Claude Code 2.1.223: Gateway Model Discovery Bug Fixed, Four Security Bypasses Closed

If your team routes Claude Code through a custom API gateway — an HTTPS proxy, a self-hosted router, or a cloud provider that registers models under namespaced IDs — 2.1.223 contains a fix you need to deploy today. The release also closes four security bypass paths that affect headless and managed deployments.

The gateway model discovery bug

Claude Code discovers which models are available by querying the API endpoint you configure via ANTHROPIC_BASE_URL. Before 2.1.223, the model picker silently discarded any model whose ID matched a provider-prefixed pattern: vertex_ai/claude-*, bedrock/anthropic.claude-*, or similar namespaced IDs that gateways use to distinguish upstream providers.

The practical consequence: if your gateway registered models under provider-namespaced IDs (a common practice in multi-provider routers that forward to Bedrock, Vertex AI, or custom inference backends), those models were invisible to Claude Code's model selector. Users were not told models were hidden — the picker simply showed a smaller list. Operators had no way to surface the issue from logs alone.

The fix in 2.1.223 makes the model discovery routine treat any registered model ID as valid regardless of prefix, then resolves the canonical model for session tracking separately. If you run a gateway that registers vertex_ai/claude-sonnet-5 or bedrock/anthropic.claude-opus-5 and your users complained the model wasn't appearing — this is the fix.

Four security bypasses, closed

1. Bash invisible-character bypass. A crafted shell command could pad itself with tabs or invisible Unicode codepoints between tokens, hiding portions of the command from the permission approval dialog while the shell executed them in full. Operators running headless Claude Code deployments — CI pipelines, automated coding agents, background workers — were exposed: a malicious prompt could instruct Claude to append invisible characters around a destructive operation and pass it through auto mode undetected.

2. Dynamic import() sandbox escape in workflow scripts. Workflow scripts executed inside the sandbox could use dynamic import() to load arbitrary Node.js modules from outside the sandbox boundary. This let a workflow script import child_process or fs and perform operations the sandbox was supposed to deny. The fix blocks dynamic imports in the sandbox context.

3. bypassPermissions agent definition ignoring org policy. When an agent definition set bypassPermissions: true, it bypassed the organization-level policy that disables bypass-permissions mode. This was a privilege escalation path: a marketplace skill or a shared .claude/agents/ definition could claim elevated permissions that the org admin had explicitly revoked. The fix enforces the org policy over agent-level declarations.

4. Bash [[ ]] regex conditional bypass (zsh). In zsh, commands embedded in [[ ]] regex conditional expressions could execute hidden operations that the Bash tool permission checker did not inspect. This allowed a crafted command to pass permission checks while executing unlisted code in the conditional branch.

modelOverrides key handling change

Before 2.1.223, a modelOverrides entry with a key that was not a recognized Anthropic model ID was silently treated as the session's canonical model ID. This could cause a gateway-configured override to propagate incorrectly through routing metadata. The fix: unknown modelOverrides keys are now ignored as the docs specified but the implementation did not enforce.

If you have modelOverrides configured in managed settings with any non-standard keys, audit them — they will no longer take effect.

Auto-compaction behavior change for 1M-context models

CLAUDE_CODE_DISABLE_1M_CONTEXT previously targeted only a fixed list of model IDs with 1M-token native windows. In 2.1.223, the env var now holds every model with a native 1M window to 200K via auto-compaction. A startup warning appears when the session is not being held within 200K.

A parallel change: sessions on unrecognized model IDs (for example, custom model IDs registered in a gateway) are now kept within the model's assumed context window by auto-compaction rather than allowed to grow unboundedly. The opt-out is CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1.

For operators running Claude Code through a proxy that assigns internal model IDs: the auto-compaction now fires on those IDs, which may change token usage patterns and billing in long-running sessions.

Managed-settings merge fix

A server-delivered managed settings update was able to disable the env block in a machine-local managed-settings.json or MDM profile. The fix makes server-delivered settings merge per key rather than clobber local env configuration. If your deployment uses both org-delivered settings and machine-local managed settings with custom env variables, verify those env vars survive after upgrading to 2.1.223.

What TheRouter users should audit

• Model list: If users on your gateway-routed Claude Code deployment have been reporting missing models, upgrade to 2.1.223 and verify model IDs registered in your gateway appear in the picker.
• modelOverrides: Audit for any non-Anthropic-model-ID keys; they are now ignored.
• CLAUDE_CODE_DISABLE_1M_CONTEXT: If you rely on this flag for cost control, confirm it now applies to all 1M-window models your gateway serves.
• Headless security posture: The four permission bypass closures in this release indicate active hardening of the permission model. If you run Claude Code in auto/headless mode, upgrade promptly.
• Managed settings env merge: Test that machine-local env vars in managed-settings.json are preserved after a server settings push.