@anthropic-ai/claude-agent-sdk 0.3.204 → 0.3.206

package/extractFromBunfs.js

@@ -1,4 +1,4 @@
-/* eslint-disable custom-rules/no-sync-fs */
+/* oxlint-disable custom-rules/no-sync-fs */
 // Extracts a file from Bun's $bunfs virtual filesystem to a real temp directory
 // so it can be spawned as a subprocess (child processes cannot access $bunfs).
 //
@@ -28,7 +28,7 @@ function tmpdir() {
     return process.env.CLAUDE_CODE_TMPDIR
   }
   if (process.platform === 'darwin') {
-    // eslint-disable-next-line custom-rules/no-hardcoded-tmp -- mirrors tempfile.ts: macOS /tmp works fine; os.tmpdir() below is for Android-on-Linux where /tmp isn't writable.
+    // oxlint-disable-next-line custom-rules/no-hardcoded-tmp -- mirrors tempfile.ts: macOS /tmp works fine; os.tmpdir() below is for Android-on-Linux where /tmp isn't writable.
     return '/tmp'
   }
   return osTmpdir()

package/manifest.json

@@ -1,47 +1,47 @@
 {
-  "version": "2.1.204",
-  "commit": "51bd0ba270a17535ce551f0eff5d09553b44a9e1",
-  "buildDate": "2026-07-07T23:24:03Z",
+  "version": "2.1.206",
+  "commit": "edc8ebf7f852d3abffad32a5bf8e49e439f92afb",
+  "buildDate": "2026-07-09T01:48:20Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "1677b67595b6251156d62600dc85d4070ec385b72dd0b07e73742a56030952c3",
-      "size": 236961904
+      "checksum": "3197aba4442dbd5b3df42b6f35e6d7bd03b5e48ce18b7a3c5c6f5f8c28e03b7f",
+      "size": 240395024
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "9ccea5f19ec0462f3b983ff3400a97adaf16a83c3dc36a69b916805f2bc8c829",
-      "size": 246384080
+      "checksum": "b1e1636917a12c7d4e1fa54cd13f7f76ba3779fb988180610b6ca483258c2f46",
+      "size": 248431568
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "c37256a8c3998b8675e8385f1ae4677d69bdff1e717c389296eec70e02e317ef",
-      "size": 253344496
+      "checksum": "cb8ccaf4ae6beb558747227a362010c6b32b4f4a5868c3a7e96aa9972fc6ef58",
+      "size": 255376112
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "c8ee1ea69154533c691a68f46abb645196fe7339d26e6fc204cc7f08220139d3",
-      "size": 256535352
+      "checksum": "d131494be407ff56a62f4e99a96ba60102002d01e3b6b1494db16bef4b7f060f",
+      "size": 258566968
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "d87a3b19f01bbf28d05e7ff7c449923fc520f2d64c4227373ccbf24dec6438f3",
-      "size": 246592696
+      "checksum": "b1920556c3b077694d52397f4e5221df2419ad9b44af641be0f49647b51f87ad",
+      "size": 248624312
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "b2d7a23342e315f8dd0d253b14f394bffb5ba04d434b7631c9837e38d99fde35",
-      "size": 251224448
+      "checksum": "b0d780783401de979024c25f14a2cae665873afbcfe718c090b73e13c4cd08a0",
+      "size": 253251968
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "e1d82bf346d99db3e611b75a4afc5fdf1530d8d8c546389cf45ac8250bce4af1",
-      "size": 246707360
+      "checksum": "d5072b25b9a20bffb24625d36129a05ed2be4d2eb7e35625aad6aa35596892c2",
+      "size": 248682144
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "085f7d5c98dfec2681996cacbf6185d1439fdc7208087afa99c22c07132b9a56",
-      "size": 241173664
+      "checksum": "c17ac3a5a8edf5cfa658e82bd41fcf83170af21538e51cc9d4cbaeefe382aba3",
+      "size": 243149984
     }
   }
 }

