@anthropic-ai/claude-agent-sdk 0.3.186 → 0.3.187

package/manifest.json

@@ -1,47 +1,47 @@
 {
-  "version": "2.1.186",
-  "commit": "6a56aff51d9e9faf62f26f2748501c2e32eec5e8",
-  "buildDate": "2026-06-22T16:51:01Z",
+  "version": "2.1.187",
+  "commit": "6a53320fad5541a68d79e4b6c53677df77b98e33",
+  "buildDate": "2026-06-23T17:07:42Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "463a79cc34a9787cff1b3361b4ec9e2dff928c18b077f41f0bb412e4cda78637",
-      "size": 216811232
+      "checksum": "a59a16ba4922adab7a145728f215d042184d349f5f7e72cddb7fc114250a4ce3",
+      "size": 215994048
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "9e17e23d451cbbc64cf4b9536c1d25efd86808512617c855091fa608f77c9899",
-      "size": 224349952
+      "checksum": "7f57b6935b4246d03cb7acee90dc22153083483a267da589c5c920dd04744c36",
+      "size": 224795776
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "817e5ff483568b78c49171be317b9b9190cade77248a5776e912789312961cb6",
-      "size": 231782112
+      "checksum": "b49be8a5e565bf2d45b50d2de62017b25462131acc9425d2fdb98b8f29c9dce2",
+      "size": 232240864
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "6a6d5d23486597c93138941c9b68caa0fbcd2dcedbf49e29a9c8d83e3a1cb329",
-      "size": 234436392
+      "checksum": "bb02fcb33626f8c599d10d8bee38585d4cf8d4225c3b497869dee7454e7bf361",
+      "size": 234874664
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "24906d06ab4cf312eb30a8d656a8d8c7fb22099ea8eb974e38ecfbc25d6631aa",
-      "size": 225161416
+      "checksum": "972fc2e0bc8104edb593ce7723d4414c0ed8e4df6d90ad26ae48097b1d910478",
+      "size": 225620168
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "d0cb255cfb03513f6099af40f045b5852a1d8a1b59d0f405d84d2a01da6c9598",
-      "size": 229420432
+      "checksum": "c5a783d13aac71d42324f2e9dcd395c266bd5774951faf0d94855c737024bee3",
+      "size": 229858704
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "6a286f0795d6dd46187b86e9124f819af35319169901cd883b80a75c47469516",
-      "size": 225908896
+      "checksum": "24964d08c5100bac6071352e5837101b333de1c1afefd2b8b0e7a60db6c0ef5c",
+      "size": 226329760
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "245869d5e5242aabfde49b091628aa4b3e7546f2cac52e1d6feb221a820910bc",
-      "size": 220571808
+      "checksum": "04124c0ba09ece85a856de652e84386094c372f002ff767a94d4a43ecf776f96",
+      "size": 220992160
     }
   }
 }

