@anthropic-ai/claude-agent-sdk 0.3.198 → 0.3.199

package/manifest.json

@@ -1,47 +1,47 @@
 {
-  "version": "2.1.198",
-  "commit": "b80c496480ebf28e6dfe755cf0b8e3dd1d7cba1f",
-  "buildDate": "2026-07-01T06:17:25Z",
+  "version": "2.1.199",
+  "commit": "968b0c4118bde7c998acd97511e68daecacd8507",
+  "buildDate": "2026-07-02T01:58:04Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "ab6f7ee109816ede414f7c285446633f805b623aa609f425609a64266451d61e",
-      "size": 229328464
+      "checksum": "e3cb61abc8a2ec7b98976cee1ffdde5a3fa755c9990bc8d688cd89290e0dcec0",
+      "size": 232155536
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "280b6cfc60dacc4caed31af1249e53c259c01759556e60633944c02405c82dd0",
-      "size": 238706000
+      "checksum": "e64853ff3bc2ae6ed8115581c851e1176762d445d0b8b9e0dd37d0d560224a88",
+      "size": 240192080
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "99b50a6f2b1f3ef07bcaf1e58a2f9883c470c84e428afa321972b1aa20372e9a",
-      "size": 245742320
+      "checksum": "14851b5170b154b01baca09bba970172e70cdd768b5a012bf347ba0f594b4ad3",
+      "size": 247184112
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "7066af42a5fe93038c13af5072d4c034dc3928092cb121fdd892c76b94b6b84d",
-      "size": 248900408
+      "checksum": "b31dfd5e3dee23b51c42e0d8ddb405148978237d3aabc8cbbf77c5cf83367e27",
+      "size": 250383160
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "88cb391085e419457569bcc57a672f734f30b424e17df7323f3bbb421238e801",
-      "size": 238990520
+      "checksum": "4115c07bc6dfa71affff595400599032b70b4ab25b7a2dae982341ef4da47b38",
+      "size": 240432312
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "42892159a03bee492926b616b1270313544f7a52b68d32cb680e91984a4c6659",
-      "size": 243589504
+      "checksum": "22c8b0861078cef1b572023e7eda4ce0dda7e12cc2e3060858eaa3de010bee21",
+      "size": 245068160
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "6afd07cb03aa981c5e918808f53a1e2b729015b695122a944f6e41aaf5393933",
-      "size": 239292064
+      "checksum": "63de670613bb74594564a2125cb54e0e2e78192c5696e396adfae093b9132eec",
+      "size": 240716448
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "10a6d21332f674c87f52b1dc09926945d0169f1bb82aced84ada100639ab70bc",
-      "size": 233758880
+      "checksum": "7e4900b1ce5588003e0ade6caa0aaef1e2b8efd903c5a86c671d0de258b7a4d4",
+      "size": 235182752
     }
   }
 }

