@anthropic-ai/claude-agent-sdk 0.3.198 → 0.3.200

package/manifest.json

@@ -1,47 +1,47 @@
 {
-  "version": "2.1.198",
-  "commit": "b80c496480ebf28e6dfe755cf0b8e3dd1d7cba1f",
-  "buildDate": "2026-07-01T06:17:25Z",
+  "version": "2.1.200",
+  "commit": "ac4f1e473e794cd41c8b6b2a2a991c0f57dcc1e2",
+  "buildDate": "2026-07-03T03:51:04Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "ab6f7ee109816ede414f7c285446633f805b623aa609f425609a64266451d61e",
-      "size": 229328464
+      "checksum": "e6fd52c0c72ff83663bf3cbfc833b45faaba2b9a9952863279dc3cfc1a0492b6",
+      "size": 231708784
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "280b6cfc60dacc4caed31af1249e53c259c01759556e60633944c02405c82dd0",
-      "size": 238706000
+      "checksum": "b0a4dd56a91b24e18c9f83b50a7f19989ecbaba3d2ae4bf6f3f95f4033a87371",
+      "size": 241100240
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "99b50a6f2b1f3ef07bcaf1e58a2f9883c470c84e428afa321972b1aa20372e9a",
-      "size": 245742320
+      "checksum": "434ab85cd215ef7d5cd7afc1d02c0a95c0521357d8819f70ca77b6b4b1c5273d",
+      "size": 248101616
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "7066af42a5fe93038c13af5072d4c034dc3928092cb121fdd892c76b94b6b84d",
-      "size": 248900408
+      "checksum": "26e42a3268979f0c5a3b6c0f375b15dd7decfaae4bb02774390d6a23f4cd51ad",
+      "size": 251300664
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "88cb391085e419457569bcc57a672f734f30b424e17df7323f3bbb421238e801",
-      "size": 238990520
+      "checksum": "b47ec4c6f9b6b1e5987f333e28b01a949c9a8c1198f47be336bab2507a772fd6",
+      "size": 241349816
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "42892159a03bee492926b616b1270313544f7a52b68d32cb680e91984a4c6659",
-      "size": 243589504
+      "checksum": "c461c6251cd2f6ebe4dc4c5f0823a404f1722b7dc7ccb0937ce7bc6e5dc5866f",
+      "size": 245985664
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "6afd07cb03aa981c5e918808f53a1e2b729015b695122a944f6e41aaf5393933",
-      "size": 239292064
+      "checksum": "575a3d2b88d1a4a8df3ee71aaabdc7074f72ab1d22371caa6e61656bbee5c995",
+      "size": 241591968
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "10a6d21332f674c87f52b1dc09926945d0169f1bb82aced84ada100639ab70bc",
-      "size": 233758880
+      "checksum": "a97e4f76ec7480cb534f7cdb990b2e26321882a779efaa51536f72f09c435da9",
+      "size": 236058784
     }
   }
 }