package/manifest.zst.json

@@ -1,55 +1,55 @@
 {
-  "version": "2.1.186",
-  "commit": "6a56aff51d9e9faf62f26f2748501c2e32eec5e8",
-  "buildDate": "2026-06-22T16:52:43Z",
+  "version": "2.1.187",
+  "commit": "6a53320fad5541a68d79e4b6c53677df77b98e33",
+  "buildDate": "2026-06-23T17:09:24Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude.zst",
-      "checksum": "07281b2cab5a467352dc77e40899914eb5efb81137b9e97f6983079b6746ae08",
-      "size": 45639919,
+      "checksum": "658417c6e9f5d76f407ee1bb04220fa6dd02333b1f8ce50bf1a7340efec64f61",
+      "size": 44489766,
       "bundle": {
-        "checksum": "44e74a8a2110fe7a88dfeb371b6d2b0df63903f83f19419410334a9202a8b332",
-        "size": 45639282
+        "checksum": "2c83be71c9f40ed86a806574ae5ef3aa99aff9735a8aaec65922d495e1e148d7",
+        "size": 44493483
       }
     },
     "darwin-x64": {
       "binary": "claude.zst",
-      "checksum": "32ebbd1ffbe914c9bb0f600ddb511b5642c31069ec01a847a619d67b9438373d",
-      "size": 48559422,
+      "checksum": "9d52d2b3c1c85c83dbb9fc81be4c73f2bd2d1c09b44e5c8924c9233f4a16b3e0",
+      "size": 48636051,
       "bundle": {
-        "checksum": "10c0d811088ee49170650dc5e6599a379bb6d37e2bf8b2bde8f9671609d585c9",
-        "size": 48557611
+        "checksum": "43f31b4d6b04a5bf8fbe8a9b200cbf592e5e8f74616d86dd2bb3cf94dd7b1fe4",
+        "size": 48631278
       }
     },
     "linux-arm64": {
       "binary": "claude.zst",
-      "checksum": "6d616cbcbb349b9b8764ad820843ebcaad98af6129a3e4d530a02dab4c2036bf",
-      "size": 53453835
+      "checksum": "dc5f7e6752374a06fb74fb222ad76d02af72acfe40c53365440b4a4b936ab890",
+      "size": 53511490
     },
     "linux-x64": {
       "binary": "claude.zst",
-      "checksum": "87f8367e30e00b8115e72385d4f9b9280bc1ad6e58340837665917a4c411fc89",
-      "size": 54685312
+      "checksum": "a209a9ed0af46b40691c271eceb69a7a8ba1d6e97e6899dc6cc93977751bcf86",
+      "size": 54745022
     },
     "linux-arm64-musl": {
       "binary": "claude.zst",
-      "checksum": "b09a5bbd670219eb7c17fa2e3c6e73eb6508793cbda6a107228a67d8405ce03e",
-      "size": 52162612
+      "checksum": "7a9e8659ab4edace5b364c102a5bfc0ddd4fc2ba48b83e30b5564d77c0b93da1",
+      "size": 52225691
     },
     "linux-x64-musl": {
       "binary": "claude.zst",
-      "checksum": "81a4518daa09109072f688b7ceca9c1bc9331d52b62a925fcd6bece56f725cf1",
-      "size": 53474357
+      "checksum": "5ee81053b67a0418a6035b814b689cc6158054757e503643d182892ac64d2920",
+      "size": 53549455
     },
     "win32-x64": {
       "binary": "claude.exe.zst",
-      "checksum": "8b2e906b70df6847bcb43434bb65e029de2cf0b9ed440ab63026647f2c56f004",
-      "size": 54900732
+      "checksum": "d3574e6f0e5d901724d3843e1d6dc0f1c6ddc1e14dbd30e733a582fc03698c43",
+      "size": 54983558
     },
     "win32-arm64": {
       "binary": "claude.exe.zst",
-      "checksum": "6af44d4ecf904ac01b327a617602914584cd9ce71b84b5aac5f56034ec5a1350",
-      "size": 52984388
+      "checksum": "81830e155993db5f756f6f29f58bad01c6b72473033534f43941739d2527fbe5",
+      "size": 53030291
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anthropic-ai/claude-agent-sdk",
-  "version": "0.3.186",
+  "version": "0.3.187",
   "main": "sdk.mjs",
   "types": "sdk.d.ts",
   "exports": {
@@ -57,14 +57,14 @@
     "zod": "^4.0.0"
   },
   "optionalDependencies": {
-    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.186",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.186",
-    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.186",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.186",
-    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.186",
-    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.186",
-    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.186",
-    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.186"
+    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.187",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.187",
+    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.187",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.187",
+    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.187",
+    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.187",
+    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.187",
+    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.187"
   },
   "files": [
     "sdk.mjs",
@@ -80,5 +80,5 @@
     "manifest.json",
     "manifest.zst.json"
   ],
-  "claudeCodeVersion": "2.1.186"
+  "claudeCodeVersion": "2.1.187"
 }

package/sdk.d.ts

@@ -270,6 +270,7 @@ declare type ControlResponse = {
 
 declare namespace coreTypes {
     export {
+        SandboxCredentialsConfig,
         SandboxFilesystemConfig,
         SandboxIgnoreViolations,
         SandboxNetworkConfig,
@@ -2197,6 +2198,25 @@ export declare interface Query extends AsyncGenerator<SDKMessage, void> {
      * @param mode - The new permission mode to set
      */
     setPermissionMode(mode: PermissionMode): Promise<void>;
+    /**
+     * Pin (or clear, with mode:null) a per-MCP-server permission-mode
+     * override. Tighten-only: only 'default' | 'auto' | null are accepted;
+     * the override applies only when the session mode would already
+     * auto-allow (bypassPermissions/auto), so it can never widen privilege.
+     * Only available in streaming input mode.
+     *
+     * @param serverName - The MCP server name (must match the name the server
+     *   was registered under)
+     * @param mode - 'default' to force per-action prompts, 'auto' to route
+     *   through the auto-mode classifier, or null to clear the override
+     * @returns An object with an optional `warning` — set when `serverName`
+     *   does not match any currently known MCP server. For a set, the
+     *   override is stored regardless and applies once a server with that
+     *   exact name connects; the warning is informational (typo detection).
+     */
+    setMcpPermissionModeOverride(serverName: string, mode: 'default' | 'auto' | null): Promise<{
+        warning?: string;
+    }>;
     /**
      * Change the model used for subsequent responses.
      * Only available in streaming input mode.
@@ -2548,6 +2568,38 @@ export declare type RewindFilesResult = {
     deletions?: number;
 };
 
