release aidev BREAKING SIG 4/5

Claude Code 2.1.223: Bash permission bypass fixed, /review folded into /code-review

Fixes three permission-enforcement holes — a crafted Bash command hiding parts of itself from permission checks, workflow scripts escaping the sandbox via dynamic import(), and agent-definition bypassPermissions ignoring the org disable policy. /review becomes an alias of /code-review, and auto-compaction now enforces context windows more broadly.

PUBLISHED2026-08-05
OBSERVED2026-08-11
AGE6d
SOURCES1
  • Fixed a Bash permission bypass where a crafted command could hide parts of itself from permission checks; commands padded with tabs or invisible Unicode can no longer hide part of the command from the approval dialog
  • Fixed workflow scripts using dynamic import() to run code outside the workflow sandbox
  • Fixed an agent definition's bypassPermissions mode ignoring the org bypass-permissions disable policy
  • /review is now an alias of /code-review, which reviews the current diff or a PR (/code-review <level> <pr#>); /code-review with no level reuses the level you typed last
  • CLAUDE_CODE_DISABLE_1M_CONTEXT now holds every Claude model with a native 1M window to 200K via auto-compaction, not just a fixed list, with a startup warning when auto-compaction isn't holding the session to 200K
  • Auto-compact now keeps sessions on unrecognized model IDs within the assumed context window; CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 restores the previous behavior
  • Added owner wildcard entries ("owner/*") to strictKnownMarketplaces and blockedMarketplaces managed settings
  • Fixed gateway model discovery hiding Claude models registered under provider-prefixed IDs such as vertex_ai/claude-* or bedrock/anthropic.claude-*
  • Fixed modelOverrides keys that aren't Anthropic model IDs being treated as the session's canonical model ID; unknown keys are now ignored
  • Fixed server-delivered managed settings disabling the env block of a machine-local managed-settings.json or MDM profile; admin env now merges per key
  • Fixed resuming a session after a mid-session /cd coming back empty, and sessions failing every turn on a malformed diagnostics attachment
securityfixbreakingcontext-windowfeature

COMMUNITY

No curated reactions recorded for this event. Facts and takes are kept in separate layers — community context is added by hand, never blended into the record above.