package/manifest.zst.json

@@ -1,55 +1,55 @@
 {
-  "version": "2.1.198",
-  "commit": "b80c496480ebf28e6dfe755cf0b8e3dd1d7cba1f",
-  "buildDate": "2026-07-01T06:19:10Z",
+  "version": "2.1.200",
+  "commit": "ac4f1e473e794cd41c8b6b2a2a991c0f57dcc1e2",
+  "buildDate": "2026-07-03T03:52:50Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude.zst",
-      "checksum": "7bc5ee873344f53ca0ea0d7ae48c77c3787aa8f437d5aeb33a6a6d83ab8d813f",
-      "size": 47036104,
+      "checksum": "1da7ad1b3a7be70975d8360031b5477b106bbe4dfc2feeb8e1d48f164bc9a18e",
+      "size": 47426979,
       "bundle": {
-        "checksum": "e84cec46ebd581937b5128e7be4f3e8788b13947bf4040a699d3404478f4bc57",
-        "size": 47034441
+        "checksum": "5a11aa187f68623998c32458022abca9e861835e1055e9b6ba970a20b9e7beaa",
+        "size": 47424141
       }
     },
     "darwin-x64": {
       "binary": "claude.zst",
-      "checksum": "b70b7a3d9f3fdb675e119bca0c1632d810aacdefadee1da5e82ebb77cbabd124",
-      "size": 51377668,
+      "checksum": "f00c668c751026622356e4538dfe1c2e82bb805ea2897dc4b1417e09231ee24d",
+      "size": 51787215,
       "bundle": {
-        "checksum": "c8eb65cce724f80d4467c9850e0643cbab91e1d66fa88b21ea17f398c7835d50",
-        "size": 51390885
+        "checksum": "f0110970ba1b72f8a99b178012cba729ce2ba7e45562809ea01fa09736a7eb28",
+        "size": 51792780
       }
     },
     "linux-arm64": {
       "binary": "claude.zst",
-      "checksum": "4d9f42ab338ead6a6e9b9738a6d1ec7ba9a0737acbc8cf7f09099172b6ff16d7",
-      "size": 56120743
+      "checksum": "e78ce96b7e249b6aea461c9fe34d40f0cd87ca0573bbe63510ab8dd37c69fdf6",
+      "size": 56534877
     },
     "linux-x64": {
       "binary": "claude.zst",
-      "checksum": "dc7986a7fad5958bfe4bf9eaf14936da2bafb283de7b80ca3e2e1878620873fe",
-      "size": 57376892
+      "checksum": "aa54a5ed5888911c3316197b5bab96187eb09335076e3afef6d4c70facf27e98",
+      "size": 57790527
     },
     "linux-arm64-musl": {
       "binary": "claude.zst",
-      "checksum": "55c5691e89c947a04777a7e2711c7bfe1589cf1783ff47ae25ad277bef9f4aeb",
-      "size": 54805858
+      "checksum": "9580ea92b0176047258a018d7288b3ce2541848dc1c8481cc038bf6b2c369f55",
+      "size": 55212819
     },
     "linux-x64-musl": {
       "binary": "claude.zst",
-      "checksum": "d0eecbaa59489d9282fbfccabf010feadb3c212e6a40b7e3e112d1c07c6cf300",
-      "size": 56180603
+      "checksum": "ceb7cfd3cd93cbc759d71f2d6f59ffd0a3fd8a6defd8730e84cfa7d0e3e6b30e",
+      "size": 56594084
     },
     "win32-x64": {
       "binary": "claude.exe.zst",
-      "checksum": "f9ce31065214cba9a1838b4eafd00f004002389a1ee87c45ca00d901fbc03129",
-      "size": 57521925
+      "checksum": "29da768777633fd390b93c948d9104cb6a034c76aa7f039182d5e56ae947bbda",
+      "size": 57917911
     },
     "win32-arm64": {
       "binary": "claude.exe.zst",
-      "checksum": "f4c7b7c80da3f07dea7d13530eeea321db4380a9da4bc1a1010c13e7e8ea6736",
-      "size": 55546586
+      "checksum": "65b793dd65af500cff48844054222d578a4709a71af34b4f51e665c264d177b6",
+      "size": 55956930
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anthropic-ai/claude-agent-sdk",
-  "version": "0.3.198",
+  "version": "0.3.200",
   "main": "sdk.mjs",
   "types": "sdk.d.ts",
   "exports": {
@@ -57,14 +57,14 @@
     "zod": "^4.0.0"
   },
   "optionalDependencies": {
-    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.198",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.198",
-    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.198",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.198",
-    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.198",
-    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.198",
-    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.198",
-    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.198"
+    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.200",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.200",
+    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.200",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.200",
+    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.200",
+    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.200",
+    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.200",
+    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.200"
   },
   "files": [
     "sdk.mjs",
@@ -80,5 +80,5 @@
     "manifest.json",
     "manifest.zst.json"
   ],
-  "claudeCodeVersion": "2.1.198"
+  "claudeCodeVersion": "2.1.200"
 }

