders running Claude Code in production — CI gates, multi-window terminal sessions, unattended agents — v2.1.261 is the operational release. (anthropics/claude-code: Release v2.1.261, Release v2.1.260)

This is a documentation-surfacing report. Every claim below is verifiable verbatim in the v2.1.260 / v2.1.261 release notes. I have not installed either release in a production harness; treat the workflow and security claims as documentation comparison, not firsthand test.

What Shipped

v2.1.260 — diff panel in fullscreen

Per the release notes: "Added a diff panel that opens beside the conversation in fullscreen mode and shows your uncommitted changes as Claude edits; toggle it with /diff."

A single capability for the v2.1.260 release. When fullscreen mode is active and the conversation runs for a while, a side panel renders the uncommitted diff that Claude has accumulated. Toggle the panel with the /diff command. For a developer running Claude Code on a long editing session, this is the at-a-glance view of what the model is changing. It pairs naturally with the existing diff tooling in Claude Code's TUI but lives in the fullscreen-only conversation surface.

v2.1.261 — 60+ items, three new capabilities + security fixes + operational reliability

v2.1.261 is a broad release. I have grouped the items by what they do.

1. bashOutputMaxChars and taskOutputMaxChars settings

Per the release notes: "Added bashOutputMaxChars and taskOutputMaxChars settings to raise how much command and background-task output Claude receives inline before it is saved to a file, up to 128K characters."

Two new settings control how much command and background-task output Claude receives inline. The default (whatever it was) saves anything past the limit to a file; the new settings let a builder raise the inline cap up to 128K characters. For an agent that runs npm test and needs to see the test output inline to debug, or a build script whose logs are useful inline rather than offloaded to a file the model then has to read with a tool call, this is the operational knob. For a CI gate running Claude Code over a long-running integration test, it means fewer "the test output was truncated; let me read the file" round trips.

The cap is bounded at 128K. This is not infinite; a builder who needs more than that still has the save-to-file path. But 128K is a meaningful increase from typical defaults (often 30K-50K) and covers the long-tail of CLI tools that produce multi-section logs.

2. /skill-doctor — see which skills go unused

Per the release notes: "Added /skill-doctor to show which loaded skills go unused and what they cost in context, so you can prune them."

A new slash command that surfaces two facts about the loaded skills in the current session: which ones the model never invoked during the session, and what each one costs in token context. For a developer who has accumulated a personal skills library (the same library the v2.1.259 release shipped the management surface for), /skill-doctor is the way to prune skills that are paying a context cost without returning value. For teams operating shared skill libraries across many developers, the command is the audit surface for "is this skill earning its place in the catalog."

The exact metric (per-session unused-skill list + per-skill context cost) was not re-fetched; the release notes do not specify whether the cost is computed from the skill's declared size or measured from runtime usage. Builders should consult the docs page for the exact computation, but the operational direction is clear: prune unused skills to recover context for the work the model is actually doing.

3. --append-subagent-system-prompt-file

Per the release notes: "Added --append-subagent-system-prompt-file to read the subagent system prompt from a file, for prompts too large to pass on the command line."

For a builder running subagents with a system prompt that has grown past what fits comfortably on a command-line invocation, the new flag reads the prompt from a file and appends it to the subagent's system prompt. The shell argument-length limit and the visibility / version-control concerns that come with putting long prompts in shell history both disappear. For teams that maintain a library of long-form subagent prompts (agent definitions, system messages, behavioral rubrics) in source control, this is the flag that lets the subagent CLI consume them directly.

4. "Organization policy" diagnostic line in /status and claude doctor

Per the release notes: "Added an 'Organization policy' line to /status and claude doctor that says why your organization's policy could not be loaded, such as a proxy not passing the endpoint through."

For builders operating Claude Code under a managed-settings policy (the same channel the v2.1.259 managedMcpServers slot uses, and the same channel the v2.1.251 sandbox-escape guard watches), a previously-loaded policy failing to load now produces a diagnostic line instead of a silent default. The example the release notes give — "a proxy not passing the endpoint through" — points at a common enterprise failure mode where a TLS-inspecting proxy or an outbound firewall strips the managed-settings endpoint. For an IT team debugging why their managed policy is not taking effect on a developer's machine, the new line is the diagnostic.

5. Dangerous-rm safety prompt widened

Per the release notes: "Improved the dangerous-rm safety prompt to also catch rm -rf on positional parameters and inside double-quoted sh -c scripts."