package/manifest.zst.json

@@ -1,55 +1,55 @@
 {
-  "version": "2.1.198",
-  "commit": "b80c496480ebf28e6dfe755cf0b8e3dd1d7cba1f",
-  "buildDate": "2026-07-01T06:19:10Z",
+  "version": "2.1.199",
+  "commit": "968b0c4118bde7c998acd97511e68daecacd8507",
+  "buildDate": "2026-07-02T01:59:55Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude.zst",
-      "checksum": "7bc5ee873344f53ca0ea0d7ae48c77c3787aa8f437d5aeb33a6a6d83ab8d813f",
-      "size": 47036104,
+      "checksum": "6ee8d7ed4bfd7e0dd2d4f20d694cdade31df5b32cd9c667c8c1ed807832ebb00",
+      "size": 48610501,
       "bundle": {
-        "checksum": "e84cec46ebd581937b5128e7be4f3e8788b13947bf4040a699d3404478f4bc57",
-        "size": 47034441
+        "checksum": "bffd78fbb26dcc00be341109772da068ada6ad38ef0826531c6595d295b5f5a2",
+        "size": 48620700
       }
     },
     "darwin-x64": {
       "binary": "claude.zst",
-      "checksum": "b70b7a3d9f3fdb675e119bca0c1632d810aacdefadee1da5e82ebb77cbabd124",
-      "size": 51377668,
+      "checksum": "c41a93c21b86a6e6ec5bf385732aa0594d522e3edcd82264a2b6d36185945237",
+      "size": 51631685,
       "bundle": {
-        "checksum": "c8eb65cce724f80d4467c9850e0643cbab91e1d66fa88b21ea17f398c7835d50",
-        "size": 51390885
+        "checksum": "cebf0ccc7298485d13d635decbbc43bff1e513a34fbef666dc539542e70486eb",
+        "size": 51645139
       }
     },
     "linux-arm64": {
       "binary": "claude.zst",
-      "checksum": "4d9f42ab338ead6a6e9b9738a6d1ec7ba9a0737acbc8cf7f09099172b6ff16d7",
-      "size": 56120743
+      "checksum": "c615bb15e71949249c3c2ee85d66a62a118c071be691a9f534e6f232a3b1151b",
+      "size": 56363665
     },
     "linux-x64": {
       "binary": "claude.zst",
-      "checksum": "dc7986a7fad5958bfe4bf9eaf14936da2bafb283de7b80ca3e2e1878620873fe",
-      "size": 57376892
+      "checksum": "0c3f4f2a2f9dc653da2e6acc1a45967d504e8577a64b675ba8e9fcb2dcb0d24c",
+      "size": 57645371
     },
     "linux-arm64-musl": {
       "binary": "claude.zst",
-      "checksum": "55c5691e89c947a04777a7e2711c7bfe1589cf1783ff47ae25ad277bef9f4aeb",
-      "size": 54805858
+      "checksum": "85c2e1a6877beaa247a85555e0b815165d5060d8365893103aefb1dd5e9fd717",
+      "size": 55048686
     },
     "linux-x64-musl": {
       "binary": "claude.zst",
-      "checksum": "d0eecbaa59489d9282fbfccabf010feadb3c212e6a40b7e3e112d1c07c6cf300",
-      "size": 56180603
+      "checksum": "b264b1b400162a528623cb93b5275d0cdcea5a7da7af09a33c9a4b101917a0c0",
+      "size": 56449012
     },
     "win32-x64": {
       "binary": "claude.exe.zst",
-      "checksum": "f9ce31065214cba9a1838b4eafd00f004002389a1ee87c45ca00d901fbc03129",
-      "size": 57521925
+      "checksum": "d14fc2cd93ec55e9b2d97b391be53497ce3398ed816c129a60fd617d01ab58db",
+      "size": 57765508
     },
     "win32-arm64": {
       "binary": "claude.exe.zst",
-      "checksum": "f4c7b7c80da3f07dea7d13530eeea321db4380a9da4bc1a1010c13e7e8ea6736",
-      "size": 55546586
+      "checksum": "d3557e13095e4b0cb61486a861023d1235cb1f1d81c422cc69fc545d5403304e",
+      "size": 55778042
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anthropic-ai/claude-agent-sdk",
-  "version": "0.3.198",
+  "version": "0.3.199",
   "main": "sdk.mjs",
   "types": "sdk.d.ts",
   "exports": {
@@ -57,14 +57,14 @@
     "zod": "^4.0.0"
   },
   "optionalDependencies": {
-    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.198",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.198",
-    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.198",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.198",
-    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.198",
-    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.198",
-    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.198",
-    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.198"
+    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.199",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.199",
+    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.199",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.199",
+    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.199",
+    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.199",
+    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.199",
+    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.199"
   },
   "files": [
     "sdk.mjs",
@@ -80,5 +80,5 @@
     "manifest.json",
     "manifest.zst.json"
   ],
-  "claudeCodeVersion": "2.1.198"
+  "claudeCodeVersion": "2.1.199"
 }

