@anthropic-ai/claude-agent-sdk 0.3.197 → 0.3.199

package/manifest.json

@@ -1,47 +1,47 @@
 {
-  "version": "2.1.197",
-  "commit": "c8fd8048f30950a21d28734718275aa7e97f5143",
-  "buildDate": "2026-06-29T19:16:30Z",
+  "version": "2.1.199",
+  "commit": "968b0c4118bde7c998acd97511e68daecacd8507",
+  "buildDate": "2026-07-02T01:58:04Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "8cc0c4d1e4eb1dca3b0cc92ab02ee3505de764e023f8c901761c167b72041fb8",
-      "size": 227251472
+      "checksum": "e3cb61abc8a2ec7b98976cee1ffdde5a3fa755c9990bc8d688cd89290e0dcec0",
+      "size": 232155536
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "5e8a57cc7a92377f0744fa4c79191cf93d4b26c79cb919b07a407511fed1be26",
-      "size": 235288016
+      "checksum": "e64853ff3bc2ae6ed8115581c851e1176762d445d0b8b9e0dd37d0d560224a88",
+      "size": 240192080
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "fb48473c467c27615ac799a754f4ef0b68c363e4596cefbb59c3815d51a0cc8a",
-      "size": 242334448
+      "checksum": "14851b5170b154b01baca09bba970172e70cdd768b5a012bf347ba0f594b4ad3",
+      "size": 247184112
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "f54e69cbc89b2da61a415700af7ff52a147e862517d4f1b0eecf768448cf7f83",
-      "size": 245517112
+      "checksum": "b31dfd5e3dee23b51c42e0d8ddb405148978237d3aabc8cbbf77c5cf83367e27",
+      "size": 250383160
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "acb885610ba06d90c46206ded9b14121bc30e96affecbfb3c37d511bf02af2bd",
-      "size": 235582648
+      "checksum": "4115c07bc6dfa71affff595400599032b70b4ab25b7a2dae982341ef4da47b38",
+      "size": 240432312
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "2f610c0f81341052426981b5dc59277a33e6ec3df924071b24edbc05e6a096dc",
-      "size": 240202112
+      "checksum": "22c8b0861078cef1b572023e7eda4ce0dda7e12cc2e3060858eaa3de010bee21",
+      "size": 245068160
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "038bd9fe90c60304601e19751269a50d62925c541dd6a2b3da5274549e9416ee",
-      "size": 236121248
+      "checksum": "63de670613bb74594564a2125cb54e0e2e78192c5696e396adfae093b9132eec",
+      "size": 240716448
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "8d2baeaf77b0e79ea33cf5ce78a37e64804c3a26d63d35355a830fda404a4f61",
-      "size": 230588064
+      "checksum": "7e4900b1ce5588003e0ade6caa0aaef1e2b8efd903c5a86c671d0de258b7a4d4",
+      "size": 235182752
     }
   }
 }