package/sdk-tools.d.ts

@@ -29,6 +29,7 @@ export type ToolInputSchemas =
   | WebFetchInput
   | WebSearchInput
   | AskUserQuestionInput
+  | ClaudeDesignInput
   | ProjectsInput
   | EnterPlanModeInput
   | TaskCreateInput
@@ -87,6 +88,7 @@ export type ToolOutputSchemas =
   | CronDeleteOutput
   | CronListOutput
   | PushNotificationOutput
+  | ClaudeDesignOutput
   | ProjectsOutput;
 export type AgentOutput =
   | {
@@ -304,6 +306,10 @@ export type FileReadOutput =
          */
         filePath: string;
       };
+      /**
+       * Set when the dedup matched a startup-seeded entry (CLAUDE.md / nested memory) rather than a prior Read tool_result
+       */
+      source?: "seeded";
     };
 export type ListMcpResourcesOutput = {
   /**
@@ -364,9 +370,6 @@ export type ProjectsOutput =
       knowledge: {
         knowledge_size: number;
         max_knowledge_size: number;
-        search_threshold: number | null;
-        rag_active: boolean;
-        remaining_budget: number | null;
       };
     }
   | {
@@ -395,13 +398,7 @@ export type ProjectsOutput =
       path: string;
       doc_uuid: string;
       replaced: boolean;
-      knowledge: {
-        knowledge_size: number;
-        max_knowledge_size: number;
-        search_threshold: number | null;
-        rag_active: boolean;
-        remaining_budget: number | null;
-      };
+      present_to_user?: boolean;
     }
   | {
       method: "project_delete";
@@ -716,6 +713,10 @@ export interface ReportFindingsInput {
      * Concrete inputs/state → wrong output/crash
      */
     failure_scenario: string;
+    /**
+     * Short kebab-case slug of the finding type, e.g. "correctness", "simplification", "efficiency", "test-coverage"
+     */
+    category?: string;
     /**
      * Set when a verify pass ran; absent on inline-only reviews
      */
@@ -2337,6 +2338,18 @@ export interface AskUserQuestionInput {
     source?: string;
   };
 }
+export interface ClaudeDesignInput {
+  /**
+   * Claude Design action to perform. Call with "list" first to discover the available operations and their argument schemas.
+   */
+  operation: string;
+  /**
+   * Action input object (server-validated). Pass {} for operations that take no input.
+   */
+  arguments: {
+    [k: string]: unknown;
+  };
+}
 export interface ProjectsInput {
   method: "project_info" | "project_read" | "project_search" | "project_write" | "project_delete";
   /**
@@ -2352,9 +2365,9 @@ export interface ProjectsInput {
    */
   local_path?: string;
   /**
-   * project_write: bypass the chat-injection budget guard. Set only when the write is genuinely worth degrading chat to retrieval mode for everyone in the project.
+   * project_write: true marks this doc as the file the user needs to see — the deliverable they asked for or must act on. Defaults to false; leave it unset for routine saves, notes, and bulk writes.
    */
-  force?: boolean;
+  present_to_user?: boolean;
   /**
    * project_search: knowledge-base query
    */
@@ -2992,6 +3005,10 @@ export interface ReportFindingsOutput {
      * Concrete inputs/state → wrong output/crash
      */
     failure_scenario: string;
+    /**
+     * Short kebab-case slug of the finding type, e.g. "correctness", "simplification", "efficiency", "test-coverage"
+     */
+    category?: string;
     /**
      * Set when a verify pass ran; absent on inline-only reviews
      */
@@ -3484,10 +3501,15 @@ export interface PushNotificationOutput {
   pushSent?: boolean;
   localSent?: boolean;
   disabledReason?: "config_off" | "user_present" | "no_transport";
-  idleSec?: number;
-  hasFocus?: boolean;
   /**
    * ISO timestamp captured at tool execution on the emitting process. Optional — resumed sessions replay pre-sentAt outputs verbatim.
    */
   sentAt?: string;
 }
+export interface ClaudeDesignOutput {
+  operation: string;
+  content: {
+    [k: string]: unknown;
+  }[];
+  isError?: boolean;
+}

package/sdk.d.ts

@@ -89,6 +89,14 @@ export declare type AgentDefinition = {
      * Permission mode controlling how tool executions are handled
      */
     permissionMode?: PermissionMode;
+    /**
+     * Agent type auto-spawned as a background observer whenever this agent runs. The observer receives read-only activity digests and reports via the ObserverReport tool; it never participates in the task.
+     */
+    observer?: string;
+    /**
+     * Supplemental postamble appended (after the harness-owned default) to each activity digest sent to the observer. Blank values are ignored.
+     */
+    observerMessage?: string;
 };
 
