Claude Code 2.1.273 stops loading a repo-chosen memory directory into the prompt under read blocking.

The September 15 release fixes a real hole for anyone running agents on untrusted repos: under permissions.blockReadsOutsideWorkingDirectories, a memory directory chosen by a repository's own settings is no longer loaded, recalled, indexed, or used by memory extraction. Same release fixes a subshell hiding a dangerous rm in bypass mode, and adds opt-in x-claude-code-* gateway hint headers exposing request class, agent type and compaction state behind CLAUDE_CODE_GATEWAY_HINT_HEADERS=1. That last one is the first time the CLI tells a proxy whether a call is a subagent turn or a compaction pass, which is enough to route or bill by agent type without parsing prompts.