@anthropic-ai/claude-agent-sdk 0.3.220 → 0.3.222

package/manifest.json

@@ -1,52 +1,51 @@
 {
-  "version": "2.1.220",
-  "commit": "4073f59596e272f39393db4f96abc5f4b10eff21",
-  "buildDate": "2026-07-24T22:28:51Z",
+  "version": "2.1.222",
+  "commit": "fbf49312c28437bf9c2546b9ace3bd7b34eb6ff6",
+  "buildDate": "2026-08-04T01:46:04Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "8addc857f3fe64d5a0368af9ee50321b50afb4a6918ba3ef018ab84f5dbbe081",
-      "size": 256908272
+      "checksum": "c66a6cc6fa2e8145bb1a6e77831f2caf4b83690ff04650500dfa6e2c05ca997c",
+      "size": 271289792
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "dca7be0aa7d3d924836d440e0c6d8e3d47ef3c8e61fa5809b54b9017170ce2f3",
-      "size": 266397712
+      "checksum": "36bfc6482a25730dbb1cee72589e522c66c45a4dc9ebfdd8a76a8113b01b6188",
+      "size": 280847136
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "159e4a51d796f3bf14677577100f7efb845611b1ceaf0c30cbd8d4650d942185",
-      "size": 271825824
+      "checksum": "a04be0a8d7fe0259571ab7411d51d85658d71a4a26ce62b60c908290372e6016",
+      "size": 286178232
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "674f61f20ff306f3100cf9200e4c36c4b70278b5bef2884549819b942a89c863",
-      "size": 275012592
+      "checksum": "10caae8f22b915c26bfff0e013a4d45608c4f1ae287583626569156f447730e5",
+      "size": 289467400
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "5eb2697a1500c1b8736e53fd696392196dc6758cf1d470c64d8d2a2fd1629eeb",
-      "size": 265074024
+      "checksum": "a3c3e3202ae8842a5e9d2b4ce1dcea9fa00d4e0ae27b5b3e8d778332ba3bb23c",
+      "size": 279491944
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "f1c20514a3571cdf9982e25c490042d740ed7cfed3f00c64ba92dc7ec47c3c5b",
-      "size": 269636176
+      "checksum": "e0b0fb4005e1ac0ebcee136254c638722f1c49e171a23d0843c605d72aac9029",
+      "size": 284074576
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "af5bf1f1b2aadffc768eccd787084c6fdf9ba81624cbe96c1c6d9ac1a1550231",
-      "size": 265720480
+      "checksum": "032cb799d2abfaa6ca440f6458304b9a2a250521063d21ebcea7f3c77c443db7",
+      "size": 279014048
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "07343ace8a2e9ba87eed716e9c0261ce4bda8954c316695e4cb26fd0605de13c",
-      "size": 260095648
+      "checksum": "f760aa2782019e55b1e44fda9eddec85ca8499429da87efddd47ab18d4a716a2",
+      "size": 273687200
     }
   },
   "sdkCompat": {
     "testedWrapperVersions": [
-      "0.3.181",
       "0.3.182",
       "0.3.183",
       "0.3.185",
@@ -68,9 +67,15 @@
       "0.3.207",
       "0.3.208",
       "0.3.209",
+      "0.3.210",
+      "0.3.211",
+      "0.3.212",
+      "0.3.214",
       "0.3.215",
       "0.3.217",
-      "0.3.218"
+      "0.3.218",
+      "0.3.220",
+      "0.3.221"
     ],
     "harnessSchema": 1
   }

