anthropic 1.35.0 → 1.37.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5db1f4f469b9a2e1aad1435777496f6d191945ff0017fdf8ff5a04522da40370
-  data.tar.gz: 35dac1ad2c116e55ec90da2acd486c45c91ad1925181876600170a16e52b4ed1
+  metadata.gz: 9eacf10bf13feb1eb221fe82ee801d2754524985991959c858db721b5cfd825e
+  data.tar.gz: 6e70a7c6d4ee0dd18a892272017f73e524ace1a943579b9694c23c94331ad421
 SHA512:
-  metadata.gz: dc6e88fb4aa8d98beabeb4755b6d7c45d1faf5e59daf133ae75b57922ebd21e86f4ff5d22f3ec0686efc1c2746fda89ba135b5510ed83360a3e215924bfc611d
-  data.tar.gz: 5f3f2d032b2f67f5f04025048470ed175afc85705e8ea2f3faded5f44f13cdc43eda11cbaddbdb7078acbdb2c9beb61b150dd4f2abde8d4122ca7f965a3f094e
+  metadata.gz: '002489936b1fa9dda322c5dd604bea0eb371ef4a25a8e091e8a7204db4acca6d3dfa7e4840666a1042b0052271215abc18499a99ab5d9a5589401ad1df9626c1'
+  data.tar.gz: 95b904d78f29eb0b36f694c628c52c686775349ca3ba9cb6746ce33758558dc48a624ca925bc72661bf54b033272cf14d57babea6d86ffed7b6d37531fada262

data/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 1.37.0 (2026-05-04)
+
+Full Changelog: [v1.36.0...v1.37.0](https://github.com/anthropics/anthropic-sdk-ruby/compare/v1.36.0...v1.37.0)
+
+### Features
+
+* **api:** improve Managed Agents APIs ([34caf5b](https://github.com/anthropics/anthropic-sdk-ruby/commit/34caf5b0994bc818a7ee835832624853cc0a2abe))
+* **client:** add Workload Identity Federation, interactive OAuth, and auth profiles ([4d394a4](https://github.com/anthropics/anthropic-sdk-ruby/commit/4d394a419f6219cf46ca459083510c89f44041a7))
+* support setting headers via env ([08e8b38](https://github.com/anthropics/anthropic-sdk-ruby/commit/08e8b382e8795ebb008daea6769550374952b301))
+
+## 1.36.0 (2026-04-23)
+
+Full Changelog: [v1.35.0...v1.36.0](https://github.com/anthropics/anthropic-sdk-ruby/compare/v1.35.0...v1.36.0)
+
+### Features
+
+* **api:** CMA Memory public beta ([9fafd1a](https://github.com/anthropics/anthropic-sdk-ruby/commit/9fafd1abe16d0398c6e59be0717a9ef9cb014347))
+
+
+### Bug Fixes
+
+* **api:** fix errors in api spec ([074fa8d](https://github.com/anthropics/anthropic-sdk-ruby/commit/074fa8dac4cdebc8eababcac95ca4fe9dc7970d3))
+* **api:** restore missing features ([4496fac](https://github.com/anthropics/anthropic-sdk-ruby/commit/4496facb8130e48340a2c4107d3aaf412b5cf4eb))
+* avoid gzip buffering during streaming ([307c594](https://github.com/anthropics/anthropic-sdk-ruby/commit/307c5944e27dd3eab5aa3c6f6e7ed02ca5b7cece))
+
+
+### Chores
+
+* **internal:** more robust bootstrap script ([e8f157e](https://github.com/anthropics/anthropic-sdk-ruby/commit/e8f157e44e664c036c0b81584eee8919d55eb6db))
+* **tests:** bump steady to v0.22.1 ([7f079ce](https://github.com/anthropics/anthropic-sdk-ruby/commit/7f079cee1a662245ce67c12b1b7790832dd931ad))
+
 ## 1.35.0 (2026-04-16)
 
 Full Changelog: [v1.34.0...v1.35.0](https://github.com/anthropics/anthropic-sdk-ruby/compare/v1.34.0...v1.35.0)

data/README.md

@@ -15,7 +15,7 @@ Add to your application's Gemfile:
 <!-- x-release-please-start-version -->
 
 ```ruby
-gem "anthropic", "~> 1.35.0"
+gem "anthropic", "~> 1.37.0"
 ```
 
 <!-- x-release-please-end -->

data/lib/anthropic/client.rb

@@ -1,6 +1,32 @@
 # frozen_string_literal: true
 
 module Anthropic
+  @warned_explicit_shadow = false
+  @warned_env_shadow = false
+
+  class << self
+    def warn_explicit_static_shadows_credentials(param)
+      return if @warned_explicit_shadow
+      @warned_explicit_shadow = true
+
+      warn(
+        "[anthropic-ruby] `#{param}:` was passed alongside `credentials:`; the static credential " \
+        "takes precedence and the credentials provider is silently disabled. " \
+        "Pass only one."
+      )
+    end
+
+    def warn_env_static_shadows_auto_discovery(env_var)
+      return if @warned_env_shadow
+      @warned_env_shadow = true
+
+      warn(
+        "[anthropic-ruby] #{env_var} is set and takes precedence over the SDK's profile / federation " \
+        "auto-discovery; unset #{env_var} to use the auto-discovered credential."
+      )
+    end
+  end
+
   class Client < Anthropic::Internal::Transport::BaseClient
     # Default max number of retries to attempt after a failed retryable request.
     DEFAULT_MAX_RETRIES = 2
@@ -33,6 +59,12 @@ module Anthropic
     # @return [String, nil]
     attr_reader :auth_token
 
+    # @return [Object, nil]
+    attr_reader :credentials
+
+    # @return [Anthropic::Credentials::TokenCache, nil]
+    attr_reader :token_cache
+
     # @return [Anthropic::Resources::Completions]
     attr_reader :completions
 
@@ -49,23 +81,19 @@ module Anthropic
     #
     # @return [Hash{String=>String}]
     private def auth_headers
-      {**api_key_auth, **bearer_auth}
-    end
+      headers = {}
 
-    # @api private
-    #
-    # @return [Hash{String=>String}]
-    private def api_key_auth
-      {"x-api-key" => @api_key}
-    end
-
-    # @api private
-    #
-    # @return [Hash{String=>String}]
-    private def bearer_auth
-      return {} if @auth_token.nil?
+      if @api_key
+        headers["x-api-key"] = @api_key
+      elsif @auth_token
+        headers["authorization"] = "Bearer #{@auth_token}"
+      elsif @token_cache
+        token = @token_cache.get_token
+        headers["authorization"] = "Bearer #{token}"
+        headers["anthropic-beta"] = Anthropic::Credentials::OAUTH_API_BETA_HEADER
+      end
 
-      {"authorization" => "Bearer #{@auth_token}"}
+      headers
     end
 
     # Calculate the timeout for non-streaming requests based on token count
@@ -91,12 +119,49 @@ module Anthropic
 
     # Creates and returns a new client for interacting with the API.
     #
-    # @param api_key [String, nil] Defaults to `ENV["ANTHROPIC_API_KEY"]`
+    # Credential precedence, matching the credential-resolution spec and
+    # the Workload Identity Federation user guide:
+    #
+    # 1. Explicit constructor arguments — +api_key:+, +auth_token:+,
+    #    +credentials:+, +config:+. If the caller passed any of these,
+    #    the SDK uses it and does *not* read credential env vars.
+    # 2. +ANTHROPIC_API_KEY+ / +ANTHROPIC_AUTH_TOKEN+ env vars. Only
+    #    consulted when no explicit credential argument was passed.
+    # 3. +ANTHROPIC_PROFILE+ — explicit profile selection.
+    # 4. Direct env-var federation (+ANTHROPIC_IDENTITY_TOKEN[_FILE]+ +
+    #    +ANTHROPIC_FEDERATION_RULE_ID+ + +ANTHROPIC_ORGANIZATION_ID+).
+    # 5. Fallback active profile from disk (+active_config+ pointer or
+    #    the literal +default+).
+    #
+    # A static env credential (step 2) *shadows* steps 3–5, silently
+    # disabling profile / federation auto-discovery.
+    #
+    # Passing an explicit +api_key:+ or +auth_token:+ *argument*
+    # alongside an explicit +credentials:+ is supported: the
+    # static credential takes precedence at the request-header level and
+    # the credentials provider is silently disabled.
     #
-    # @param auth_token [String, nil] Defaults to `ENV["ANTHROPIC_AUTH_TOKEN"]`
+    # @param api_key [String, nil] Defaults to +ENV["ANTHROPIC_API_KEY"]+ when
+    #   no explicit credential argument is passed.
+    #
+    # @param auth_token [String, nil] Defaults to +ENV["ANTHROPIC_AUTH_TOKEN"]+ when
+    #   no explicit credential argument is passed.
+    #
+    # @param credentials [#call, nil] Credential provider — any callable returning
+    #   +AccessToken.new(token:, expires_at:)+. The provider is wrapped in a
+    #   +TokenCache+ for thread-safe caching and proactive refresh (120s advisory /
+    #   30s mandatory before expiry). Common providers: +WorkloadIdentity+,
+    #   +CredentialsFile+, +StaticToken+, or a custom lambda.
+    #
+    # @param config [Hash, nil] In-memory configuration hash with the same shape
+    #   as +configs/<profile>.json+. Must include an +authentication+ object with
+    #   a +type+ field (+oidc_federation+ or +user_oauth+). Mutually exclusive
+    #   with +credentials:+. For +user_oauth+, must also include
+    #   +authentication.credentials_path+.
     #
     # @param base_url [String, nil] Override the default base URL for the API, e.g.,
-    # `"https://api.example.com/v2/"`. Defaults to `ENV["ANTHROPIC_BASE_URL"]`
+    #   +"https://api.example.com/v2/"+. Defaults to +ENV["ANTHROPIC_BASE_URL"]+,
+    #   then to the profile's +base_url+ if present, then to +https://api.anthropic.com+.
     #
     # @param max_retries [Integer] Max number of retries to attempt after a failed retryable request.
     #
@@ -106,22 +171,86 @@ module Anthropic
     #
     # @param max_retry_delay [Float]
     def initialize(
-      api_key: ENV["ANTHROPIC_API_KEY"],
-      auth_token: ENV["ANTHROPIC_AUTH_TOKEN"],
-      base_url: ENV["ANTHROPIC_BASE_URL"],
+      api_key: nil,
+      auth_token: nil,
+      credentials: nil,
+      config: nil,
+      base_url: nil,
       max_retries: self.class::DEFAULT_MAX_RETRIES,
       timeout: self.class::DEFAULT_TIMEOUT_IN_SECONDS,
       initial_retry_delay: self.class::DEFAULT_INITIAL_RETRY_DELAY,
       max_retry_delay: self.class::DEFAULT_MAX_RETRY_DELAY
     )
+      if config && credentials
+        raise ArgumentError, "Pass at most one of `credentials:` or `config:`."
+      end
+
+      has_explicit_credential = api_key || auth_token || credentials || config
+
+      unless has_explicit_credential
+        api_key = ENV["ANTHROPIC_API_KEY"]
+        auth_token = ENV["ANTHROPIC_AUTH_TOKEN"]
+      end
+
+      @api_key = api_key&.to_s
+      @auth_token = auth_token&.to_s
+      @credentials = nil
+      @token_cache = nil
+
+      base_url_is_explicit = base_url && !base_url.empty?
+      base_url ||= ENV["ANTHROPIC_BASE_URL"]
+
+      credential_headers = {}
+
+      if config
+        in_memory = Anthropic::Credentials::InMemoryConfig.new(config)
+        @credentials = in_memory
+        credential_headers = in_memory.extra_headers
+        if !base_url_is_explicit && in_memory.resolved_base_url
+          base_url = in_memory.resolved_base_url
+        end
+      else
+        @credentials = credentials
+      end
+
+      if @credentials.nil? && @api_key.nil? && @auth_token.nil?
+        default_base_url = base_url || "https://api.anthropic.com"
+        result = Anthropic::Credentials.default_credentials(base_url: default_base_url)
+        if result
+          @credentials = result.provider
+          credential_headers = result.extra_headers
+          base_url = result.base_url if !base_url_is_explicit && result.base_url
+        end
+      end
+
+      warn_explicit_shadow(api_key: api_key, auth_token: auth_token, credentials: credentials || config)
+      warn_env_shadow(api_key: api_key, auth_token: auth_token)
+
+      if @credentials
+        @token_cache = Anthropic::Credentials::TokenCache.new(@credentials)
+      end
+
       base_url ||= "https://api.anthropic.com"
 
+      if @credentials.respond_to?(:bind_base_url)
+        @credentials.bind_base_url(base_url)
+      end
+
       headers = {
         "anthropic-version" => "2023-06-01"
       }
-
-      @api_key = api_key&.to_s
-      @auth_token = auth_token&.to_s
+      custom_headers_env = ENV["ANTHROPIC_CUSTOM_HEADERS"]
+      unless custom_headers_env.nil?
+        parsed = {}
+        custom_headers_env.split("\n").each do |line|
+          colon = line.index(":")
+          unless colon.nil?
+            parsed[line[0...colon].strip] = line[(colon + 1)..].strip
+          end
+        end
+        headers = parsed.merge(headers)
+      end
+      headers = headers.merge(credential_headers)
 
