Claude Code v2.1.317: Email Check, Gateway Costs, CI Fixes

Claude Code v2.1.317 has 87 changelog entries: 62 fixes, 10 additions, 8 improvements, 6 changes, and 1 removal. The headline additions are a check before a web or shell tool call sends your account email address to the network, onFailure: "block" for Agent SDK hook callbacks, a cost report for Claude apps gateways, and four new OpenTelemetry attributes. The fixes are spread widely, with clusters around headless claude -p runs and self-hosted runners, OpenTelemetry exports behind proxies, agent teams, and the VS Code extension. A few entries change existing behavior, including the effort level subagents use and what the Read tool returns for an unchanged file, so read the Changed Behavior section before you update.

What’s New

A check before your account email goes out. Claude Code now asks before a web or shell tool call sends your account email address to the network.

onFailure: "block" for Agent SDK hook callbacks. With this option set, an Agent SDK hook callback that fails blocks the action instead of letting it run, so a callback you rely on as a guard fails closed. Command and HTTP hooks have accepted onFailure: "block" since v2.1.295; this release extends it to SDK callbacks.

New notices and warnings.

Auto mode now shows a notice when its check has no answer for a subagent’s tool call. Before, nothing appeared in the main view.
Claude Desktop’s Code tab shows a notice when your organization’s remote managed settings haven’t loaded for the session, and another once they do.
/schedule warns when a new cloud scheduled task gets connectors you did not ask for, and tells you how to remove them.
Cloud sessions show a link card when an MCP server asks you to visit a link, so you can open or decline it instead of the request going unseen.

Changed Behavior Worth Noting

Subagents and teammates on another model use that model’s effort. A subagent or agent team teammate running on a different model from the main conversation now uses that model’s saved effort level, or the model’s default, instead of the session’s effort level. Raising effort for the session no longer carries over to work delegated to another model. Our effort levels guide covers the other places effort is set.
SendMessage reaches a busy background agent sooner. A message sent with SendMessage to a running background agent now arrives earlier: the agent’s running command moves to the background without being stopped.
Exit no longer prompts for plugin monitors. Plugin monitors no longer trigger the “Background work is running” prompt when you exit.
The Read tool’s unchanged-file stub is removed. Reading a file again when it has not changed now returns its content, where Read used to return a “file unchanged since your last Read” stub.
plugin-authoring offers to help share your mod. After a mod you built works, the built-in plugin-authoring skill now offers, once, to help share it.
claude -p exit status and session IDs. Two fixes in the next section change what scripts see: in text and json output, claude -p now exits 1 when writes were lost, and a claude -p run inside a cloud or self-hosted runner session no longer shares that session’s ID.

Headless Runs and Self-Hosted Runners

Lost writes now fail the run. claude -p used to exit 0 when a full disk or quota lost its transcript or ~/.claude.json writes. It now prints an error and, in text and json output, exits 1. The changelog notes that full NFS exports may still be missed.

Nested runs no longer share the session’s ID. A claude -p run inside a cloud or self-hosted runner session shared that session’s ID: it wrote into the session’s transcript, and a restart could resume the wrong conversation. It also generated a title of its own and sent it to the session. Both are fixed. If a self-hosted runner setup depends on the old behavior, set CLAUDE_CODE_DISABLE_NESTED_SESSION_ID=1 on the runner, and claude -p run inside a session uses that session’s ID and transcript, as in earlier versions.

Other fixes for unattended runs:

Headless sessions with many plugins that register commands no longer suffer high memory use and slow startup.
Self-hosted runner sessions restarted while a plan waited for approval no longer lose recent turns or the whole conversation.
When a session moves to a new runner and the turn is older than CLAUDE_CODE_RESUME_INTERRUPTED_TURN_MAX_AGE_MS, Claude now sees the interrupted tool call.
An MCP server you switched off no longer comes back on after the session moves to a new machine, in the case where the session service had refused to save the switch.
Three improvements change how runners and their sessions recover from failed connections. After a 5xx other than 501 or 529, a runner’s next poll and the session itself open new connections instead of reusing the one that failed. After a heartbeat gets no answer, a session opens new connections instead of trying each idle one in turn.