package/manifest.zst.json

@@ -1,60 +1,59 @@
 {
-  "version": "2.1.220",
-  "commit": "4073f59596e272f39393db4f96abc5f4b10eff21",
-  "buildDate": "2026-07-24T22:30:51Z",
+  "version": "2.1.222",
+  "commit": "fbf49312c28437bf9c2546b9ace3bd7b34eb6ff6",
+  "buildDate": "2026-08-04T01:48:06Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude.zst",
-      "checksum": "bc30c97e9736447fba8bd2eac6a317d4aaadf269b09f20fcc4ef53dc649b21d6",
-      "size": 52528564,
+      "checksum": "3d9167ec33e7075b37f3a141e95cd53781bae654935b33a0995a1296fca9d86e",
+      "size": 54481803,
       "bundle": {
-        "checksum": "1ae58974156f01fcd6e4590e4dcb18740fcf98ba70f3f6f833038081ea6bc0af",
-        "size": 52533430
+        "checksum": "e05b161d6c498b136ca4a33dad2cb3d1fb45e44748741e474d908c3bcda09db3",
+        "size": 54479945
       }
     },
     "darwin-x64": {
       "binary": "claude.zst",
-      "checksum": "1017a8bdd8c02ce5df79ab0181110292bb6c3b48ae468a9fb6a3cac48c41951a",
-      "size": 57135309,
+      "checksum": "3e35e6c90cf98da026bb3263e1b4f8f90f9ae8356b7091f5b3ee40acd133ea55",
+      "size": 59125253,
       "bundle": {
-        "checksum": "ade9f5eebf5394766ada73d3c244d099140ca8c7a2e9ef244b1c4a22217e2b57",
-        "size": 57139607
+        "checksum": "a70a9a94aa97a61d967f751c95b225224d726032417610eb310c41627dfbf33e",
+        "size": 59124389
       }
     },
     "linux-arm64": {
       "binary": "claude.zst",
-      "checksum": "d663d771947513311a3af5de6e73f993688a7ff3357ea5b6f86726f2be65ae67",
-      "size": 61240539
+      "checksum": "5b45d688c9413d1fab1cfc0fae36f1eac907913aca548a7689d213afdde5f911",
+      "size": 63220586
     },
     "linux-x64": {
       "binary": "claude.zst",
-      "checksum": "ec2d84d88ae9f5e3c9e0ab21f8092f9df3c8d0c599a551dd91cddce23993e55e",
-      "size": 62556070
+      "checksum": "913436d3e6b4707a022136cf4cdd35894e7b7b9f449a9ffa5caacc94404cacf1",
+      "size": 64686089
     },
     "linux-arm64-musl": {
       "binary": "claude.zst",
-      "checksum": "a38ac99e050fc217485196fdee0fee4aaf5212d6c90e59508c1a966d4b97e914",
-      "size": 59906737
+      "checksum": "cd6af30a333c74514f2b0855b7bb1460b2f49998921c3180e5bd9b2c73c2db6c",
+      "size": 62052400
     },
     "linux-x64-musl": {
       "binary": "claude.zst",
-      "checksum": "27356dcc27e7ee42a70d8c3134a4b4ffdbabdcc879e035d7f387449e383a08f2",
-      "size": 61358054
+      "checksum": "3708ff69cf0fc9cd5065d2228cdc862033146104d8be4690717ecf6087f1acd8",
+      "size": 63505036
     },
     "win32-x64": {
       "binary": "claude.exe.zst",
-      "checksum": "8999275ddf501363a28692f9ef5267cfdc10ca54873e21c007de0107d1fac526",
-      "size": 62943531
+      "checksum": "8fa68c162691c9952df710ab56548ded883d4830644a1fc84dfbc4cce90429c7",
+      "size": 64891486
     },
     "win32-arm64": {
       "binary": "claude.exe.zst",
-      "checksum": "a1a2e4e30e91c4c1d2a676a6b5ec68b8987d1b00211c694215f19f5818999d8d",
-      "size": 60936226
+      "checksum": "917682441d99ce6473a05ec26ce5943a6ced708766c094596a3970eb2eabf543",
+      "size": 63016178
     }
   },
   "sdkCompat": {
     "testedWrapperVersions": [
-      "0.3.181",
       "0.3.182",
       "0.3.183",
       "0.3.185",
@@ -76,9 +75,15 @@
       "0.3.207",
       "0.3.208",
       "0.3.209",
+      "0.3.210",
+      "0.3.211",
+      "0.3.212",
+      "0.3.214",
       "0.3.215",
       "0.3.217",
-      "0.3.218"
+      "0.3.218",
+      "0.3.220",
+      "0.3.221"
     ],
     "harnessSchema": 1
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anthropic-ai/claude-agent-sdk",
-  "version": "0.3.220",
+  "version": "0.3.222",
   "main": "sdk.mjs",
   "types": "sdk.d.ts",
   "exports": {
@@ -57,14 +57,14 @@
     "zod": "^4.0.0"
   },
   "optionalDependencies": {
-    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.220",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.220",
-    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.220",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.220",
-    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.220",
-    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.220",
-    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.220",
-    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.220"
+    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.222",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.222",
+    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.222",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.222",
+    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.222",
+    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.222",
+    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.222",
+    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.222"
   },
   "files": [
     "sdk.mjs",
@@ -80,5 +80,5 @@
     "manifest.json",
     "manifest.zst.json"
   ],
-  "claudeCodeVersion": "2.1.220"
+  "claudeCodeVersion": "2.1.222"
 }

