Claude Code v2.1.223 adds two governance controls that teams deploying agents to production have been waiting for: organization wildcards to manage skill marketplaces and alerts when a subagent requests a restricted model and receives the parent model instead.

As we covered yesterday with v2.1.222, Claude Code is rapidly closing the operational gaps that separated it from team use. Owner wildcards ("owner/*") in managed settings strictKnownMarketplaces and blockedMarketplaces let you approve or block all marketplace repositories from a GitHub organization with a single rule. Until now you had to list repos one by one, or open everything.

The second change concerns transparency in resumed flows. When a workflow agent, forked skill, slash command, or resumed background agent requests a subagent model that your organization has restricted, the system was running the parent model without telling you. Now a warning appears. It sounds like a detail, but in a team managing costs and permissions per model, not knowing which model executed a task is an audit problem.

The release also closes six security bugs, including a Bash permission bypass where a carefully constructed command could hide part of itself from controls, and a bug that let workflow scripts use dynamic import() to execute code outside the sandbox.

In detail

The skill marketplace is the mechanism Claude Code uses to distribute capability packages: a skill can add a command, a procedure, an entire workflow. For a team running Claude Code in production, deciding which skills are allowed is a matter of security and consistency. A malicious or broken skill can expose data, execute arbitrary commands, or break a consolidated flow.

Before v2.1.223, managed settings strictKnownMarketplaces and blockedMarketplaces required explicit repository lists. If your organization publishes ten skill repos to the GitHub marketplace, the administrator had to write ten entries. The wildcard "owner/*" condenses this to one line: you approve or block the entire organization, and new repos that org publishes afterward automatically follow the same rule.

It’s a trade-off between granularity and maintainability. If you trust an internal organization, the wildcard solves the problem of updating configuration with every new repo. If you need to block a specific repo while keeping others, the granular per-repo rule remains available.

The subagent model warning addresses a different but equally concrete problem. Claude Code can delegate parts of a task to a subagent running on a different model than the main one. If your organization has restricted use of a model for cost or compliance, and a resumed flow or forked skill requests it, the system would fall back to the parent model without reporting it. In production, an audit report saying “executed on Opus 5” could be false: the subagent ran on the model the parent was using.

The warning doesn’t block execution, it makes it visible. For those managing agents in teams, the difference between “silent” and “reported” is the difference between possible audit and impossible audit.

The security fixes deserve attention. The Bash permission bypass let a command built with specific characters hide parts of itself from approval controls. The fix for tabs and invisible Unicode characters closes the same vector: a command with invisible padding could trick the approval dialog into showing only part of the actual instruction. The dynamic import() in workflow scripts bypassed the sandbox by allowing code to load arbitrary modules. These are three vectors security folks recognize: payload obfuscation, invisible characters, sandbox escape. All closed in one release.

The /teleport command shows in cloud session how to continue locally with claude --teleport <session id>. It’s a continuity feature: those working in a cloud session can take their work to their own environment without starting over. The change to /review, now an alias for /code-review, simplifies code review in the terminal. The context window fix with CLAUDE_CODE_DISABLE_1M_CONTEXT now keeps every Claude model with a native 1M token window within 200K via auto-compaction, with a warning when compaction can’t fit the session.