Claude Apps Gateway

A cost report in the admin API. GET /v1/organizations/analytics/cost reads past spend over a date range, in total, per developer, per day, or per IdP group.
A daily record of IdP groups. Gateways with admin: set now keep a daily record of each developer’s IdP groups for admin.identity_retention_days, and the cost report groups by that record.
Pooled budgets. The status line and /usage no longer show a developer’s own spend limit as 100% used after their group’s pooled budget runs out.
Bedrock’s “Input is too long.” The gateway no longer hides this Amazon Bedrock error. Hiding it left sessions failing every turn with “upstream rejected the request” instead of compacting.
Clearer startup errors. When a required gateway can’t be reached, the startup error now points to the network instead of a sign-in, and says when the gateway’s TLS certificate can’t be verified.

OpenTelemetry

Four new attributes. anthropic.plan, anthropic.seat_type, anthropic.provider, and anthropic.custom_base_url are now added to OTel metrics, events, and spans.
Exports to an https:// endpoint through a proxy are now sent even when they start while another export is still in progress. Before, they were never sent.
A proxy that blocks (HTTP 403) exports to an http:// endpoint no longer receives a flood of connection attempts.
Exports behind a proxy that never answers no longer hang indefinitely. They now time out after 10 seconds, or after OTEL_EXPORTER_OTLP_TIMEOUT, up to 30 seconds.

More Fixes and Improvements

Sessions and compaction

Sessions whose very large CLAUDE.md changed since it was last sent no longer hit “Prompt is too long” after automatic compaction.
Very long conversations no longer lose their earlier summary when compaction has to shorten its own request.
Resumed sessions no longer tell Claude again about a file change it already knew about.
In a resumed session, Claude no longer sometimes avoids a built-in tool after an earlier call failed because the tool was switched off.
The “Resume this session with” hint shown at exit now repeats the flags you launched with, such as --chrome --debug, ahead of --resume.
claude --from-pr no longer reports “No conversations found” in projects with many sessions when the linked session is older than the first page.
In cloud and SDK sessions, a session title is no longer lost when a new message or Stop arrives while the title is generating.
Old transcripts are now cleaned up on machines where some runs skip cleanup, such as runs that use --setting-sources.

Files, search, and settings

Claude no longer treats partial Grep and Glob results as complete when a search hits its time limit.
A PDF’s own metadata can no longer make Read and @-mentions under-count its pages.
Edits to settings files made in the first second or so after launch now take effect, instead of waiting until a settings file changes again.
A project’s effortLevel setting now applies to sessions that an app starts ahead of time and then opens in the project, such as new sessions in the desktop app’s Code tab.
DISABLE_PROMPT_CACHING_OPUS and DISABLE_PROMPT_CACHING_SONNET now take effect on [1m], other-region, and undated spellings of the default model.

Agent teams, background work, and permissions

Deleted agent team inboxes are no longer re-created by a teammate’s late message, and a re-created teammate is no longer removed from its team by an earlier shutdown approval.
Teammates in tmux or iTerm2 panes no longer start in auto mode when the lead session is in manual mode.
A background session no longer sometimes loses a permission mode change you just made when it is upgraded or retired.
Pressing Ctrl+C to clear typed text at the prompt no longer stops all running background agents.
Child processes of a stopped shell command are no longer sometimes sent SIGTERM twice, which could make some programs skip their cleanup.
Auto mode no longer fails every turn when an LLM gateway set as the base URL answers its server-side safety check with 403 or 422. The behavior for a 403 with an apiKeyHelper is unchanged.
In cloud sessions, auto mode no longer stops for approval when the Artifact tool uploads, writes to a database, or saves a file through the outputs folder.
On claude.ai and the mobile apps, the second of two simultaneous permission prompts now shows its file path or command.
Remote Control and SDK hosts no longer offer “don’t ask again” on a mod’s tool calls.
In screen reader mode, a running subagent’s elapsed time and token count are no longer spoken on every change.

