Claude Code 2.1.317 checks before a tool call leaks your email
The daily-driver build hardens unattended agents: a /schedule connector alert, SDK hooks that can hard-block, an org spend API, plus Qwen Code 0.26.6.
Copy markdown
A guard against your agent leaking your email
2.1.317 now asks before a web or shell tool call sends your account email address out to the network. It's a concrete defense: a prompt-injected or trojanized tool can no longer quietly exfiltrate who you are. On by default in the new build.
/schedule flags connectors you didn't ask for
Spin up a cloud scheduled task and Claude Code now warns when it picks up connectors you never requested, and tells you how to strip them. Scheduled runs execute unattended, so a surprise connector is a silent capability grant you'd want to catch.
Agent SDK hooks can finally hard-block
New onFailure: "block" for Agent SDK hook callbacks: if your callback throws, the action it was gating is blocked instead of running anyway. If you've built guardrail hooks, this closes the fail-open gap where a crashing check let the tool call through.
Cloud auto mode stops nagging on Artifact writes
Auto mode in cloud sessions no longer halts for approval when the Artifact tool uploads, writes a database, or saves through the outputs folder, so headless runs stop stalling. The same build fixes claude -p inside a cloud or self-hosted session hijacking that session's ID and transcript.
A spend API for the Claude apps gateway
Admins get GET /v1/organizations/analytics/cost to pull past spend over any date range: total, per developer, per day, or per IdP group. If you run a team gateway, you can script a cost dashboard now instead of eyeballing usage.
Qwen Code 0.26.6 adds live per-model metrics
Same-day from Alibaba's CLI: the Web Shell token panel now plots request success rate, output speed, and first-token latency per model, and prompt.submit hooks run in headless -p runs so you can inspect or rewrite prompts before they're sent. Ships with Fedora 44 and RHEL 10 RPM installers.