Claude Code v2.1.223 Major Updates - Permission Bypass Fix and /review Integration into /code-review

This is Ishikawa from the Cloud Business Division. Claude Code v2.1.223 (released 2026-08-06) has been released. Following up on the previous release, this update includes breaking changes and behavioral changes such as slash command integration and deprecation.

The previous update article is here.

https://dev.classmethod.jp/articles/20260805-cc-updates-v2-1-222/

Update Summary

v2.1.223 includes 19 changes. The breakdown is: 4 security fixes related to permission checks and sandboxing, 3 changes to context window handling and slash command behavior, with the remainder being fixes for managed settings, gateway model detection, session resumption, and the addition of warning displays. There are few new features, and this release is centered on changes that correct existing behavior.

Notable Updates

4 Fixes That Bypass Permission Checks

A Bash permission bypass was fixed where crafted commands could hide parts of themselves from permission checks. Additionally, a problem where commands padded with tabs or invisible Unicode characters could hide parts of a command from the approval dialog, a problem where workflow scripts could execute code outside the sandbox using dynamic import(), and a problem where agent-defined bypassPermissions mode was ignoring the organization's bypass-permissions disable policy have each been fixed.

I feel these fixes have a greater impact for operations that rely on the approval dialog display to determine whether Bash execution is permitted. Teams that have organized a permissions allowlist may want to prioritize upgrading to this version.

/review Becomes an Alias for /code-review

/review has become an alias for /code-review. It is also worth noting that /code-review was recently renamed from /simplify in v2.1.147. /code-review reviews the current diff or PR, and you can specify the level and target in the format /code-review <level> <pr#>. Specifying /code-review ultra runs a detailed review in the cloud. Furthermore, running /code-review without specifying a level will now reuse the last level you entered.

For those running code reviews with slash commands, I feel it would be good to check the syntax for specifying levels once.

Changes to Context Window Control

The scope of CLAUDE_CODE_DISABLE_1M_CONTEXT has expanded from a fixed list to all Claude models that natively have a 1M context window. A warning will be displayed at startup if auto-compaction is not keeping the session within 200K. Additionally, auto-compaction will now keep sessions with unrecognized model IDs within the expected context window.

In environments where context length is constrained with environment variables, I feel it would be wise to verify after updating that it is staying within 200K as expected.

Owner Wildcard for Marketplace Settings

strictKnownMarketplaces and blockedMarketplaces in managed settings now support owner-level wildcard specifications in the format "owner/*". You can collectively allow or block marketplace repositories under a GitHub organization.

For those managing plugin marketplaces within an organization, I feel this is a change that frees you from the operation of enumerating repositories one by one.

Update Details

Security

• Fixed a Bash permission bypass where crafted commands could hide parts of themselves from permission checks
• Fixed a problem where commands padded with tabs or invisible Unicode characters could hide parts of a command from the approval dialog
• Fixed a problem where workflow scripts could execute code outside the workflow sandbox using dynamic import()
• Fixed a permission loophole where agent-defined bypassPermissions mode was ignoring the organization's bypass-permissions disable policy

New Features

• strictKnownMarketplaces and blockedMarketplaces in managed settings now support owner-level wildcard specifications in the "owner/*" format. You can collectively allow or block marketplace repositories under a GitHub organization

Improvements / Developer Experience

• A warning is now displayed when the sub-agent model requested by a workflow agent, forked skill, slash command, or resumed background agent is restricted and runs on the parent model
• A /teleport hint is now displayed in cloud sessions showing how to continue working locally via claude --teleport <session id>
• Running /code-review without specifying an effort level will now reuse the last level entered. To change it, specify a level such as /code-review high

Fixes

• Fixed gateway model detection omission: Fixed a problem where Claude models registered with provider-prefixed IDs such as vertex_ai/claude-* or bedrock/anthropic.claude-* were not displayed
• Fixed handling of unknown keys in modelOverrides: Fixed a problem where keys that are not Anthropic model IDs were being treated as the canonical model ID for a session; unknown keys are now ignored as documented
• Fixed managed settings env overwrite: Server-delivered settings no longer disable the env block in machine-local managed-settings.json or MDM profiles. Admin env is merged on a per-key basis
• Fixed sandbox startup failure on Linux: Fixed a problem where sandboxed commands failed to start when sandbox.filesystem.denyWrite included the working directory
• Fixed background agent "already resuming": Fixed a problem where a forked background agent would get stuck in that state for the entire session when rebuilding the source parent prompt failed on resume
• Fixed consecutive failures on session resume: Fixed a problem where a resumed session would fail on every turn, or the interactive app would remain on an unresponsive error screen, when the history contained malformed diagnostic attachments
• A quietly appreciated fix: Fixed a problem where resuming a session after running /cd during it would result in empty content. I feel this is a handy fix for those who continue long sessions while switching working directories
• In addition, minor bugs such as a hang that occasionally occurred when parsing git push output have also been fixed

Breaking Changes / Behavioral Changes

These are all changes that alter the behavior of existing settings and commands.

