@anthropic-ai/claude-agent-sdk 0.3.215 → 0.3.216

package/manifest.json

@@ -1,47 +1,47 @@
 {
-  "version": "2.1.215",
-  "commit": "316ce99628e89900bf0b1328fed3b8fec0c0c92d",
-  "buildDate": "2026-07-19T00:11:19Z",
+  "version": "2.1.216",
+  "commit": "7fead72f57c595d5a353a2e477bd2608d27ddcc6",
+  "buildDate": "2026-07-20T18:40:59Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "90608b5c5ab504e96e77365cea6203d046e291d59b2bb42cf28dcb2ccdf9dd58",
-      "size": 247124336
+      "checksum": "d01b49210d72ecbe277a2665d104bacccddf2d22185be99446d2929e0edfc48d",
+      "size": 249225584
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "1ef5f5e56ede9f7765a9bef654ece6045dba58f48b7f5b699765375953d52b6b",
-      "size": 256540048
+      "checksum": "e17cdc51437bd7a80ce0244d25045f568d67b212eea4ff81b83ee90f8666e42f",
+      "size": 258670096
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "2b43a3d5b0787217e5d7381fad42c7314292546fe9db9eb8b9b379de90509b30",
-      "size": 262060960
+      "checksum": "9e3a6aecc5164f607e1183aea2092c7d7705d146e504a6207df291776996a8ea",
+      "size": 264158112
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "c1efffaaf370aa187cb6a09dd93d4e511c646899b0078476f83791b664bde7fe",
-      "size": 265239536
+      "checksum": "74deca45220b8080ec75ab099bd5a5980e41a2b5879846a008fb115d436de085",
+      "size": 267353072
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "95f1bb89dd94ae099c7b5e53832f99624fdf82da8e0f11d81e1632b26e61973e",
-      "size": 255309160
+      "checksum": "70b5dcf81bd13212ab26ec9427fa87527cd44ceb3a2a21ac04308d0f1a418a52",
+      "size": 257406312
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "3a14b862d102d0b6b88650a00b8489b1dfec7f84b367f8192ee62c8bdaeb9220",
-      "size": 259863120
+      "checksum": "54ac63736128b3aa9a73e2d9ba1f35177eb69d7b97d975f63a36d33fe0666652",
+      "size": 261976656
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "f14452d1e199273795f2920c00fd7a7f818178ddf1f3efb4d005a7e3d4ec4eff",
-      "size": 256247968
+      "checksum": "902215367918866f3c36564e115bd5636d60178acf28181713d449275b833540",
+      "size": 258288288
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "0e976441467cb09e35b52c83e661ce8e148c5a8766e0899a4255d95c4b8110f6",
-      "size": 250623648
+      "checksum": "850ba4969ca49964b418863648131f65f76107be36d6719ff0aaaf3dfc9a422e",
+      "size": 252663968
     }
   },
   "sdkCompat": {
@@ -66,7 +66,8 @@
       "0.3.205",
       "0.3.207",
       "0.3.208",
-      "0.3.209"
+      "0.3.209",
+      "0.3.215"
     ],
     "harnessSchema": 1
   }

