Which permission settings does Claude Code 2.1.273 change?

Claude Code 2.1.273 fixes `permissions.blockReadsOutsideWorkingDirectories`, which had let Bash commands the checker cannot fully analyze skip the prompt, and which now also keeps a repository-chosen memory directory out of the prompt and out of memory extraction. Bypass mode is fixed so a subshell cannot hide a dangerous `rm`.

Does Claude Code 2.1.273 change anything for Bedrock or Vertex users?

Yes. Claude Code 2.1.273 switches auto mode on Bedrock, Vertex and Foundry to the local classifier by default; setting `CLAUDE_CODE_AUTO_MODE_SERVER=1` restores the platform's server-side classifier. The release also rewrites 401 and 403 errors on those platforms so the message names the credential to refresh instead of telling everyone to run `/login`.

Why were long Claude Code sessions compacting so early before this release?

The context meter in Claude Code counted advisor-tool turns at roughly twice their real context size. Auto-compact reads that meter, so it fired at about half the real context window and sessions were compacted earlier than necessary. Version 2.1.273 corrects the counting, so the meter and auto-compact both track actual usage.

What are the new gateway request headers in Claude Code 2.1.273 for?

Claude Code 2.1.273 adds five request headers — `x-claude-code-request-class`, `x-claude-code-agent-type`, `x-claude-code-prev-tool-durations`, `x-claude-code-compaction` and `x-claude-code-context-compacted` — so an LLM gateway can see what kind of request it is routing. They are off by default and are enabled with `CLAUDE_CODE_GATEWAY_HINT_HEADERS=1`.

Anthropic · 2026-09-15 · major

Claude Code 2.1.273 — a subshell could hide a dangerous rm in bypass mode

Claude Code 2.1.273 fixes two permission-checker gaps: Bash commands the checker cannot fully analyze skipped the prompt under blockReadsOutsideWorkingDirectories, and a subshell could hide a dangerous rm in bypass mode.

Claude Code 2.1.273 closes two permission-checker gaps and stops the context meter double-counting advisor-tool turns.

Quick facts

Version	v2.1.273
Maker	Anthropic
Released	2026-09-15
Permission fixes	Unanalyzable Bash lines and bypass-mode subshells
New gateway flag	CLAUDE_CODE_GATEWAY_HINT_HEADERS=1
Auto mode on Bedrock/Vertex/Foundry	Local classifier by default
Session forking	Remote-control sessions fork to a background session

What is it?

Two permission bugs are fixed in Claude Code 2.1.273. Bash commands that the permission checker cannot fully analyze no longer skip the prompt when `permissions.blockReadsOutsideWorkingDirectories` is set, and a subshell can no longer hide a dangerous `rm` while bypass mode is on. The same setting now also keeps a memory directory chosen by a repository's settings out of the prompt, recall, indexing and memory extraction.

How does it work?

The permission checker reads each Bash line before Claude Code runs it. When a line is too dynamic to analyze, the checker used to fall through instead of asking, which is the gap this release closes. Version 2.1.273 also reverts a 2.1.268 change that had erred the other way — it denied Bash lines containing `eval` or `env -C` outright, so ordinary commands like `time -p make build` now prompt again instead of being blocked.

Why does it matter?

Teams running in bypass mode, or with `blockReadsOutsideWorkingDirectories` set, were relying on a guard with a hole in it. A second fix in this release is about cost rather than safety: the context meter counted advisor-tool turns at roughly twice their real size, so auto-compact fired at about half the real window and long sessions compacted far earlier than they needed to.

Who is it for?

Claude Code users and platform admins

Frequently asked questions

Which permission settings does Claude Code 2.1.273 change?: Claude Code 2.1.273 fixes `permissions.blockReadsOutsideWorkingDirectories`, which had let Bash commands the checker cannot fully analyze skip the prompt, and which now also keeps a repository-chosen memory directory out of the prompt and out of memory extraction. Bypass mode is fixed so a subshell cannot hide a dangerous `rm`.
Does Claude Code 2.1.273 change anything for Bedrock or Vertex users?: Yes. Claude Code 2.1.273 switches auto mode on Bedrock, Vertex and Foundry to the local classifier by default; setting `CLAUDE_CODE_AUTO_MODE_SERVER=1` restores the platform's server-side classifier. The release also rewrites 401 and 403 errors on those platforms so the message names the credential to refresh instead of telling everyone to run `/login`.
Why were long Claude Code sessions compacting so early before this release?: The context meter in Claude Code counted advisor-tool turns at roughly twice their real context size. Auto-compact reads that meter, so it fired at about half the real context window and sessions were compacted earlier than necessary. Version 2.1.273 corrects the counting, so the meter and auto-compact both track actual usage.
What are the new gateway request headers in Claude Code 2.1.273 for?: Claude Code 2.1.273 adds five request headers — `x-claude-code-request-class`, `x-claude-code-agent-type`, `x-claude-code-prev-tool-durations`, `x-claude-code-compaction` and `x-claude-code-context-compacted` — so an LLM gateway can see what kind of request it is routing. They are off by default and are enabled with `CLAUDE_CODE_GATEWAY_HINT_HEADERS=1`.