Claude Code 2.1.223: four permission bypasses closed, /review merges into /code-review

Claude Code 2.1.223 shipped on August 6. Four security fixes go straight at permission prompts and sandboxing, /review stops existing as its own command, and 1M context window handling gets stricter. Here’s what matters.

Security: four ways around permission prompts, closed in one release

The densest batch in this release:

Bash: a carefully crafted command could hide part of itself from permission checks. The classifier only saw a fragment of what would actually run.
Approval dialog: a command padded with tabs or invisible Unicode characters could hide part of its content from what the user sees in the prompt. You approve what’s shown, not necessarily what executes.
Workflows: a workflow script could use a dynamic import() to run code outside the sandbox workflows are supposed to be confined to.
bypassPermissions: an agent definition set to bypassPermissions ignored the org policy that disables that mode. A company that had turned off bypassPermissions at the admin level could still have it reintroduced through a locally defined agent.

All four fixes point the same way: what’s shown to the user, or to the admin, now has to match what actually runs. If you operate in acceptEdits or auto mode over dynamically generated commands (scripts, workflows, third-party agents), these close real gaps, not lab scenarios.

`/review` is gone, absorbed into `/code-review`

Muscle-memory change worth noting right away: /review is now just an alias for /code-review, which reviews the current diff or a pull request via /code-review <level> <pr#>. For a deep cloud review, that’s /code-review ultra.

One more practical detail: calling /code-review with no level now reuses whatever level you typed last, instead of falling back to a default. To change it, just type an explicit level again, like /code-review high.

1M context window, better enforced

Two related changes, relevant if you work with native 1M-window models or non-standard model IDs:

CLAUDE_CODE_DISABLE_1M_CONTEXT now covers every Claude model with a native 1M window through auto-compaction, not just a fixed list. A startup warning now appears if auto-compaction can’t hold the session under 200K.
Auto-compact also keeps sessions running on unrecognized model IDs within their assumed context window, instead of letting them grow past it unchecked. To restore the old behavior, CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 is available.

What changes your day-to-day

Plugin marketplaces: strictKnownMarketplaces and blockedMarketplaces now accept wildcard entries like "owner/*", to allow or block every marketplace repo under a GitHub org at once.
Restricted subagent model: a warning now shows up when a workflow agent, forked skill, slash command, or resumed background agent requests a model the org policy restricts, and the parent’s model runs instead.
/teleport in cloud sessions: a hint now shows how to continue locally with claude --teleport <session id>.
Managed settings: server-delivered settings no longer wipe out the entire env block of a machine-local managed-settings.json or MDM profile. The merge now happens key by key.
Model gateways: model discovery no longer hides Claude models registered under a provider-prefixed ID, like vertex_ai/claude-* or bedrock/anthropic.claude-*.
modelOverrides: a key that isn’t a valid Anthropic model ID is no longer mistakenly treated as the session’s canonical model ID. Unknown keys are now ignored, as documented.

The rest, worth a skim

Sandboxed commands failing to start on Linux when sandbox.filesystem.denyWrite covered the working directory: fixed.
Resuming a session after a mid-session /cd coming back empty: fixed.
Forked background agents getting stuck on “already resuming” for the rest of the session when rebuilding the fork’s parent prompt failed during resume: fixed.
A resumed session failing every turn, or leaving the interactive app on a frozen error screen, when its history held a malformed diagnostics attachment: fixed.
A rare hang when parsing unusual git push output: fixed.

Should you update

Yes, don’t wait: four real permission bypasses closed in the same release is not something you see often. Also plan to retrain your /review reflex into /code-review, and double-check your use of bypassPermissions if your org relies on it to lock down agents.

Source: official Claude Code changelog.