Claude Code 2.1.317: email check, SDK hook block, cost API

Claude Code 2.1.317, released November 3, adds a check that asks before a web or shell tool call sends your account email address to the network, so the address can still leave your machine, but only after you approve it. The release notes on GitHub describe this as a confirmation prompt, not a block, and anyone who runs claude -p inside cloud or self-hosted runner sessions gets a behaviour change in the same release.

Where the email comes from

A reporter in a GitHub issue says Claude Code adds a block reading ”# userEmail The user’s email address is <account email>.” to the model’s system prompt in every session, without consent or disclosure, and with no supported way to stop it. The reporter read the v2.1.220 bundle and found that the value comes from oauthAccount.emailAddress in ~/.claude.json. The only code path that skips it is ANTHROPIC_UNIX_SOCKET, which selects a different transport and is not a privacy control. The same issue says IS_DEMO=1, which is documented as hiding the email from the header and /status, only affects what is shown on screen and never reaches the context builder.

That is the background to a user’s claim in October that Claude had put their address into outbound HTTP requests, including one to the SEC. The “10+ times this month” figure in that post came from Claude’s own answer when the user asked. The new check doesn’t act on that context block. It acts at the moment a web or shell tool call would send the address out.

Changes to the defaults

The Read tool’s “file unchanged since your last Read” stub is gone. Reading a file that hasn’t changed now returns its full content again. Subagents and teammates running on a different model from the main conversation now use that model’s saved effort level, or its default, rather than the session’s effort level.

Searches have changed too. Claude no longer treats partial Grep and Glob results as complete when a search hits its time limit. DISABLE_PROMPT_CACHING_OPUS and DISABLE_PROMPT_CACHING_SONNET now also apply to the [1m], other-region and undated spellings of the default model. Previously they had no effect on those. Pressing Ctrl+C to clear typed text at the prompt no longer stops every running background agent.

For admins on the gateway

The Claude apps gateway admin API gets a cost report at GET /v1/organizations/analytics/cost. It returns past spend over a date range, either in total or broken down per developer, per day or per IdP group (the identity provider’s user groups). The group breakdown depends on a new daily record of each developer’s IdP groups. Gateways with admin: set now keep that record for admin.identity_retention_days. A related fix stops the status line and /usage from showing a developer’s own spend limit as 100% used once their group’s pooled budget runs out.

OTel metrics, events and spans now carry anthropic.plan, anthropic.seat_type, anthropic.provider and anthropic.custom_base_url. Exports stuck behind a proxy that never answers used to hang indefinitely. They now time out after 10 seconds, or after the value of OTEL_EXPORTER_OTLP_TIMEOUT, up to 30 seconds. In Claude Desktop’s Code tab, a notice now says when your organization’s remote managed settings haven’t loaded for the session, and a second notice appears once they do.

Scripts, hooks and runners

Agent SDK hook callbacks accept onFailure: "block". With it set, a callback that fails blocks the action instead of letting it run, which matters to anyone using hooks as a guard. claude -p used to exit 0 when a full disk or quota lost its transcript or ~/.claude.json writes. It now prints an error and exits 1 in text and json output, though full NFS exports may still be missed. Another fix covers claude auth status, which could exit before a slow token refresh was saved and sign you out on the next run.

Inside a cloud or self-hosted runner session, claude -p used to share the session’s ID. It wrote into that session’s transcript, and a restart could resume the wrong conversation. It also generated a title of its own and sent it to the session. Both are fixed, so a nested run is now separate from the session it runs in. Runners also get new connections after a 5xx error other than 501 or 529, and after a heartbeat goes unanswered, instead of reusing the connection that failed.

If a pipeline depends on the old shared behaviour, set CLAUDE_CODE_DISABLE_NESTED_SESSION_ID to 1 on the self-hosted runner, and claude -p will again use the session’s ID and transcript.