package/manifest.zst.json

@@ -1,55 +1,55 @@
 {
-  "version": "2.1.204",
-  "commit": "51bd0ba270a17535ce551f0eff5d09553b44a9e1",
-  "buildDate": "2026-07-07T23:25:43Z",
+  "version": "2.1.206",
+  "commit": "edc8ebf7f852d3abffad32a5bf8e49e439f92afb",
+  "buildDate": "2026-07-09T01:50:10Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude.zst",
-      "checksum": "1d4527d26b9cbc27b52428ec6877ed12ade6173bac0d04dd0fc9bae9cdbb4a32",
-      "size": 48687311,
+      "checksum": "f82b3ad6293ce2c991e63a7e5af05ad7d8b78c6a5f454838b928116ea8506b45",
+      "size": 50458380,
       "bundle": {
-        "checksum": "10635839917bd4975223bb7221e2f94bc4219ecba4ff83a9dafe1463a05820ef",
-        "size": 48693339
+        "checksum": "6a7ff1b3d4fc5739a9befc4df3a6419dedab342579f9f9fb4c26a356dddec052",
+        "size": 50456788
       }
     },
     "darwin-x64": {
       "binary": "claude.zst",
-      "checksum": "19043c1ddfef6fd794ed5b925ba74a75e539990d51700386f696587b80f088e5",
-      "size": 53073836,
+      "checksum": "25419961c3d901b18b0d63bb2efe3e68c47629239f9872ac08139f8f7559216e",
+      "size": 53474125,
       "bundle": {
-        "checksum": "1e349acd3508480f5bc453e0eb67af926fa74f802efb62d47b994cda9efa9ac9",
-        "size": 53076746
+        "checksum": "6cbf6ee82fedf869ccde175ae739ed8740e517a5caad1f2c5a9aa400ec5b0161",
+        "size": 53484346
       }
     },
     "linux-arm64": {
       "binary": "claude.zst",
-      "checksum": "82f78aced693423886d93c7281fdf7bbd0dd2dd9e2232d9793ea0e80f32c782f",
-      "size": 57767671
+      "checksum": "a6a1698b6dc9438deab622618756e735f29e22a624bdf5d382e9a9dd835438fd",
+      "size": 58141512
     },
     "linux-x64": {
       "binary": "claude.zst",
-      "checksum": "51316279ed58bb1cb78e7932c58b96d39954833c074be0ba3503970b1646db06",
-      "size": 59016642
+      "checksum": "a224eb404540adc8f3bbd29165ff3c070c1550c1e629e62d7effd6c673d1d79b",
+      "size": 59407746
     },
     "linux-arm64-musl": {
       "binary": "claude.zst",
-      "checksum": "303032c7733b06d25db66507628dcd25c1dc8a27884215ee539c88cafdae171f",
-      "size": 56440401
+      "checksum": "ef98d868f5695fbd05fdf3b83f1df52e81a5024022b22fb999a1f3e48d5b3d3b",
+      "size": 56828247
     },
     "linux-x64-musl": {
       "binary": "claude.zst",
-      "checksum": "ad717cd837bf4110d8bbf30d7b7068b693c5620db6f7624f6e522ef56cd89154",
-      "size": 57824202
+      "checksum": "316fdfb584e22897aea3c6532f93f00f93b86f9af64d2422295a7a93da809758",
+      "size": 58218590
     },
     "win32-x64": {
       "binary": "claude.exe.zst",
-      "checksum": "779d7d102639728d426b38c9b47473d14bfbcb02c445d2d034a0d8ef4214305c",
-      "size": 59136883
+      "checksum": "a5733df130abe206b7ba95d1c1c8bcc40c661a8284b1c11409cc072eb41944bd",
+      "size": 59528232
     },
     "win32-arm64": {
       "binary": "claude.exe.zst",
-      "checksum": "bfeb8611403c789575cb5a231fb2adccb5ee3a5d361bc825966f1812d1b1721f",
-      "size": 57178875
+      "checksum": "e2f74a9b7c5bc2ba9b9650cc654c87b4a71f1df453f99ab427788bd081ba681e",
+      "size": 57558450
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anthropic-ai/claude-agent-sdk",
-  "version": "0.3.204",
+  "version": "0.3.206",
   "main": "sdk.mjs",
   "types": "sdk.d.ts",
   "exports": {
@@ -57,14 +57,14 @@
     "zod": "^4.0.0"
   },
   "optionalDependencies": {
-    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.204",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.204",
-    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.204",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.204",
-    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.204",
-    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.204",
-    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.204",
-    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.204"
+    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.206",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.206",
+    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.206",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.206",
+    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.206",
+    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.206",
+    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.206",
+    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.206"
   },
   "files": [
     "sdk.mjs",
@@ -80,5 +80,5 @@
     "manifest.json",
     "manifest.zst.json"
   ],
-  "claudeCodeVersion": "2.1.204"
+  "claudeCodeVersion": "2.1.206"
 }