 /**
@@ -188,6 +196,12 @@ export declare type BaseOutputFormat = {
 /**
  * Permission callback function for controlling tool usage.
  * Called before each tool execution to determine if it should be allowed.
+ *
+ * Return `null` ONLY after the consumer has already sent the
+ * control_response out-of-band (e.g. a signed HTTP POST echoing
+ * `requestId`); the SDK will skip its own transport write. Fail-closed: an
+ * accidental null means no control_response is sent and the tool stays
+ * blocked indefinitely — permission prompts have no park deadline.
  */
 export declare type CanUseTool = (toolName: string, input: Record<string, unknown>, options: {
     /** Signaled if the operation should be aborted. */
@@ -231,7 +245,13 @@ export declare type CanUseTool = (toolName: string, input: Record<string, unknow
     toolUseID: string;
     /** If running within the context of a sub-agent, the sub-agent's ID. */
     agentID?: string;
-}) => Promise<PermissionResult>;
+    /**
+     * The control_request envelope's `request_id`. A control_response sent
+     * out-of-band (e.g. a signed HTTP POST instead of the SDK's WS write)
+     * must echo this value for the worker to match it.
+     */
+    requestId: string;
+}) => Promise<PermissionResult | null>;
 
 export declare type ConfigChangeHookInput = BaseHookInput & {
     hook_event_name: 'ConfigChange';
@@ -2240,6 +2260,7 @@ export declare interface Query extends AsyncGenerator<SDKMessage, void> {
     setMcpPermissionModeOverride(serverName: string, mode: 'default' | 'auto' | null): Promise<{
         warning?: string;
     }>;
+
     /**
      * Change the model used for subsequent responses.
      * Only available in streaming input mode.
@@ -2421,6 +2442,7 @@ export declare interface Query extends AsyncGenerator<SDKMessage, void> {
 
 
 
+
     /**
      * Reconnect an MCP server by name.
      * Throws on failure.
@@ -2617,8 +2639,13 @@ declare const SandboxCredentialsConfigSchema: () => z.ZodOptional<z.ZodObject<{
     }, z.core.$strip>>>;
     envVars: z.ZodOptional<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
-        mode: z.ZodLiteral<"deny">;
+        mode: z.ZodEnum<{
+            deny: "deny";
+            mask: "mask";
+        }>;
+        injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>>;
+    allowPlaintextInject: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>>;
 
 export declare type SandboxFilesystemConfig = NonNullable<z.infer<ReturnType<typeof SandboxFilesystemConfigSchema>>>;
@@ -2696,8 +2723,13 @@ declare const SandboxSettingsSchema: () => z.ZodObject<{
         }, z.core.$strip>>>;
         envVars: z.ZodOptional<z.ZodArray<z.ZodObject<{
             name: z.ZodString;
-            mode: z.ZodLiteral<"deny">;
+            mode: z.ZodEnum<{
+                deny: "deny";
+                mask: "mask";
+            }>;
+            injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>>>;
+        allowPlaintextInject: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     ignoreViolations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
     enableWeakerNestedSandbox: z.ZodOptional<z.ZodBoolean>;
@@ -3387,6 +3419,10 @@ declare type SDKControlPermissionRequest = {
     tool_use_id: string;
     agent_id?: string;
     description?: string;
+    /**
+     * True when the tool's approval card IS the user-interaction surface (Tool.requiresUserInteraction()). SDK hosts must not offer one-tap Approve/Deny for these — the user has to open the session and respond on the card itself.
+     */
+    requires_user_interaction?: boolean;
 };
 
 /**
@@ -3476,7 +3512,7 @@ export declare type SDKControlRequest = {
     request: SDKControlRequestInner;
 };
 
