Claude Code 2.1.317: Safer Hooks and Scheduled Tasks

Anthropic released Claude Code v2.1.317 on November 3, 2026. The headline is not a new model: it is a set of safeguards and operational fixes for people who let coding agents run tools, schedule cloud work, or operate inside a company gateway. The release introduces an optional way for Agent SDK hook failures to stop an action, flags unexpected connectors on newly created cloud schedules, and asks before a web or shell tool call sends the account email address to the network. Each change has a different scope, so it is worth checking the exact behavior before treating the update as a general security guarantee.

What changed in v2.1.317

• Agent SDK hook callbacks can use onFailure: "block" so a failed callback blocks the action instead of silently proceeding.
• The /schedule command warns if a new cloud scheduled task has connectors the user did not request, and explains how to remove them.
• Claude Code asks before a web or shell tool call transmits the account email address to the network.
• Gateway administrators gain a cost-report endpoint, GET /v1/organizations/analytics/cost, with breakdowns such as developer, day, or identity-provider group.
• Additional fixes cover MCP server disconnections, self-hosted runner recovery, nested claude -p sessions, and transcript-write failures.

Agent SDK hooks: blocking is an explicit choice

A hook is a programmatic check around an agent action. Imagine a PreToolUse policy callback that reviews a shell command before the agent executes it. If the callback crashes or cannot return a valid result, an application may need to stop rather than assume the command is safe. The new onFailure: "block" option addresses that failure case for Agent SDK callbacks. It does not mean every hook is now blocking by default, and it is not the same as a hook deliberately returning a deny decision.

Anthropic's Python Agent SDK v0.2.177 changelog names the corresponding HookMatcher option on_failure="block". It says the default is "continue", and blocking applies when a callback raises an exception, returns None, or returns a value rejected by the CLI. The SDK also requires a compatible Claude CLI: using this setting with an older CLI that cannot honor it raises CLIConnectionError. That compatibility check matters when teams update Python dependencies but leave an older CLI on their runner.

Cloud schedules: review connectors, not just prompts

A scheduled agent can access services beyond its code repository. In v2.1.317, /schedule now warns when a newly created cloud scheduled task receives connectors that were not requested and includes guidance for removing them. This is a visibility improvement, not a statement that Claude automatically strips every unwanted connection or that older tasks have been retroactively audited. The same release fixes /schedule omitting the next-run time and task link after creation or update, which should make it easier to review what was actually scheduled.

1. Create or review a cloud scheduled task and read the connector warning before relying on the schedule.
2. Compare the connectors shown with the task's actual need; remove any unexpected access using the product's provided controls.
3. Verify the task's next-run time and link after saving; the release specifically addresses missing result details.
4. For high-impact tasks, test a harmless run first and keep human approval for actions that are difficult to reverse.
5. If using SDK policy hooks, test a callback failure deliberately in a safe environment before enabling the workflow in production.

Account-email checks are narrow, not a privacy shield

Claude Code now asks before a web or shell tool call sends your account email address to the network. That is a specific disclosure check, not proof that all personal information, files, secrets, or environment variables are blocked from leaving a session. Developers should still limit tool permissions, inspect outbound requests, avoid placing secrets in prompts, and use explicit approval for sensitive actions. The release notes do not establish a universal guarantee across every tool or integration.

Operational fixes for teams running agents

The new Claude apps gateway cost report is aimed at administrators, not an automatic new dashboard for every Claude subscriber. The official release says the admin API can return historical spending in aggregate or grouped by developer, day, and IdP group. It also adds plan, seat type, provider, and custom base URL attributes to OpenTelemetry metrics and traces. Teams can use those signals to investigate cost and routing, while checking their own gateway configuration and access rights before assuming the endpoint is enabled for them.

Several fixes are easy to overlook but important for unattended agents. A nested claude -p process no longer unintentionally shares its parent cloud or self-hosted runner session ID and transcript. A full disk or quota that prevents transcript or configuration writes now causes claude -p to report an error and exit with code 1 in the documented text and JSON modes, rather than falsely signaling success; Anthropic notes that some full NFS exports may still be missed. These are reliability improvements, not evidence that every runner failure is now detectable.