package/sdk.d.ts

@@ -625,7 +625,7 @@ export declare type ElicitationResultHookSpecificOutput = {
     content?: Record<string, unknown>;
 };
 
-export declare const EXIT_REASONS: readonly ["clear", "resume", "logout", "prompt_input_exit", "other", "bypass_permissions_disabled"];
+export declare const EXIT_REASONS: readonly ['clear', 'resume', 'logout', 'prompt_input_exit', 'other', 'bypass_permissions_disabled'];
 
 export declare type ExitReason = 'clear' | 'resume' | 'logout' | 'prompt_input_exit' | 'other' | 'bypass_permissions_disabled';
 
@@ -813,7 +813,7 @@ export declare type GetSubagentMessagesOptions = {
     sessionStore?: SessionStore;
 };
 
-export declare const HOOK_EVENTS: readonly ["PreToolUse", "PostToolUse", "PostToolUseFailure", "PostToolBatch", "Notification", "UserPromptSubmit", "UserPromptExpansion", "SessionStart", "SessionEnd", "Stop", "StopFailure", "SubagentStart", "SubagentStop", "PreCompact", "PostCompact", "PermissionRequest", "PermissionDenied", "Setup", "TeammateIdle", "TaskCreated", "TaskCompleted", "Elicitation", "ElicitationResult", "ConfigChange", "WorktreeCreate", "WorktreeRemove", "InstructionsLoaded", "CwdChanged", "FileChanged", "DirectoryAdded", "MessageDisplay"];
+export declare const HOOK_EVENTS: readonly ['PreToolUse', 'PostToolUse', 'PostToolUseFailure', 'PostToolBatch', 'Notification', 'UserPromptSubmit', 'UserPromptExpansion', 'SessionStart', 'SessionEnd', 'Stop', 'StopFailure', 'SubagentStart', 'SubagentStop', 'PreCompact', 'PostCompact', 'PermissionRequest', 'PermissionDenied', 'Setup', 'TeammateIdle', 'TaskCreated', 'TaskCompleted', 'Elicitation', 'ElicitationResult', 'ConfigChange', 'WorktreeCreate', 'WorktreeRemove', 'InstructionsLoaded', 'CwdChanged', 'FileChanged', 'DirectoryAdded', 'MessageDisplay'];
 
 /**
  * Hook callback function for responding to events during execution.
@@ -2060,7 +2060,7 @@ export declare type Options = {
  *
  * @alpha
  */
-export declare const ORG_POLICY_LIMIT_PREFIXES: readonly ["This service is disabled for your org"];
+export declare const ORG_POLICY_LIMIT_PREFIXES: readonly ['This service is disabled for your org'];
 
 export declare type OutputFormat = JsonSchemaOutputFormat;
 