-declare type SDKControlRequestInner = SDKControlInterruptRequest | SDKControlPermissionRequest | SDKControlInitializeRequest | SDKControlSetPermissionModeRequest | SDKControlSetModelRequest | SDKControlSetMaxThinkingTokensRequest | SDKControlRenameSessionRequest | SDKControlSetColorRequest | SDKControlMcpStatusRequest | SDKControlGetContextUsageRequest | SDKControlGetSessionCostRequest | SDKControlListModelsRequest | SDKControlGetUsageRequest | SDKControlGetBinaryVersionRequest | SDKControlMcpCallRequest | SDKControlFileSuggestionsRequest | SDKHookCallbackRequest | SDKControlMcpMessageRequest | SDKControlRewindFilesRequest | SDKControlCancelAsyncMessageRequest | SDKControlReadFileRequest | SDKControlGetWorkspaceDiffRequest | SDKControlGetPlanRequest | SDKControlSeedReadStateRequest | SDKControlMcpSetServersRequest | SDKControlRegisterRepoRootRequest | SDKControlReloadPluginsRequest | SDKControlReloadSkillsRequest | SDKControlMcpReconnectRequest | SDKControlMcpToggleRequest | SDKControlSetMcpPermissionModeOverrideRequest | SDKControlRewindConversationRequest | SDKControlChannelEnableRequest | SDKControlEndSessionRequest | SDKControlMcpAuthenticateRequest | SDKControlMcpClearAuthRequest | SDKControlMcpOAuthCallbackUrlRequest | SDKControlClaudeAuthenticateRequest | SDKControlClaudeOAuthCallbackRequest | SDKControlClaudeOAuthWaitForCompletionRequest | SDKControlRemoteControlRequest | SDKControlGenerateSessionTitleRequest | SDKControlSideQuestionRequest | SDKControlUltrareviewLaunchRequest | SDKControlStageFileRequest | SDKControlAddDirectoryRequest | SDKControlMessageRatedRequest | SDKControlOAuthTokenRefreshRequest | SDKControlHostAuthTokenRefreshRequest | SDKControlStopTaskRequest | SDKControlBackgroundTasksRequest | SDKControlApplyFlagSettingsRequest | SDKControlGetSettingsRequest | SDKControlElicitationRequest | SDKControlRequestUserDialogRequest | SDKControlSubmitFeedbackRequest;
+declare type SDKControlRequestInner = SDKControlInterruptRequest | SDKControlPermissionRequest | SDKControlInitializeRequest | SDKControlSetPermissionModeRequest | SDKControlSetModelRequest | SDKControlSetMaxThinkingTokensRequest | SDKControlRenameSessionRequest | SDKControlSetColorRequest | SDKControlMcpStatusRequest | SDKControlGetContextUsageRequest | SDKControlGetSessionCostRequest | SDKControlListModelsRequest | SDKControlGetUsageRequest | SDKControlGetBinaryVersionRequest | SDKControlMcpCallRequest | SDKControlFileSuggestionsRequest | SDKHookCallbackRequest | SDKControlMcpMessageRequest | SDKControlRewindFilesRequest | SDKControlCancelAsyncMessageRequest | SDKControlReadFileRequest | SDKControlGetWorkspaceDiffRequest | SDKControlGetPlanRequest | SDKControlSeedReadStateRequest | SDKControlMcpSetServersRequest | SDKControlRegisterRepoRootRequest | SDKControlReloadPluginsRequest | SDKControlReloadSkillsRequest | SDKControlMcpReconnectRequest | SDKControlMcpToggleRequest | SDKControlSetMcpPermissionModeOverrideRequest | SDKControlRewindConversationRequest | SDKControlChannelEnableRequest | SDKControlEndSessionRequest | SDKControlMcpAuthenticateRequest | SDKControlMcpClearAuthRequest | SDKControlMcpOAuthCallbackUrlRequest | SDKControlClaudeAuthenticateRequest | SDKControlClaudeOAuthCallbackRequest | SDKControlClaudeOAuthWaitForCompletionRequest | SDKControlRemoteControlRequest | SDKControlGenerateSessionTitleRequest | SDKControlSideQuestionRequest | SDKControlUltrareviewLaunchRequest | SDKControlStageFileRequest | SDKControlAddDirectoryRequest | SDKControlSetCwdRequest | SDKControlMessageRatedRequest | SDKControlOAuthTokenRefreshRequest | SDKControlHostAuthTokenRefreshRequest | SDKControlStopTaskRequest | SDKControlBackgroundTasksRequest | SDKControlApplyFlagSettingsRequest | SDKControlGetSettingsRequest | SDKControlElicitationRequest | SDKControlRequestUserDialogRequest | SDKControlSubmitFeedbackRequest;
 