package/sdk-tools.d.ts

@@ -29,6 +29,7 @@ export type ToolInputSchemas =
   | WebFetchInput
   | WebSearchInput
   | AskUserQuestionInput
+  | ClaudeDesignInput
   | ProjectsInput
   | EnterPlanModeInput
   | TaskCreateInput
@@ -87,6 +88,7 @@ export type ToolOutputSchemas =
   | CronDeleteOutput
   | CronListOutput
   | PushNotificationOutput
+  | ClaudeDesignOutput
   | ProjectsOutput;
 export type AgentOutput =
   | {
@@ -304,6 +306,10 @@ export type FileReadOutput =
          */
         filePath: string;
       };
+      /**
+       * Set when the dedup matched a startup-seeded entry (CLAUDE.md / nested memory) rather than a prior Read tool_result
+       */
+      source?: "seeded";
     };
 export type ListMcpResourcesOutput = {
   /**
@@ -364,9 +370,6 @@ export type ProjectsOutput =
       knowledge: {
         knowledge_size: number;
         max_knowledge_size: number;
-        search_threshold: number | null;
-        rag_active: boolean;
-        remaining_budget: number | null;
       };
     }
   | {
@@ -395,13 +398,6 @@ export type ProjectsOutput =
       path: string;
       doc_uuid: string;
       replaced: boolean;
-      knowledge: {
-        knowledge_size: number;
-        max_knowledge_size: number;
-        search_threshold: number | null;
-        rag_active: boolean;
-        remaining_budget: number | null;
-      };
     }
   | {
       method: "project_delete";
@@ -716,6 +712,10 @@ export interface ReportFindingsInput {
      * Concrete inputs/state → wrong output/crash
      */
     failure_scenario: string;
+    /**
+     * Short kebab-case slug of the finding type, e.g. "correctness", "simplification", "efficiency", "test-coverage"
+     */
+    category?: string;
     /**
      * Set when a verify pass ran; absent on inline-only reviews
      */
@@ -2337,6 +2337,18 @@ export interface AskUserQuestionInput {
     source?: string;
   };
 }
+export interface ClaudeDesignInput {
+  /**
+   * Claude Design action to perform. Call with "list" first to discover the available operations and their argument schemas.
+   */
+  operation: string;
+  /**
+   * Action input object (server-validated). Pass {} for operations that take no input.
+   */
+  arguments: {
+    [k: string]: unknown;
+  };
+}
 export interface ProjectsInput {
   method: "project_info" | "project_read" | "project_search" | "project_write" | "project_delete";
   /**
@@ -2351,10 +2363,6 @@ export interface ProjectsInput {
    * project_write: a file inside the working directory to upload. The tool reads, encodes, and uploads directly — contents never enter your context. Mutually exclusive with content.
    */
   local_path?: string;
-  /**
-   * project_write: bypass the chat-injection budget guard. Set only when the write is genuinely worth degrading chat to retrieval mode for everyone in the project.
-   */
-  force?: boolean;
   /**
    * project_search: knowledge-base query
    */
@@ -2992,6 +3000,10 @@ export interface ReportFindingsOutput {
      * Concrete inputs/state → wrong output/crash
      */
     failure_scenario: string;
+    /**
+     * Short kebab-case slug of the finding type, e.g. "correctness", "simplification", "efficiency", "test-coverage"
+     */
+    category?: string;
     /**
      * Set when a verify pass ran; absent on inline-only reviews
      */
@@ -3484,10 +3496,15 @@ export interface PushNotificationOutput {
   pushSent?: boolean;
   localSent?: boolean;
   disabledReason?: "config_off" | "user_present" | "no_transport";
-  idleSec?: number;
-  hasFocus?: boolean;
   /**
    * ISO timestamp captured at tool execution on the emitting process. Optional — resumed sessions replay pre-sentAt outputs verbatim.
    */
   sentAt?: string;
 }
+export interface ClaudeDesignOutput {
+  operation: string;
+  content: {
+    [k: string]: unknown;
+  }[];
+  isError?: boolean;
+}

package/sdk.d.ts

@@ -188,6 +188,12 @@ export declare type BaseOutputFormat = {
 /**
  * Permission callback function for controlling tool usage.
  * Called before each tool execution to determine if it should be allowed.
+ *
+ * Return `null` ONLY after the consumer has already sent the
+ * control_response out-of-band (e.g. a signed HTTP POST echoing
+ * `requestId`); the SDK will skip its own transport write. Fail-closed: an
+ * accidental null means no control_response is sent and the tool stays
+ * blocked indefinitely — permission prompts have no park deadline.
  */
 export declare type CanUseTool = (toolName: string, input: Record<string, unknown>, options: {
     /** Signaled if the operation should be aborted. */
@@ -231,7 +237,13 @@ export declare type CanUseTool = (toolName: string, input: Record<string, unknow
     toolUseID: string;
     /** If running within the context of a sub-agent, the sub-agent's ID. */
     agentID?: string;
-}) => Promise<PermissionResult>;
+    /**
+     * The control_request envelope's `request_id`. A control_response sent
+     * out-of-band (e.g. a signed HTTP POST instead of the SDK's WS write)
+     * must echo this value for the worker to match it.
+     */
+    requestId: string;
+}) => Promise<PermissionResult | null>;
 