package/manifest.zst.json

@@ -1,55 +1,55 @@
 {
-  "version": "2.1.215",
-  "commit": "316ce99628e89900bf0b1328fed3b8fec0c0c92d",
-  "buildDate": "2026-07-19T00:13:19Z",
+  "version": "2.1.216",
+  "commit": "7fead72f57c595d5a353a2e477bd2608d27ddcc6",
+  "buildDate": "2026-07-20T18:42:29Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude.zst",
-      "checksum": "ea977b83c55cd9997431293666c0836f88facd7eec5e833db40090a89e064e5f",
-      "size": 51058017,
+      "checksum": "0e2f0bb7c0cc87233fb3b723e6a1b4bec47770c8ad1a28bf41a026567a506419",
+      "size": 51249356,
       "bundle": {
-        "checksum": "331d771edc83df2288c27e213a8c7e99fce4782c10778788d179b1ae57af7d98",
-        "size": 51055405
+        "checksum": "83ddce39ccbc04204cbf8e0826ad81858dd4bdd7cb64df75321894df1d8422b6",
+        "size": 51253933
       }
     },
     "darwin-x64": {
       "binary": "claude.zst",
-      "checksum": "3a8da176472282548e7e05d4627e67b2307c48ba820d7597792c7f752bee97ed",
-      "size": 55527475,
+      "checksum": "b6f1eb9d15fe26d032f68a586314499174a27949b8f47ad6e1a5c6d13d1fae6f",
+      "size": 55865246,
       "bundle": {
-        "checksum": "78e192d3afb4cff317050874cc6c09c63710ce70d390bad1517c3d29b4fb46d5",
-        "size": 55530080
+        "checksum": "8b7f4c687e7f326158d15b19230019d3bc8e6672ba9fafadec65fdf65b8997f8",
+        "size": 55868423
       }
     },
     "linux-arm64": {
       "binary": "claude.zst",
-      "checksum": "37f4f0c778b592d1878d235008ba190bdcc7602d87cc17e2a4f65f1438ed93e8",
-      "size": 59821134
+      "checksum": "5c270298200e995641abdf2935df6f0b1fa9003074e9586e1ae8d3969134ef5e",
+      "size": 60098614
     },
     "linux-x64": {
       "binary": "claude.zst",
-      "checksum": "7ff9594e53cd89d1af9ceb3c18d3d70be1a5c6d27475e31ee2bed65d748f18c0",
-      "size": 61214933
+      "checksum": "9f4e2873c4435cd22f0a57cf9d974e80f7942e5779d20b731155b4a7c36da38e",
+      "size": 61418616
     },
     "linux-arm64-musl": {
       "binary": "claude.zst",
-      "checksum": "5be2a8365515a6e62155ae0f612da1571164eff5605dd3ce7341e4351d6d23a4",
-      "size": 58629351
+      "checksum": "084cd6a13f749d8a120ff479c3fc94de95af7ff8295229879d4f8472af660faf",
+      "size": 58779613
     },
     "linux-x64-musl": {
       "binary": "claude.zst",
-      "checksum": "55c50d31f4145b6bb6d374a3f453bfee34ffa540f48ad64fe54cdf8cf3c023a7",
-      "size": 60067478
+      "checksum": "9c092a5e7162f1c6c594dc6cc71d0787e1459ce684982fbcfdae2c2d2b97b9ed",
+      "size": 60188121
     },
     "win32-x64": {
       "binary": "claude.exe.zst",
-      "checksum": "b26d3a56a5646912971973ee765011502d4887ca0ad2607daead8bc6a7e39714",
-      "size": 61282091
+      "checksum": "a3607330d83c8129133fcdd8a7c6a20baa3dd03eb070a0d7c4617ef833d276c5",
+      "size": 61834150
     },
     "win32-arm64": {
       "binary": "claude.exe.zst",
-      "checksum": "56e089a68b94f6e9507164da8632840e2a7422d9ef7a85f9e7e728775d278f56",
-      "size": 59507909
+      "checksum": "455fadbea866e6e31aec9a6afdd6e991bc9191e0d4f5321457df1b1ccc434039",
+      "size": 59805811
     }
   },
   "sdkCompat": {
@@ -74,7 +74,8 @@
       "0.3.205",
       "0.3.207",
       "0.3.208",
-      "0.3.209"
+      "0.3.209",
+      "0.3.215"
     ],
     "harnessSchema": 1
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anthropic-ai/claude-agent-sdk",
-  "version": "0.3.215",
+  "version": "0.3.216",
   "main": "sdk.mjs",
   "types": "sdk.d.ts",
   "exports": {
@@ -57,14 +57,14 @@
     "zod": "^4.0.0"
   },
   "optionalDependencies": {
-    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.215",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.215",
-    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.215",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.215",
-    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.215",
-    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.215",
-    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.215",
-    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.215"
+    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.216",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.216",
+    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.216",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.216",
+    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.216",
+    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.216",
+    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.216",
+    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.216"
   },
   "files": [
     "sdk.mjs",
@@ -80,5 +80,5 @@
     "manifest.json",
     "manifest.zst.json"
   ],
-  "claudeCodeVersion": "2.1.215"
+  "claudeCodeVersion": "2.1.216"
 }

package/sdk-tools.d.ts

@@ -406,6 +406,7 @@ export type ArtifactOutput =
       warnings?: string[];
       contract?: string;
       updated?: boolean;
+      liveSubscription?: string;
     }
   | {
       artifacts: {