package/manifest.zst.json

@@ -1,55 +1,55 @@
 {
-  "version": "2.1.197",
-  "commit": "c8fd8048f30950a21d28734718275aa7e97f5143",
-  "buildDate": "2026-06-29T19:18:17Z",
+  "version": "2.1.199",
+  "commit": "968b0c4118bde7c998acd97511e68daecacd8507",
+  "buildDate": "2026-07-02T01:59:55Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude.zst",
-      "checksum": "9b11f0d6c9ce73434bf75440eb19f339c47e099da6d53c481cda1a9c6e693a7d",
-      "size": 47889227,
+      "checksum": "6ee8d7ed4bfd7e0dd2d4f20d694cdade31df5b32cd9c667c8c1ed807832ebb00",
+      "size": 48610501,
       "bundle": {
-        "checksum": "c921aa65eb8f10a3f387a86526f97b94dee721f26b741dadf0d2357ac376c437",
-        "size": 47903450
+        "checksum": "bffd78fbb26dcc00be341109772da068ada6ad38ef0826531c6595d295b5f5a2",
+        "size": 48620700
       }
     },
     "darwin-x64": {
       "binary": "claude.zst",
-      "checksum": "a1dc9d160ae29aff4373dec60623111080fe2c645a21f25c96dd2b443ee184e6",
-      "size": 50919995,
+      "checksum": "c41a93c21b86a6e6ec5bf385732aa0594d522e3edcd82264a2b6d36185945237",
+      "size": 51631685,
       "bundle": {
-        "checksum": "f2d6011db80732e4f0850d5c27e0ce83bb4d2c4a66374072134232214dddedab",
-        "size": 50915693
+        "checksum": "cebf0ccc7298485d13d635decbbc43bff1e513a34fbef666dc539542e70486eb",
+        "size": 51645139
       }
     },
     "linux-arm64": {
       "binary": "claude.zst",
-      "checksum": "e5f4307ad01f9720878ce4088331f33722cdd610aaa1d0026260ca9ced498030",
-      "size": 55692187
+      "checksum": "c615bb15e71949249c3c2ee85d66a62a118c071be691a9f534e6f232a3b1151b",
+      "size": 56363665
     },
     "linux-x64": {
       "binary": "claude.zst",
-      "checksum": "bbb773dbaaa24c20d564ae83ce906d9b676c3ccb8f092176722bcbc5016d957b",
-      "size": 56956227
+      "checksum": "0c3f4f2a2f9dc653da2e6acc1a45967d504e8577a64b675ba8e9fcb2dcb0d24c",
+      "size": 57645371
     },
     "linux-arm64-musl": {
       "binary": "claude.zst",
-      "checksum": "55464849825a33e23de886656a1b7e2bdaa0edc21854c88f9e5468ac97997f1d",
-      "size": 54362236
+      "checksum": "85c2e1a6877beaa247a85555e0b815165d5060d8365893103aefb1dd5e9fd717",
+      "size": 55048686
     },
     "linux-x64-musl": {
       "binary": "claude.zst",
-      "checksum": "506a64a81005e1cd7b4b540061b10f6de62297a456a47070894faa994e1cf5eb",
-      "size": 55764001
+      "checksum": "b264b1b400162a528623cb93b5275d0cdcea5a7da7af09a33c9a4b101917a0c0",
+      "size": 56449012
     },
     "win32-x64": {
       "binary": "claude.exe.zst",
-      "checksum": "e5a97e820e244ddfef2f3fd61e7dbc15daed49615ab9ec7f7946256aca565456",
-      "size": 57090391
+      "checksum": "d14fc2cd93ec55e9b2d97b391be53497ce3398ed816c129a60fd617d01ab58db",
+      "size": 57765508
     },
     "win32-arm64": {
       "binary": "claude.exe.zst",
-      "checksum": "e75b4797151ea6eba808d353759b28a22d6c1cf12cc327f349fdeef414607ecc",
-      "size": 55093687
+      "checksum": "d3557e13095e4b0cb61486a861023d1235cb1f1d81c422cc69fc545d5403304e",
+      "size": 55778042
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anthropic-ai/claude-agent-sdk",
-  "version": "0.3.197",
+  "version": "0.3.199",
   "main": "sdk.mjs",
   "types": "sdk.d.ts",
   "exports": {
@@ -57,14 +57,14 @@
     "zod": "^4.0.0"
   },
   "optionalDependencies": {
-    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.197",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.197",
-    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.197",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.197",
-    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.197",
-    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.197",
-    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.197",
-    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.197"
+    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.199",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.199",
+    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.199",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.199",
+    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.199",
+    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.199",
+    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.199",
+    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.199"
   },
   "files": [
     "sdk.mjs",
@@ -80,5 +80,5 @@
     "manifest.json",
     "manifest.zst.json"
   ],
-  "claudeCodeVersion": "2.1.197"
+  "claudeCodeVersion": "2.1.199"
 }

