# Claude Code 2.1.223: Bash permission bypass fixed, /review folded into /code-review

> Fixes three permission-enforcement holes — a crafted Bash command hiding parts of itself from permission checks, workflow scripts escaping the sandbox via dynamic `import()`, and agent-definition `bypassPermissions` ignoring the org disable policy. `/review` becomes an alias of `/code-review`, and auto-compaction now enforces context windows more broadly.

| | |
|---|---|
| **Tool** | Claude Code |
| **Version** | 2.1.223 |
| **Kind** | release |
| **Published** | 2026-08-05 |
| **Observed** | 2026-08-11 |
| **Significance** | 4/5 |
| **Breaking** | yes |
| **Categories** | security, fix, breaking, context-window, feature |

## What changed


- Fixed a Bash permission bypass where a crafted command could hide parts of itself from permission checks; commands padded with tabs or invisible Unicode can no longer hide part of the command from the approval dialog
- Fixed workflow scripts using dynamic `import()` to run code outside the workflow sandbox
- Fixed an agent definition's `bypassPermissions` mode ignoring the org bypass-permissions disable policy
- `/review` is now an alias of `/code-review`, which reviews the current diff or a PR (`/code-review <level> <pr#>`); `/code-review` with no level reuses the level you typed last
- `CLAUDE_CODE_DISABLE_1M_CONTEXT` now holds every Claude model with a native 1M window to 200K via auto-compaction, not just a fixed list, with a startup warning when auto-compaction isn't holding the session to 200K
- Auto-compact now keeps sessions on unrecognized model IDs within the assumed context window; `CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1` restores the previous behavior
- Added owner wildcard entries (`"owner/*"`) to `strictKnownMarketplaces` and `blockedMarketplaces` managed settings
- Fixed gateway model discovery hiding Claude models registered under provider-prefixed IDs such as `vertex_ai/claude-*` or `bedrock/anthropic.claude-*`
- Fixed `modelOverrides` keys that aren't Anthropic model IDs being treated as the session's canonical model ID; unknown keys are now ignored
- Fixed server-delivered managed settings disabling the env block of a machine-local `managed-settings.json` or MDM profile; admin env now merges per key
- Fixed resuming a session after a mid-session `/cd` coming back empty, and sessions failing every turn on a malformed diagnostics attachment


## Sources

- [changelog_md](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) — retrieved 2026-08-11

## Community

_No curated reactions recorded. Facts and community takes are kept in separate layers
and never blended._

---
Canonical: https://changelogs.info/claude-code/2-1-223
Entity: https://changelogs.info/claude-code
Event ID: `evt_2026-08-05_claude-code_2-1-223`
Licence: event synthesis © changelogs.info, CC BY 4.0. Linked sources belong to their vendors.