🧭 Claude Code v2.1.273: LLM Gateway Hint Headers, Remote Session Forking, and Critical Permission Security Patches

Released late on September 15, Claude Code v2.1.273 is a substantive drop with one brand-new capability for gateway operators, a quality-of-life improvement for Remote Control users, and three security-related permission fixes that close real bypass paths. The headline feature is opt-in request headers that expose session metadata to LLM gateways and proxies — closing a gap that has made gateway-level observability, routing, and cost attribution awkward for teams running Claude behind corporate proxies or custom inference routers.

LLM Gateway Hint Headers

Set the environment variable CLAUDE_CODE_GATEWAY_HINT_HEADERS=1 in your runner or .env to activate five new request headers on every outbound API call:

• x-claude-code-request-class — classifies the request type (e.g. tool_use, interactive, batch)
• x-claude-code-agent-type — identifies whether the request came from a human turn, a subagent, or auto mode
• x-claude-code-prev-tool-durations — JSON array of the previous turn's tool execution times in milliseconds, enabling adaptive timeout policies at the proxy
• x-claude-code-compaction — signals that context compaction occurred before this request, so gateways can route to a fresh cache tier
• x-claude-code-context-compacted — boolean confirming whether context compaction has occurred anywhere in the current session

Session Forking from Remote Control

Sessions started with claude --remote-control (or launched via /remote-control in the Claude app) can now be forked. The fork runs as a background session on your local machine while the original remote session continues uninterrupted. This is especially useful for exploration: fork a session at the exact point you want to diverge, run an experiment in the fork, and the main session remains clean if the experiment goes sideways.

Permission Security Fixes

Three related bugs were patched, each representing a path around permissions.blockReadsOutsideWorkingDirectories:

• Bash commands the permission checker could not fully analyse were silently passing the prompt in auto mode instead of surfacing for approval — now blocked correctly.
• Subshell constructs could hide dangerous rm commands from bypass-mode detection — patched.
• The memory directory was being incorrectly loaded into prompts and indexed, potentially leaking memory contents to the model context — now excluded.

A complementary revert was also included: the previous release had introduced an overly strict check that blocked legitimate eval and env -C Bash patterns; that restriction is rolled back.

Other notable fixes

• Skills synced from claude.ai that are subsequently disabled by an org admin now move to recoverable trash rather than disappearing silently.
• MDM/managed-settings fields allowManagedMcpServersOnly, deniedMcpServers, and disableClaudeAiConnectors were being ignored on some deployments — now applied correctly.
• 401/403 errors on Bedrock, Vertex, Foundry, and Claude app gateways now include clear messaging identifying which credential needs refreshing or pointing to the gateway administrator.
• MCP server disconnection mid-session now fires a notification with a pointer to /mcp when automatic reconnection fails, instead of failing silently.

🧭 Claude Writes the First Complete Computer-Checked Proof of Fermat's Last Theorem — Autonomously, in Lean, Over 11 Days

Anthropic's research team has published a landmark result: Claude worked autonomously for 11 days to produce the first complete, computer-verified formalisation of Fermat's Last Theorem in the Lean proof assistant. Lean's kernel — which mechanically checks every logical inference step — accepted the proof in full. The result closes a 30-year gap between Wiles' 1995 human proof and a machine-checkable version that any formal-methods tool can independently verify.

What was actually accomplished

Fermat's Last Theorem states that there are no positive integers a, b, c satisfying aⁿ + bⁿ = cⁿ for any integer n > 2. Andrew Wiles' 1995 proof spans roughly 200 pages of advanced mathematics, drawing on modular forms, elliptic curves, and Galois representations. Formalising it in Lean required translating every definition, lemma, and inference — including many steps that Wiles left implicit — into a language strict enough that a proof kernel accepts it. Human formalisers had been working on a partial formalisation for years; significant sections of the required mathematical infrastructure were missing from Lean's Mathlib library entirely.

Claude's 11-day autonomous run did not discover a new proof of Fermat's Last Theorem. What it did — filling those library gaps, constructing all intermediate lemmas, and assembling the complete proof file — is arguably the harder engineering challenge.

Why this matters for developers

• Long-horizon autonomous reasoning at research depth: 11 continuous days of self-directed mathematical work, touching the deepest formal mathematics yet handled by an AI model, is the longest validated autonomous reasoning run on a formally precise task published to date.
• Mathlib gap-filling: To complete the proof, Claude had to extend Lean's Mathlib library with new definitions and lemmas in modular forms and Galois cohomology — areas where no Lean formalisation previously existed. These extensions are being contributed back to Mathlib.
• Directly applicable to software verification: The same formal reasoning capability applies to verifying software correctness proofs in Lean, Coq, and Isabelle. Teams working on formally-verified systems software — operating system kernels, cryptographic primitives, safety-critical controllers — can now consider Claude a capable collaborator for tasks that previously required specialist human formalisers.

🧭 Anthropic Python SDK v1.6.0: Managed Agent Permissions, Signed Compaction Blocks, and Async Credential Providers

Released September 15 alongside Claude Code v2.1.273, the Anthropic Python SDK v1.6.0 ships a set of additions that collectively improve how developers wire managed agents, handle long-context sessions, and authenticate in serverless and credential-delegation environments. The release requires anyio 4.1+ — check your environment before upgrading if you pin transitive dependencies.

What's new

• Auto-mode tool permissions for Managed Agents: When creating or updating a Managed Agent via the API, you can now pass a tool_permissions block that specifies which tools the agent is allowed to invoke in auto mode. Previously this required a post-creation policy update; it can now be declared at creation time, simplifying infrastructure-as-code deployments.
• Compaction parameter + signed compaction blocks (beta): A new compaction parameter in the Messages API lets you opt into context compaction for a specific request. Responses include a signed compaction_block that can be passed back on future turns to prove the compaction was server-authorised — a foundation for audit trails in compliance-sensitive pipelines.
• URL sources for the web fetch tool: The web_fetch tool now accepts a url_sources list in addition to a single URL, allowing a single tool call to fetch and aggregate content from multiple URLs. Reduces round-trips in research-agent pipelines.
• Async credential token providers: AnthropicAsync now accepts an async-based callable for the api_key argument — useful for serverless environments that rotate credentials via async secrets managers (AWS Secrets Manager, GCP Secret Manager, Azure Key Vault) without blocking the event loop.
• Workspace ID on user profiles: The user_profiles endpoint now accepts a workspace_id parameter, enabling per-workspace profile customisation in multi-tenant Claude Co-Work or API deployments.
• Geo enum types for data-residency fields: Data-residency geography fields previously accepted free-form strings. They now accept typed Geo enum values (Geo.US, Geo.EU, Geo.APAC), reducing the risk of typos silently routing requests to the wrong region.