package/sdk-tools.d.ts

@@ -29,6 +29,7 @@ export type ToolInputSchemas =
   | WebFetchInput
   | WebSearchInput
   | AskUserQuestionInput
+  | ClaudeDesignInput
   | ProjectsInput
   | EnterPlanModeInput
   | TaskCreateInput
@@ -87,6 +88,7 @@ export type ToolOutputSchemas =
   | CronDeleteOutput
   | CronListOutput
   | PushNotificationOutput
+  | ClaudeDesignOutput
   | ProjectsOutput;
 export type AgentOutput =
   | {
@@ -304,6 +306,10 @@ export type FileReadOutput =
          */
         filePath: string;
       };
+      /**
+       * Set when the dedup matched a startup-seeded entry (CLAUDE.md / nested memory) rather than a prior Read tool_result
+       */
+      source?: "seeded";
     };
 export type ListMcpResourcesOutput = {
   /**
@@ -364,9 +370,6 @@ export type ProjectsOutput =
       knowledge: {
         knowledge_size: number;
         max_knowledge_size: number;
-        search_threshold: number | null;
-        rag_active: boolean;
-        remaining_budget: number | null;
       };
     }
   | {
@@ -395,13 +398,6 @@ export type ProjectsOutput =
       path: string;
       doc_uuid: string;
       replaced: boolean;
-      knowledge: {
-        knowledge_size: number;
-        max_knowledge_size: number;
-        search_threshold: number | null;
-        rag_active: boolean;
-        remaining_budget: number | null;
-      };
     }
   | {
       method: "project_delete";
@@ -428,7 +424,7 @@ export interface AgentInput {
    */
   model?: "sonnet" | "opus" | "haiku" | "fable";
   /**
-   * Set to true to run this agent in the background. You will be notified when it completes.
+   * Agents run in the background by default; you will be notified when one completes. Set to false to run this agent synchronously when you need its result before continuing.
    */
   run_in_background?: boolean;
   /**
@@ -630,7 +626,7 @@ export interface GrepInput {
 }
 export interface TaskStopInput {
   /**
-   * The ID of the background task to stop
+   * The ID of the background task to stop. Agent-team teammates and named background agents are also accepted by agent ID or name.
    */
   task_id?: string;
   /**
@@ -716,6 +712,10 @@ export interface ReportFindingsInput {
      * Concrete inputs/state → wrong output/crash
      */
     failure_scenario: string;
+    /**
+     * Short kebab-case slug of the finding type, e.g. "correctness", "simplification", "efficiency", "test-coverage"
+     */
+    category?: string;
     /**
      * Set when a verify pass ran; absent on inline-only reviews
      */
@@ -2337,6 +2337,18 @@ export interface AskUserQuestionInput {
     source?: string;
   };
 }
+export interface ClaudeDesignInput {
+  /**
+   * Claude Design action to perform. Call with "list" first to discover the available operations and their argument schemas.
+   */
+  operation: string;
+  /**
+   * Action input object (server-validated). Pass {} for operations that take no input.
+   */
+  arguments: {
+    [k: string]: unknown;
+  };
+}
 export interface ProjectsInput {
   method: "project_info" | "project_read" | "project_search" | "project_write" | "project_delete";
   /**
@@ -2351,10 +2363,6 @@ export interface ProjectsInput {
    * project_write: a file inside the working directory to upload. The tool reads, encodes, and uploads directly — contents never enter your context. Mutually exclusive with content.
    */
   local_path?: string;
-  /**
-   * project_write: bypass the chat-injection budget guard. Set only when the write is genuinely worth degrading chat to retrieval mode for everyone in the project.
-   */
-  force?: boolean;
   /**
    * project_search: knowledge-base query
    */
@@ -2992,6 +3000,10 @@ export interface ReportFindingsOutput {
      * Concrete inputs/state → wrong output/crash
      */
     failure_scenario: string;
+    /**
+     * Short kebab-case slug of the finding type, e.g. "correctness", "simplification", "efficiency", "test-coverage"
+     */
+    category?: string;
     /**
      * Set when a verify pass ran; absent on inline-only reviews
      */
@@ -3271,6 +3283,10 @@ export interface AskUserQuestionOutput {
       notes?: string;
     };
   };
+  /**
+   * Set when the dialog auto-resolved after this many milliseconds of idle (user away from keyboard). Absent on every human-resolved path.
+   */
+  afkTimeoutMs?: number;
 }
 export interface EnterWorktreeOutput {
   worktreePath: string;
@@ -3327,7 +3343,13 @@ export interface ArtifactOutput {
   path: string;
   title?: string;
   version?: string;
-  mcpDropped?: string;
+  capabilities?: unknown;
+  stored?: {
+    contract: string;
+    capabilities?: {
+      [k: string]: unknown;
+    };
+  };
 }
 export interface RemoteTriggerOutput {
   status: number;
@@ -3474,10 +3496,15 @@ export interface PushNotificationOutput {
   pushSent?: boolean;
   localSent?: boolean;
   disabledReason?: "config_off" | "user_present" | "no_transport";
-  idleSec?: number;
-  hasFocus?: boolean;
   /**
    * ISO timestamp captured at tool execution on the emitting process. Optional — resumed sessions replay pre-sentAt outputs verbatim.
    */
   sentAt?: string;
 }
+export interface ClaudeDesignOutput {
+  operation: string;
+  content: {
+    [k: string]: unknown;
+  }[];
+  isError?: boolean;
+}

