On this page
Anthropic published Claude Code 2.1.317 to the npm package @anthropic-ai/claude-code. At write-up time, dist-tags show latest＝next＝2.1.317, while stable remains 2.1.311. The registry records time["2.1.317"] as 2026-11-02T23:57:53.069Z, which is 2026-11-03 07:57 Asia/Shanghai. The package modified stamp 2026-11-03T01:26:49.839Z lines up with about 2026-11-03 09:26 Asia/Shanghai, around when the latest tag moved. A common install path is npm i -g @anthropic-ai/claude-code@latest. DigIntoAI hasn't installed or exercised this build.
Related earlier cuts: Claude Code 2.1.312 Adds OIDC user_id_claim and Safer Large-File Writes, Claude Code 2.1.310 Opens Monitor Tool on Bedrock, Vertex and Foundry, and Claude Code 2.1.309 Fixes Sandbox Gaps and Requires Trust for Ultrareview.
What the official CHANGELOG lists for 2.1.317
The official CHANGELOG section ## 2.1.317 opens with three product-facing additions that match the search title, then a long list of desktop, cloud, self-hosted, VS Code, gateway, and Remote Control notes. The three headline items are summarized below as written on the CHANGELOG; secondary fixes stay brief so the write-up stays a version brief, not a repair catalog.
/schedule: warning on unexpected connectors
CHANGELOG wording: a warning was added to /schedule when a new cloud scheduled task gets connectors that were not requested, together with guidance on how to remove them. In plain terms, creating a cloud schedule can attach connector access the operator did not ask for; 2.1.317 surfaces that case and points to removal steps.
The same section also records a related schedule fix: /schedule previously left a cloud scheduled task’s next run time and link out of its results after create or update. That repair is secondary to the connector warning and is not part of the search title.
Web / shell: confirm before sending the account email
CHANGELOG wording: a check was added that asks before a web or shell tool call sends the account email address to the network. The point is outbound identity leakage through tool traffic—web fetches or shell-driven network calls that would otherwise ship the account email without an explicit confirm step.
This note is about the account email on the Claude Code / Claude apps side as described in the CHANGELOG. DigIntoAI has not reproduced the prompt path or measured how often the check fires.
Agent SDK: onFailure: "block"
CHANGELOG wording: Agent SDK hook callbacks gain onFailure: "block", so a callback that fails blocks the action instead of letting it run. That is a failure-mode control for SDK integrations: when a hook callback errors, the configured "block" path stops the action rather than falling through. DigIntoAI has not run Agent SDK hook suites against 2.1.317.
Secondary notes (not in the search title)
The same cut adds notices and metrics that matter for operators but are kept off the H1:
- Claude Desktop’s Code tab can show when an organization’s remote managed settings have not loaded for the session, and again once they do.
- Auto mode can surface a notice when a safety check has no answer for a subagent tool call (previously the main view could stay empty).
- OpenTelemetry metrics, events, and spans pick up fields such as
anthropic.plan,anthropic.seat_type,anthropic.provider, andanthropic.custom_base_url. - Claude apps gateway admin API gains a cost report endpoint,
GET /v1/organizations/analytics/cost, for past spend over a date range (total, per developer, per day, or per IdP group). - Self-hosted runners can set
CLAUDE_CODE_DISABLE_NESTED_SESSION_ID=1soclaude -pinside a session reuses that session’s ID and transcript.
Beyond those additions, the CHANGELOG lists many Fixed / Improved / Changed lines spanning desktop MCP disconnects, auto-mode gateway handling, auth token-refresh races, cloud session titles, skills sync, TLS-inspecting proxies, OpenTelemetry export timeouts, VS Code fork/message/UI issues, cloud-session link cards, Windows path checks, and self-hosted runner recovery. Those lines are real CHANGELOG entries; they are omitted from the search title on purpose so the page stays a version brief rather than a full repair index.
Dist-tags: latest is not stable
A recurring source of confusion on Claude Code npm cuts is mixing latest with stable. For 2.1.317:
| Dist-tag | Version at write-up |
|---|---|
latest | 2.1.317 |
next | 2.1.317 |
stable | 2.1.311 |
Installing with @latest tracks 2.1.317. Pinning @stable still resolves to 2.1.311 until Anthropic moves that tag—stable is still 2.1.311, not 2.1.317.
DigIntoAI hasn't run this build
DigIntoAI hasn't upgraded a production or lab install to 2.1.317, hasn't triggered the /schedule connector warning, hasn't walked the web/shell account-email confirm UI, and hasn't exercised Agent SDK onFailure: "block" hooks. Install commands above are the usual npm path only. Product wording can change; the latest official CHANGELOG and npm registry tags take precedence.
Quick facts
- Who. Anthropic — Claude Code npm package
@anthropic-ai/claude-code. - What. Version 2.1.317 on
latest/next;stablestill 2.1.311. - When. Package time 2026-11-03 07:57 Asia/Shanghai (2026-11-02T23:57:53.069Z);
modified≈ 2026-11-03 09:26 Asia/Shanghai. - Headline CHANGELOG items.
/scheduleunexpected-connector warning + removal guidance; web/shell confirm before sending account email; Agent SDKonFailure: "block". - Secondary. Desktop managed-settings notices, OTel fields, gateway cost report API, nested session ID env, plus a large Fixed/Improved/Changed set — not elevated into the search title.
- Hands-on. DigIntoAI hasn't exercised this build.
- Prior briefs. 2.1.312 / 2.1.310 / 2.1.309.
In short
Claude Code 2.1.317 is on npm latest and next as of early 2026-11-03 Asia/Shanghai, while stable stays on 2.1.311. The official CHANGELOG’s visitor-facing headliners are a /schedule warning when a new cloud scheduled task picks up unexpected connectors, a confirm step before web or shell tools send the account email, and Agent SDK hook onFailure: "block". A long tail of desktop, cloud, VS Code, gateway, and self-hosted fixes ships in the same cut without owning the H1. DigIntoAI hasn't run this build; the notes above follow npm tags plus the official CHANGELOG.