Know Which Cache You Paid For and Which Commit Your Workflow Ran

At a glance

• Claude Code telemetry now tells you which kind of cache write you paid for.
• Two hook fixes in Claude Code make gates stricter and exit cleanup steadier.
• GitHub can pin every workflow dependency to a reviewed commit, in preview.
• Copilot CLI hooks and resumes got steadier, and HydraFusion added a Max mode.

Wednesday was quieter than Tuesday, so we lead with what a team can act on, and the thread is evidence. Claude Code now tells your telemetry which kind of cache write you paid for, GitHub can prove which commit of an action a workflow ran, and Copilot CLI closes gaps where hooks and resumed sessions could quietly do the wrong thing. Treat today as the day to check whether your cost dashboards read the new cache fields, lock one workflow and verify it in CI, and retest any Copilot hook that shells out.

Top Stories

1. Claude Code v2.1.300 tells your telemetry which cache you paid for

Anthropic published Claude Code v2.1.300 to npm at 10:27 AM ET Wednesday, and it took both the latest and next tags. At our 5:54 AM ET check Thursday, stable pointed at v2.1.292, up from v2.1.287 on Wednesday morning.

The line most teams will feel is in the OpenTelemetry api_request event, which now carries cache_creation_5m_tokens and cache_creation_1h_tokens so cache writes are split by lifetime. So far these fields are documented only in the changelog; the monitoring docs do not list them yet. Trace spans also gain OpenTelemetry GenAI semantic convention attributes such as gen_ai.provider.name, gen_ai.conversation.id, gen_ai.tool.name and error.type, useful when one collector groups spans from several AI tools.

Two hook fixes ride along. Agent hooks now respect their model setting, so aliases like haiku resolve, a subagent's model no longer overrides the hook's, and an unavailable model falls back to the caller's model instead of allowing the action. SessionEnd hooks now run when you exit with a background command still going, and a conversation no longer fails every turn with a 400 error when the API rejects an MCP tool's input schema.

Practical dev impact: If you track Claude Code spend from telemetry, the split shows whether one hour or five minute cache writes drive the bill, but only once your dashboard reads the new fields. The agent hook fix closes a case where a hook pointed at a missing model could let an action through, so in our reading a hook you use as a gate is now stricter, and cleanup hooks on SessionEnd should fire more reliably.

2. GitHub Actions can now run the exact commits you locked

GitHub's Changelog post at 9:49 AM ET Wednesday 14 Oct put workflow dependency lockfiles in public preview for GitHub Enterprise Cloud, Enterprise Cloud with data residency, Team and Free plans. Tags and branches can move after you review a workflow, so a compromised action can slip in through a moved tag without any change to your repository.

The gh actions-lock extension for the GitHub CLI generates .github/workflows/actions.lock with reviewable commits for actions, their transitive dependencies and reusable workflows. You onboard workflows one at a time, and once a workflow is onboarded, Actions requires each of its dependencies to be in the lockfile and runs the recorded commit even if the tag moves. The extension's README, which is pre-1.0, adds gh actions-lock --verify for a read only check in CI and gh actions-lock --relock to move pins forward on purpose. A Require lockfile policy, also in preview, lets admins make lockfiles mandatory, and Dependabot updates the matching lockfile entry in the same pull request when it bumps an onboarded action.

Practical dev impact: Treat this as a preview, not a settled format. Because agents now open many workflow changes, a lockfile gives reviewers one diff that shows exactly which commits will run, though GitHub says locking does not judge whether a dependency is safe. The README warns the format and flags may change before 1.0, and GitHub Enterprise Server is not supported.

3. Copilot CLI v1.0.98 steadies hooks and resumes, and HydraFusion adds Max

GitHub published Copilot CLI v1.0.98 to npm at 3:53 PM ET Wednesday, and it was latest at our 5:54 AM ET check Thursday. The prerelease tag had already moved to v1.0.99-0, published at 8:59 PM ET Wednesday with no changelog notes yet.

Beyond the Gemini 4 Argon support GitHub announced Tuesday, the useful lines are fixes. Command hooks now complete reliably even when child exit signals are lost under Node, and resuming a session respects abandoned pending permission work and continues only active permission requests. Answers from /ask now expand with Ctrl+E and copy in full with Ctrl+Y.

A Changelog post at 4:01 PM ET updated HydraFusion, which orchestrates several models into one response, and added HydraFusion Max for harder tasks. Per the post, the pool now includes Claude Opus 5.5, GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna, drafts run at medium effort and review at high effort, and both stay in research preview in VS Code, the Copilot app and Copilot CLI for Pro, Pro+, Business and Enterprise plans with preview features enabled.

Practical dev impact: A hook whose exit signal went missing could look like a hung tool, so teams that saw intermittent stalls in hooked sessions should update and retest, and the resume change keeps a resumed run from acting on an abandoned permission prompt. HydraFusion Max is worth a trial on a hard review task, while your organization's model policy decides whether it reaches your seat.

Practical Impact Analysis

All three stories give a team better evidence about what actually happened, which matters because agents now trigger more spend, workflow runs and hooks than anyone watches live, so in our view today's work is wiring these signals into the reviews and dashboards you already have.

The rollout order follows from risk. Individual developers can take Claude Code v2.1.300 from latest, while teams that want slower change can stay on stable, which read v2.1.292 at 5:54 AM ET Thursday, and the telemetry owner should add the two cache fields before anyone draws conclusions. Workflow lockfiles are a preview, so start with one high value workflow and a --verify step in CI rather than a Require lockfile policy across an organization. Copilot CLI v1.0.98 is a reasonable fleet update. At the same check, Gemini CLI latest held at v0.64.0 with preview at v0.65.0-preview.0, and Codex latest held at v0.162.1 with alpha at v0.163.0-alpha.11. Cursor's main changelog still leads with Tuesday's Origin App Marketplace, and the Cursor CLI changelog still ends at v2026.10.08.

Tutorial

We have not run this script end to end on every platform, so read it before you run it. It prints channel pointers and your local version, and every line that installs, enables telemetry or writes a lockfile is commented out and labeled, so nothing changes unless you uncomment it on purpose.

#!/usr/bin/env bash
# We have not run this script end to end on every platform. Nothing below installs or writes unless you uncomment it.
# 1. Channel pointers. At 5:54 AM ET Thu 15 Oct npm showed Claude Code stable v2.1.292, latest and next v2.1.300.
npm view @anthropic-ai/claude-code dist-tags --json

# 2. What this machine runs
claude --version

# 3. Optional, Claude Code latest channel, npm installs only, npm latest at 5:54 AM ET Thu 15 Oct:
# npm install -g @anthropic-ai/claude-code@2.1.300

# 4. Optional, documented in Claude Code monitoring docs: print telemetry events to this shell
# export CLAUDE_CODE_ENABLE_TELEMETRY=1
# export OTEL_LOGS_EXPORTER=console

# 5. Optional, preview, from the pre-1.0 gh-actions-lock README (flags may change): install the extension, then check without writing
# gh extension install github/gh-actions-lock
# gh actions-lock --verify

With step 4 enabled, run one short session and look for the two new cache fields on api_request events. Whether console output shows them in a short session is our expectation, not something the docs state. Running gh actions-lock with no flags onboards every workflow under .github/workflows/ and can change workflow files as well as the lockfile, so run it on a branch and review the diff. Do not mix npm and native installs of the same tool on one machine.

Recommended AI prompt

Copy this paragraph into ChatGPT, Claude, Gemini, Grok, or whatever AI you use.