+export declare type SandboxCredentialsConfig = NonNullable<z.infer<ReturnType<typeof SandboxCredentialsConfigSchema>>>;
+
+/**
+ * Credentials configuration schema for sandbox.
+ *
+ * Declares credential sources (files/directories and environment variables)
+ * to protect. Every entry carries `mode: 'deny'`: file paths are denied for
+ * reads inside the sandbox, environment variables are unset in sandboxed
+ * commands.
+ *
+ * Only explicitly declared sources are affected — sandbox-runtime ships no
+ * built-in credential deny list, so entries here are the complete set of
+ * credential restrictions applied to sandboxed commands.
+ *
+ * Mode is `deny`-only — no `mask`. Claude Code hands this config to
+ * sandbox-runtime programmatically, bypassing sandbox-runtime's own Zod
+ * validation, and on that path unsupported modes are silently ignored rather
+ * than rejected. This schema must be the gate that rejects modes
+ * sandbox-runtime can't enforce yet; widen the mode (e.g. `mask`) only once
+ * a sandbox-runtime version that enforces it ships.
+ */
+declare const SandboxCredentialsConfigSchema: () => z.ZodOptional<z.ZodObject<{
+    files: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        mode: z.ZodLiteral<"deny">;
+    }, z.core.$strip>>>;
+    envVars: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        mode: z.ZodLiteral<"deny">;
+    }, z.core.$strip>>>;
+}, z.core.$strip>>;
+
 export declare type SandboxFilesystemConfig = NonNullable<z.infer<ReturnType<typeof SandboxFilesystemConfigSchema>>>;
 
 /**
@@ -2616,6 +2668,16 @@ declare const SandboxSettingsSchema: () => z.ZodObject<{
         allowRead: z.ZodOptional<z.ZodArray<z.ZodString>>;
         allowManagedReadPathsOnly: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
+    credentials: z.ZodOptional<z.ZodObject<{
+        files: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            mode: z.ZodLiteral<"deny">;
+        }, z.core.$strip>>>;
+        envVars: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            mode: z.ZodLiteral<"deny">;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
     ignoreViolations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
     enableWeakerNestedSandbox: z.ZodOptional<z.ZodBoolean>;
     enableWeakerNetworkIsolation: z.ZodOptional<z.ZodBoolean>;
@@ -3374,7 +3436,7 @@ export declare type SDKControlRequest = {
     request: SDKControlRequestInner;
 };
 
