@anthropic-ai/claude-agent-sdk 0.3.219 → 0.3.221

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/manifest.json CHANGED
@@ -1,47 +1,47 @@
1
1
  {
2
- "version": "2.1.219",
3
- "commit": "7006c4c3acac98e554d3997baeda6a7fa4d1ff7c",
4
- "buildDate": "2026-07-24T03:34:26Z",
2
+ "version": "2.1.221",
3
+ "commit": "6efaf12e8b43dc7dbe50e0955c76dc4174a15876",
4
+ "buildDate": "2026-08-03T21:08:11Z",
5
5
  "platforms": {
6
6
  "darwin-arm64": {
7
7
  "binary": "claude",
8
- "checksum": "a8e806faaefac53c7a0f26523d8a45c60dbef3407b14ef990c75765d08febc82",
9
- "size": 256908272
8
+ "checksum": "7a181f36ed0fc4fbac6cee4ecf2b615eff93d8b434221fff5d7c878dc5ebf380",
9
+ "size": 270518240
10
10
  },
11
11
  "darwin-x64": {
12
12
  "binary": "claude",
13
- "checksum": "03be9f988ed88391b4a5f08e4c5dc317ce2fffa4a9dc66c01106326e7698ee76",
14
- "size": 266381200
13
+ "checksum": "f408b9f7e46439f6e34a3687ff67433fc6bc189f40220ce4f0a1e829e58f0a52",
14
+ "size": 280087584
15
15
  },
16
16
  "linux-arm64": {
17
17
  "binary": "claude",
18
- "checksum": "1f834b322ba9d1291cc7ffeff16a6795a59145bda279dbd59cd7ecebc7b7f15a",
19
- "size": 271825824
18
+ "checksum": "d3c59d6bcc4adcf4cd85abca3bc13fa1131a34cb32f982bdf030d83a3b11e700",
19
+ "size": 285457336
20
20
  },
21
21
  "linux-x64": {
22
22
  "binary": "claude",
23
- "checksum": "22cfd6f5b3061c0391ba84e9cf8c9deaa37783aac18b004d42ec061e98f00691",
24
- "size": 275004400
23
+ "checksum": "60db8e88d42c24b5199c92cfd56ec88370c510c3789c6f364af748354f087ada",
24
+ "size": 288705544
25
25
  },
26
26
  "linux-arm64-musl": {
27
27
  "binary": "claude",
28
- "checksum": "22b2c2e0f41ab0b7c7b8845be9c49fe6f27e4c344aab1bd174bdf84a4e6b0570",
29
- "size": 265074024
28
+ "checksum": "85985afd58d33578efd217788dd9e5cbbc0177ad00e638d9316c6fd89640f3ff",
29
+ "size": 278771048
30
30
  },
31
31
  "linux-x64-musl": {
32
32
  "binary": "claude",
33
- "checksum": "487008769dd69599adb779205b6b371de27b4245f0ad2ad70f15baf4eac5f81e",
34
- "size": 269627984
33
+ "checksum": "15b068e06eafff9b64583b46cdc065ac18b0d0d13950c2a83c6ee854f301a32f",
34
+ "size": 283312720
35
35
  },
36
36
  "win32-x64": {
37
37
  "binary": "claude.exe",
38
- "checksum": "10f4c1f85b07f3cf6b8fff930fd26ecd475bd146a378acfafa559a6db9d89637",
39
- "size": 265714848
38
+ "checksum": "0f73196359a07f9ad435a8c83ca7c741b9f2adbc0ad9b05f71a0c2f4aabe906a",
39
+ "size": 278279328
40
40
  },
41
41
  "win32-arm64": {
42
42
  "binary": "claude.exe",
43
- "checksum": "6a1db10161b93e81ac55537feeae8a299f0bf67601c1c0f2016e79c850302baa",
44
- "size": 260090016
43
+ "checksum": "1407585e0c33a70061d6ea7cb873b8582dcedbe928d2118982676f1951576a58",
44
+ "size": 272952480
45
45
  }
46
46
  },
47
47
  "sdkCompat": {
@@ -64,12 +64,18 @@
64
64
  "0.3.202",
65
65