@@ -2705,18 +2705,29 @@ export declare type RewindFilesResult = {
 export declare type SandboxCredentialsConfig = NonNullable<z.infer<ReturnType<typeof SandboxCredentialsConfigSchema>>>;
 
 declare const SandboxCredentialsConfigSchema: () => z.ZodOptional<z.ZodObject<{
-    files: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    files: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
         path: z.ZodString;
-        mode: z.ZodLiteral<"deny">;
-    }, z.core.$strip>>>;
-    envVars: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        mode: z.ZodEnum<{
+            deny: "deny";
+            mask: "mask";
+        }>;
+        extract: z.ZodOptional<z.ZodString>;
+        onExtractNoMatch: z.ZodOptional<z.ZodEnum<{
+            deny: "deny";
+            error: "error";
+            warn: "warn";
+        }>>;
+        maskDuplicates: z.ZodOptional<z.ZodBoolean>;
+        injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>>;
+    envVars: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
         name: z.ZodString;
         mode: z.ZodEnum<{
             deny: "deny";
             mask: "mask";
         }>;
         injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    }, z.core.$strip>>>;
+    }, z.core.$strip>>>>;
     allowPlaintextInject: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>>;
 
@@ -2793,18 +2804,29 @@ declare const SandboxSettingsSchema: () => z.ZodObject<{
         disabled: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     credentials: z.ZodOptional<z.ZodObject<{
-        files: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        files: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
             path: z.ZodString;
-            mode: z.ZodLiteral<"deny">;
-        }, z.core.$strip>>>;
-        envVars: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            mode: z.ZodEnum<{
+                deny: "deny";
+                mask: "mask";
+            }>;
+            extract: z.ZodOptional<z.ZodString>;
+            onExtractNoMatch: z.ZodOptional<z.ZodEnum<{
+                deny: "deny";
+                error: "error";
+                warn: "warn";
+            }>>;
+            maskDuplicates: z.ZodOptional<z.ZodBoolean>;
+            injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>>>;
+        envVars: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
             name: z.ZodString;
             mode: z.ZodEnum<{
                 deny: "deny";
                 mask: "mask";
             }>;
             injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        }, z.core.$strip>>>;
+        }, z.core.$strip>>>>;
         allowPlaintextInject: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     ignoreViolations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
@@ -2816,8 +2838,8 @@ declare const SandboxSettingsSchema: () => z.ZodObject<{
         command: z.ZodString;
         args: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
-    bwrapPath: z.ZodCatch<z.ZodOptional<z.ZodPipe<z.ZodTransform<string, unknown>, z.ZodString>>>;
-    socatPath: z.ZodCatch<z.ZodOptional<z.ZodPipe<z.ZodTransform<string, unknown>, z.ZodString>>>;
+    bwrapPath: z.ZodCatch<z.ZodOptional<z.ZodPipe<z.ZodTransform<string | undefined, unknown>, z.ZodString>>>;
+    socatPath: z.ZodCatch<z.ZodOptional<z.ZodPipe<z.ZodTransform<string | undefined, unknown>, z.ZodString>>>;
 }, z.core.$loose>;
 
 /**
@@ -4085,13 +4107,17 @@ export declare type SDKMirrorErrorMessage = {
 };
 