-declare type SDKControlRequestInner = SDKControlInterruptRequest | SDKControlPermissionRequest | SDKControlInitializeRequest | SDKControlSetPermissionModeRequest | SDKControlSetModelRequest | SDKControlSetMaxThinkingTokensRequest | SDKControlRenameSessionRequest | SDKControlSetColorRequest | SDKControlMcpStatusRequest | SDKControlGetContextUsageRequest | SDKControlGetSessionCostRequest | SDKControlGetUsageRequest | SDKControlGetBinaryVersionRequest | SDKControlMcpCallRequest | SDKControlFileSuggestionsRequest | SDKHookCallbackRequest | SDKControlMcpMessageRequest | SDKControlRewindFilesRequest | SDKControlCancelAsyncMessageRequest | SDKControlReadFileRequest | SDKControlSeedReadStateRequest | SDKControlMcpSetServersRequest | SDKControlRegisterRepoRootRequest | SDKControlReloadPluginsRequest | SDKControlReloadSkillsRequest | SDKControlMcpReconnectRequest | SDKControlMcpToggleRequest | SDKControlSetMcpPermissionModeOverrideRequest | SDKControlRewindConversationRequest | SDKControlChannelEnableRequest | SDKControlEndSessionRequest | SDKControlMcpAuthenticateRequest | SDKControlMcpClearAuthRequest | SDKControlMcpOAuthCallbackUrlRequest | SDKControlClaudeAuthenticateRequest | SDKControlClaudeOAuthCallbackRequest | SDKControlClaudeOAuthWaitForCompletionRequest | SDKControlRemoteControlRequest | SDKControlGenerateSessionTitleRequest | SDKControlSideQuestionRequest | SDKControlUltrareviewLaunchRequest | SDKControlStageFileRequest | SDKControlMessageRatedRequest | SDKControlOAuthTokenRefreshRequest | SDKControlHostAuthTokenRefreshRequest | SDKControlStopTaskRequest | SDKControlBackgroundTasksRequest | SDKControlApplyFlagSettingsRequest | SDKControlGetSettingsRequest | SDKControlElicitationRequest | SDKControlRequestUserDialogRequest | SDKControlSubmitFeedbackRequest;
+declare type SDKControlRequestInner = SDKControlInterruptRequest | SDKControlPermissionRequest | SDKControlInitializeRequest | SDKControlSetPermissionModeRequest | SDKControlSetModelRequest | SDKControlSetMaxThinkingTokensRequest | SDKControlRenameSessionRequest | SDKControlSetColorRequest | SDKControlMcpStatusRequest | SDKControlGetContextUsageRequest | SDKControlGetSessionCostRequest | SDKControlGetUsageRequest | SDKControlGetBinaryVersionRequest | SDKControlMcpCallRequest | SDKControlFileSuggestionsRequest | SDKHookCallbackRequest | SDKControlMcpMessageRequest | SDKControlRewindFilesRequest | SDKControlCancelAsyncMessageRequest | SDKControlReadFileRequest | SDKControlSeedReadStateRequest | SDKControlMcpSetServersRequest | SDKControlRegisterRepoRootRequest | SDKControlReloadPluginsRequest | SDKControlReloadSkillsRequest | SDKControlMcpReconnectRequest | SDKControlMcpToggleRequest | SDKControlSetMcpPermissionModeOverrideRequest | SDKControlRewindConversationRequest | SDKControlChannelEnableRequest | SDKControlEndSessionRequest | SDKControlMcpAuthenticateRequest | SDKControlMcpClearAuthRequest | SDKControlMcpOAuthCallbackUrlRequest | SDKControlClaudeAuthenticateRequest | SDKControlClaudeOAuthCallbackRequest | SDKControlClaudeOAuthWaitForCompletionRequest | SDKControlRemoteControlRequest | SDKControlGenerateSessionTitleRequest | SDKControlSideQuestionRequest | SDKControlUltrareviewLaunchRequest | SDKControlStageFileRequest | SDKControlAddDirectoryRequest | SDKControlMessageRatedRequest | SDKControlOAuthTokenRefreshRequest | SDKControlHostAuthTokenRefreshRequest | SDKControlStopTaskRequest | SDKControlBackgroundTasksRequest | SDKControlApplyFlagSettingsRequest | SDKControlGetSettingsRequest | SDKControlElicitationRequest | SDKControlRequestUserDialogRequest | SDKControlSubmitFeedbackRequest;
 
 /**
  * Requests the SDK consumer to render a tool-driven blocking dialog and return the user choice. Used by tools that previously rendered Ink JSX via setToolJSX with an onDone callback.
@@ -5712,6 +5774,34 @@ export declare interface Settings {
              */
             allowManagedReadPathsOnly?: boolean;
         };
+        credentials?: {
+            /**
+             * Credential files or directories to protect. `deny` blocks reads inside the sandbox.
+             */
+            files?: {
+                /**
+                 * Path to a credential file or directory. Same resolution as sandbox.filesystem.* paths: absolute, ~ expanded, or relative to the settings file root (project root for project settings, ~/.claude for user settings).
+                 */
+                path: string;
+                /**
+                 * Access mode for this path. Only `deny` is supported.
+                 */
+                mode: 'deny';
+            }[];
+            /**
+             * Environment variables to protect. `deny` unsets the variable for sandboxed commands.
+             */
+            envVars?: {
+                /**
+                 * Environment variable name.
+                 */
+                name: string;
+                /**
+                 * Access mode for this environment variable. Only `deny` is supported.
+                 */
+                mode: 'deny';
+            }[];
+        };
         ignoreViolations?: {
             [k: string]: string[];
         };