 /**
  * Requests the SDK consumer to render a tool-driven blocking dialog and return the user choice. Used by tools that previously rendered Ink JSX via setToolJSX with an onDone callback.
@@ -3756,8 +3792,14 @@ export declare type SDKMessageOrigin = {
     kind: 'task-notification';
 } | {
     kind: 'coordinator';
+} | {
+    kind: 'observer';
+    from: string;
+    senderTaskId: string;
 } | {
     kind: 'auto-continuation';
+} | {
+    kind: 'observer-activity';
 };
 
 /**
@@ -4701,7 +4743,7 @@ export declare interface Settings {
          */
         ask?: string[];
         /**
-         * Default permission mode when Claude Code needs access
+         * Default permission mode when Claude Code needs access ('manual' is accepted as an alias for 'default')
          */
         defaultMode?: 'acceptEdits' | 'auto' | 'bypassPermissions' | 'default' | 'dontAsk' | 'plan';
         /**
@@ -5813,7 +5855,7 @@ export declare interface Settings {
             httpProxyPort?: number;
             socksProxyPort?: number;
             /**
-             * [EXPERIMENTAL] Enable in-process TLS termination so the per-request filter can see HTTPS request bodies. Provide a CA cert+key, or omit both to have sandbox-runtime generate an ephemeral one for the session.
+             * [EXPERIMENTAL] Enable in-process TLS termination so the per-request filter can see HTTPS request bodies. Provide a CA cert+key, or omit both to have sandbox-runtime generate an ephemeral one for the session. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored.
              */
             tlsTerminate?: {
                 caCertPath?: string;
@@ -5857,7 +5899,7 @@ export declare interface Settings {
                 mode: 'deny';
             }[];
             /**
-             * Environment variables to protect. `deny` unsets the variable for sandboxed commands.
+             * Environment variables to protect. `deny` unsets the variable for sandboxed commands; `mask` substitutes a sentinel inside the sandbox and injects the real value at the proxy.
              */
             envVars?: {
                 /**
@@ -5865,10 +5907,18 @@ export declare interface Settings {
                  */
                 name: string;
                 /**
-                 * Access mode for this environment variable. Only `deny` is supported.
+                 * Access mode for this environment variable. `deny` unsets the variable for sandboxed commands; `mask` shows sandboxed commands a sentinel value and the host proxy swaps sentinel→real on egress to `injectHosts`.
                  */
-                mode: 'deny';
+                mode: 'deny' | 'mask';
+                /**
+                 * Optional narrowing of where the proxy substitutes this credential. Only meaningful when mode is `mask`; accepted but ignored for `deny`. If unset, defaults to `network.allowedDomains` — the credential is injected at every reachable host. Each entry must be reachable via `network.allowedDomains` (sandbox-runtime validates this).
+                 */
+                injectHosts?: string[];
             }[];
+            /**
+             * Allow sentinel→real substitution on the plain-HTTP proxy path. Defaults to false: without TLS termination the upstream identity is unverified and the credential travels in cleartext. Set only for trusted-network test fixtures. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored.
+             */
+            allowPlaintextInject?: boolean;
         };
         ignoreViolations?: {
             [k: string]: string[];
@@ -5967,6 +6017,10 @@ export declare interface Settings {
      * When true, the plan-approval dialog offers a "clear context" option. Defaults to false.
      */
     showClearContextOnPlanAccept?: boolean;
+    /**
+     * Idle time before Claude's questions auto-continue with any answers selected so far. Defaults to never — auto-continue only runs when explicitly set to 60s/5m/10m.
+     */
+    askUserQuestionTimeout?: '60s' | '5m' | '10m' | 'never';
     /**
      * Name of an agent (built-in or custom) to use for the main thread. Applies the agent's system prompt, tool restrictions, and model.
      */
@@ -6577,6 +6631,13 @@ export declare interface Transport {
      * Each transport handles its own protocol and error checking
      */
     readMessages(): AsyncGenerator<StdoutMessage, void, unknown>;
+    /**
+     * Register a request_id whose control_response the caller will await
+     * out-of-band via Query.awaitControlResponse. Transports that see
+     * per-frame source (multi-client fan-out) SHOULD drop non-worker
+     * control_responses matching this id — only the worker may answer.
+     */
+    expectControlResponse?(requestId: string): void;
     /**
      * End the input stream
      */