Claude Code v2.1.317–318: An Egress Check for Your Email, and Background Subagents on a 3-Minute Clock

Two releases landed this week: 2.1.317 on November 3 and 2.1.318 on November 4. Per the official changelog, they carry 62 and 47 bug fixes respectively, plus a few changes worth a spec-driven team’s attention. I have not run either. Everything below is the changelog’s claim, not my measurement. The changelog page is over a million characters long and I read only the first 100K, which covered both entries.

v2.1.317: the security-flavored one

#

Email egress check. Claude Code now asks before a web or shell tool call sends your account email address to the network. This is a small guardrail aimed at a real failure mode: an agent that has read its own environment, or been steered by an injected prompt, puts identifying data into a curl or a fetch. The changelog does not describe how detection works, so I can’t tell you how it handles encoded or partial addresses. Treat it as a speed bump, not a data-loss-prevention system.

onFailure: "block" for Agent SDK hook callbacks. If you build on the Agent SDK, a hook callback that throws or fails can now block the action instead of letting it proceed. That is the right default for policy hooks. A guardrail that fails open is decoration. If you have SDK hooks enforcing rules such as “no writes outside the repo”, set this explicitly and test the failure path.

Smaller items:

• CLAUDE_CODE_DISABLE_NESTED_SESSION_ID for self-hosted runners.
• /schedule now warns when a new cloud scheduled task is given connectors you didn’t request.
• SendMessage delivers to running background agents sooner.
• The Read tool no longer returns a “file unchanged” stub; rereading an unchanged file returns its content. This trades a few tokens for fewer confused agents that thought they had stale or empty context.
• Fixes include OpenTelemetry export timeouts and a claude -p exit-code problem on full disks.

v2.1.318: operations and autonomy

#

Background subagents: shell commands move to the background after 3 minutes, on all providers. For long-running agentic workflows this matters. Previously a subagent blocked on a slow test suite or build could sit there. Now it gets backgrounded and can carry on. The flip side: your specs and CLAUDE.md should say how a subagent must verify results from a command that finished later, because “ran the tests” and “tests passed” are now separated by time.

Sign-in expiry visibility. claude auth status and claude -p JSON output show when a stored claude.ai sign-in expires, and claude -p warns on stderr starting 10 days before. Anyone running headless jobs from a subscription login has been bitten by silent expiry. Parse that warning in CI and alert on it.

IDE extension no longer auto-installs from an IDE terminal. Use /ide from an outside terminal. This is a behavior change that will surprise people who relied on it; it also reduces unexpected software installs from a shell.

Gateway and mods:

• assume_role on mantle upstreams for roles in other AWS accounts, with per-developer cost attribution. A cost report admin API endpoint arrived in 2.1.317.
• An effort option on $.model.fork, so mod side jobs run at a fixed effort level. This pairs with the CLAUDE_CODE_SUBAGENT_EFFORT variable from v2.1.316.

Removed: the 2.1.288 fix that preserved earlier thinking when resuming conversations from 2.1.286 or older. If you resume very old sessions, expect different behavior.

What to do this week

#

1. Set onFailure: "block" on any SDK hook that enforces policy, then deliberately break the callback in a test to confirm it blocks.
2. Add a check for the sign-in expiry warning to any scheduled claude -p job.
3. Review CLAUDE.md language for subagents on slow commands, given the 3-minute backgrounding.
4. If you used the IDE-terminal auto-install, switch to /ide.

Why this is the right direction

#

Notice what these releases are about: fail-closed hooks, egress prompts, expiry visibility, cost attribution. None of it is flashy. It is the plumbing that makes autonomous agents tolerable to run unattended, which is the exact thing IDE-bound assistants never had to solve because a human is staring at every diff. Claude Code keeps shipping for the case where nobody is watching.

Sources

#

• Claude Code changelog (Anthropic), entries 2.1.317 and 2.1.318.