Claude Code 2.1.261: keybindings change, auto mode gets wary of links

Just one release since the last digest, 2.1.261 from September 4. The official changelog lists sixty-seven entries, close to half of them VS Code and Remote Control fixes. The thread running through it is three changes that touch your muscle memory and what Claude does without asking first: the prompt's word-editing keys change their default behavior, auto mode gets suspicious of one specific kind of link, and two more disguises for a forced recursive delete get caught.

The prompt's keyboard now follows Bash, and a whole setting stops mattering

Three word-editing shortcuts in the prompt change, and they all move toward the same reference: the Bash shell. Ctrl+W now deletes backward to the preceding whitespace, Alt+F and Alt+D stop at the end of a word, and punctuation counts as a word boundary. The distinction is worth noting: Ctrl+W ignores punctuation and runs back to the whitespace, whereas Alt+F and Alt+D stop on a punctuation mark. That is your terminal's rule, exactly.

The bigger change is elsewhere: the keybindingFlavor setting no longer does anything at all. Whatever value it holds in your settings, text editing now always follows the Bash convention described above. The keybindings doc doesn't mention that setting at all: it documents only the ~/.claude/keybindings.json file, which covers client actions (submit, cancel, switch mode, open an external editor) but nothing about deleting or jumping across raw text. The two mechanisms answered to different layers, keybindings.json for actions and keybindingFlavor for text editing, and this release locks the second layer down for good.

Auto mode gets wary of links into a diagram renderer

A quieter default change, but one with real practical consequences: when a link Claude assembles packs content directly into the URL of a public diagram-rendering tool, the kind of service that rebuilds a diagram from the content encoded in the address, auto mode used to treat that as opening an ordinary link and approved it without asking. As of 2.1.261, that kind of link counts as sending content to a third-party service, so it's no longer auto-approved unless you specifically asked for that render.

The distinction matters because a link like that carries the diagram's content in plain sight inside the URL, potentially retained on the rendering service's side, even if the link itself is never shared with anyone else. The permission modes guide describes how auto mode's classifier evaluates any action no explicit rule already covers; this change adds a category to what it refuses by default, where it used to wave through a plain URL open.

Two more doors close on rm -rf

The safety prompt that catches a forced recursive delete, even under auto mode, now covers two more cases: rm -rf passed through a script's positional parameter ($1, $2), and rm -rf hidden inside a double-quoted sh -c script. Both used to slip past detection, even though they produce exactly the same effect as writing rm -rf out in the open.

This isn't a new mechanism, just wider coverage for an existing one. The permission modes guide already describes the neighboring rule: a forced recursive delete whose target is a shell variable the classifier never sees assigned, such as rm -rf "$VAR", prompts in every mode, and a positional parameter is exactly that case. Next to it, rm -rf / and rm -rf ~ stay denied outright, including when tucked inside command substitution with $(...). The principle stays the same: adding a layer of indirection to the command isn't enough to slip it through unnoticed.

Everything else, briefly

• /skill-doctor lists the loaded skills going unused in the current session and what they cost in context, so you can prune them.
• bashOutputMaxChars and taskOutputMaxChars, two new settings, raise how much a command or background task can return inline, up to 128,000 characters, before it switches to a file.
• --append-subagent-system-prompt-file reads a subagent's system prompt from a file, for prompts too long for the command line.
• Fast typing or pasting no longer drops or reorders characters during key repeat.
• Resuming a session no longer loses context around tool calls that ran in parallel, which used to change the reconstructed request after a resume.
• A Stop or interrupt sent right after the first message, before the turn had actually started, now really stops the turn in SDK and cloud sessions instead of letting it run to completion.
• claude.ai connectors no longer stay missing for the whole session when their initial load times out; recovery now happens in the background.
• The /model picker now shows a model's readable name instead of its raw Bedrock, Vertex AI, or LLM gateway ID, when Claude Code recognizes it.
• /context falls back to a local token estimate when the token-counting API is unavailable, instead of firing extra small-model requests.
• Machines whose managed settings pin forceLoginMethod: "gateway" now ignore a leftover API key or claude.ai login and ask for /login. Bedrock, Vertex AI, and Foundry sessions are unaffected.

What to take away from this

If you're an individual user, the keyboard change is the one that actually affects you: if you had keybindingFlavor set to something, your prompt edits differently as of this release, and Ctrl+W in particular runs back to the whitespace without stopping at punctuation, so it can take out in one press what you meant to remove in two. The diagram-link change, for its part, adds a confirmation where auto mode used to wave through a content upload disguised as a plain link: you'll see it the next time Claude offers a render you didn't ask for. If you run a fleet or rely on auto mode to operate unsupervised, the two new rm -rf detections are worth checking against your own scripts: a positional parameter or a quoted sh -c that used to pass without confirmation will ask for one now.