  "0.3.204",
66
66
  "0.3.205",
67
+ "0.3.206",
67
68
  "0.3.207",
68
69
  "0.3.208",
69
70
  "0.3.209",
71
+ "0.3.210",
72
+ "0.3.211",
73
+ "0.3.212",
74
+ "0.3.214",
70
75
  "0.3.215",
71
76
  "0.3.217",
72
- "0.3.218"
77
+ "0.3.218",
78
+ "0.3.220"
73
79
  ],
74
80
  "harnessSchema": 1
75
81
  }
package/manifest.zst.json CHANGED
@@ -1,55 +1,55 @@
1
1
  {
2
- "version": "2.1.219",
3
- "commit": "7006c4c3acac98e554d3997baeda6a7fa4d1ff7c",
4
- "buildDate": "2026-07-24T03:36:23Z",
2
+ "version": "2.1.221",
3
+ "commit": "6efaf12e8b43dc7dbe50e0955c76dc4174a15876",
4
+ "buildDate": "2026-08-03T21:10:16Z",
5
5
  "platforms": {
6
6
  "darwin-arm64": {
7
7
  "binary": "claude.zst",
8
- "checksum": "c886b408ca4cda1d2959310faad132b933405a3b1bad4a9848d492d68eb47c2a",
9
- "size": 52506446,
8
+ "checksum": "3cc00a82f60d6be3d57a13360ac4cb544c44420c744238df7ff03956e3323184",
9
+ "size": 54310824,
10
10
  "bundle": {
11
- "checksum": "980a7160d6db0bc8173a269e2853fa1da2c5565fc3b288cd173704b85c74c0f8",
12
- "size": 52497683
11
+ "checksum": "e3627fb90b70c823fd6b1afea5b3747ba8a66925dcc7f20f89b1eaa14c1e5af0",
12
+ "size": 54313524
13
13
  }
14
14
  },
15
15
  "darwin-x64": {
16
16
  "binary": "claude.zst",
17
- "checksum": "44a0ce208070bdfb884959292e35bd231204d2a023a02022e589ea73d7f69b9f",
18
- "size": 56935079,
17
+ "checksum": "b000bac7919e0e5314369a888286eef1f51e7ae7c299725d1ad669b89186aa82",
18
+ "size": 58952796,
19
19
  "bundle": {
20
- "checksum": "51c66f290fea291765a110b4f665617b2e21560a8d75bccfe8cbcf0886c886da",
21
- "size": 56935309
20
+ "checksum": "5c9b3639bce10bec691a944c105890d1f96c5e69ddadc2d7759bd5ab64ec83b8",
21
+ "size": 58953965
22
22
  }
23
23
  },
24
24
  "linux-arm64": {
25
25
  "binary": "claude.zst",
26
- "checksum": "799d6c5d6dff67c5cbd0bbc8ff680e6450ddbc671368e6de638d46f48ecbc4dd",
27
- "size": 61249923
26
+ "checksum": "4ddd9f096f81f25deecf63cc4c74bfa1c54ed31510b808f44fc5d8182d326bec",
27
+ "size": 63194178
28
28
  },
29
29
  "linux-x64": {
30
30
  "binary": "claude.zst",
31
- "checksum": "a24d9e365afe1d253518fa2cf2892430e11b06b18eaabec50dfe8e5cbba93d1d",
32
- "size": 62548539
31
+ "checksum": "d8a43ae3cea71283d1d228937735c47f5b533829ce7a725ee081a5a72510ab41",
32
+ "size": 64369245
33
33
  },
34
34
  "linux-arm64-musl": {
35
35
  "binary": "claude.zst",
36
- "checksum": "4134b86427f31017d709aefd83f08f2ae1c2c8b9c6ade1405c0afc7ff9acd86f",
37
- "size": 59922435
36
+ "checksum": "7a7a529aaf23aaf6e2a05430342a43db2c7ab4b881731e1b91adbe95916673db",
37
+ "size": 61825337
38
38
  },
39
39
  "linux-x64-musl": {
40
40
  "binary": "claude.zst",
41
- "checksum": "01acb73d847bbfe6eb53488a9d002695f5ee0b0897f0e0ae42bfb147ea70600d",
42
- "size": 61622798
41
+ "checksum": "ec32162ba30a8dff3f90f147a2c73db5cc46c5b47daf30337433928d26549738",