A security-relevant change. The safety prompt that catches destructive rm invocations now also triggers on patterns that previously slipped through: rm -rf where the targets are positional parameters (rm -rf $1 in a script where $1 is unquoted, or rm -rf "$@"), and sh -c "rm -rf /some/path" where the destructive command is buried inside a double-quoted shell script. For a builder whose permissions.allow rules include Bash(rm:*) and who has been treating the dangerous-rm prompt as the safety net, the net now catches a wider set of patterns. For a builder whose workflows rely on rm -rf inside shell scripts, expect new prompts where you used to see silent operations.

This is a behavior change worth verifying against your own allow rules. A common workflow pattern — running a cleanup script that ends in rm -rf build/ — used to be caught only by the literal rm check; under v2.1.261 it can also be caught by the double-quoted sh -c check, depending on the script's structure.

6. Auto-mode URL upload reclassification

Per the release notes: "Changed auto mode to treat a link that packs content into a public diagram renderer's URL as an upload to that site: no longer auto-approved unless you asked for it."

A second security-relevant change. When auto mode encounters a link whose URL packs content (e.g., a Mermaid diagram encoded into the path or query of a public diagram-rendering service like mermaid.ink or kroki.io), the action is now classified as an upload to that site rather than a benign URL fetch. Auto mode will not auto-approve the action unless the user explicitly asked for the upload. For a developer who has been letting auto mode approve "render this diagram" requests without explicit approval, expect new prompts where the previous release approved silently.

This closes a data-exfiltration shape where a malicious or accidentally-misused URL parameter could exfiltrate content from the local conversation into a third-party service. The mitigation is to require explicit approval for any URL that embeds content.

7. API timeout default raised to 10 minutes

Per the release notes: "Improved handling when the API sends no response headers: the retry now waits up to API_TIMEOUT_MS (10 minutes by default) instead of another 3 minutes, and the messages say what to change."

The default for API_TIMEOUT_MS is now 10 minutes (was 3 minutes). For a long-running inference call on a slow model, or an inference call that hits a stalled connection without response headers, the retry now waits longer before giving up. For builders running unattended Claude Code sessions over flaky networks, the longer default means fewer retry-budget-exhausted failures. The setting is still configurable; the change is to the default.

8. Word-editing keys match Bash, /context uses local estimate

Two workflow-quality items:

• "Changed the prompt's word-editing keys to match Bash: Ctrl+W deletes back to whitespace, Alt+F and Alt+D stop at word end, punctuation separates words; keybindingFlavor no longer has any effect."
• "Changed /context token counting to use a local estimate when the token-counting API is unavailable, instead of extra small-model requests."

The first standardizes the prompt's word-editing keybindings to the same behavior Bash uses — Ctrl+W deletes back to whitespace (not a single word), Alt+F moves forward to word end, Alt+D deletes forward to word end. The keybindingFlavor setting no longer has any effect because the behavior is now uniform. For a developer who has been bouncing between Bash and the Claude Code prompt, this removes a small but persistent muscle-memory conflict.

The second is a cost and latency optimization for /context. When the token-counting API is unavailable, the slash command now uses a local estimate instead of firing a small-model request to get a count. For builders on metered plans, this is a small but recurring token spend that goes away.

9. Other fixes worth flagging

A selection from the ~50 other items in v2.1.261:

