Claude Code tags gateway requests by class and agent

Claude Code has been counting advisor-tool turns at roughly twice their real size, which made auto-compact fire at about half the real context window. That is fixed in v2.1.273, whose headline addition, according to the release notes on Github, is a set of five request headers for LLM gateways.

At a glance

• The five headers carry the request class, the agent type, how long previous tool calls took, and whether the session is compacting or has just been compacted; they ship off by default.
• A session started with claude --remote-control, or with /remote-control, can be forked from the Claude app, and the fork then runs as a background session on your own computer.
• The release also reverts a 2.1.268 change that checked Read and Edit deny rules on Bash lines the permission checker cannot analyze, so commands like time -p make build prompt again instead of being denied.

If you have not followed the gateway thread: the Claude apps gateway is a self-hosted service between your Claude Code clients and the upstream provider, and according to Amazon Web Services it ships inside the same claude binary you already run. Google Cloud says it was built to close enterprise friction: per-developer credentials, settings pushed by MDM, no usage attribution, no spend caps. The previous release, v2.1.271, added a chargeback pricing multiplier of up to 10, per Gradually AI.

Five headers tell the gateway what kind of request it is

The new headers are x-claude-code-request-class, x-claude-code-agent-type, x-claude-code-prev-tool-durations, x-claude-code-compaction and x-claude-code-context-compacted. They ride along with the request to an LLM gateway, and you turn them on with CLAUDE_CODE_GATEWAY_HINT_HEADERS=1.

Think of a mailroom forwarding every parcel from one building: with no label on the box, the sorter cannot tell an interactive keystroke from a background sub-agent chewing through a repository. The headers are the label. Two other gateway-side changes land with them. OTEL_LOG_TOOL_DETAILS=1 now puts real agent, skill, plugin and MCP server names on cost and token metrics, and 401/403 errors on Bedrock, Vertex and Foundry, plus 403s from the Claude apps gateway, stop telling you to run /login and instead name the credential to refresh or point you at your gateway administrator.

A subshell could hide an rm in bypass mode

In bypass mode, a dangerous rm tucked inside a subshell got past the permission checker. So did Bash commands the checker cannot fully analyze under permissions.blockReadsOutsideWorkingDirectories, which skipped the prompt instead of raising it. The same setting now keeps a memory directory chosen by a repository's own settings out of the prompt, out of recall and indexing, and away from memory extraction.

On the managed side, allowManagedMcpServersOnly, deniedMcpServers and disableClaudeAiConnectors set through MDM or managed-settings.json were ignored whenever server-managed settings were also present. Skills synced from claude.ai stayed usable after an organization switched Skills off; they move to the recoverable trash instead. And the 2.1.268 deny-rule check on Bash lines the checker cannot read, such as eval and env -C, is gone.

Sub-agents were reported as failed when the model id was missing

If a sub-agent or background agent finished with a streamed reply that carried no token usage or no model id, Claude Code called it failed and never delivered the result. SDK and --output-format stream-json output had a sibling bug: a sub-agent moved to the background mid-run, say by CLAUDE_AUTO_BACKGROUND_TASKS, lost its remaining messages and final report. Separately, when an MCP server drops mid-session and automatic reconnection gives up, a notification now says so and points at /mcp.

Three smaller fixes sit beside the context-meter one. /login, /upgrade and /extra-usage discarded earlier thinking from the conversation and forced a full prompt-cache rewrite on the next request; hook progress and sub-agent activity stop re-processing the whole conversation on every update, which helps long sessions; and /tui refused to restart because of an agent-team teammate that had already finished.

Slack scheduled tasks in shared private channels never posted

Claude Tag got a batch. Scheduled tasks created in an organization-shared private Slack channel ran silently and posted nothing; they now keep running in the thread where they were created. Replying in an older thread while Claude was mid-task sometimes restarted it from scratch and lost work it had not pushed. AWS connections refused region-less endpoints such as Budgets, Savings Plans, WAF Classic and Import/Export, and Global Accelerator requests now sign correctly. Claude also starts watching related public channels on its own, such as an incident channel a conversation depends on.

Code Review picked up two worth noting: /ultrareview --post posts its findings comment exactly once after a retry following a GitHub error, and names the reviewed commit; and empty or content-identical pushes are skipped on repositories whose owner or name contains a capital letter.

What the notes do not spell out is what a gateway should do with the hints once it has them: the headers describe the request, and any routing, quota or dashboard built on them is left to whoever runs the gateway. Oddly, they ship off by default, so the per-class view of your traffic appears only after someone sets CLAUDE_CODE_GATEWAY_HINT_HEADERS=1.

When the server-side classifier returns

Auto mode on Bedrock, Vertex and Foundry falls back to the local classifier by default, and the wording is "for now" with no date attached; CLAUDE_CODE_AUTO_MODE_SERVER=1 is how you get the platform's server-side classifier today. The open question on the headers is the other end of the wire: they pay off only once gateway software reads them, and this release says nothing about which products do.