42
+ "size": 63188804
43
43
  },
44
44
  "win32-x64": {
45
45
  "binary": "claude.exe.zst",
46
- "checksum": "f284e5c1b9591c71d00fa56724dbb93e97f2ad9062043641288b0aac197a6764",
47
- "size": 62957683
46
+ "checksum": "4a68cb0cbe8e4e726c49d48df1465f38d026492367151be64d48dc6d7ea3bd6f",
47
+ "size": 64602024
48
48
  },
49
49
  "win32-arm64": {
50
50
  "binary": "claude.exe.zst",
51
- "checksum": "1b11cf292eb8db6dc8c26395dc26157d09b4d0846d4f4f996cd4386704ba58c6",
52
- "size": 60973807
51
+ "checksum": "abd504266dbf91d10ba61da699ea22ca00b99d7e91e62f9e520d99eb90c9eedf",
52
+ "size": 62745683
53
53
  }
54
54
  },
55
55
  "sdkCompat": {
@@ -72,12 +72,18 @@
72
72
  "0.3.202",
73
73
  "0.3.204",
74
74
  "0.3.205",
75
+ "0.3.206",
75
76
  "0.3.207",
76
77
  "0.3.208",
77
78
  "0.3.209",
79
+ "0.3.210",
80
+ "0.3.211",
81
+ "0.3.212",
82
+ "0.3.214",
78
83
  "0.3.215",
79
84
  "0.3.217",
80
- "0.3.218"
85
+ "0.3.218",
86
+ "0.3.220"
81
87
  ],
82
88
  "harnessSchema": 1
83
89
  }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@anthropic-ai/claude-agent-sdk",
3
- "version": "0.3.219",
3
+ "version": "0.3.221",
4
4
  "main": "sdk.mjs",
5
5
  "types": "sdk.d.ts",
6
6
  "exports": {
@@ -57,14 +57,14 @@
57
57
  "zod": "^4.0.0"
58
58
  },
59
59
  "optionalDependencies": {
60
- "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.219",
61
- "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.219",
62
- "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.219",
63
- "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.219",
64
- "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.219",
65
- "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.219",
66
- "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.219",
67
- "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.219"
60
+ "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.221",
61
+ "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.221",
62
+ "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.221",
63
+ "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.221",
64
+ "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.221",
65
+ "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.221",
66
+ "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.221",
67
+ "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.221"
68
68
  },
69
69
  "files": [
70
70
  "sdk.mjs",
@@ -80,5 +80,5 @@
80
80
  "manifest.json",
81
81
  "manifest.zst.json"
82
82
  ],
83
- "claudeCodeVersion": "2.1.219"
83
+ "claudeCodeVersion": "2.1.221"
84
84
  }
package/sdk.d.ts CHANGED
@@ -625,7 +625,7 @@ export declare type ElicitationResultHookSpecificOutput = {
625
625
  content?: Record<string, unknown>;
626
626
  };
627
627
 