package/sdk.d.ts

@@ -188,6 +188,12 @@ export declare type BaseOutputFormat = {
 /**
  * Permission callback function for controlling tool usage.
  * Called before each tool execution to determine if it should be allowed.
+ *
+ * Return `null` ONLY after the consumer has already sent the
+ * control_response out-of-band (e.g. a signed HTTP POST echoing
+ * `requestId`); the SDK will skip its own transport write. Fail-closed: an
+ * accidental null means no control_response is sent and the tool stays
+ * blocked indefinitely — permission prompts have no park deadline.
  */
 export declare type CanUseTool = (toolName: string, input: Record<string, unknown>, options: {
     /** Signaled if the operation should be aborted. */
@@ -231,7 +237,13 @@ export declare type CanUseTool = (toolName: string, input: Record<string, unknow
     toolUseID: string;
     /** If running within the context of a sub-agent, the sub-agent's ID. */
     agentID?: string;
-}) => Promise<PermissionResult>;
+    /**
+     * The control_request envelope's `request_id`. A control_response sent
+     * out-of-band (e.g. a signed HTTP POST instead of the SDK's WS write)
+     * must echo this value for the worker to match it.
+     */
+    requestId: string;
+}) => Promise<PermissionResult | null>;
 
 export declare type ConfigChangeHookInput = BaseHookInput & {
     hook_event_name: 'ConfigChange';
@@ -985,6 +997,7 @@ export declare type McpHttpServerConfig = {
      * Per-server tool-call timeout in milliseconds. Overrides the MCP_TOOL_TIMEOUT environment variable for this server. Hard wall-clock limit per call; progress notifications do not extend it. Values below 1000ms are ignored (falls through to MCP_TOOL_TIMEOUT or the default).
      */
     timeout?: number;
+
     /**
      * When true, all tools from this server are always included in the prompt and never deferred behind tool search. Equivalent to setting defer_loading: false on the API. Default: tools are deferred when tool search is enabled. As a side effect this also blocks startup until the server is connected (capped at the standard 5s connect timeout) even though MCP startup is otherwise non-blocking by default, since the tools must be present when the turn-1 prompt is built.
      */
@@ -1099,6 +1112,7 @@ export declare type McpSSEServerConfig = {
      * Per-server tool-call timeout in milliseconds. Overrides the MCP_TOOL_TIMEOUT environment variable for this server. Hard wall-clock limit per call; progress notifications do not extend it. Values below 1000ms are ignored (falls through to MCP_TOOL_TIMEOUT or the default).
      */
     timeout?: number;
+
     /**
      * When true, all tools from this server are always included in the prompt and never deferred behind tool search. Equivalent to setting defer_loading: false on the API. Default: tools are deferred when tool search is enabled. As a side effect this also blocks startup until the server is connected (capped at the standard 5s connect timeout) even though MCP startup is otherwise non-blocking by default, since the tools must be present when the turn-1 prompt is built.
      */
@@ -2615,8 +2629,13 @@ declare const SandboxCredentialsConfigSchema: () => z.ZodOptional<z.ZodObject<{
     }, z.core.$strip>>>;
     envVars: z.ZodOptional<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
-        mode: z.ZodLiteral<"deny">;
+        mode: z.ZodEnum<{
+            deny: "deny";
+            mask: "mask";
+        }>;
+        injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>>;
+    allowPlaintextInject: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>>;
 
 export declare type SandboxFilesystemConfig = NonNullable<z.infer<ReturnType<typeof SandboxFilesystemConfigSchema>>>;
@@ -2694,8 +2713,13 @@ declare const SandboxSettingsSchema: () => z.ZodObject<{
         }, z.core.$strip>>>;
         envVars: z.ZodOptional<z.ZodArray<z.ZodObject<{
             name: z.ZodString;
-            mode: z.ZodLiteral<"deny">;
+            mode: z.ZodEnum<{
+                deny: "deny";
+                mask: "mask";
+            }>;
+            injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>>>;
+        allowPlaintextInject: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     ignoreViolations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
     enableWeakerNestedSandbox: z.ZodOptional<z.ZodBoolean>;
@@ -3302,6 +3326,13 @@ declare type SDKControlInterruptRequest = {
 