A region or network block (HTTP 403) is no longer shown as a sign-in failure; the error now explains the block.
claude auth status no longer exits before a slow token refresh is saved, which could sign you out on the next run.
API requests no longer fail with “unable to get local issuer certificate” behind some TLS-inspecting proxies after a root certificate renewal.
On Microsoft Foundry, the error shown when Azure credentials can’t be loaded now says to check or refresh them, and reports as cloud_credential_error.
When a stdio MCP server’s env config sets AWS_BEARER_TOKEN_BEDROCK to empty, the variable is now unset instead of passed empty, so the server can use the machine’s own AWS credentials.

MCP, skills, and commands

Project and local MCP servers no longer disconnect after the first turn in some Claude Desktop sessions.
In cloud sessions, Claude no longer says a working claude.ai connector needs authorization or has failed when a synced plugin includes the same server.
Skills synced from claude.ai are no longer lost, or downloaded again every ten minutes, when they can’t be written to disk.
/team-onboarding: asked to delete a guide without being told which, Claude no longer deletes your most recently updated one, and it no longer says a guide was deleted when the server refused the delete.
/artifacts and the Artifact tool’s shared list now show shared artifacts when you have 200 or more of your own.
/remote-control now says that Remote Control is turned off by the disableRemoteControl setting, instead of answering “Unknown command”.
/design-sync now says up front when your design system has moved to Claude, and stops before building instead of failing at upload.
/feedback no longer shows “Enter to confirm” while a report is being sent.

Scheduled tasks

/schedule now includes a cloud scheduled task’s next run time and link in its results after creating or updating it.
Stored scheduled tasks can be listed and deleted again after scheduled tasks are turned off.
Self-paced /loop wakeups are no longer sometimes left unscheduled when Claude leaves a field out of its request.
In cloud sessions, the form for a new scheduled task now starts on the default environment an admin chose for your organization, instead of the Anthropic-hosted default.

Windows

Every tool call was refused on some volumes where the native path lookup fails. The working-directory check now compares the folder’s identity instead.
In sessions not started by Claude Desktop, the session scratchpad and other temporary paths no longer grow with your project’s path length, which had made repositories cloned into them hit the 260-character path limit.

VS Code

Forked conversations no longer drop messages. Only one of the tool calls Claude ran in parallel was kept, and the last messages a compaction kept were lost, which could leave Claude’s answer without the question it answered.
A message was lost when Claude did not finish starting in time; the extension now starts Claude once more before showing the error.
The sign-in screen no longer opens when a request is blocked for its region or network.
File links in a Claude tab now open in another editor group instead of on top of the chat.
Attachment chips, menus, banners, and dialogs in the Claude panel no longer stay small when chat.fontSize is raised.
ultrathink now raises effort for its turn and shows its rainbow when telemetry is off.
The Account panel no longer shows the plan name with a lower-cased second word.

Cloud Sessions, Remote Control, and Claude Tag

Cloud sessions: adding a network secret for a host that already has one no longer silently replaces it; the Add secret form refuses and points you to the existing secret. The organization environment dialog in admin settings now uses the personal dialogs’ short layout: each section opens from a row, and unsaved input asks before closing.
Remote Control: after you restart claude remote-control, the next message to an idle session no longer goes unanswered when you send it within a minute of your previous message. When the app doesn’t name a fork, a long name keeps its “(fork)” ending, and in sessions started with claude remote-control, a fork of “Name (fork)” is named “Name (fork 2)”.
Claude Tag: newly pasted artifact links in Slack show a simpler card with an Open button that opens the artifact in Claude, instead of Slack’s side panel.

For the exact wording of all 87 entries, see the official changelog.

How to Update

Check your installed version: claude --version
Update in place: claude update
On a self-hosted runner where claude -p inside a session should keep using that session’s ID and transcript, set CLAUDE_CODE_DISABLE_NESTED_SESSION_ID=1.