package/sdk.d.ts

@@ -2669,6 +2669,10 @@ export declare type RewindFilesResult = {
     filesChanged?: string[];
     insertions?: number;
     deletions?: number;
+    /**
+     * Count of tracked files NOT restored or deleted because a symlink, hard link, or other non-regular file was detected at the tracked path, its parent directory no longer resolves to where it pointed when the checkpoint was taken, or its backup could not be safely read. Only populated by a real (non-dryRun) rewind — on a dryRun response the field is never set and the preview counts do not reflect link-safety refusals. Absent or 0 on a real rewind means no link-safety refusals occurred; other per-file failures (for example a missing backup file) are logged and reported in telemetry but are not counted here.
+     */
+    skippedLinks?: number;
 };
 
 export declare type SandboxCredentialsConfig = NonNullable<z.infer<ReturnType<typeof SandboxCredentialsConfigSchema>>>;
@@ -2700,6 +2704,7 @@ declare const SandboxFilesystemConfigSchema: () => z.ZodOptional<z.ZodObject<{
     denyRead: z.ZodOptional<z.ZodArray<z.ZodString>>;
     allowRead: z.ZodOptional<z.ZodArray<z.ZodString>>;
     allowManagedReadPathsOnly: z.ZodOptional<z.ZodBoolean>;
+    disabled: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>>;
 
 export declare type SandboxIgnoreViolations = NonNullable<SandboxSettings['ignoreViolations']>;
@@ -2756,6 +2761,7 @@ declare const SandboxSettingsSchema: () => z.ZodObject<{
         denyRead: z.ZodOptional<z.ZodArray<z.ZodString>>;
         allowRead: z.ZodOptional<z.ZodArray<z.ZodString>>;
         allowManagedReadPathsOnly: z.ZodOptional<z.ZodBoolean>;
+        disabled: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     credentials: z.ZodOptional<z.ZodObject<{
         files: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -2895,7 +2901,7 @@ export declare type SDKBackgroundTasksChangedMessage = {
 export declare type SdkBeta = 'context-1m-2025-08-07';
 
 /**
- * Fire-and-forget push of the full slash-command list after a mid-session change (e.g. skills discovered dynamically as the agent works in a subdirectory). Clients should REPLACE their cached command list with this payload: supportedCommands() is captured once at initialize and never reflects mid-session changes, so a client re-fetch would return the stale init list.
+ * Fire-and-forget push of the full slash-command list after a mid-session change (e.g. skills discovered dynamically as the agent works in a subdirectory). Clients should REPLACE their cached command list with this payload; supportedCommands() tracks the latest push, so a re-fetch returns the same fresh list.
  */
 export declare type SDKCommandsChangedMessage = {
     type: 'system';
@@ -3394,7 +3400,7 @@ declare type SDKControlInitializeRequest = {
      */
     title?: string;
     /**
-     * When provided, only skills whose names match an entry are loaded into the main session system prompt, using the same rules as AgentDefinition.skills: exact name, plugin-qualified name, or ":name" suffix. Omit to load every discovered skill. Applies to the main session only; subagents use AgentDefinition.skills.
+     * When provided, only skills whose names match an entry are loaded into the main session system prompt, matching the exact canonical name (e.g. "my-plugin:my-skill") or a ":name" suffix of it. Display names and aliases do not match. Omit to load every discovered skill. Applies to the main session only; subagents use AgentDefinition.skills, which additionally resolves display names and aliases.
      */
     skills?: string[];
 
@@ -3764,7 +3770,10 @@ declare type SDKControlSetMaxThinkingTokensRequest = {
  */
 declare type SDKControlSetModelRequest = {
     subtype: 'set_model';
-    model?: string;
+    /**
+     * Model to switch to. Omitted, null, or 'default' resets to the session default model.
+     */
+    model?: string | null;
 
 };
 
@@ -3986,6 +3995,10 @@ export declare type SDKMessageOrigin = {
      * Sender display name, normalized by the harness: Unicode control, format, surrogate, and line/paragraph-separator code points stripped (categories Cc/Cf/Cs/Zl/Zp — covers bidi controls, zero-width characters, and tag characters), trimmed, at most 64 code points (+ ellipsis, never splitting a surrogate pair). Sender-asserted display text (the addressable identity is `from`) — render it as reported speech, but no client-side character sanitization is needed. Absent when the wire is not exactly one harness-formed envelope and on messages from older senders.
      */
     name?: string;
+    /**
+     * The sender's host-openable session id (the envelope's `from-session` attribute — e.g. a desktop `local_<uuid>` or a CCR `session_`/`ses_` id), set by the sender's host so a receiving UI can link this message back to the sending session. Sender-asserted like `from`: a navigation target only, never authority. Absent when the sender's host provides none and on messages from older senders.
+     */
+    fromSession?: string;
 