 };
 
+/**
+ * Requests the worker's selectable model catalog. Fulfills the caps.modelCatalog capability: in a remote thin-client session the worker's provider, settings cascade, and enforcement policy decide which models the session can run, so the thin client must ask rather than read its own getModelOptions().
+ */
+declare type SDKControlListModelsRequest = {
+    subtype: 'list_models';
+};
+
 /**
  * Invokes an MCP tool via the subprocess MCP client without a model turn. No permission check (control channel is trusted, same as other subtypes). SDK-type MCP servers (config.type === "sdk") are rejected — they are caller-provided, so the caller can invoke them directly without the subprocess round-trip. Result content passes through the same processing as model-turn MCP calls. Session expiry is not retried automatically; callers can mcp_reconnect and retry. UrlElicitationRequired (-32042) tries Elicitation hooks; if no hook resolves, the call errors with the URL in the message — open it out-of-band, then retry mcp_call.
  */
@@ -3378,6 +3409,10 @@ declare type SDKControlPermissionRequest = {
     tool_use_id: string;
     agent_id?: string;
     description?: string;
+    /**
+     * True when the tool's approval card IS the user-interaction surface (Tool.requiresUserInteraction()). SDK hosts must not offer one-tap Approve/Deny for these — the user has to open the session and respond on the card itself.
+     */
+    requires_user_interaction?: boolean;
 };
 
 /**
@@ -3467,7 +3502,7 @@ export declare type SDKControlRequest = {
     request: SDKControlRequestInner;
 };
 
-declare type SDKControlRequestInner = SDKControlInterruptRequest | SDKControlPermissionRequest | SDKControlInitializeRequest | SDKControlSetPermissionModeRequest | SDKControlSetModelRequest | SDKControlSetMaxThinkingTokensRequest | SDKControlRenameSessionRequest | SDKControlSetColorRequest | SDKControlMcpStatusRequest | SDKControlGetContextUsageRequest | SDKControlGetSessionCostRequest | SDKControlGetUsageRequest | SDKControlGetBinaryVersionRequest | SDKControlMcpCallRequest | SDKControlFileSuggestionsRequest | SDKHookCallbackRequest | SDKControlMcpMessageRequest | SDKControlRewindFilesRequest | SDKControlCancelAsyncMessageRequest | SDKControlReadFileRequest | SDKControlSeedReadStateRequest | SDKControlMcpSetServersRequest | SDKControlRegisterRepoRootRequest | SDKControlReloadPluginsRequest | SDKControlReloadSkillsRequest | SDKControlMcpReconnectRequest | SDKControlMcpToggleRequest | SDKControlSetMcpPermissionModeOverrideRequest | SDKControlRewindConversationRequest | SDKControlChannelEnableRequest | SDKControlEndSessionRequest | SDKControlMcpAuthenticateRequest | SDKControlMcpClearAuthRequest | SDKControlMcpOAuthCallbackUrlRequest | SDKControlClaudeAuthenticateRequest | SDKControlClaudeOAuthCallbackRequest | SDKControlClaudeOAuthWaitForCompletionRequest | SDKControlRemoteControlRequest | SDKControlGenerateSessionTitleRequest | SDKControlSideQuestionRequest | SDKControlUltrareviewLaunchRequest | SDKControlStageFileRequest | SDKControlAddDirectoryRequest | SDKControlMessageRatedRequest | SDKControlOAuthTokenRefreshRequest | SDKControlHostAuthTokenRefreshRequest | SDKControlStopTaskRequest | SDKControlBackgroundTasksRequest | SDKControlApplyFlagSettingsRequest | SDKControlGetSettingsRequest | SDKControlElicitationRequest | SDKControlRequestUserDialogRequest | SDKControlSubmitFeedbackRequest;
+declare type SDKControlRequestInner = SDKControlInterruptRequest | SDKControlPermissionRequest | SDKControlInitializeRequest | SDKControlSetPermissionModeRequest | SDKControlSetModelRequest | SDKControlSetMaxThinkingTokensRequest | SDKControlRenameSessionRequest | SDKControlSetColorRequest | SDKControlMcpStatusRequest | SDKControlGetContextUsageRequest | SDKControlGetSessionCostRequest | SDKControlListModelsRequest | SDKControlGetUsageRequest | SDKControlGetBinaryVersionRequest | SDKControlMcpCallRequest | SDKControlFileSuggestionsRequest | SDKHookCallbackRequest | SDKControlMcpMessageRequest | SDKControlRewindFilesRequest | SDKControlCancelAsyncMessageRequest | SDKControlReadFileRequest | SDKControlGetWorkspaceDiffRequest | SDKControlGetPlanRequest | SDKControlSeedReadStateRequest | SDKControlMcpSetServersRequest | SDKControlRegisterRepoRootRequest | SDKControlReloadPluginsRequest | SDKControlReloadSkillsRequest | SDKControlMcpReconnectRequest | SDKControlMcpToggleRequest | SDKControlSetMcpPermissionModeOverrideRequest | SDKControlRewindConversationRequest | SDKControlChannelEnableRequest | SDKControlEndSessionRequest | SDKControlMcpAuthenticateRequest | SDKControlMcpClearAuthRequest | SDKControlMcpOAuthCallbackUrlRequest | SDKControlClaudeAuthenticateRequest | SDKControlClaudeOAuthCallbackRequest | SDKControlClaudeOAuthWaitForCompletionRequest | SDKControlRemoteControlRequest | SDKControlGenerateSessionTitleRequest | SDKControlSideQuestionRequest | SDKControlUltrareviewLaunchRequest | SDKControlStageFileRequest | SDKControlAddDirectoryRequest | SDKControlMessageRatedRequest | SDKControlOAuthTokenRefreshRequest | SDKControlHostAuthTokenRefreshRequest | SDKControlStopTaskRequest | SDKControlBackgroundTasksRequest | SDKControlApplyFlagSettingsRequest | SDKControlGetSettingsRequest | SDKControlElicitationRequest | SDKControlRequestUserDialogRequest | SDKControlSubmitFeedbackRequest;
 