• "Fixed typed or pasted characters occasionally landing out of order or being dropped during fast input or key repeat" — input reliability.
• "Fixed the Bedrock setup wizard hanging when AWS or an AWS credential helper never responds (it now times out with a clear error), and its model checks failing behind a TLS-inspecting proxy" — operational reliability for Bedrock users.
• "Fixed cloud sessions discarding a plugin synced from claude.ai when managed settings force-enable it in enabledPlugins, then falling back to a marketplace clone that could fail" — managed-settings / cloud session interaction fix.
• "Fixed resuming a session losing hook output and other context around parallel tool calls, which changed the resumed request" — resume reliability.
• "Fixed Remote Control showing a stale permission mode when a phone, browser, or claude.ai app attaches to a terminal session or after the mode changes in the terminal" — Remote Control state sync.
• "Fixed Remote Control sessions showing as still working (stuck spinner and Stop button) after stopping a turn from a connected phone or browser, or after a local slash command like /clear" — Remote Control Stop-button fix.
• "Fixed SDK and cloud sessions ignoring a Stop or interrupt sent just after the first prompt, before the turn had started; the turn now stops instead of running to completion" — SDK Stop-before-turn-start fix. Important for builders who have been hitting "the turn I tried to cancel still ran."
• "Fixed gcpAuthRefresh opening a browser at startup when the Google credential check was slow, even though the credential was still valid" — GCP credential UX fix; no spurious browser launch on slow checks.
• "Fixed claude.ai connectors staying absent for the whole session when the startup connector fetch timed out — the CLI now retries in the background" — claude.ai connector resilience.
• "Fixed sustained high CPU usage when a background agent could not be resumed and its wake-up was retried in a tight loop" — background-agent CPU / retry-loop fix.
• "Fixed feature flags gated to a newer version occasionally applying to an older Claude Code version running on the same machine" — version-gating correctness.
• "Fixed /usage and the VS Code usage panel dropping a model-specific weekly limit row when the usage endpoint is rate limited or when opened right after startup" — /usage UI fix.
• "Fixed claude -p --resume <file> adopting a malformed session ID recorded in the transcript; it now resumes under a fresh session ID instead" — resume safety.
• "Fixed the terminal progress indicator (iTerm2, Ghostty, ConEmu) showing the session as finished while a background workflow or agent was still running" — terminal progress indicator fix.
• "Fixed Claude apps gateway client IP when a trusted proxy appends a port to X-Forwarded-For; with an access list set, an unreadable entry now gets 403" — apps gateway proxy handling.
• "Fixed Claude apps gateway telling Claude Desktop to export OpenTelemetry as JSON even when the terminal CLI uses protobuf, so protobuf-only collectors rejected Desktop's data" — OTEL format consistency.
• "Improved the /model picker and the VS Code model pill to show a model's name instead of its raw Bedrock, Vertex AI, or LLM gateway ID when Claude Code recognizes it" — model-picker UX.
• "Improved startup on Google Vertex AI when GOOGLE_APPLICATION_CREDENTIALS is set: API client creation no longer re-runs Google Cloud project discovery or spawns extra gcloud processes" — Vertex AI startup performance.
• "Improved streaming performance: already-rendered blocks are no longer re-checked by layout on each update" — streaming performance.

And the VSCode-specific items in v2.1.261 are too many to enumerate; the headline additions are: a "Build a custom style" walkthrough in the Output styles menu, an Add-server and Remove-action form in the MCP servers dialog so MCP servers can be managed without leaving the IDE, a hollow ring in the session list for sessions open in a terminal or another VS Code window, a fold button on permission and question prompts so the conversation behind them can be read without dismissing them, an "Archive session" entry in the session list's right-click menu, and a flat-list model picker with older model spellings kept at the bottom.

What Actually Changed For Builders

Command output: A new bashOutputMaxChars / taskOutputMaxChars setting lifts inline command and background-task output to up to 128K characters. Long CLI tools and integration tests no longer get truncated to file as aggressively.

Skills library hygiene: /skill-doctor shows which loaded skills the model never invoked and what each one costs in context. The prune command for personal or shared skill libraries.

Subagent prompts: --append-subagent-system-prompt-file reads a subagent system prompt from a file instead of the command line. Long subagent prompts in source control can now be consumed directly.

Managed-settings diagnostics: /status and claude doctor now report why an organization's policy could not be loaded (proxy, endpoint, etc.). IT debugging surface.

Security — rm: The dangerous-rm safety prompt now catches rm -rf on positional parameters and inside double-quoted sh -c scripts. Wider net for the existing safety check.

Security — URL uploads: Auto mode no longer auto-approves URLs that pack content into a public diagram renderer's URL parameter. Mermaid/Kroki-style encoded URLs now prompt instead of silently fetching.

API timeout: Default API_TIMEOUT_MS raised from 3 minutes to 10 minutes. Fewer retry-budget-exhausted failures on stalled connections.

Input consistency: Prompt word-editing keybindings now match Bash (Ctrl+W to whitespace, Alt+F/D for word boundaries). keybindingFlavor setting no longer has any effect.

SDK reliability: Stop / interrupt sent just after the first prompt, before the turn has started, now actually stops the turn. Cloud-session plugin-sync race with managed settings resolved.