package/sdk-tools.d.ts

@@ -360,6 +360,7 @@ export type ArtifactOutput =
       };
       warnings?: string[];
       contract?: string;
+      updated?: boolean;
     }
   | {
       artifacts: {
@@ -518,7 +519,7 @@ export interface TaskOutputInput {
 }
 export interface ExitPlanModeInput {
   /**
-   * Prompt-based permissions needed to implement the plan. These describe categories of actions rather than specific commands.
+   * Deprecated: no longer used.
    */
   allowedPrompts?: {
     /**
@@ -3406,6 +3407,10 @@ export interface ScheduleWakeupOutput {
    * True when the model ended the loop via `stop: true`
    */
   stopped?: boolean;
+  /**
+   * How many pending dynamic-loop wakeups stop:true cancelled. 0 means nothing was pending — a recurring /loop cron is not cancelled by stop:true.
+   */
+  cancelledWakeups?: number;
 }
 export interface MonitorOutput {
   /**

package/sdk.d.ts

@@ -2235,9 +2235,13 @@ export declare interface Query extends AsyncGenerator<SDKMessage, void> {
      */
     /**
      * Interrupt the current query execution. The query will stop processing
-     * and return control to the caller.
+     * and return control to the caller. On CLIs advertising the
+     * `interrupt_receipt_v1` capability (system/init `capabilities`) the
+     * resolved value is the interrupt receipt — `still_queued` uuids of async
+     * user messages that WILL still run unless cancelled first. Older CLIs
+     * resolve to `undefined`.
      */
-    interrupt(): Promise<void>;
+    interrupt(): Promise<SDKControlInterruptResponse | undefined>;
     /**
      * Change the permission mode for the current session.
      * Only available in streaming input mode.
@@ -3391,6 +3395,16 @@ declare type SDKControlInterruptRequest = {
 
 };
 
+/**
+ * Result of an interrupt operation. Advertised by the interrupt_receipt_v1 capability on system/init; older CLIs send an empty success response with no still_queued field.
+ */
+export declare type SDKControlInterruptResponse = {
+    /**
+     * Uuids of async user messages that survive this interrupt: commands still in the queue, plus any batch already dequeued for the imminent turn but not yet reachable by the abort. These WILL run unless cancelled first. Cancellation granularity: uuids still in the queue are individually cancellable via cancel_async_message; once a batch is dequeued and coalesced into one turn, cancelling a NON-representative member uuid is a no-op (its content still runs), while cancelling the batch-representative uuid drops the WHOLE coalesced batch — in both cases the cancel response reports cancelled:false because the message was no longer in the queue. Coverage caveats: only uuid-STAMPED messages appear (a message enqueued without a uuid still runs but is never listed, so [] does not mean "nothing will run"); only main-thread messages are listed (subagent-addressed messages are out of scope); and the list may include internally-enqueued uuids the client never sent (cron triggers, auto-resume continuations) — ignore unknown uuids rather than treating them as an error. Ordering: on a clean interrupt this receipt is written before the interrupted turn result; a turn that crashes during interrupt handling emits its error result on a direct-write path that may precede the receipt. Snapshot is taken synchronously with abort processing — probing the queue after the interrupted result instead always loses the race against the drain loop, which starts the next queued turn immediately.
+     */
+    still_queued: string[];
+};
+
 /**
  * Requests the worker's selectable model catalog. Fulfills the caps.modelCatalog capability: in a remote thin-client session the worker's provider, settings cascade, and enforcement policy decide which models the session can run, so the thin client must ask rather than read its own getModelOptions().
  */
@@ -3399,15 +3413,53 @@ declare type SDKControlListModelsRequest = {
 };
 