 /**
  * Requests the SDK consumer to render a tool-driven blocking dialog and return the user choice. Used by tools that previously rendered Ink JSX via setToolJSX with an onDone callback.
@@ -3724,7 +3759,7 @@ export declare type SDKMemoryRecallMessage = {
     session_id: string;
 };
 
-export declare type SDKMessage = SDKAssistantMessage | SDKUserMessage | SDKUserMessageReplay | SDKResultMessage | SDKSystemMessage | SDKPartialAssistantMessage | SDKCompactBoundaryMessage | SDKStatusMessage | SDKAPIRetryMessage | SDKModelRefusalFallbackMessage | SDKModelRefusalNoFallbackMessage | SDKLocalCommandOutputMessage | SDKHookStartedMessage | SDKHookProgressMessage | SDKHookResponseMessage | SDKPluginInstallMessage | SDKToolProgressMessage | SDKAuthStatusMessage | SDKTaskNotificationMessage | SDKTaskStartedMessage | SDKTaskUpdatedMessage | SDKTaskProgressMessage | SDKThinkingTokensMessage | SDKSessionStateChangedMessage | SDKWorkerShuttingDownMessage | SDKCommandsChangedMessage | SDKNotificationMessage | SDKFilesPersistedEvent | SDKToolUseSummaryMessage | SDKMemoryRecallMessage | SDKRateLimitEvent | SDKElicitationCompleteMessage | SDKPermissionDeniedMessage | SDKPromptSuggestionMessage | SDKMirrorErrorMessage | SDKInformationalMessage;
+export declare type SDKMessage = SDKAssistantMessage | SDKUserMessage | SDKUserMessageReplay | SDKResultMessage | SDKSystemMessage | SDKPartialAssistantMessage | SDKCompactBoundaryMessage | SDKStatusMessage | SDKAPIRetryMessage | SDKControlRequestProgressMessage | SDKModelRefusalFallbackMessage | SDKModelRefusalNoFallbackMessage | SDKLocalCommandOutputMessage | SDKHookStartedMessage | SDKHookProgressMessage | SDKHookResponseMessage | SDKPluginInstallMessage | SDKToolProgressMessage | SDKAuthStatusMessage | SDKTaskNotificationMessage | SDKTaskStartedMessage | SDKTaskUpdatedMessage | SDKTaskProgressMessage | SDKThinkingTokensMessage | SDKSessionStateChangedMessage | SDKWorkerShuttingDownMessage | SDKCommandsChangedMessage | SDKNotificationMessage | SDKFilesPersistedEvent | SDKToolUseSummaryMessage | SDKMemoryRecallMessage | SDKRateLimitEvent | SDKElicitationCompleteMessage | SDKPermissionDeniedMessage | SDKPromptSuggestionMessage | SDKMirrorErrorMessage | SDKInformationalMessage | SDKConversationResetMessage;
 
