Matins
← All briefs
Matins
Thursday 6 August — v2.1.223
16 changes / 4 actionable / 2 deep dives
Claude Code
  • Four security fixes patch Bash permission bypasses, workflow sandbox escapes, and an agent bypassPermissions policy gap. If you run managed settings or org policies, verify your agents' bypassPermissions fields are not circumventing your disable policy (more below).
  • CLAUDE_CODE_DISABLE_1M_CONTEXT now catches every 1M-window Claude model, not a fixed list. If you relied on the old list missing a model to get full 1M context while the flag was set, that model is now capped at 200K too.
  • Auto-compact now enforces assumed window limits on unrecognized model IDs. Sessions on custom or gateway models that previously grew unbounded will now compact earlier. Set CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 to restore the old behavior.
  • /review is now an alias for /code-review, and /code-review remembers your last effort level. Type /code-review high once, then plain /code-review reuses high until you change it. Use /code-review ultra for the deep cloud review.

New in 2.1.223

2.1.223 (August 6, 2026)

  • Added owner wildcard entries ("owner/*") to the strictKnownMarketplaces and blockedMarketplaces managed settings for allowing or blocking all marketplace repos under a GitHub org
  • Added a warning when workflow agents, forked skills, slash commands, or resumed background agents' requested subagent model is restricted and the parent model runs instead
  • Added a /teleport hint in cloud sessions showing how to continue locally with claude --teleport <session id>
  • Fixed a Bash permission bypass where a crafted command could hide parts of itself from permission checks
  • Fixed permission prompts so commands padded with tabs or invisible Unicode can no longer hide part of the command from the approval dialog
  • Fixed workflow scripts being able to use dynamic import() to run code outside the workflow sandbox
  • Fixed a permission gap where an agent definition's bypassPermissions mode ignored the org bypass-permissions disable policy
  • Fixed resuming a session after a mid-session /cd coming back empty
  • Fixed gateway model discovery hiding Claude models registered under provider-prefixed IDs such as vertex_ai/claude-* or bedrock/anthropic.claude-*
  • Fixed modelOverrides keys that aren't Anthropic model IDs being treated as the session's canonical model ID; unknown keys are now ignored as documented
  • Fixed managed settings: server-delivered settings no longer disable the env block of a machine-local managed-settings.json or MDM profile; admin env now merges per key
  • Fixed sandboxed commands failing to start on Linux when sandbox.filesystem.denyWrite covers the working directory
  • Fixed forked background agents getting stuck "already resuming" for the rest of the session when rebuilding the fork's parent prompt failed during resume
  • Fixed a resumed session failing every turn, or leaving the interactive app on an unresponsive error screen, when its history held a malformed diagnostics attachment
  • Fixed a rare hang when parsing unusual git push output
  • Changed CLAUDE_CODE_DISABLE_1M_CONTEXT to hold every Claude model with a native 1M window to 200K via auto-compaction, not just a fixed list; a startup warning now appears when auto-compaction isn't holding the session to 200K
  • Changed auto-compact to keep sessions on unrecognized model IDs within the assumed context window instead of letting them grow past it; set CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 to restore the previous behavior
  • Changed /review to be an alias of /code-review, which reviews the current diff or a PR (/code-review <level> <pr#>); use /code-review ultra for a deep cloud review
  • Changed /code-review with no effort level to reuse the level you typed last; type a level like /code-review high to change it

Notes

Security: four fixes, one org-policy gap worth checking

This batch closes a cluster of permission and sandbox holes. The Bash bypass (crafted commands hiding from permission checks) and the invisible-Unicode padding trick are variants of the same attack surface that 2.1.221 and 2.1.222 also patched (zsh [[ ]] conditionals, tab/Unicode padding). The workflow import() escape is new territory: workflow scripts could previously load arbitrary modules outside the sandbox via dynamic imports.

The org-policy item is the one to act on if you run managed settings. An agent definition's bypassPermissions field was being honored even when the org had a policy explicitly disabling bypass-permissions. If you have agents with bypassPermissions in their frontmatter and you rely on the org disable policy, confirm after updating that those agents now prompt as expected.

Context window enforcement is now model-aware, not list-based

CLAUDE_CODE_DISABLE_1M_CONTEXT previously checked a hardcoded model list. With Opus 5 (2.1.219), Opus 4.8, and provider-prefixed IDs like vertex_ai/claude-*, the fixed list could not keep up. The flag now detects any Claude model with a native 1M window and applies the 200K cap via auto-compaction. Separately, sessions on unrecognized model IDs (custom gateways, aliases) that previously grew without limit are now compacted at the assumed window boundary. Both changes have escape hatches (CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 for the latter), but the defaults are stricter.