Back to Blog
claude-codeweekly-updatehooks +4 topics

What's Up Claude Code: Week of October 5th

Claude Code 2.1.292 to 2.1.296 made failure boundaries the story: fail-closed hooks, unattended-run fixes, and a Haiku 5.5 alias that quietly changes model.

Olivier Legris Calculating read time…
In this article

TL;DR

This week’s Claude Code releases were about what happens when things go wrong. Versions 2.1.292 through 2.1.296 added onFailure: "block" for command and HTTP hooks, fixed a batch of unattended-run problems, and changed what the haiku alias points to on the Anthropic API.

My takeaway: the useful unit of Claude Code maturity is no longer the feature. It’s the failure boundary. Before you upgrade, test the cases that go wrong: a hook that can’t start, a session that resumes, a scheduled task that should still fire, a model that quietly changes under you.

1. Hooks can now fail closed

Until 2.1.295, a broken guard hook failed open. If it was missing, timed out or crashed, the tool call went through. v2.1.295 adds onFailure: "block" for command and HTTP hooks, so the action is blocked instead.

The default is still fail-open, so this is opt-in. Add it to PreToolUse guards, secret scanners and policy webhooks, then audit the existing ones after upgrading.

Two related fixes matter here. v2.1.294 stopped instruction-style prompt and agent hooks from allowing the very action they were meant to block. Treat LLM-judged hooks as defence in depth. Keep hard blocks in deterministic command hooks or permissions.deny. In 2.1.296, managed PreToolUse hooks that deny with "continue": false now end the turn, rather than only refusing the one call.

Test every guard with a known-bad input. Then test the failure paths: a timeout, a malformed response, and a missing binary. If the workflow continues in those last three cases, it’s fail-open whatever the config says.

2. Unattended runs got more honest

v2.1.295 bounds retry behaviour for headless runs. CLAUDE_CODE_RETRY_WATCHDOG_MAX_WAIT_MS caps how long unattended retry mode waits out 429 and 529 errors, so a job fails in bounded time instead of hanging. Sub-agent and -p output also got several fixes, including a skill’s allowed-tools being dropped in -p runs.

The open issues are the more useful read. #100005 reports that --dangerously-skip-permissions doesn’t suppress Write/Edit approval in --print mode, so unattended edits can fail silently while reporting success. It’s a single report with no maintainer reply yet, so verify on your version. The practical rule for cron and CI: assert on the file diff and the exit status, not on the assistant’s summary.

3. The haiku alias changed under you

v2.1.293 made haiku resolve to Claude Haiku 5.5 on the Anthropic API. Background tasks and any subagent declared model: haiku silently moved to the new model. Bedrock, Vertex and Foundry stay on Haiku 4.5, so mixed-provider setups can drift.

Haiku 5.5 is cheaper per token, but its tokenizer uses roughly 25–30% more tokens than Haiku 4.5, and it crosses a pricing cliff above 100K input tokens. Claude Code’s base context can already be 30–66K, so long-lived Haiku sessions can cost more than expected. Pin the model ID for anything reproducible, and benchmark before using Haiku for anything beyond search, summarising and classification. One early reader found Haiku matched Opus on code search but fell down on web research and fact-checking. That’s one user’s six-task test, so treat it as a lead, not a result.

Also in this batch: the Sonnet 5.5 cache-read price was cut to $0.10 per million tokens on October 7. Claude Code versions before 2.1.296 still price it at $0.20 in /cost and --max-budget-usd, so budgets can trip early on older builds.

4. Watch for the quiet failures

Three reports this week show how failures stay silent. Each one is unverified beyond the report itself, so check on your own setup:

  • #101057: a PreCompact hook’s stdout is appended to the compaction instructions with no size limit. One reporter’s bd prime printed 2.2 MB per run, leaving the session about 95% full after compaction. Cap hook output, for example with | head -c 8000.
  • A hook matcher of mcp__server fired 0 of 42 times in one measured test, while the same string worked as a permission rule. Use mcp__server__.* for the hook matcher. A hook that never fires produces no error.
  • #100894: the idle “new task? /clear” hint appears at 75 minutes, but the one-hour prompt cache is gone by about 62. The reporter’s workaround is CLAUDE_CODE_IDLE_THRESHOLD_MINUTES=60 in the settings env block.