628
- export declare const EXIT_REASONS: readonly ["clear", "resume", "logout", "prompt_input_exit", "other", "bypass_permissions_disabled"];
628
+ export declare const EXIT_REASONS: readonly ['clear', 'resume', 'logout', 'prompt_input_exit', 'other', 'bypass_permissions_disabled'];
629
629
 
630
630
  export declare type ExitReason = 'clear' | 'resume' | 'logout' | 'prompt_input_exit' | 'other' | 'bypass_permissions_disabled';
631
631
 
@@ -813,7 +813,7 @@ export declare type GetSubagentMessagesOptions = {
813
813
  sessionStore?: SessionStore;
814
814
  };
815
815
 
816
- export declare const HOOK_EVENTS: readonly ["PreToolUse", "PostToolUse", "PostToolUseFailure", "PostToolBatch", "Notification", "UserPromptSubmit", "UserPromptExpansion", "SessionStart", "SessionEnd", "Stop", "StopFailure", "SubagentStart", "SubagentStop", "PreCompact", "PostCompact", "PermissionRequest", "PermissionDenied", "Setup", "TeammateIdle", "TaskCreated", "TaskCompleted", "Elicitation", "ElicitationResult", "ConfigChange", "WorktreeCreate", "WorktreeRemove", "InstructionsLoaded", "CwdChanged", "FileChanged", "DirectoryAdded", "MessageDisplay"];
816
+ export declare const HOOK_EVENTS: readonly ['PreToolUse', 'PostToolUse', 'PostToolUseFailure', 'PostToolBatch', 'Notification', 'UserPromptSubmit', 'UserPromptExpansion', 'SessionStart', 'SessionEnd', 'Stop', 'StopFailure', 'SubagentStart', 'SubagentStop', 'PreCompact', 'PostCompact', 'PermissionRequest', 'PermissionDenied', 'Setup', 'TeammateIdle', 'TaskCreated', 'TaskCompleted', 'Elicitation', 'ElicitationResult', 'ConfigChange', 'WorktreeCreate', 'WorktreeRemove', 'InstructionsLoaded', 'CwdChanged', 'FileChanged', 'DirectoryAdded', 'MessageDisplay'];
817
817
 
818
818
  /**
819
819
  * Hook callback function for responding to events during execution.
@@ -2060,7 +2060,7 @@ export declare type Options = {
2060
2060
  *
2061
2061
  * @alpha
2062
2062
  */
2063
- export declare const ORG_POLICY_LIMIT_PREFIXES: readonly ["This service is disabled for your org"];
2063
+ export declare const ORG_POLICY_LIMIT_PREFIXES: readonly ['This service is disabled for your org'];
2064
2064
 
2065
2065
  export declare type OutputFormat = JsonSchemaOutputFormat;
2066
2066
 
@@ -2705,18 +2705,29 @@ export declare type RewindFilesResult = {
2705
2705
  export declare type SandboxCredentialsConfig = NonNullable<z.infer<ReturnType<typeof SandboxCredentialsConfigSchema>>>;
2706
2706
 
2707
2707
  declare const SandboxCredentialsConfigSchema: () => z.ZodOptional<z.ZodObject<{
2708
- files: z.ZodOptional<z.ZodArray<z.ZodObject<{
2708
+ files: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
2709
2709
  path: z.ZodString;
2710
- mode: z.ZodLiteral<"deny">;
2711
- }, z.core.$strip>>>;
2712
- envVars: z.ZodOptional<z.ZodArray<z.ZodObject<{
2710
+ mode: z.ZodEnum<{
2711
+ deny: "deny";
2712
+ mask: "mask";
2713
+ }>;
2714
+ extract: z.ZodOptional<z.ZodString>;
2715
+ onExtractNoMatch: z.ZodOptional<z.ZodEnum<{
2716
+ deny: "deny";
2717
+ error: "error";
2718
+ warn: "warn";
2719
+ }>>;
2720
+ maskDuplicates: z.ZodOptional<z.ZodBoolean>;
2721
+ injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
2722
+ }, z.core.$strip>>>>;
2723
+ envVars: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
2713
2724
  name: z.ZodString;
2714
2725
  mode: z.ZodEnum<{
2715
2726
  deny: "deny";
2716
2727
  mask: "mask";
2717
2728
  }>;
2718
2729
  injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
2719
- }, z.core.$strip>>>;
2730
+ }, z.core.$strip>>>>;
2720
2731
  allowPlaintextInject: z.ZodOptional<z.ZodBoolean>;
2721
2732
  }, z.core.$strip>>;
2722
2733
 