Operational reliability: Sustained high CPU from background-agent wake-up retry loops is fixed. Bedrock setup wizard no longer hangs behind TLS-inspecting proxies. GCP credential check no longer opens a browser on slow checks.

VSCode surface: Add/remove MCP servers in the IDE; build a custom output style with a walkthrough; archive session from the session list; fold permission prompts.

Why Developers And Founders Should Care

Reason 1: If your workflows depend on long CLI output staying inline, v2.1.261 removes a recurring friction. bashOutputMaxChars lets you push the inline cap from whatever the default was up to 128K characters. For an agent that runs pytest -v, npm test, terraform plan, or any tool whose output the model needs to see inline to debug, fewer "the output was truncated; let me read the file" round trips. The cap is bounded (128K, not infinite), but the change covers the long-tail.

Reason 2: If you have been accumulating skills, /skill-doctor is the prune tool. Skills that the model never uses still pay a context cost. The new slash command surfaces both the unused list and the per-skill cost, so you can drop the skills that are paying rent without earning it.

Reason 3: If you run subagents with long system prompts in source control, --append-subagent-system-prompt-file removes the shell-argument-length limit. Prompts you have been maintaining in .md files can now be consumed directly by the CLI.

Reason 4: If you have been seeing "I sent Stop but the turn kept running" or "I cancelled before the turn started and it still ran," v2.1.261 fixes the SDK Stop-before-turn-start case. A small but consequential reliability fix for unattended Claude Code.

Reason 5: If you operate Claude Code under managed settings, the new "Organization policy" diagnostic line in /status and claude doctor is the surface for debugging "why is my managed policy not loading." Previously silent; now reported.

Reason 6: If you fence dangerous-rm with the safety prompt, v2.1.261 widens the net to catch rm -rf on positional parameters and inside sh -c "..." scripts. If your allow rules previously approved these patterns because they slipped past the literal rm check, expect new prompts.

Reason 7: If you have been letting auto mode approve URL fetches that encode content into a public diagram renderer's URL, v2.1.261 reclassifies those as uploads. No longer auto-approved unless explicitly asked. Closes a small data-exfiltration shape and changes auto-mode behavior for Mermaid / Kroki / similar encoded-URL renders.

Reason 8: If you run unattended Claude Code over flaky networks, the API_TIMEOUT_MS default raises from 3 minutes to 10 minutes. Fewer retry-budget-exhausted failures on stalled connections.

Evidence And Test Results

Primary sources: the v2.1.260 release notes, the v2.1.261 release notes, and the atom feed entry timestamps (v2.1.260 updated 2026-09-03T23:48:12Z, v2.1.261 updated 2026-09-04T19:58:10Z). Every claim above is verifiable verbatim in the release notes. Atom feed confirmed at fetch time 2026-09-04 20:08 UTC.

Cross-check against recent coverage: v2.1.259 (covered Sep 3 in [Claude Code v2.1.259 Just Gave Admins Org-Wide MCP Provisioning and Headless Hosts a --permission-prompts none Mode](https://mr.technology/payloads/claude-code-2-1-259-managed-mcp-servers-permission-prompts-none-sep-2026)) shipped managedMcpServers + --permission-prompts none + Bash Read() deny-rule bypass fix + concurrent-session state fix. v2.1.261 sits one release later in the same capability-and-reliability cadence — bashOutputMaxChars + /skill-doctor + --append-subagent-system-prompt-file are the new capability additions; the dangerous-rm widening and the auto-mode URL reclassification are the new security-relevant items; the SDK Stop-before-turn-start fix and the background-agent CPU fix are the operational reliability wins.

No firsthand test was run. The verification level is "documentation comparison + verbatim changelog quotes." I have not installed v2.1.261, not raised bashOutputMaxChars to 128K, not run /skill-doctor against a personal skill library, not exercised --append-subagent-system-prompt-file, and not tested the dangerous-rm widening on a real script. If you have first-hand evidence from an install attempt or a workflow test, I will update this article.

Cost, Risk, And Limitations

Cost: No new paid tier, no pricing change. bashOutputMaxChars and taskOutputMaxChars affect how much inline output is processed per turn; raising them does not change per-token pricing but may increase the per-turn token count for tool calls that produce large output. The cap is 128K characters; a builder who needs more still has the save-to-file path.

