claudekit / updates / claude-code-2-1-223
[ PATCH · ]

Claude Code 2.1.223

A Bash permission bypass where a crafted command could hide parts of itself from permission checks is fixed, along with permission prompts where tabs or invisible Unicode could hide part of the command from the approval dialog. Workflow scripts can no longer use dynamic import() to run code outside the workflow sandbox, and an agent definition's bypassPermissions mode no longer ignores the org bypass-permissions disable policy. The strictKnownMarketplaces and blockedMarketplaces managed settings now accept owner wildcard entries ("owner/*"), and cloud sessions show a /teleport hint for continuing locally with claude --teleport <session id>. CLAUDE_CODE_DISABLE_1M_CONTEXT now holds every Claude model with a native 1M window to 200K, and /review is an alias of /code-review.

Claude Code
Official announcement →

This article is a summary based on official documentation.

What changed

Claude Code 2.1.223 shipped on August 6, 2026. The center of the release is closing paths around permission checks and the workflow sandbox: a crafted command could hide parts of itself from permission checks, tabs and invisible Unicode could hide part of a command from the approval dialog, workflow scripts could reach outside the sandbox through dynamic import(), and an agent definition’s bypassPermissions mode could ignore an org policy that disables it. Alongside those, managed settings gain org-wide marketplace wildcards, context-window enforcement changes for 1M and unrecognized models, and /review becomes an alias of /code-review.

New features

  • Owner wildcard entries for marketplace managed settings

    strictKnownMarketplaces and blockedMarketplaces — the managed settings that allow or block plugin marketplaces — took repos one at a time, so covering a GitHub org meant listing every repo under it. They now accept owner wildcard entries ("owner/*") for allowing or blocking all marketplace repos under a GitHub org.

  • /teleport hint in cloud sessions

    Continuing a cloud session locally meant knowing the command up front. Cloud sessions now show a /teleport hint with how to continue locally using claude --teleport <session id>.

Key improvements

  • Warning when a requested subagent model is restricted

    When workflow agents, forked skills, slash commands, or resumed background agents requested a subagent model that turned out to be restricted, the parent model ran instead with nothing said about it. A warning is now shown when the requested subagent model is restricted and the parent model runs instead.

  • CLAUDE_CODE_DISABLE_1M_CONTEXT covers every 1M model

    The variable applied to a fixed list of models, so 1M-window models outside that list were not held to 200K. It now holds every Claude model with a native 1M window to 200K via auto-compaction, not just a fixed list, and a startup warning appears when auto-compaction isn’t holding the session to 200K.

  • Context-window enforcement for unrecognized model IDs

    Sessions running on model IDs Claude Code doesn’t recognize weren’t auto-compacted, so they could grow past the assumed context window. Auto-compact now keeps those sessions within the assumed context window; set CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 to restore the previous behavior.

  • /review is an alias of /code-review

    Two separate review commands left it unclear which one to reach for. /review is now an alias of /code-review, which reviews the current diff or a PR (/code-review <level> <pr#>); use /code-review ultra for a deep cloud review.

  • /code-review reuses your last effort level

    Running /code-review without an effort level didn’t carry over the level you had been using. It now reuses the level you typed last; type a level like /code-review high to change it.

Bug fixes

Permissions & sandbox

  • A Bash permission bypass where a crafted command could hide parts of itself from permission checks — fixed.
  • Commands padded with tabs or invisible Unicode hiding part of the command from the approval dialog — fixed.
  • Workflow scripts being able to use dynamic import() to run code outside the workflow sandbox — fixed.
  • An agent definition’s bypassPermissions mode ignoring the org bypass-permissions disable policy — fixed.

Models & settings

  • Gateway model discovery hiding Claude models registered under provider-prefixed IDs such as vertex_ai/claude-* or bedrock/anthropic.claude-* — fixed.
  • modelOverrides keys that aren’t Anthropic model IDs being treated as the session’s canonical model ID — fixed; unknown keys are now ignored as documented.
  • Server-delivered managed settings disabling the env block of a machine-local managed-settings.json or MDM profile — fixed; admin env now merges per key.

Sessions & execution

  • Resuming a session after a mid-session /cd coming back empty — fixed.
  • Sandboxed commands failing to start on Linux when sandbox.filesystem.denyWrite covers the working directory — fixed.
  • Forked background agents getting stuck “already resuming” for the rest of the session when rebuilding the fork’s parent prompt failed during resume — fixed.
  • A resumed session failing every turn, or leaving the interactive app on an unresponsive error screen, when its history held a malformed diagnostics attachment — fixed.
  • A rare hang when parsing unusual git push output — fixed.

Notes

  • This release carries security fixes — the Bash permission bypass, the approval-dialog padding trick, the workflow sandbox escape through dynamic import(), and the ignored org bypass-permissions policy all land together. There’s little reason to hold off on upgrading.
  • Keep typing /review if you prefer — it’s an alias, so the command you type doesn’t have to change; the behavior is now /code-review’s.
  • Context-window enforcement shifts — both setups that pinned 1M-window models to 200K and setups running on unrecognized model IDs will behave differently. For unrecognized model IDs, set CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 to restore the previous behavior.
  • Marketplace wildcards are a managed setting — "owner/*" applies to strictKnownMarketplaces and blockedMarketplaces in admin-delivered managed settings, not to personal settings files.
  • Managed env now merges per key — where server-delivered settings sit alongside a machine-local managed-settings.json or MDM profile, env values that were previously disabled can come back into effect. Worth checking after upgrading.