 export declare type ConfigChangeHookInput = BaseHookInput & {
     hook_event_name: 'ConfigChange';
@@ -2617,8 +2629,13 @@ declare const SandboxCredentialsConfigSchema: () => z.ZodOptional<z.ZodObject<{
     }, z.core.$strip>>>;
     envVars: z.ZodOptional<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
-        mode: z.ZodLiteral<"deny">;
+        mode: z.ZodEnum<{
+            deny: "deny";
+            mask: "mask";
+        }>;
+        injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>>;
+    allowPlaintextInject: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>>;
 
 export declare type SandboxFilesystemConfig = NonNullable<z.infer<ReturnType<typeof SandboxFilesystemConfigSchema>>>;
@@ -2696,8 +2713,13 @@ declare const SandboxSettingsSchema: () => z.ZodObject<{
         }, z.core.$strip>>>;
         envVars: z.ZodOptional<z.ZodArray<z.ZodObject<{
             name: z.ZodString;
-            mode: z.ZodLiteral<"deny">;
+            mode: z.ZodEnum<{
+                deny: "deny";
+                mask: "mask";
+            }>;
+            injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>>>;
+        allowPlaintextInject: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     ignoreViolations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
     enableWeakerNestedSandbox: z.ZodOptional<z.ZodBoolean>;
@@ -3387,6 +3409,10 @@ declare type SDKControlPermissionRequest = {
     tool_use_id: string;
     agent_id?: string;
     description?: string;
+    /**
+     * True when the tool's approval card IS the user-interaction surface (Tool.requiresUserInteraction()). SDK hosts must not offer one-tap Approve/Deny for these — the user has to open the session and respond on the card itself.
+     */
+    requires_user_interaction?: boolean;
 };
 
 /**
@@ -5813,7 +5839,7 @@ export declare interface Settings {
             httpProxyPort?: number;
             socksProxyPort?: number;
             /**
-             * [EXPERIMENTAL] Enable in-process TLS termination so the per-request filter can see HTTPS request bodies. Provide a CA cert+key, or omit both to have sandbox-runtime generate an ephemeral one for the session.
+             * [EXPERIMENTAL] Enable in-process TLS termination so the per-request filter can see HTTPS request bodies. Provide a CA cert+key, or omit both to have sandbox-runtime generate an ephemeral one for the session. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored.
              */
             tlsTerminate?: {
                 caCertPath?: string;
@@ -5857,7 +5883,7 @@ export declare interface Settings {
                 mode: 'deny';
             }[];
             /**
-             * Environment variables to protect. `deny` unsets the variable for sandboxed commands.
+             * Environment variables to protect. `deny` unsets the variable for sandboxed commands; `mask` substitutes a sentinel inside the sandbox and injects the real value at the proxy.
              */
             envVars?: {
                 /**
@@ -5865,10 +5891,18 @@ export declare interface Settings {
                  */
                 name: string;
                 /**
-                 * Access mode for this environment variable. Only `deny` is supported.
+                 * Access mode for this environment variable. `deny` unsets the variable for sandboxed commands; `mask` shows sandboxed commands a sentinel value and the host proxy swaps sentinel→real on egress to `injectHosts`.
                  */
-                mode: 'deny';
+                mode: 'deny' | 'mask';
+                /**
+                 * Optional narrowing of where the proxy substitutes this credential. Only meaningful when mode is `mask`; accepted but ignored for `deny`. If unset, defaults to `network.allowedDomains` — the credential is injected at every reachable host. Each entry must be reachable via `network.allowedDomains` (sandbox-runtime validates this).
+                 */
+                injectHosts?: string[];
             }[];
+            /**
+             * Allow sentinel→real substitution on the plain-HTTP proxy path. Defaults to false: without TLS termination the upstream identity is unverified and the credential travels in cleartext. Set only for trusted-network test fixtures. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored.
+             */
+            allowPlaintextInject?: boolean;
         };
         ignoreViolations?: {
             [k: string]: string[];