Risk: The dangerous-rm widening is a behavior change for any workflow that previously relied on rm -rf inside shell scripts. If your permissions.allow rules previously auto-approved Bash(rm:*) and a cleanup script ended with rm -rf "$@", the new check may prompt. Audit the scripts in your repo's CI and your agent workflows.

The auto-mode URL reclassification is a behavior change for any workflow that relied on auto mode approving Mermaid / Kroki / encoded-URL renders. If your agent workflow has been generating these URLs and expecting auto-mode approval, expect new prompts.

The API_TIMEOUT_MS default raise to 10 minutes means a stalled connection takes longer to give up. For an unattended agent on a healthy network, this is a non-issue. For an unattended agent on a misconfigured network, the longer timeout delays the visible-failure signal.

The Stop-before-turn-start fix is a behavior change for any workflow that was relying on "Stop sent before turn start gets ignored." Previously: the turn ran to completion. Now: the turn stops. If a CI gate or a cron job had been depending on the old behavior, expect the new behavior.

Limitations of this report:

• Documentation-surfacing report, not firsthand test. I have not installed v2.1.261.
• The full ~60-item v2.1.261 changelog is summarized above; the items I have called out as the "operational shortlist" are my editorial selection based on impact for production Claude Code. Items I have abbreviated or omitted are real changes but not material to the capability-or-security story.
• The /skill-doctor exact metric (whether context cost is computed from declared size or measured from runtime usage) was not re-fetched. The release notes describe it as "what they cost in context"; the exact computation is in the docs.
• The keybindingFlavor setting's removal is mentioned in the release notes; if your settings.toml or settings.json includes keybindingFlavor, it will be silently ignored going forward.
• The exact VSCode item list is summarized above; the ~15 VSCode-specific items in v2.1.261 include both new capabilities and bug fixes, and I have enumerated the headline additions.
• The dangerous-rm widening's exact interaction with permissions.deny rules was not re-fetched. A builder who has permissions.deny covering Bash(rm:<em>) should expect no change; a builder who has permissions.allow covering Bash(rm:</em>) should expect the new check to prompt in more cases.

Mr. Technology verdict

v2.1.260 is a single-feature release (/diff fullscreen panel) that ships cleanly. v2.1.261 is a broad operational release: three new user-facing capabilities (bashOutputMaxChars/taskOutputMaxChars up to 128K, /skill-doctor, --append-subagent-system-prompt-file), one managed-settings diagnostic, two security-relevant behavior changes (dangerous-rm widening, auto-mode URL reclassification), one default-config change (API_TIMEOUT_MS to 10 minutes), and a long tail of operational reliability fixes including the SDK Stop-before-turn-start fix and the background-agent CPU fix. The combination is a release to upgrade to if you run unattended or CI-driven Claude Code, manage a skills library, or operate Claude Code under a managed-settings policy. For interactive-only users, the headline capability is /skill-doctor; everything else is incremental.

Recommended action

Today: upgrade to v2.1.261 if you depend on long CLI output staying inline (bashOutputMaxChars up to 128K), or if you run unattended / CI / cron-driven Claude Code (the SDK Stop-before-turn-start fix and the API_TIMEOUT_MS default raise are both operational wins). Also run /skill-doctor against your current session to see which loaded skills are paying a context cost without being used.

This week: audit your permissions.allow rules for rm and your auto-mode workflow for Mermaid / encoded-URL renders. The dangerous-rm widening now catches positional parameters and sh -c "..." scripts, and the auto-mode URL reclassification now treats encoded diagram URLs as uploads. If your workflow has been depending on auto-approval for either, expect new prompts and plan for them. Also remove keybindingFlavor from your settings — the setting no longer has any effect.

Next week: if you have subagents with long system prompts in source control, switch to --append-subagent-system-prompt-file instead of passing the prompt on the command line. Removes shell-argument-length concerns and version-control friction. If you operate Claude Code under managed settings and have been debugging "why is my policy not loading" without a diagnostic, the new "Organization policy" line in /status and claude doctor is the surface to use.

Skip if not in scope: don't enable bashOutputMaxChars if your per-turn token budget is tight — raising the cap increases the per-turn tool-output token count. Don't expect /skill-doctor to surface skills the model has not yet had a chance to use — the command measures against the current session's invocation history.

Article history and corrections

Originally published: 2026-09-04 20:08 UTC Last verified: 2026-09-04 20:08 UTC No corrections at this time.