Community projects worth looking at

Each project below has a repository created or updated this week, and I checked the repo metadata directly. The dates are the repo’s own.

  • claude-show-your-work, new this week. A plugin that shows screenshots, Playwright recordings and before/after QA inside the terminal, for Ghostty and kitty. Repo created October 8, MIT licence, 82 stars at check time. It was the most-discussed project in r/ClaudeCode this week, with a 661-point post on October 11. The useful idea is that the agent shows its evidence, which makes review faster. The README’s claims are the author’s, and there’s no independent audit. Check what it renders, and where screenshots are stored, before running it on a client project.
  • claude-remote, new this week. A Windows-focused, MIT-licensed PWA over Tailscale that starts a Claude Code session on a chosen local folder. Repo created October 5, 8 stars. It starts sessions rather than only reconnecting to them, which is the useful part. The risk is also real: it’s a remote control plane with a passcode, and it has access to your local hooks, skills and files. Bind it to the network you intend, and don’t treat a private tailnet as an application-level authorisation boundary.
  • harness-eval, ongoing, updated this week. A Red Hat community tool that lints and security-audits your agent setup: instruction files, skills, hooks, MCP configuration and credential paths. The repo dates from June and was updated October 10, so it’s an update to an existing project rather than a launch. Its deterministic lint mode is the part I’d use. Check what leaves your machine before enabling any optional review mode.

From the AI-news feed

Latent Space’s AINews ran five issues covering October 5–11. Three are relevant to Claude Code readers. The headlines and figures below are the newsletter’s own summaries, not independent benchmarks.

  • Typed decisions are becoming a product category. The October 8–9 issue reports several vendors shipping “decision” models that return typed answers, such as probabilities, picks from a list or scores, in a single pass rather than free text. Jev, the TypeSafe product, is the example it leads with. The link to this week’s hook story is direct: a yes/no guard is easier to test and route than a paragraph. The same issue reports TypeSafe’s claim of $100M ARR in its first week, which Sequoia reportedly “leaked”. That’s unverified, so don’t repeat it as fact.
  • Haiku 5.5 is positioned as the subagent under Opus or Sonnet. AINews quotes Anthropic’s framing: “Opus does the heavy thinking, Haiku does the high-volume work.” It also notes that Anthropic cut Sonnet 5.5 prices and subscription plans the same day. The practical reading matches section 3: use Haiku for summaries, compactions and classification, and benchmark before anything else.
  • An open-weight release with a clear licence. The October 6 issue covers Reflection’s Beam, a 501B-total, 23B-active MoE for coding and agentic work, trained from scratch. Reflection says full weights under Apache 2.0 are due this month, and it cites 80.9 on SWE-bench Verified. Those are the company’s claims, and the newsletter says the strongest open models (GLM 5.3, Kimi K3, Qwen 3.8 Max, DeepSeek V4.1 Flash) are generally ahead. Worth watching if you want a non-Anthropic option for cheap bulk work.

Two other items from the window are outside this newsletter’s focus. OpenAI’s release of 722 mathematics manuscripts (October 7) is a large claim that the AINews issue itself qualifies. Separately, three former OpenAI safety researchers say they were fired, and OpenAI reportedly says they mishandled confidential information. That’s a disputed account, and I haven’t included it as established.

Community events

The Clauders events index is the source of truth for titles, dates and links. During October 5–11 it lists:

Coming during October 12–18:

These are calendar records, not confirmation that an event ran or that anyone attended. Check the Luma page for last-minute changes.

What I’m watching

  • Do teams turn on onFailure: "block" for production-sensitive hooks, and then monitor the policy service as a dependency?
  • Will haiku stay a convenient default, or will serious workflows pin model IDs and provider mappings?
  • Will the quiet failures above (hook matchers, PreCompact output, silent -p edits) get loud errors, or stay something you have to test for?
  • Does remote session-starting stay tailnet-scoped, or become another way to expose a developer machine by accident?

The next upgrade should be a controlled experiment. Record the CLI version, model ID, hook decisions, transcript, diff and cost. Repeat the same task after the upgrade, including one failure case. Release notes say what changed. A boundary test says whether your setup still deserves trust.