[Release] anthropics/claude-code v2.1.223: v2.1.223

Claude Code v2.1.223 introduces owner wildcard marketplace controls, improves security by fixing permission bypass vulnerabilities and sandbox escapes, and enhances model discovery and session management. Key updates include stricter command obfuscation prevention, workflow sandbox isolation fixes, and better handling of context windows across Claude models. The release also refines the code review workflow and improves managed settings merging for enterprise deployments.

Key Points

• •Owner wildcard entries (`owner/*`) now supported in `strictKnownMarketplaces` and `blockedMarketplaces` for org-level marketplace control
• •Fixed critical Bash permission bypass where crafted commands could hide parts from permission checks using padding or invisible Unicode
• •Fixed workflow scripts escaping sandbox via dynamic `import()` statements—code execution now properly contained
• •Fixed permission gap where agent definition's `bypassPermissions` mode ignored org-level bypass-permissions disable policy
• •Improved gateway model discovery to recognize Claude models under provider-prefixed IDs (e.g., `vertex_ai/claude-*`, `bedrock/anthropic.claude-*`)
• •Fixed `modelOverrides` handling—unknown keys now ignored instead of treated as canonical model IDs
• •Enhanced managed settings: server-delivered settings no longer disable local `managed-settings.json` env block; admin env merges per-key
• •Fixed sandboxed commands failing on Linux when `sandbox.filesystem.denyWrite` covers working directory
• •Changed `CLAUDE_CODE_DISABLE_1M_CONTEXT` to auto-compact all 1M-window Claude models to 200K with startup warning
• •Refactored `/review` as alias of `/code-review` with persistent effort level memory and `/code-review ultra` for deep cloud reviews

Workflow Diagram

Concepts