@@ -2793,18 +2804,29 @@ declare const SandboxSettingsSchema: () => z.ZodObject<{
2793
2804
  disabled: z.ZodOptional<z.ZodBoolean>;
2794
2805
  }, z.core.$strip>>;
2795
2806
  credentials: z.ZodOptional<z.ZodObject<{
2796
- files: z.ZodOptional<z.ZodArray<z.ZodObject<{
2807
+ files: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
2797
2808
  path: z.ZodString;
2798
- mode: z.ZodLiteral<"deny">;
2799
- }, z.core.$strip>>>;
2800
- envVars: z.ZodOptional<z.ZodArray<z.ZodObject<{
2809
+ mode: z.ZodEnum<{
2810
+ deny: "deny";
2811
+ mask: "mask";
2812
+ }>;
2813
+ extract: z.ZodOptional<z.ZodString>;
2814
+ onExtractNoMatch: z.ZodOptional<z.ZodEnum<{
2815
+ deny: "deny";
2816
+ error: "error";
2817
+ warn: "warn";
2818
+ }>>;
2819
+ maskDuplicates: z.ZodOptional<z.ZodBoolean>;
2820
+ injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
2821
+ }, z.core.$strip>>>>;
2822
+ envVars: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
2801
2823
  name: z.ZodString;
2802
2824
  mode: z.ZodEnum<{
2803
2825
  deny: "deny";
2804
2826
  mask: "mask";
2805
2827
  }>;
2806
2828
  injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
2807
- }, z.core.$strip>>>;
2829
+ }, z.core.$strip>>>>;
2808
2830
  allowPlaintextInject: z.ZodOptional<z.ZodBoolean>;
2809
2831
  }, z.core.$strip>>;
2810
2832
  ignoreViolations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
@@ -2816,8 +2838,8 @@ declare const SandboxSettingsSchema: () => z.ZodObject<{
2816
2838
  command: z.ZodString;
2817
2839
  args: z.ZodOptional<z.ZodArray<z.ZodString>>;
2818
2840
  }, z.core.$strip>>;
2819
- bwrapPath: z.ZodCatch<z.ZodOptional<z.ZodPipe<z.ZodTransform<string, unknown>, z.ZodString>>>;
2820
- socatPath: z.ZodCatch<z.ZodOptional<z.ZodPipe<z.ZodTransform<string, unknown>, z.ZodString>>>;
2841
+ bwrapPath: z.ZodCatch<z.ZodOptional<z.ZodPipe<z.ZodTransform<string | undefined, unknown>, z.ZodString>>>;
2842
+ socatPath: z.ZodCatch<z.ZodOptional<z.ZodPipe<z.ZodTransform<string | undefined, unknown>, z.ZodString>>>;
2821
2843
  }, z.core.$loose>;
2822
2844
 
