Claude Code got two new versions in short order — 2.1.222 and 2.1.223. Neither is a fireworks show of features; both are solid maintenance. And this time that’s a compliment, because almost everything here is about security and permissions.
2.1.222: The sandbox tightens up
The most important fix concerns worktree isolation. Until now, isolated sessions and their subagents could, under certain conditions, fire destructive git commands against the main checkout. Isolation now applies to file edits and Bash in every session type — not just some.
On top of that: PreToolUse auto-allow hooks no longer bypass tool restrictions in background agents. And messages sent to other agent sessions via SendMessage now run through the permission classifier before dispatch. A small bit of housekeeping on the side: the “ultraplan” feature is gone.
2.1.223: Permission gaps closed, /teleport added
The newer version picks up where 222 left off. Two permission gaps are closed: a cleverly crafted Bash command could previously hide parts of itself from the permission checks. And commands padded with tabs or invisible Unicode characters could hide parts of themselves in the approval dialog. Both are sealed now. Workflow scripts also can no longer use dynamic import() to break out of their sandbox.
The nicest new detail, though, is /teleport. In cloud sessions, Claude Code now shows you directly how to continue locally — with claude --teleport <session id>. Handy when you kicked off a task in the cloud and want to finish it on your own machine.
And for anyone who uses the review command: /review is now an alias of /code-review. Without a level specified, the command reuses the one you typed last — so you don’t have to tack on high or ultra every single time.
My take
Two point releases back to back, and nearly every entry is about permissions, sandbox boundaries, or isolation. That’s no accident. The more autonomously Claude Code works — with background agents, subagents, and cloud sessions — the more it matters that the guardrails hold.
I read these two releases as a clear signal: Anthropic takes the attack surface that comes with agentic work seriously. A command sneaking past approval with invisible characters sounds like small stuff — but it’s exactly the kind of gap you don’t want left open. That /teleport arrives at the same time shows the other side: security and convenience don’t have to be at odds.
Sources: