claude-agent-sdk 0.16.8 → 0.16.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 77f3f91c222e9af9b14687a6dfe5a7fdfc5fb175a99b0d1d66e84c3ba21f823d
-  data.tar.gz: c421820aa8d1de1863c55183ba8fdf384cd47b7cb334900d26cdd01fe7e5f8d4
+  metadata.gz: ebf4d55c080946d0311e12f6afb60f595da80945b19579aa84f7d58536e84792
+  data.tar.gz: 1e9dc70ab01a74b4326ce6d1bf375162e5f3cc1ab5a7ac6102ef78b5635a2552
 SHA512:
-  metadata.gz: 62f8e35411630b0ff7b4205dfd1444eb4c5d2ee2e86900dacd5a8fbc0feb9537ffbd975e666e9a6f9a57ae3185a1fccd00c840af8accbc11a1d6fb429ee5b6e8
-  data.tar.gz: 7077a54c30b2ac6371ce374f75eae8053b922e4c2041331f7440d359f984c67363455e05620a1381596b46aaff173ba3e7890ace17fb7ded21e95d433adbe124
+  metadata.gz: 2a14aef3b12d83964e8487f56d80d2c35ab7ebab39255272e9789ee132aa73cf99dc5f31e6082ffc38c65c8cc2a519e4a4290944fbd00db83df6798cfcdaee34
+  data.tar.gz: 4d1c7552f077549723955c06fb357cdff4ee9b9f0bd0402de5471539679be4fab6639b42b269dba66c46a148b27af69e6f5d33c4d43484be38dd3ac47268146a

data/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.16.10] - 2026-06-04
+
+### Added
+- `ClaudeAgentOptions#strict_mcp_config` — forwarded as `--strict-mcp-config`. When `true`, the CLI uses **only** the MCP servers passed via `mcp_servers`, ignoring project `.mcp.json`, user/global settings, and plugin-provided servers, for a fully deterministic server set. Defaults to `false`. (Parity with [Python SDK #915](https://github.com/anthropics/claude-agent-sdk-python/pull/915))
+- `ClaudeAgentOptions#include_hook_events` — forwarded as `--include-hook-events`. When `true`, the CLI emits hook lifecycle events (PreToolUse, PostToolUse, Stop, etc.) into the message stream. The parser already maps these to `HookStartedMessage` / `HookProgressMessage` / `HookResponseMessage` (the CLI simply never emitted them without this flag). Defaults to `false`. (Parity with [Python SDK #917](https://github.com/anthropics/claude-agent-sdk-python/pull/917))
+- `SandboxNetworkConfig#denied_domains` (`deniedDomains`) and `#allow_mach_lookup` (`allowMachLookup`) — completes the sandbox network allowlist field set. `denied_domains` blocks domains even when matched by `allowed_domains`; `allow_mach_lookup` is a macOS-only list of XPC/Mach service names to allow (supports a trailing wildcard). Completes [Python SDK #893](https://github.com/anthropics/claude-agent-sdk-python/pull/893) — `denied_domains` and `allow_mach_lookup` were the last two fields the Ruby port had not yet landed.
+- **Orphaned-subprocess cleanup**: `SubprocessCLITransport` now tracks live CLI subprocesses in a class-level, mutex-guarded `Set` and registers an `at_exit` handler that sends `SIGTERM` to any still running when the parent Ruby process exits. This prevents leaked `claude` processes when callers crash or exit before reaching `#close`. The handler skips already-exited processes (`Process::Waiter#alive?`) and swallows errors so it never interrupts interpreter shutdown. (Parity with [Python SDK #916](https://github.com/anthropics/claude-agent-sdk-python/pull/916))
+
+## [0.16.9] - 2026-05-25
+
+### Fixed
+- `Types.normalize_name` no longer mutates the frozen string returned by `Symbol#to_s` under Ruby 3.4+. The previous `name.dup.to_s` order dup'd the Symbol (a no-op) and then took `.to_s`, which Ruby 3.4 stages to return a frozen string in 4.0 — emitting a deprecation warning on every `gsub!`/`tr!`/`downcase!`. Swapped to `name.to_s.dup`. (#35, @chagel)
+
 ## [0.16.8] - 2026-05-15
 
 ### Added

data/README.md

@@ -68,7 +68,7 @@ Add this line to your application's Gemfile:
 gem 'claude-agent-sdk', github: 'ya-luotao/claude-agent-sdk-ruby'
 
 # Or use a stable version from RubyGems
-gem 'claude-agent-sdk', '~> 0.16.8'
+gem 'claude-agent-sdk', '~> 0.16.10'
 ```
 
 Then `bundle install`, or install directly: `gem install claude-agent-sdk`.

data/lib/claude_agent_sdk/command_builder.rb

@@ -277,6 +277,8 @@ module ClaudeAgentSDK
       cmd.push("--include-partial-messages") if @options.include_partial_messages
       cmd.push("--fork-session") if @options.fork_session
       cmd.push("--bare") if @options.bare
+      cmd.push("--include-hook-events") if @options.include_hook_events
+      cmd.push("--strict-mcp-config") if @options.strict_mcp_config
     end
 
     def append_plugins(cmd)

data/lib/claude_agent_sdk/subprocess_cli_transport.rb

@@ -2,6 +2,7 @@
 
 require 'json'
 require 'open3'
+require 'set'
 require 'timeout'
 require_relative 'transport'
 require_relative 'errors'
@@ -15,6 +16,75 @@ module ClaudeAgentSDK
     MINIMUM_CLAUDE_CODE_VERSION = '2.0.0'
     RECENT_STDERR_LINES_LIMIT = 20
 
+    # Track live CLI subprocesses so we can terminate them when the parent Ruby
+    # process exits. Mirrors the Python (PR #916, a `set[Process]`) and
+    # TypeScript SDKs' parent-exit cleanup, preventing orphaned `claude`
+    # processes from leaking when callers crash or exit before reaching #close.
+    # A Set keyed by object identity (like Python's set) keeps the hot path
+    # off `#pid` — only #kill_active_processes touches `#pid`/`#alive?`, at exit.
+    # Guarded by a mutex because #close can run on a FiberBoundary worker thread
+    # while #connect runs on the reactor fiber.
+    # Stored in CONSTANTS (not class instance variables) so the registry is a
+    # single shared instance across this class and any subclass: constants
+    # resolve through the ancestor chain, whereas class ivars are NOT inherited
+    # — a `SubprocessCLITransport` subclass instance calling
+    # `self.class.register_active_process` would otherwise reach a nil mutex and
+    # raise mid-#connect, orphaning the just-spawned child. The base-class
+    # at_exit handler must be able to see every subprocess, a subclass's too.
+    ACTIVE_PROCESSES = Set.new
+    ACTIVE_PROCESSES_MUTEX = Mutex.new
+
+    class << self
+      # Public readers (the test suite uses `described_class.active_processes`);
+      # they return the shared constants so subclasses observe the same objects.
+      def active_processes
+        ACTIVE_PROCESSES
+      end
+
+      def active_processes_mutex
+        ACTIVE_PROCESSES_MUTEX
+      end
+
+      # +wait_thr+ is the Process::Waiter returned by Open3.popen3.
+      def register_active_process(wait_thr)
+        return unless wait_thr
+
+        active_processes_mutex.synchronize { active_processes.add(wait_thr) }
+      end
+
+      def deregister_active_process(wait_thr)
+        return unless wait_thr
+
+        active_processes_mutex.synchronize { active_processes.delete(wait_thr) }
+      end
+
+      # Best-effort SIGTERM to every still-running child. Registered with
+      # at_exit at the bottom of this file. Never reaps (a blocking wait could
+      # hang interpreter shutdown) — the OS reparents and reaps orphans.
+      #
+      # Deliberately does NOT take active_processes_mutex: at interpreter
+      # shutdown Ruby runs at_exit handlers *before* terminating other threads,
+      # and Mutex is unfair, so blocking here while a still-live worker churns
+      # register/deregister can starve this handler and hang the process. A
+      # lock-free read is safe — a torn snapshot at worst misses or repeats a
+      # SIGTERM, both harmless. The outer rescue guarantees the handler never
+      # raises (e.g. ThreadError if reached from a trap context, or a
+      # concurrent-modification error from the unlocked read), honoring the
+      # "never interrupt interpreter shutdown" contract.
+      def kill_active_processes
+        active_processes.to_a.each do |wait_thr|
+          next unless wait_thr.alive?
+
+          Process.kill('TERM', wait_thr.pid)
+        rescue StandardError
+          # Process already gone (Errno::ESRCH), not permitted, or invalid pid.
+        end
+        active_processes.clear
+      rescue StandardError
+        # Never let cleanup interfere with interpreter shutdown.
+      end
+    end
+
     def initialize(options_or_prompt = nil, options = nil)
       # Support both new single-arg form and legacy two-arg form
       @options = options.nil? ? options_or_prompt : options
@@ -104,6 +174,7 @@ module ClaudeAgentSDK
         opts = { chdir: @cwd&.to_s }.compact
 
         @stdin, @stdout, @stderr, @process = Open3.popen3(process_env, *cmd, opts)
+        self.class.register_active_process(@process)
 
         # Always drain stderr to prevent pipe buffer deadlock.
