v2.1.223
Claude CodeSummary
This release introduces enhanced managed settings for marketplace repositories and improved handling of restricted subagent models. Several critical bugs have been fixed, including permission bypasses, sandbox violations, and issues with session resumption and model discovery.
New Features
- Added owner wildcard entries (e.g., "owner/*") to `strictKnownMarketplaces` and `blockedMarketplaces` managed settings for granular control over marketplace repositories within a GitHub organization.
- Added a warning when restricted subagent models are requested, ensuring the parent model runs instead for workflow agents, forked skills, slash commands, and resumed background agents.
- Introduced a `/teleport` hint in cloud sessions to facilitate seamless continuation of sessions locally using `claude --teleport <session id>`.
Bug Fixes
- Fixed a Bash permission bypass vulnerability that allowed crafted commands to obscure parts of themselves from permission checks.
- Fixed permission prompts to prevent commands padded with tabs or invisible Unicode characters from hiding parts of the command from the approval dialog.
- Fixed workflow scripts from using dynamic `import()` to execute code outside the designated workflow sandbox.
- Fixed a permission gap where the `bypassPermissions` mode in agent definitions incorrectly ignored the organization's policy to disable bypass-permissions.
- Fixed resumed sessions to correctly restore context after a mid-session `/cd` command, preventing empty sessions.
- Fixed gateway model discovery to properly display Claude models registered with provider-prefixed IDs (e.g., `vertex_ai/claude-*` or `bedrock/anthropic.claude-*`).
- Fixed `modelOverrides` to ignore keys that are not Anthropic model IDs, preventing them from being treated as the session's canonical model ID.
- Fixed managed settings to ensure server-delivered settings no longer disable the environment block of local `managed-settings.json` or MDM profiles; admin environments now merge settings per key.
- Fixed sandboxed commands on Linux to start correctly when `sandbox.filesystem.denyWrite` covers the working directory.
- Fixed forked background agents from getting stuck in an 'already resuming' state when the fork's parent prompt rebuild failed during resume.
- Fixed resumed sessions from failing every turn or displaying an unresponsive error screen by handling malformed diagnostics attachments in session history.
- Fixed a rare hang issue encountered when parsing unusual `git push` output.
- Fixed issues with resumed sessions failing or leaving the interactive app on an unresponsive error screen when session history contained a malformed diagnostics attachment.
Improvements
- Changed `CLAUDE_CODE_DISABLE_1M_CONTEXT` to automatically compact the context window to 200K for all Claude models with a native 1M window, providing a startup warning if auto-compaction is not maintaining this limit.
- Enhanced auto-compaction to keep sessions on unrecognized model IDs within the assumed context window, preventing them from exceeding it. The previous behavior can be restored by setting `CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1`.
- Changed `/review` to be an alias for `/code-review`, allowing for reviews of the current diff or a PR (e.g., `/code-review <level> <pr#>`), with `/code-review ultra` enabling a deep cloud review.
- Modified `/code-review` to remember and reuse the last specified effort level when no level is provided, allowing users to change it by typing a level like `/code-review high`.