The checker’s blind spot
Claude Code’s permission checker missed an rm inside a subshell; 2.1.273 closes it and reopens what 2.1.268 refused
The note does not say which rm counts as dangerous, and the release before it says only “bug fixes”.
Anthropic’s v2.1.273 release notes, published 15 September, name two holes in the Bash permission checker.
One is “a subshell hiding a dangerous rm in bypass mode”. The other is commands the checker “cannot fully analyze” skipping the prompt under permissions.blockReadsOutsideWorkingDirectories. The note does not say which rm counts as dangerous or what the subshell looked like, and v2.1.272, a day earlier, says only “Bug fixes and reliability improvements”.
The same release reverts a 2.1.268 change that ran Read and Edit deny rules on lines the checker cannot parse, eval and env -C among them, so that, in the note’s example, time -p make build prompts again instead of being denied. Five request headers for LLM gateways, x-claude-code-request-class among them, arrive behind CLAUDE_CODE_GATEWAY_HINT_HEADERS=1 and stay off unless it is set.
The two fixes pull in opposite directions on purpose: one makes the checker stricter about what it had missed, the other makes it stop refusing what it could not read.
What it changes Upgrade. If you run with permissions bypassed, this is the release that matters. If you run behind a gateway, the headers are opt-in and nothing changes until you set the variable.
Primary source read
anthropics/claude-code v2.1.273 anthropics/claude-code v2.1.272