     /**
      * Task id of the in-process background subagent that sent this message, stamped by the harness from the sending loop (never from tool input). Absent for cross-session peers.
@@ -3995,6 +4008,10 @@ export declare type SDKMessageOrigin = {
      * Decoded message body with the peer envelope stripped — byte-exact with what the model sees. Present only when the turn is exactly one harness-formed envelope (or an in-process agent message); render this instead of re-parsing the message text.
      */
     body?: string;
+    /**
+     * Kernel-verified pid of the process that connected to this session's cross-session messaging socket, read from the connection (SO_PEERCRED / LOCAL_PEERPID) — never from the payload. This identifies the CONNECTING process, which for relayed traffic (e.g. a daemon forwarding on another session's behalf) is the relay, not the message's author. Key sender identity on this, never on `from`: `from` is sender-authored and kept only for reply routing, so it is forgeable by any same-user process. Absent when unverifiable (Windows, non-UDS ingress) — never a wrong value. Pids are recyclable: provenance, not an authentication token.
+     */
+    verifiedPeerPid?: number;
 } | {
     kind: 'task-notification';
     /**
@@ -4240,6 +4257,8 @@ export declare type SDKResultSuccess = {
     ttft_ms?: number;
     ttft_stream_ms?: number;
     time_to_request_ms?: number;
+    user_message_uuid?: string;
+    request_sent_wall_ms?: number;
     time_to_request_from_spawn_ms?: number;
     warm_spare_claimed?: boolean;
     time_origin_ms?: number;
@@ -4274,7 +4293,7 @@ export declare type SDKSessionInfo = {
      */
     summary: string;
     /**
-     * Last modified time in milliseconds since epoch.
+     * Last modified time in integer milliseconds since epoch.
      */
     lastModified: number;
     /**
@@ -4302,7 +4321,7 @@ export declare type SDKSessionInfo = {
      */
     tag?: string;
     /**
-     * Creation time in milliseconds since epoch, extracted from the first entry's timestamp.
+     * Creation time in integer milliseconds since epoch, extracted from the first entry's timestamp.
      */
     createdAt?: number;
 };
@@ -4551,6 +4570,7 @@ export declare type SDKUserMessage = {
 
 
 
+
     uuid?: UUID;
     session_id?: string;
     /**
@@ -4596,6 +4616,7 @@ export declare type SDKUserMessageReplay = {
 
 
 
+
     uuid: UUID;
     session_id: string;
     isReplay: true;
@@ -4764,7 +4785,8 @@ export declare type SessionStore = {
     load(key: SessionKey): Promise<SessionStoreEntry[] | null>;
     /**
      * List sessions for a projectKey. Returns IDs + modification times.
-     * `mtime` is Unix epoch milliseconds; adapters without native modification
+     * `mtime` is integer Unix epoch milliseconds (floor fractional sources);
+     * adapters without native modification
      * time (e.g. Redis) must maintain their own index. Result order is
      * unspecified — the SDK sorts by mtime descending.
      * Optional — if undefined, listSessions() with a sessionStore throws.
@@ -6129,6 +6151,10 @@ export declare interface Settings {
              * When true (set in managed settings), only allowRead paths from policySettings are used.
              */
             allowManagedReadPathsOnly?: boolean;
+            /**
+             * macOS and Linux/WSL only: skip filesystem isolation entirely while keeping network and seccomp isolation. Ignored on native Windows, where the sandboxed process runs as a separate user with no inherent rights, so skipping the filesystem rules would withhold every access grant rather than loosen them — filesystem isolation stays on there. Sandboxed commands get unrestricted read/write access to the host filesystem; network egress is still confined to network.allowedDomains. Intended for deployments whose goal is egress control rather than filesystem containment. Does not change Bash prompting: sandbox.autoAllowBashIfSandboxed is independent and still defaults to true, so set it to false to keep prompting for sandboxed commands. Drops the read protection from filesystem.denyRead and credentials.files for sandboxed commands, since both are enforced by the filesystem layer this turns off; credentials.envVars deny/mask is unaffected. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored. If managed settings configure sandbox.filesystem at all, or list any sandbox.credentials.files entry, only managed settings can set this: an admin who deployed filesystem restrictions must not have them switched off by a user-writable file. (sandbox.credentials.envVars does not pin it — env scrubbing is independent of the filesystem layer and survives this setting.) When unset, filesystem isolation stays on.
+             */
+            disabled?: boolean;
         };
         credentials?: {
             /**