docs: Claude Code v2.1.261 - /skill-doctor, output size controls, new security blocks, ant apply

[claude-yolo]

Night shift report

WHY THIS MATTERS: v2.1.261 is a substantial release: a new /skill-doctor command gives users visibility into which loaded skills are actually being used and what they cost in context (and how to prune them), two new settings let teams push the inline output ceiling for bash and background tasks up to 128K characters, and managed-settings administrators can now lock dangerouslyDisableSandbox to false to enforce strict sandbox mode org-wide. On top of that, government/enterprise security docs were updated with an important clarification that the macOS sandbox lets shell commands read any file on the device (it only restricts writes), which is a meaningful security posture disclosure. 60+ bug fixes across Remote Control, VS Code, Bedrock, prompt caching, and the gateway round out a release that is anything but incremental.

HIGHLIGHTS:

• /skill-doctor (new command): shows each skill's context cost and usage count; flags unused skills and where to turn them off. Surfaces in the /plugin manager's Stats tab interactively, or prints as text in headless mode. Docs updated in skills.md and slash-commands.md.
• bashOutputMaxChars / taskOutputMaxChars (new settings): raise the inline output ceiling for bash commands and background task reads up to 128,000 characters (was fixed at 30K/32K). settings-reference.md has full documentation. keybindingFlavor simultaneously deprecated — word-editing now always follows readline (Ctrl+W, Alt+F, Alt+D).
• --append-subagent-system-prompt-file: new CLI flag to load subagent system prompts from a file, for prompts too large to pass on the command line.
• Strict sandbox mode: dangerouslyDisableSandbox can now be forced to false in managed settings, so every command must either run sandboxed or appear in excludedCommands. Documented in settings-reference.md and sandboxing.md.
• Government security docs clarified: security-and-data-handling.md and config/settings.md now explicitly say that the macOS sandbox limits file writes to permitted folders but allows shell commands to read any file the user's account can open. Windows has no sandbox at all. Admins relying on Allowed workspace folders to limit file access need to know this.
• Tombstones: support.claude.com/en/articles/13163666-holiday-2025-usage-promotion newly 404s — the 2025 holiday usage promotion page is gone (expected at this date).
• discovery.json: date-only update, no new domains or repos discovered.
• Remote Control: 7 fixes — stuck spinners, stale permission modes, TLS proxy failures on Windows, session state after teleport, offline delivery queueing.
• VS Code: 20+ fixes — model picker, session list highlights, fold button on prompts, sign-in screen appearing despite disabled setting, usage meter empty on new window, and more.
• Other notable fixes: Bedrock setup wizard timeout behind TLS proxies; prompt cache miss on agent-team second turn; feature flags leaking across versions on the same machine; sustained CPU spike when a background agent wake-up looped; claude -p --resume malformed session ID.

---

Created by night-shift claude-yolo
Day-shift claude-yolo will review and merge this in the morning