       super(
         base_url: base_url,
@@ -137,5 +266,38 @@ module Anthropic
       @models = Anthropic::Resources::Models.new(client: self)
       @beta = Anthropic::Resources::Beta.new(client: self)
     end
+
+    # @api private
+    #
+    # @param status [Integer]
+    # @param headers [Hash{String=>String}]
+    #
+    # @return [Boolean]
+    def retry_request?(status, headers:)
+      if status == 401 && @token_cache
+        @token_cache.invalidate
+        return true
+      end
+      super
+    end
+
+    private
+
+    def warn_explicit_shadow(api_key:, auth_token:, credentials:)
+      return if credentials.nil?
+
+      Anthropic.warn_explicit_static_shadows_credentials("api_key") if api_key
+      Anthropic.warn_explicit_static_shadows_credentials("auth_token") if auth_token
+    end
+
+    def warn_env_shadow(api_key:, auth_token:)
+      return unless Anthropic::Credentials.auto_discoverable_credentials?
+
+      if api_key && ENV["ANTHROPIC_API_KEY"]
+        Anthropic.warn_env_static_shadows_auto_discovery("ANTHROPIC_API_KEY")
+      end
+      return unless auth_token && ENV["ANTHROPIC_AUTH_TOKEN"]
+      Anthropic.warn_env_static_shadows_auto_discovery("ANTHROPIC_AUTH_TOKEN")
+    end
   end
 end

data/lib/anthropic/credentials/access_token.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Anthropic
+  module Credentials
+    # An Anthropic API access token with optional expiry.
+    #
+    # This is a frozen value object representing an access token and its
+    # expiration time. The +expires_at+ is a Unix timestamp in seconds;
+    # +nil+ means no expiry information (the token will be treated as
+    # never-expires by {TokenCache}).
+    class AccessToken
+      # @return [String] the access token string
+      attr_reader :token
+
+      # @return [Integer, nil] Unix timestamp in seconds when the token expires,
+      #   or +nil+ if the token never expires
+      attr_reader :expires_at
+
+      # @param token [String] the access token string
+      # @param expires_at [Integer, nil] Unix timestamp in seconds, or +nil+ for no expiry
+      def initialize(token:, expires_at: nil)
+        @token = token
+        @expires_at = expires_at
+        freeze
+      end
+
+      # @return [Integer] hash code for the token
+      def hash
+        [token, expires_at].hash
+      end
+
+      def ==(other)
+        return false unless other.is_a?(AccessToken)
+        token == other.token && expires_at == other.expires_at
+      end
+
+      alias_method :eql?, :==
+    end
+  end
+end

data/lib/anthropic/credentials/config.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require "pathname"
+require "uri"
+
+module Anthropic
+  module Config
+    class << self
+      def config_file_path(profile)
+        validate_profile_name!(profile)
+        Anthropic::Credentials.config_file_path(profile)
+      end
+
+      def credentials_file_path(profile)
+        validate_profile_name!(profile)
+        Anthropic::Credentials.config_dir.join("credentials", "#{profile}.json")
+      end
+
+      def active_profile
+        profile = Anthropic::Credentials.active_profile
+        validate_profile_name!(profile)
+        profile
+      end
+
+      def active_profile_config?
+        config_file_path(active_profile).file?
+      rescue Anthropic::Errors::ConfigurationError
+        false
+      end
+
+      def validate_profile_name!(profile, source: "profile name")
+        if profile.nil? || profile.empty?
+          raise Anthropic::Errors::ConfigurationError,
+                "#{source} must not be empty"
+        end
+        if profile != profile.strip
+          raise Anthropic::Errors::ConfigurationError,
+                "#{source} '#{profile}' has leading/trailing whitespace"
+        end
+        if profile.start_with?(".")
+          raise Anthropic::Errors::ConfigurationError,
+                "#{source} '#{profile}' must not start with a dot"
+        end
+
+        ["/", "\\", File::SEPARATOR].each do |sep|
+          next if sep.empty?
+          if profile.include?(sep)
+            raise Anthropic::Errors::ConfigurationError,
+                  "#{source} '#{profile}' must not contain path separators"
+          end
+        end
+
+        return unless profile.include?("\x00")
+        raise Anthropic::Errors::ConfigurationError, "#{source} '#{profile}' must not contain null bytes"
+      end
+
+      def require_https!(url, field:)
+        begin
+          uri = URI.parse(url.to_s)
+        rescue URI::InvalidURIError
+          raise Anthropic::Errors::ConfigurationError,
+                "#{field} is not a valid URL (got '#{url}')"
+        end
+
+        return if uri.scheme == "https"
+        return if uri.scheme == "http" && %w[localhost 127.0.0.1 ::1].include?(uri.hostname)
+
+        raise Anthropic::Errors::ConfigurationError,
+              "#{field} must use https (got '#{url}'); the token-exchange endpoint " \
+              "carries secret material and cannot be used over cleartext HTTP."
+      end
+    end
+  end
+end