Claude Code v2.1.223 introduces new managed settings for GitHub organization-level marketplace control and addresses several security vulnerabilities related to permission checks.

  • Added owner wildcard entries ("owner/*") to strictKnownMarketplaces and blockedMarketplaces settings.
  • Fixed a Bash permission bypass where crafted commands could hide parts of themselves from permission checks.
  • Fixed permission prompts so commands padded with tabs or invisible Unicode can no longer hide part of the command from the approval dialog.
  • Fixed workflow scripts being able to use dynamic import() to run code outside the workflow sandbox.
  • Fixed a permission gap where an agent definition's bypassPermissions mode ignored the org bypass-permissions disable policy.
  • Changed CLAUDE_CODE_DISABLE_1M_CONTEXT to hold every Claude model with a native 1M window to 200K via auto-compaction.

These updates enhance security by closing gaps that allowed unauthorized code execution or permission evasion, while also providing administrators with finer control over marketplace access.