2823
2845
  /**
@@ -6174,7 +6196,7 @@ export declare interface Settings {
6174
6196
  httpProxyPort?: number;
6175
6197
  socksProxyPort?: number;
6176
6198
  /**
6177
- * [EXPERIMENTAL] Enable in-process TLS termination so the per-request filter can see HTTPS request bodies. Provide a CA cert+key, or omit both to have sandbox-runtime generate an ephemeral one for the session. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored.
6199
+ * [EXPERIMENTAL] Enable in-process TLS termination so the per-request filter can see HTTPS request bodies. Provide a CA cert+key, or omit both to have sandbox-runtime generate an ephemeral one for the session. On native Windows an ephemeral CA cannot pass the sandbox trust check, so omitting the paths uses a persistent CA managed by the sandbox runtime (set up and trusted via /sandbox install); configured paths are passed to the sandbox runtime verbatim, which rejects a bad or incomplete pair at sandbox initialization. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored.
6178
6200
  */
6179
6201
  tlsTerminate?: {
6180
6202
  caCertPath?: string;
@@ -6203,13 +6225,13 @@ export declare interface Settings {
6203
6225
  */
6204
6226
  allowManagedReadPathsOnly?: boolean;
6205
6227
  /**
6206
- * macOS and Linux/WSL only: skip filesystem isolation entirely while keeping network and seccomp isolation. Ignored on native Windows, where the sandboxed process runs as a separate user with no inherent rights, so skipping the filesystem rules would withhold every access grant rather than loosen them — filesystem isolation stays on there. Sandboxed commands get unrestricted read/write access to the host filesystem; network egress is still confined to network.allowedDomains. Intended for deployments whose goal is egress control rather than filesystem containment. Does not change Bash prompting: sandbox.autoAllowBashIfSandboxed is independent and still defaults to true, so set it to false to keep prompting for sandboxed commands. Drops the read protection from filesystem.denyRead and credentials.files for sandboxed commands, since both are enforced by the filesystem layer this turns off; credentials.envVars deny/mask is unaffected. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored. If managed settings configure sandbox.filesystem at all, or list any sandbox.credentials.files entry, only managed settings can set this: an admin who deployed filesystem restrictions must not have them switched off by a user-writable file. (sandbox.credentials.envVars does not pin it — env scrubbing is independent of the filesystem layer and survives this setting.) When unset, filesystem isolation stays on.
6228
+ * macOS and Linux/WSL only: skip filesystem isolation entirely while keeping network and seccomp isolation. Ignored on native Windows, where the sandboxed process runs as a separate user with no inherent rights, so skipping the filesystem rules would withhold every access grant rather than loosen them — filesystem isolation stays on there. Sandboxed commands get unrestricted read/write access to the host filesystem; network egress is still confined to network.allowedDomains. Intended for deployments whose goal is egress control rather than filesystem containment. Does not change Bash prompting: sandbox.autoAllowBashIfSandboxed is independent and still defaults to true, so set it to false to keep prompting for sandboxed commands. Drops the read protection from filesystem.denyRead and credentials.files deny entries for sandboxed commands, since both are enforced by the filesystem layer this turns off; credentials.files mask entries (sentinel binds) and credentials.envVars deny/mask are unaffected. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored. If managed settings configure sandbox.filesystem at all, or list any sandbox.credentials.files deny entry, only managed settings can set this: an admin who deployed filesystem restrictions must not have them switched off by a user-writable file. (sandbox.credentials.envVars and credentials.files mask entries do not pin it — env scrubbing and sentinel binds are independent of the filesystem layer and survive this setting.) When unset, filesystem isolation stays on.
6207
6229
  */
6208
6230
  disabled?: boolean;
6209
6231
  };
6210
6232
  credentials?: {
6211
6233
  /**
6212
- * Credential files or directories to protect. `deny` blocks reads inside the sandbox.
6234
+ * Credential files or directories to protect. `deny` blocks reads inside the sandbox; `mask` substitutes a sentinel inside the sandbox (whole-file, or per-`extract` capture) and injects the real value at the proxy. On macOS and Windows `mask` degrades to `deny`.
6213
6235
  */
6214
6236
  files?: {
6215
6237
  /**
@@ -6217,9 +6239,25 @@ export declare interface Settings {
6217
6239
  */
6218
6240
  path: string;
6219
6241
  /**
6220
- * Access mode for this path. Only `deny` is supported.