 /**
  * Provenance of a user-role message (peer session, team lead, channel). Absent or `human` means keyboard input from the user.
@@ -5023,7 +5058,7 @@ export declare interface Settings {
      */
     disableArtifact?: boolean;
     /**
-     * Enable or disable the Artifact tool for this user. Unset = default by plan once the feature is available.
+     * Enable or disable the Artifact tool for this user. Unset defaults to enabled once the feature is available.
      */
     enableArtifact?: boolean;
     /**
@@ -5804,7 +5839,7 @@ export declare interface Settings {
             httpProxyPort?: number;
             socksProxyPort?: number;
             /**
-             * [EXPERIMENTAL] Enable in-process TLS termination so the per-request filter can see HTTPS request bodies. Provide a CA cert+key, or omit both to have sandbox-runtime generate an ephemeral one for the session.
+             * [EXPERIMENTAL] Enable in-process TLS termination so the per-request filter can see HTTPS request bodies. Provide a CA cert+key, or omit both to have sandbox-runtime generate an ephemeral one for the session. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored.
              */
             tlsTerminate?: {
                 caCertPath?: string;
@@ -5848,7 +5883,7 @@ export declare interface Settings {
                 mode: 'deny';
             }[];
             /**
-             * Environment variables to protect. `deny` unsets the variable for sandboxed commands.
+             * Environment variables to protect. `deny` unsets the variable for sandboxed commands; `mask` substitutes a sentinel inside the sandbox and injects the real value at the proxy.
              */
             envVars?: {
                 /**
@@ -5856,10 +5891,18 @@ export declare interface Settings {
                  */
                 name: string;
                 /**
-                 * Access mode for this environment variable. Only `deny` is supported.
+                 * Access mode for this environment variable. `deny` unsets the variable for sandboxed commands; `mask` shows sandboxed commands a sentinel value and the host proxy swaps sentinel→real on egress to `injectHosts`.
                  */
-                mode: 'deny';
+                mode: 'deny' | 'mask';
+                /**
+                 * Optional narrowing of where the proxy substitutes this credential. Only meaningful when mode is `mask`; accepted but ignored for `deny`. If unset, defaults to `network.allowedDomains` — the credential is injected at every reachable host. Each entry must be reachable via `network.allowedDomains` (sandbox-runtime validates this).
+                 */
+                injectHosts?: string[];
             }[];
+            /**
+             * Allow sentinel→real substitution on the plain-HTTP proxy path. Defaults to false: without TLS termination the upstream identity is unverified and the credential travels in cleartext. Set only for trusted-network test fixtures. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored.
+             */
+            allowPlaintextInject?: boolean;
         };
         ignoreViolations?: {
             [k: string]: string[];
@@ -6340,7 +6383,7 @@ export declare function startup(_params?: {
     initializeTimeoutMs?: number;
 }): Promise<WarmQuery>;
 
-declare type StdoutMessage = coreTypes.SDKMessage | coreTypes.SDKPostTurnSummaryMessage | coreTypes.SDKTaskSummaryMessage | coreTypes.SDKTranscriptMirrorMessage | SDKControlResponse | SDKControlRequest | SDKControlCancelRequest | SDKKeepAliveMessage;
+declare type StdoutMessage = coreTypes.SDKMessage | coreTypes.SDKPostTurnSummaryMessage | coreTypes.SDKTaskSummaryMessage | coreTypes.SDKTranscriptMirrorMessage | coreTypes.SDKActiveGoalMessage | SDKControlResponse | SDKControlRequest | SDKControlCancelRequest | SDKKeepAliveMessage;
 
 export declare type StopFailureHookInput = BaseHookInput & {
     hook_event_name: 'StopFailure';