Claude Code v2.1.223: Security Fixes, /teleport Hint, and /review Alias

Claude Code v2.1.223 is out, carrying a batch of security fixes and workflow improvements. The headline: a Bash permission bypass where crafted commands could hide parts of themselves from permission checks is now patched. Also, permission prompts now catch commands padded with tabs or invisible Unicode.

Security fixes

• Fixed a Bash permission bypass that allowed hidden command parts.
• Permission prompts no longer allow tabs or invisible Unicode to obfuscate the command.
• Workflow scripts can no longer use dynamic import() to run code outside the sandbox.
• An agent's bypassPermissions mode now respects the org's bypass-permissions disable policy.

Marketplace wildcards

Managed settings (strictKnownMarketplaces and blockedMarketplaces) now support "owner/*" entries, letting you allow or block entire GitHub orgs in one go.

Cloud session hint

Cloud sessions show a /teleport hint so you can continue locally with claude --teleport <session id>.

Other fixes

• Resuming a session after a mid-session /cd no longer comes back empty.
• Gateway model discovery now includes Claude models with provider-prefixed IDs like vertex_ai/claude-* or bedrock/anthropic.claude-*.
• modelOverrides keys that aren't Anthropic model IDs are now ignored, not treated as the session's canonical model.
• Server-delivered settings no longer disable the env block of machine-local managed-settings.json; admin env merges per key.
• Sandboxed commands fail less on Linux when denyWrite covers the working directory.
• Forked background agents no longer get stuck 'already resuming' when rebuilding the parent prompt fails.
• Fixed a hang on unusual git push output.

Context window changes

Two changes to context handling:

• CLAUDE_CODE_DISABLE_1M_CONTEXT now holds every Claude model with a native 1M window to 200K via auto-compaction, not just a fixed list. A startup warning appears if auto-compaction isn't holding the session to 200K.
• Auto-compact now keeps sessions on unrecognized model IDs within the assumed context window. Set CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 to restore old behavior.

Code review changes

/review is now an alias for /code-review, which reviews the current diff or a PR with /code-review <level> <pr#>. Use /code-review ultra for a deep cloud review. Without a level, it reuses the last one you typed.

This release is primarily for developers using Claude Code in CI or scripts — the security patches are worth updating for.