6242
+ * Access mode for this path. `deny` blocks reads inside the sandbox; `mask` shows sandboxed commands a sentinel-substituted copy (whole-file, or only the spans captured by `extract`) and the host proxy swaps sentinel→real on egress to `injectHosts`. On macOS and Windows `mask` currently degrades to `deny`.
6221
6243
  */
6222
- mode: 'deny';
6244
+ mode: 'deny' | 'mask';
6245
+ /**
6246
+ * Optional regex for structured masking when mode is `mask`. Applied globally to the file; capture group 1 of each match is a credential value, and only those captured spans are replaced with sentinels — the rest of the file is preserved so a tool that parses it (.netrc, JSON, YAML) still succeeds. Without `extract`, the entire file content is replaced with one sentinel (whole-file masking, suited to single-secret files). If the regex matches nothing, behavior is governed by `onExtractNoMatch` (default `warn`). Accepted but ignored for `deny`.
6247
+ */
6248
+ extract?: string;
6249
+ /**
6250
+ * What to do when `extract` matches nothing in the file. `warn` (default) emits a stderr warning and leaves the file readable as-is inside the sandbox (fail-open, for credentials that may be legitimately absent); `deny` degrades the entry to mode `deny` so the file is unreadable (fail-closed) — under `sandbox.filesystem.disabled` it is treated as `error`, since read-denies are dropped in that mode; `error` aborts at sandbox setup so nothing runs until the config is fixed. Only meaningful when mode is `mask` and `extract` is set; accepted but ignored otherwise.
6251
+ */
6252
+ onExtractNoMatch?: 'warn' | 'deny' | 'error';
6253
+ /**
6254
+ * If true, verbatim occurrences of each captured credential value outside the regex-matched spans are also replaced with the corresponding sentinel — for a secret repeated where the regex does not reach (e.g. pasted into a comment). Matches raw substrings, so short or common values may corrupt unrelated content; intended for long, high-entropy secrets. Defaults to false. Only meaningful when mode is `mask` and `extract` is set; accepted but ignored otherwise.
6255
+ */
6256
+ maskDuplicates?: boolean;
6257
+ /**
6258
+ * Optional narrowing of where the proxy substitutes this credential. Only meaningful when mode is `mask`; accepted but ignored for `deny`. If unset, defaults to `network.allowedDomains` — the credential is injected at every reachable host. Each entry must be reachable via `network.allowedDomains` (sandbox-runtime validates this).
6259
+ */
6260
+ injectHosts?: string[];
6223
6261
  }[];
6224
6262
  /**
6225
6263
  * Environment variables to protect. `deny` unsets the variable for sandboxed commands; `mask` substitutes a sentinel inside the sandbox and injects the real value at the proxy.
@@ -7022,7 +7060,7 @@ export declare interface Transport {
7022
7060
  *
7023
7061
  * @alpha
7024
7062
  */
7025
- export declare const USAGE_LIMIT_ERROR_PREFIXES: readonly ["You've hit your", "You've reached your", "You're out of usage credits", "Your org is out of usage · add funds to continue", "Your org is out of usage · contact your admin", "Your seat type doesn't include usage credits", "Your seat type doesn't include usage", "Your usage allocation has been disabled by your admin", "Your group's usage limit is set to $0", "Fable 5 requires usage credits", "You're out of extra usage", "Your seat type doesn't include extra usage"];
7063
+ export declare const USAGE_LIMIT_ERROR_PREFIXES: readonly ["You've hit your", "You've reached your", "You're out of usage credits", 'Your org is out of usage · add funds to continue', 'Your org is out of usage · contact your admin', "Your seat type doesn't include usage credits", "Your seat type doesn't include usage", 'Your usage allocation has been disabled by your admin', "Your group's usage limit is set to $0", 'Fable 5 requires usage credits', "You're out of extra usage", "Your seat type doesn't include extra usage"];
7026
7064
 
7027
7065
  /**
7028
7066
  * Overage-transition notifications ("now drawing from credits"). Toast only;
@@ -7030,7 +7068,7 @@ export declare const USAGE_LIMIT_ERROR_PREFIXES: readonly ["You've hit your", "Y
7030
7068
  *
7031
7069
  * @alpha
7032
7070
  */
7033
- export declare const USAGE_TRANSITION_PREFIXES: readonly ["You're now using usage credits", "You're now using your usage allocation", "Now using your usage allocation", "Now using usage credits", "You're now using extra usage", "Now using extra usage"];
7071
+ export declare const USAGE_TRANSITION_PREFIXES: readonly ["You're now using usage credits", "You're now using your usage allocation", 'Now using your usage allocation', 'Now using usage credits', "You're now using extra usage", 'Now using extra usage'];
7034
7072
 
7035
7073
  /**
7036
7074
  * Approaching-limit warnings (severity:'warning'). Footer/toast only; these