 /**
- * Invokes an MCP tool via the subprocess MCP client without a model turn. No permission check (control channel is trusted, same as other subtypes). SDK-type MCP servers (config.type === "sdk") are rejected — they are caller-provided, so the caller can invoke them directly without the subprocess round-trip. Result content passes through the same processing as model-turn MCP calls. Session expiry is not retried automatically; callers can mcp_reconnect and retry. UrlElicitationRequired (-32042) tries Elicitation hooks; if no hook resolves, the call errors with the URL in the message — open it out-of-band, then retry mcp_call.
+ * Invokes an MCP tool via the subprocess MCP client without a model turn. No permission check (control channel is trusted, same as other subtypes). SDK-type MCP servers (config.type === "sdk") are rejected — they are caller-provided, so the caller can invoke them directly without the subprocess round-trip. Result content passes through the same processing as model-turn MCP calls. Session expiry is not retried automatically; callers can mcp_reconnect and retry. UrlElicitationRequired (-32042) tries Elicitation hooks; if no hook resolves, the call errors with the URL in the message — open it out-of-band, then retry mcp_call. STAGED calls (input_files/output_files declared) additionally stage lane rows in/out around the call — see the input_files describe. Staged failures come back as a success-subtype response whose staging field carries a typed error_code; subtype:error is emitted only when the call could not be attempted at all (server not connected, kill switch, dispatch failure) and means nothing ran. Standard RPC semantics: a redelivered request_id supersedes the in-flight run (it is aborted and its response suppressed — exactly one response per request_id); conversion is idempotent, so re-running is safe. Cancellable via control_cancel_request.
  */
 declare type SDKControlMcpCallRequest = {
     subtype: 'mcp_call';
     /**
-     * Fully-qualified MCP tool name, e.g. mcp__server__tool_name.
+     * Fully-qualified MCP tool name, e.g. mcp__server__tool_name. Plugin-hosted servers are ordinary MCP servers here — e.g. mcp__plugin_documents_docs__doc_export (server names are normalized: non-[a-zA-Z0-9_-] becomes _).
      */
     tool: string;
+    /**
+     * Tool arguments. When input_files/output_files are declared, any string VALUE that exactly equals "{{in:NAME}}" or "{{out:NAME}}" (whole string, not a substring) is replaced with the worker-chosen absolute path of that named staged file before the call; a token naming no declared file fails the request with staging error_code=tool_error, and every declared output's "{{out:NAME}}" token must appear in arguments (the substituted path is the only way the tool learns where to write, so an unreferenced output fails the request before the tool runs). With no files declared — including expires_at/timeout_ms-only staged calls — passed through unchanged.
+     */
     arguments?: Record<string, unknown>;
+    /**
+     * RFC3339 deadline, REQUIRED when output_files are declared (a stale buffered drain must not overwrite rows written since). Sending expires_at routes the call through the staging engine, same as timeout_ms — the response gains a staging result. UNDELIVERED requests buffer durably and drain after reattach; a drain past this instant is dropped with staging error_code=expired instead of executing stale. Once delivered to a live worker the request is acked immediately and never redelivered — a worker killed mid-run surfaces as a missing response (apply your own deadline), not a later drain. An unparseable value is treated as already expired (fail closed).
+     */
+    expires_at?: string;
+    /**
+     * Tool-execution timeout (staging and collection have their own transport timeouts). Clamped to [1000, 600000]; default 120000. Sending timeout_ms routes the call through the staging engine — so it is always enforced when present and the response carries a staging result; omit it for a plain call. Staged calls are POSIX-worker-only: on a Windows worker any staged-field call fails with a typed staging refusal.
+     */
+    timeout_ms?: number;
+    /**
+     * Declaring input_files or output_files makes this a STAGED call: rows are fetched from the synced-file lane into a private per-request temp dir the WORKER chooses (random, per-UID — the caller never sees or computes paths; it references files via tokens in arguments), the tool runs, and declared outputs are written back as lane rows (durable-at-ack PUT). The response then carries a `staging` result the caller switches on.
+     */
+    input_files?: {
+        /**
+         * Handle referenced from arguments as "{{in:NAME}}". Unique within the request.
+         */
+        name: string;
+        /**
+         * Synced-file lane row to stage, e.g. /working/.cowork/originals/a.docx. A missing row fails with staging error_code=input_missing; the etag actually staged is echoed back in staging.inputs_used.
+         */
+        lane_path: string;
+    }[];
+    output_files?: {
+        /**
+         * Handle referenced from arguments as "{{out:NAME}}" — the tool is told (via the substituted path) where to write; the worker collects from exactly that path. Unique within the request.
+         */
+        name: string;
+        /**
+         * Synced-file lane row to write, e.g. /working/report.cd. Unique within the request (two outputs on one row would self-conflict under CAS). Outputs over the 25 MiB lane cap fail with staging error_code=output_too_large.
+         */
+        lane_path: string;
+        /**
+         * Opaque lane etag the output row must still carry for the write to land (CAS). Omitted = unconditional last-writer-wins (an empty string is rejected, not treated as unconditional). A row that moved since fails that output with staging error_code=output_conflict and the requested bytes are not written. Redelivery of a completed CAS write re-runs and conflicts with its own prior write — treat output_conflict on a retry as possible-prior-success and reconcile by etag.
+         */
+        if_match?: string;
+    }[];
 };
 
 /**
@@ -3866,12 +3918,19 @@ export declare type SDKMessageOrigin = {
 } | {
     kind: 'peer';
     from: string;
+    /**
+     * Sender display name, normalized by the harness: Unicode control, format, surrogate, and line/paragraph-separator code points stripped (categories Cc/Cf/Cs/Zl/Zp — covers bidi controls, zero-width characters, and tag characters), trimmed, at most 64 code points (+ ellipsis, never splitting a surrogate pair). Sender-asserted display text (the addressable identity is `from`) — render it as reported speech, but no client-side character sanitization is needed. Absent when the wire is not exactly one harness-formed envelope and on messages from older senders.
+     */
     name?: string;
 
     /**
      * Task id of the in-process background subagent that sent this message, stamped by the harness from the sending loop (never from tool input). Absent for cross-session peers.
      */
     senderTaskId?: string;
+    /**
+     * Decoded message body with the peer envelope stripped — byte-exact with what the model sees. Present only when the turn is exactly one harness-formed envelope (or an in-process agent message); render this instead of re-parsing the message text.
+     */
+    body?: string;
 } | {
     kind: 'task-notification';
 } | {
@@ -3935,7 +3994,7 @@ export declare type SDKModelRefusalFallbackMessage = {
 };
 
 /**
- * Emitted when the model ends the stream with stop_reason "refusal" and no fallback model is configured, so the turn ends as an error. The structured counterpart to detecting stop_reason "refusal" on the assistant error frame. Not emitted when a fallback existed but was declined or gate-failed (model_refusal_fallback covers the retry case). Absent from older CLIs.
+ * Emitted when the model ends the stream with stop_reason "refusal" and no retry runs: no fallback model is configured, or per-category routing declined the retry (the refusal category has no fallback map entry). The structured counterpart to detecting stop_reason "refusal" on the assistant error frame. Not emitted when the retry ran or the user declined the retry dialog (model_refusal_fallback covers the retry case). Absent from older CLIs.
  */
 export declare type SDKModelRefusalNoFallbackMessage = {
     type: 'system';
@@ -4251,6 +4310,10 @@ export declare type SDKSystemMessage = {
 
 
     fast_mode_state?: FastModeState;
+    /**
+     * Protocol capabilities this CLI supports, so SDK consumers can feature-detect instead of version-sniffing. Open set — ignore unknown values; check each capability for exactly the behavior you use. 'interrupt_receipt_v1' = the interrupt control_response success payload carries still_queued (uuids of async user messages that survive the interrupt). Absent on older CLIs.
+     */
+    capabilities?: string[];
 
 
 
@@ -6640,9 +6703,9 @@ export declare type TeammateIdleHookInput = BaseHookInput & {
 };
 
 /**
- * Why the query loop terminated. Unset when the loop was bypassed (local slash command) or interrupted externally (budget/retry limits checked between yields).
+ * Why the query loop terminated. Unset when the loop was bypassed (local slash command).
  */
-export declare type TerminalReason = 'blocking_limit' | 'rapid_refill_breaker' | 'prompt_too_long' | 'image_error' | 'model_error' | 'aborted_streaming' | 'aborted_tools' | 'stop_hook_prevented' | 'hook_stopped' | 'tool_deferred' | 'max_turns' | 'background_requested' | 'completed';
+export declare type TerminalReason = 'blocking_limit' | 'rapid_refill_breaker' | 'prompt_too_long' | 'image_error' | 'model_error' | 'api_error' | 'malformed_tool_use_exhausted' | 'aborted_streaming' | 'aborted_tools' | 'stop_hook_prevented' | 'hook_stopped' | 'tool_deferred' | 'max_turns' | 'background_requested' | 'completed' | 'budget_exhausted' | 'structured_output_retry_exhausted' | 'tool_deferred_unavailable' | 'turn_setup_failed';
 
 /**
  * Claude decides when and how much to think (Opus 4.6+).