Claude Code 2.1.294 prompt hook fix: spend limits need a command hook

Claude Code 2.1.294 (October 8, 2026) fixed prompt and agent hooks written as instructions, such as "Block commands that...", which allowed what they should have blocked. If you guard paid Sume tools with a hook, upgrade, but also pick the hook type on purpose: a spend limit is an exact rule, so a command hook that checks max_spend_usd and idempotency_key is a better fit than a model judging a sentence.

What did 2.1.294 fix?

The changelog lists two items under hooks. First, prompt and agent hooks written as instructions (its example is "Block commands that...") were allowing what they should block. Second, prompt hooks on Stop and SubagentStop written as instructions ("Carry on if the build is broken") are now judged better, so Claude is less likely to stop early.

If you had a prompt hook like "Block any Sume video call that looks expensive" and it never fired, this is the release that addresses that class of failure.

Why is a prompt hook a poor spend limit anyway?

A prompt or agent hook asks a model to judge the call. "Looks expensive" is a judgment, and judgments vary. Sume's paid creators take explicit arguments you can test deterministically: the server's docs require an idempotency_key on paid and write calls made with an API key, and max_spend_usd is the optional cap on a create.

A command hook reads the call JSON and exits 2 to block. It gives the same answer every time and costs no model tokens. Use a prompt hook for fuzzy policy, for example whether a prompt for a clip reads as an ad for something you do not sell.

How do the hook types compare?

What is a sound setup?

Layer them. Match the paid tools by name, mcp__sume__generate_image and mcp__sume__generate_video if the server is called sume, with a command hook that blocks when max_spend_usd or idempotency_key is absent. Add "onFailure": "block" from 2.1.295 so a broken script cannot approve a call; that post has the settings and script.

Keep OAuth access narrow as well. A session that signs in with only mcp:read cannot run the paid tools at all, and Sume's docs say there is no separate paid scope, so mcp:write is the one you grant on purpose.

Finally, the hook is a client-side check. Sume's wallet and admission controls still decide whether a job is accepted, and dry_run on a create or generation_admission_preview shows what a request would cost without creating a job.