How to block the Claude Code email leak

Claude Code put the signed-in account's email in the model's context, and the model sometimes used it as the contact in User-Agent headers of curl calls it wrote. Anthropic says a release expected early next week removes it. The interim cc-plugin-privacy mod, per AI News Report's reading of its source, checks only Bash, PowerShell and Monitor calls, so web tools, scripts and other headers pass. Some users say it did not fire on 2.1.317 and 2.1.318, and npm stable (2.1.311) has no mod. A PreToolUse hook can block it.