--- title: "Claude Code v2.1.223 发布：强化安全修复与市场管理功能" source: "Claude Code：GitHub Releases（RSS）" source_tier: "t1_5" url: "https://github.com/anthropics/claude-code/releases/tag/v2.1.223" permalink: "https://feed.astralor.com/items/itm_4293fda08d368c9529b14cc1" published: "2026-08-06T00:52:37.000Z" score: 77 channel: "ai" tags: ["Claude Code","GitHub","权限安全","沙箱"] --- # Claude Code v2.1.223 发布：强化安全修复与市场管理功能 ## AI 点评 > 这次更新里最让我注意的是那几个安全绕过修复——特别是 Bash 权限隐藏和 Unicode 填充，这类漏洞对日常使用 Claude Code 的开发者影响很直接，建议尽快升级。对使用市场插件和管理策略的企业团队，新增的 owner/* 通配符也值得仔细研究。 ## 速览 Claude Code v2.1.223 发布，引入 GitHub 组织通配符市场管控，支持通过 owner/* 允许或阻止整个 GitHub 组织下的 marketplace 仓库。同时修复多个安全漏洞，包括 Bash 权限绕过、Unicode 填充隐藏命令、沙箱外动态导入执行及权限模式绕过等。新增 /teleport 本地续接提示，/review 成为 /code-review 的别名，并改进自动压缩策略与网关模型发现等细节。 ## 关键点 - 新增 owner/* 通配符，可允许或阻止整个 GitHub 组织下的 marketplace 仓库。 - 修复 Bash 权限绕过、Unicode 填充隐藏命令、动态 import 沙箱逃逸等多项安全漏洞。 - 自动压缩策略更新，对 1M 上下文模型统一限制为 200K，并新增未知模型窗口强制执行开关。 - /review 成为 /code-review 的别名，云会话新增 /teleport 本地续接提示。 ## 全文 What's changed Added owner wildcard entries ("owner/*") to the strictKnownMarketplaces and blockedMarketplaces managed settings for allowing or blocking all marketplace repos under a GitHub org Added a warning when workflow agents, forked skills, slash commands, or resumed background agents' requested subagent model is restricted and the parent model runs instead Added a /teleport hint in cloud sessions showing how to continue locally with claude --teleport Fixed a Bash permission bypass where a crafted command could hide parts of itself from permission checks Fixed permission prompts so commands padded with tabs or invisible Unicode can no longer hide part of the command from the approval dialog Fixed workflow scripts being able to use dynamic import() to run code outside the workflow sandbox Fixed a permission gap where an agent definition's bypassPermissions mode ignored the org bypass-permissions disable policy Fixed resuming a session after a mid-session /cd coming back empty Fixed gateway model discovery hiding Claude models registered under provider-prefixed IDs such as vertex_ai/claude-* or bedrock/anthropic.claude-* Fixed modelOverrides keys that aren't Anthropic model IDs being treated as the session's canonical model ID; unknown keys are now ignored as documented Fixed managed settings: server-delivered settings no longer disable the env block of a machine-local managed-settings.json or MDM profile; admin env now merges per key Fixed sandboxed commands failing to start on Linux when sandbox.filesystem.denyWrite covers the working directory Fixed forked background agents getting stuck "already resuming" for the rest of the session when rebuilding the fork's parent prompt failed during resume Fixed a resumed session failing every turn, or leaving the interactive app on an unresponsive error screen, when its history held a malformed diagnostics attachment Fixed a rare hang when parsing unusual git push output Changed CLAUDE_CODE_DISABLE_1M_CONTEXT to hold every Claude model with a native 1M window to 200K via auto-compaction, not just a fixed list; a startup warning now appears when auto-compaction isn't holding the session to 200K Changed auto-compact to keep sessions on unrecognized model IDs within the assumed context window instead of letting them grow past it; set CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 to restore the previous behavior Changed /review to be an alias of /code-review, which reviews the current diff or a PR (/code-review ); use /code-review ultra for a deep cloud review Changed /code-review with no effort level to reuse the level you typed last; type a level like /code-review high to change it --- 引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_4293fda08d368c9529b14cc1