Claude Code 2.1.223 patches Bash permission bypasses, adds /teleport
The security release: crafted commands could hide from approval prompts and workflow scripts could break the sandbox. Also folds /review into /code-review.
Copy markdown
Update now: commands could slip past the approval prompt
A crafted Bash command could hide parts of itself from permission checks, and a command padded with tabs or invisible Unicode could conceal part of itself in the approval dialog. Both are patched in 2.1.223 — reason enough to upgrade today.
Workflow sandbox escape, closed
Workflow scripts could use dynamic import() to run code outside the workflow sandbox, and an agent definition's bypassPermissions mode could ignore your org's bypass-permissions disable policy. If you run untrusted workflows or manage a team, this is the update to take.
/teleport: hand a cloud session to your terminal
Cloud sessions now surface a hint to continue locally with `claude --teleport <session id>`. Start a run in Claude Code on the web, then pick it up in your own terminal with the full context intact.
/review is now just /code-review
`/review` is now an alias of `/code-review`, which reviews the current diff or a PR (`/code-review <level> <pr#>`, or `/code-review ultra` for a deep cloud pass). With no level it reuses the one you typed last, so update any scripts or docs that still call /review.
The 1M-context off-switch got stricter
CLAUDE_CODE_DISABLE_1M_CONTEXT now clamps every Claude model with a native 1M window down to 200K via auto-compaction — not just a hardcoded list — and warns at startup when it can't. If you rely on the full million tokens, make sure this flag isn't set.