--- title: "Claude Code v2.1.223 Release: Enhanced Security Fixes and Marketplace Management" source: "Claude Code：GitHub Releases（RSS）" source_tier: "t1_5" url: "https://github.com/anthropics/claude-code/releases/tag/v2.1.223" permalink: "https://feed.astralor.com/items/itm_4293fda08d368c9529b14cc1" published: "2026-08-06T00:52:37.000Z" score: 77 channel: "ai" tags: ["Claude Code","GitHub","Permission security","Sandbox"] --- # Claude Code v2.1.223 Release: Enhanced Security Fixes and Marketplace Management ## AI commentary > The security bypass fixes—especially the Bash permission hiding and Unicode padding exploits—stand out to me, as they directly affect developers using Claude Code daily, so upgrading is highly recommended. The new owner/* wildcards also deserve close attention for enterprise teams managing marketplace plugins and policies. ## At a glance Claude Code v2.1.223 has been released, introducing owner wildcard entries to managed settings for greater control over marketplace repositories under GitHub organizations. This release fixes several security vulnerabilities, such as Bash permission bypasses where crafted commands could hide parts of themselves, commands padded with tabs or invisible Unicode being hidden from approval dialogs, and workflow scripts using dynamic import() to run outside the sandbox. It also addresses permission gaps with bypassPermissions mode and improves session resumption after mid-session directory changes. New features include a /teleport hint in cloud sessions for continuing locally, and /review now serves as an alias for /code-review, supporting effort levels and pull request numbers. Auto-compaction logic has been updated to handle all Claude models with native 1M context windows, and a new environment variable allows disabling unknown model window enforcement. Additionally, gateway model discovery now correctly finds Claude models registered under provider-prefixed IDs like vertex_ai/claude-* and bedrock/anthropic.claude-*. ## Key points - Added owner/* wildcards to allow or block all marketplace repos under a GitHub org. - Fixed multiple security vulnerabilities including Bash permission bypass, Unicode padding hiding commands, and dynamic import sandbox escape. - Auto-compaction now caps all native 1M-window Claude models to 200K, with an option to disable window enforcement for unknown models. - /review is now an alias of /code-review, and cloud sessions show a /teleport hint for continuing locally. ## Full text What's changed Added owner wildcard entries ("owner/*") to the strictKnownMarketplaces and blockedMarketplaces managed settings for allowing or blocking all marketplace repos under a GitHub org Added a warning when workflow agents, forked skills, slash commands, or resumed background agents' requested subagent model is restricted and the parent model runs instead Added a /teleport hint in cloud sessions showing how to continue locally with claude --teleport Fixed a Bash permission bypass where a crafted command could hide parts of itself from permission checks Fixed permission prompts so commands padded with tabs or invisible Unicode can no longer hide part of the command from the approval dialog Fixed workflow scripts being able to use dynamic import() to run code outside the workflow sandbox Fixed a permission gap where an agent definition's bypassPermissions mode ignored the org bypass-permissions disable policy Fixed resuming a session after a mid-session /cd coming back empty Fixed gateway model discovery hiding Claude models registered under provider-prefixed IDs such as vertex_ai/claude-* or bedrock/anthropic.claude-* Fixed modelOverrides keys that aren't Anthropic model IDs being treated as the session's canonical model ID; unknown keys are now ignored as documented Fixed managed settings: server-delivered settings no longer disable the env block of a machine-local managed-settings.json or MDM profile; admin env now merges per key Fixed sandboxed commands failing to start on Linux when sandbox.filesystem.denyWrite covers the working directory Fixed forked background agents getting stuck "already resuming" for the rest of the session when rebuilding the fork's parent prompt failed during resume Fixed a resumed session failing every turn, or leaving the interactive app on an unresponsive error screen, when its history held a malformed diagnostics attachment Fixed a rare hang when parsing unusual git push output Changed CLAUDE_CODE_DISABLE_1M_CONTEXT to hold every Claude model with a native 1M window to 200K via auto-compaction, not just a fixed list; a startup warning now appears when auto-compaction isn't holding the session to 200K Changed auto-compact to keep sessions on unrecognized model IDs within the assumed context window instead of letting them grow past it; set CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 to restore the previous behavior Changed /review to be an alias of /code-review, which reviews the current diff or a PR (/code-review ); use /code-review ultra for a deep cloud review Changed /code-review with no effort level to reuse the level you typed last; type a level like /code-review high to change it --- Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_4293fda08d368c9529b14cc1