Release archive

Claude Code v2.1.223: Permission-Bypass Fixes, /review Becomes a /code-review Alias, and Marketplace Owner Wildcards

Claude Code v2.1.223 closes several permission and sandbox gaps, makes /review an alias of /code-review, adds owner wildcards to marketplace policies, and extends CLAUDE_CODE_DISABLE_1M_CONTEXT to every native 1M model.

August 6, 2026 • 10 min read • By ClaudeWorld

Claude Code v2.1.223 includes 19 changelog entries, several of which close permission and sandbox gaps: a Bash permission bypass, commands hiding parts of themselves from the approval dialog, workflow scripts escaping the workflow sandbox via dynamic import(), and agent definitions ignoring the org bypass-permissions disable policy. It also turns /review into an alias of /code-review, adds owner wildcards to marketplace managed settings, and changes how context-window limits are enforced during auto-compaction.

What’s New

/review Is Now an Alias of /code-review

/review is now an alias of /code-review, which reviews the current diff or a PR (/code-review <level> <pr#>); use /code-review ultra for a deep cloud review. Running /code-review with no effort level now reuses the level you typed last; type a level like /code-review high to change it.

Owner Wildcards for Marketplace Policies

The strictKnownMarketplaces and blockedMarketplaces managed settings now accept owner wildcard entries ("owner/*") for allowing or blocking all marketplace repos under a GitHub org.

CLAUDE_CODE_DISABLE_1M_CONTEXT Covers Every Native 1M Model

CLAUDE_CODE_DISABLE_1M_CONTEXT now holds every Claude model with a native 1M window to 200K via auto-compaction, not just a fixed list. A startup warning now appears when auto-compaction isn’t holding the session to 200K.

Context Window Enforcement for Unrecognized Models

Auto-compact now keeps sessions on unrecognized model IDs within the assumed context window instead of letting them grow past it. Set CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 to restore the previous behavior.

Warning When a Requested Subagent Model Is Restricted

Claude Code now warns when the subagent model requested by workflow agents, forked skills, slash commands, or resumed background agents is restricted and the parent model runs instead.

/teleport Hint in Cloud Sessions

Cloud sessions now show a /teleport hint explaining how to continue locally with claude --teleport <session id>.

Fixes and Improvements

Security and permissions

  • A Bash permission bypass, where a crafted command could hide parts of itself from permission checks, is fixed.
  • Commands padded with tabs or invisible Unicode can no longer hide part of the command from the approval dialog.
  • Workflow scripts can no longer use dynamic import() to run code outside the workflow sandbox.
  • An agent definition’s bypassPermissions mode no longer ignores the org bypass-permissions disable policy.

Sessions and resume

  • Resuming a session after a mid-session /cd no longer comes back empty.
  • Forked background agents no longer get stuck “already resuming” for the rest of the session when rebuilding the fork’s parent prompt failed during resume.
  • A resumed session no longer fails every turn, or leaves the interactive app on an unresponsive error screen, when its history holds a malformed diagnostics attachment.

Models and gateways

  • Gateway model discovery no longer hides Claude models registered under provider-prefixed IDs such as vertex_ai/claude-* or bedrock/anthropic.claude-*.
  • modelOverrides keys that aren’t Anthropic model IDs are no longer treated as the session’s canonical model ID; unknown keys are now ignored as documented.

Managed settings

  • Server-delivered settings no longer disable the env block of a machine-local managed-settings.json or MDM profile; admin env now merges per key.

Sandbox and git

  • Sandboxed commands no longer fail to start on Linux when sandbox.filesystem.denyWrite covers the working directory.
  • A rare hang when parsing unusual git push output is fixed.

How to Update

  1. Check your installed version: claude --version
  2. Update in place: claude update
  3. If you use model IDs that Claude Code doesn’t recognize, auto-compact now keeps those sessions within the assumed context window; set CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 to restore the previous behavior.