Claude Code 2.1.273: auto-compact gets recalibrated, another Bash permission gap closed

Claude Code 2.1.273, released September 15, 2026, is a big one: another Bash permission gap in bypass mode, a counting bug that triggered auto-compact way too early, and a new way to fork a Remote Control session into a background one on your machine. Everything else sits in some sixty entries: reliability fixes, clearer error messages, and small interface improvements. Here is what actually matters.

Another Bash permission gap, in bypass mode

2.1.273 closes two distinct blind spots in the Bash permission checker. On one side, commands it can't fully analyze kept skipping the confirmation prompt expected under permissions.blockReadsOutsideWorkingDirectories. On the other, a subshell could hide a dangerous rm and let it slip through unnoticed, this time in bypass mode.

The permissions doc is blunt about what this mode already assumes: "In bypassPermissions mode, Claude Code skips permission prompts, including for writes to protected paths such as .git and .claude... Only use this mode in isolated environments like containers or VMs where Claude Code can't cause damage." Bypass mode assumes you're in a disposable sandbox. A subshell able to hide an rm inside it, with no rule catching it, worked directly against that: the only protection left in bypass mode is a literal reading of the command, and that's exactly what the subshell got around.

The same doc spells out what blockReadsOutsideWorkingDirectories actually covers: "Claude Code recognizes a built-in set of Bash commands as read-only and runs them without a permission prompt in every mode, except for a path that permissions.blockReadsOutsideWorkingDirectories fences." If you rely on that setting to fence reads outside your working directory, this release closes a whole class of commands that could slip under it.

The context meter was double-counting, so auto-compact fired twice too early

The context meter and auto-compact were counting turns that call the advisor tool at roughly double their real size. In practice: any session with an advisor configured saw its meter climb faster than reality whenever Claude consulted it at a key moment, and auto-compact fired at about half the real context window, not when it was actually full.

The miscount isn't surprising given what the advisor does: the doc states that "the advisor receives the full conversation, including every tool call and result, and returns guidance that Claude applies before continuing." A turn that re-reads the whole conversation to give an opinion can reasonably look expensive to the meter, but double the real cost was too much.

The catch is that triggering auto-compact isn't free: "/compact replaces the conversation with a structured summary," and "the automatic pass works the same way as the /compact step," with the loss of continuity that implies. If you call the advisor regularly, especially on long tasks, this release hands back the half of your context window you were losing without knowing it.

Forking a Remote Control session into a background one

A separate addition: you can now fork a session started with claude --remote-control or via /remote-control from the Claude app, and the fork runs as a background session on your machine. The docs describe the existing /fork command as "Copy the current conversation into a new background session and keep working here." Claude Code also instructs the copy to create a worktree of its own before making code changes, except when it edits in place. The Remote Control doc recalls what this kind of session already does: "When you start a Remote Control session on your machine, Claude keeps running locally the entire time, so your code execution and filesystem access stay on your machine."

Combining the two means you can start from a Remote Control session, the one you're steering from your phone or a browser, and split off a copy that keeps running locally, in the background, without blocking either the original session or the remote device steering it. Useful if you want to explore a different approach without disturbing the main conversation you're following remotely.

Everything else, briefly

• A notification now appears when an MCP server disconnects mid-session and automatic reconnection gives up, pointing at /mcp.
• 401/403 errors on Bedrock, Vertex, Foundry, and the Claude apps gateway now name the credential to refresh, or point to your gateway administrator, instead of just telling you to run /login.
• /login, /upgrade, and /extra-usage no longer discard earlier thinking from the conversation, which used to force a full prompt-cache rewrite on the next request.
• On macOS, Read refused a dragged-in screenshot, or any file the system reports under a second path, with a symlink-resolution error. That's fixed.
• Sub-agents and background agents are no longer reported as failed, with their result never delivered, when the final streamed reply carried no token usage or no model id.
• blockReadsOutsideWorkingDirectories no longer lets a memory directory chosen by a repository's settings load into the prompt, get recalled, or get indexed.
• New request headers (x-claude-code-request-class and others) are available for LLM gateways, opt in with CLAUDE_CODE_GATEWAY_HINT_HEADERS=1.
• A 2.1.268 change is reverted: Read and Edit deny rules are no longer checked on Bash lines the permission checker can't analyze (eval, env -C). A command like time -p make build prompts again instead of being denied.
• Auto mode on Bedrock, Vertex, and Foundry falls back to the local classifier by default; set CLAUDE_CODE_AUTO_MODE_SERVER=1 to use the platform's server-side classifier.
• VS Code, Claude Code on the web, Claude Tag, and Code Review pick up about twenty fixes between them, mostly clearer error messages and display bugs.

What actually matters here

If you use the advisor on long tasks, the context-meter fix is the most concrete change in this release: your real context window goes back to being what it's supposed to be, not half of it. The Bash permission gap closes one more case in a list that keeps growing release after release, for anyone relying on bypass mode or blockReadsOutsideWorkingDirectories. The Remote Control session fork, on the other hand, changes nothing about your current usage: it's one more option if you already steer Claude Code from your phone.