         # Without this, --verbose output fills the OS pipe buffer (~64KB),
@@ -273,6 +344,7 @@ module ClaudeAgentSDK
         warn "Claude SDK: Cleanup warnings: #{cleanup_errors.join(', ')}"
       end
 
+      self.class.deregister_active_process(@process)
       @process = nil
       @stdout = nil
       # @stdin already nilled under the mutex above.
@@ -403,6 +475,13 @@ module ClaudeAgentSDK
         returncode = nil
       end
 
+      # The child has exited and been reaped; drop it from the parent-exit
+      # registry now rather than waiting for #close, which a caller may never
+      # reach (e.g. a Client abandoned without #disconnect, or direct transport
+      # use). Idempotent — #close's own deregister becomes a harmless no-op, and
+      # #close still sees @process (left set here) for its termination logic.
+      self.class.deregister_active_process(@process)
+
       if returncode && returncode != 0
         # Wait briefly for stderr thread to finish draining
         @stderr_task&.join(1)
@@ -457,3 +536,8 @@ module ClaudeAgentSDK
     end
   end
 end
+
+# Terminate any CLI subprocess still live when the parent Ruby process exits.
+# Registered once at require time (require is idempotent). Best-effort: the
+# handler swallows all errors so it never interferes with interpreter shutdown.
+at_exit { ClaudeAgentSDK::SubprocessCLITransport.kill_active_processes }

data/lib/claude_agent_sdk/types.rb

@@ -127,7 +127,7 @@ module ClaudeAgentSDK
     end
 
     def normalize_name(name)
-      name = name.dup.to_s
+      name = name.to_s.dup
       name.gsub!(/(?<=[A-Z])(?=[A-Z][a-z])|(?<=[a-z\d])(?=[A-Z])/, "_")
       name.tr!("-", "_")
       name.downcase!
@@ -1344,17 +1344,19 @@ module ClaudeAgentSDK
 
   # Sandbox network configuration
   class SandboxNetworkConfig < Type
-    attr_accessor :allowed_domains, :allow_managed_domains_only,
+    attr_accessor :allowed_domains, :denied_domains, :allow_managed_domains_only,
                   :allow_unix_sockets, :allow_all_unix_sockets, :allow_local_binding,
-                  :http_proxy_port, :socks_proxy_port
+                  :allow_mach_lookup, :http_proxy_port, :socks_proxy_port
 
     def to_h
       result = {}
       result[:allowedDomains] = @allowed_domains if @allowed_domains
+      result[:deniedDomains] = @denied_domains if @denied_domains
       result[:allowManagedDomainsOnly] = @allow_managed_domains_only unless @allow_managed_domains_only.nil?
       result[:allowUnixSockets] = @allow_unix_sockets unless @allow_unix_sockets.nil?
       result[:allowAllUnixSockets] = @allow_all_unix_sockets unless @allow_all_unix_sockets.nil?
       result[:allowLocalBinding] = @allow_local_binding unless @allow_local_binding.nil?
+      result[:allowMachLookup] = @allow_mach_lookup if @allow_mach_lookup
       result[:httpProxyPort] = @http_proxy_port if @http_proxy_port
       result[:socksProxyPort] = @socks_proxy_port if @socks_proxy_port
       result
@@ -1477,13 +1479,16 @@ module ClaudeAgentSDK
                   :betas, :tools, :sandbox, :append_allowed_tools,
                   :thinking, :effort, :observers, :task_budget
     attr_reader :bare, :fork_session, :enable_file_checkpointing,
-                :include_partial_messages, :continue_conversation
+                :include_partial_messages, :continue_conversation,
+                :include_hook_events, :strict_mcp_config
 
     def initialize(attributes = {})
       self.fork_session = false
       self.continue_conversation = false
       self.include_partial_messages = false
       self.enable_file_checkpointing = false
+      self.include_hook_events = false
+      self.strict_mcp_config = false
 
       super(merge_with_defaults(attributes || {}))
 
@@ -1543,6 +1548,22 @@ module ClaudeAgentSDK
       @continue_conversation = coerce_boolean(value)
     end
 
+    def include_hook_events?
+      !!include_hook_events
+    end
+
+    def include_hook_events=(value)
+      @include_hook_events = coerce_boolean(value)
+    end
+
+    def strict_mcp_config?
+      !!strict_mcp_config
+    end
+
+    def strict_mcp_config=(value)
+      @strict_mcp_config = coerce_boolean(value)
+    end
+
     private
 
     # Strict key validation: unlike other Type subclasses (which silently drop

data/lib/claude_agent_sdk/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ClaudeAgentSDK
-  VERSION = '0.16.8'
+  VERSION = '0.16.10'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: claude-agent-sdk
 version: !ruby/object:Gem::Version
-  version: 0.16.8
+  version: 0.16.10
 platform: ruby
 authors:
 - Community Contributors
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-15 00:00:00.000000000 Z
+date: 2026-06-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: async