/review Becomes an Alias for /code-review

The command name /review itself continues to work. What changes is that the content executed becomes that of /code-review.

• /review : Alias for /code-review. Reviews the current diff
• /code-review high 123 : Reviews PR #123 with a specified level
• /code-review ultra : Detailed review in the cloud

Expansion of CLAUDE_CODE_DISABLE_1M_CONTEXT Scope

Before the change (〜v2.1.222):

# Only models in a fixed list are constrained to 200K
export CLAUDE_CODE_DISABLE_1M_CONTEXT=1

After the change (v2.1.223〜):

# All Claude models that natively have a 1M window are
# constrained to 200K by auto-compaction
export CLAUDE_CODE_DISABLE_1M_CONTEXT=1

A warning will be displayed at startup if auto-compaction is not keeping the session within 200K.

Auto-compaction with Unrecognized Model IDs

• Before the change (〜v2.1.222): Sessions with unrecognized model IDs would grow beyond the expected window
• After the change (v2.1.223〜): By default, stays within the expected context window

# To revert to the previous behavior:
export CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1

Supplement: Integration of /review into /code-review

The Confusing /review and /code-review

Here is a chronological explanation of the winding history of /review and /code-review. /code-review is a command that was renamed from /simplify in v2.1.147. /review <pr> was changed in v2.1.186 to use the same review engine as /code-review medium. At this point, the internal implementation was unified once. However, in v2.1.202, /review <pr> reverted to a fast single-pass review, with guidance to "use /code-review <level> <pr#> with an effort level for multi-agent reviews." It has gone through integration → separation → re-integration.

And now, in v2.1.223 (8/6), /review has become an alias for /code-review, consolidating into a single form where /code-review reviews both the current diff and PRs. At the same time, the behavior of reusing the previously entered level when no effort level is specified has been added.

/review Is Treated as /code-review

I prepared a small Git repository for verification and had it review an intentionally problematic diff. The content of the diff was rewriting a parameterized SQL query to string concatenation, deleting the inventory count check, and swallowing exceptions in the update process. Slash commands are a feature for interactive sessions, but since they could also be executed from claude -p, I am sharing those results.

claude -p "/review" --max-turns 1

--max-turns 1 is a specification that limits the number of turns to 1, and the review is cut off midway. The purpose here is to confirm whether it works as an alias, so I ran it in this form. The review actually ran and the planted problems were detected. The opening was All findings verified empirically. Here are the results. and the following is the first of those results.

[
  {
    "file": "inventory.py",
    "line": 35,
    "summary": "The insufficient-stock guard was deleted, so take_stock now drives inventory negative instead of raising ValueError.",
    "failure_scenario": "Item 'A1' has quantity=5. take_stock(conn, 'A1', 100) previously raised ValueError('insufficient stock: 5 < 100'). Verified against a real sqlite3 DB: it now returns -95 and commits quantity=-95 to the items table."
  },

The fact that it is being treated as an alias can also be confirmed from the session records. Sessions are saved in JSON Lines format under ~/.claude/projects/.

It was also confirmed that while /review is entered in the input queue, what is recorded as the prompt is /code-review.

{"type":"queue-operation","operation":"enqueue","timestamp":"2026-08-06T04:15:53.291Z","sessionId":"184cdec5-5ed7-4bb9-8af7-44f1061e5e97","content":"/review"}
:
:
{"type":"last-prompt","lastPrompt":"/code-review","leafUuid":"2b5f19cd-d340-4c66-94d8-599a4f38680c","sessionId":"184cdec5-5ed7-4bb9-8af7-44f1061e5e97"}
:

There used to be situations where I was unsure whether to use /review or /code-review, but now that the same review runs regardless of which you type, I feel it has become possible to focus on the operation of using them appropriately — lightly for regular use and ultra for key moments.

In Closing

In addition to 4 security fixes, behavioral changes including context window handling and the aliasing of /review have been introduced simultaneously. I feel that especially in cases where context is controlled via environment variables, it would be reassuring to verify once after updating that things are working as expected.

For those who have built up permission settings and context length in their operations, why not update and give it a try?

References

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

https://code.claude.com/docs/en/changelog

https://dev.classmethod.jp/articles/20260805-cc-updates-v2-1-222/