 /**
- * Emitted when the primary model ends the stream with stop_reason "refusal" and the turn is retried once on a fallback model with the swap made persistent for the session (direction: "retry"). "revert" and "sticky" are retained in the enum for SDK-consumer compat and are no longer emitted.
+ * Emitted when the primary model ends the stream with stop_reason "refusal" and the turn is retried once on a fallback model (direction: "retry"). When `scope` is "session" (or absent — older CLIs), the swap is made persistent for the session; when `scope` is "local", only that subagent/side-question response came from the fallback model and the session model is unchanged. "revert" and "sticky" are retained in the enum for SDK-consumer compat and are no longer emitted.
  */
 export declare type SDKModelRefusalFallbackMessage = {
     type: 'system';
     subtype: 'model_refusal_fallback';
     trigger: 'refusal';
     direction: 'retry' | 'revert' | 'sticky';
+    /**
+     * 'session': the main thread fell back and the session model is swapped. 'local': a subagent / side-question (/btw) / background fork fell back — only that response came from the fallback model and the session model is unchanged. Absent from older CLIs (treat as 'session').
+     */
+    scope?: 'session' | 'local';
     original_model: string;
     fallback_model: string;
     request_id: string | null;
@@ -6174,7 +6200,7 @@ export declare interface Settings {
             httpProxyPort?: number;
             socksProxyPort?: number;
             /**
-             * [EXPERIMENTAL] Enable in-process TLS termination so the per-request filter can see HTTPS request bodies. Provide a CA cert+key, or omit both to have sandbox-runtime generate an ephemeral one for the session. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored.
+             * [EXPERIMENTAL] Enable in-process TLS termination so the per-request filter can see HTTPS request bodies. Provide a CA cert+key, or omit both to have sandbox-runtime generate an ephemeral one for the session. On native Windows an ephemeral CA cannot pass the sandbox trust check, so omitting the paths uses a persistent CA managed by the sandbox runtime (set up and trusted via /sandbox install); configured paths are passed to the sandbox runtime verbatim, which rejects a bad or incomplete pair at sandbox initialization. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored.
              */
             tlsTerminate?: {
                 caCertPath?: string;
@@ -6203,13 +6229,13 @@ export declare interface Settings {
              */
             allowManagedReadPathsOnly?: boolean;
             /**
-             * macOS and Linux/WSL only: skip filesystem isolation entirely while keeping network and seccomp isolation. Ignored on native Windows, where the sandboxed process runs as a separate user with no inherent rights, so skipping the filesystem rules would withhold every access grant rather than loosen them — filesystem isolation stays on there. Sandboxed commands get unrestricted read/write access to the host filesystem; network egress is still confined to network.allowedDomains. Intended for deployments whose goal is egress control rather than filesystem containment. Does not change Bash prompting: sandbox.autoAllowBashIfSandboxed is independent and still defaults to true, so set it to false to keep prompting for sandboxed commands. Drops the read protection from filesystem.denyRead and credentials.files for sandboxed commands, since both are enforced by the filesystem layer this turns off; credentials.envVars deny/mask is unaffected. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored. If managed settings configure sandbox.filesystem at all, or list any sandbox.credentials.files entry, only managed settings can set this: an admin who deployed filesystem restrictions must not have them switched off by a user-writable file. (sandbox.credentials.envVars does not pin it — env scrubbing is independent of the filesystem layer and survives this setting.) When unset, filesystem isolation stays on.
+             * macOS and Linux/WSL only: skip filesystem isolation entirely while keeping network and seccomp isolation. Ignored on native Windows, where the sandboxed process runs as a separate user with no inherent rights, so skipping the filesystem rules would withhold every access grant rather than loosen them — filesystem isolation stays on there. Sandboxed commands get unrestricted read/write access to the host filesystem; network egress is still confined to network.allowedDomains. Intended for deployments whose goal is egress control rather than filesystem containment. Does not change Bash prompting: sandbox.autoAllowBashIfSandboxed is independent and still defaults to true, so set it to false to keep prompting for sandboxed commands. Drops the read protection from filesystem.denyRead and credentials.files deny entries for sandboxed commands, since both are enforced by the filesystem layer this turns off; credentials.files mask entries (sentinel binds) and credentials.envVars deny/mask are unaffected. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored. If managed settings configure sandbox.filesystem at all, or list any sandbox.credentials.files deny entry, only managed settings can set this: an admin who deployed filesystem restrictions must not have them switched off by a user-writable file. (sandbox.credentials.envVars and credentials.files mask entries do not pin it — env scrubbing and sentinel binds are independent of the filesystem layer and survive this setting.) When unset, filesystem isolation stays on.
              */
             disabled?: boolean;
         };
         credentials?: {
             /**
-             * Credential files or directories to protect. `deny` blocks reads inside the sandbox.
+             * Credential files or directories to protect. `deny` blocks reads inside the sandbox; `mask` substitutes a sentinel inside the sandbox (whole-file, or per-`extract` capture) and injects the real value at the proxy. On macOS and Windows `mask` degrades to `deny`.
              */
             files?: {
                 /**
@@ -6217,9 +6243,25 @@ export declare interface Settings {
                  */
                 path: string;
                 /**
-                 * Access mode for this path. Only `deny` is supported.
+                 * Access mode for this path. `deny` blocks reads inside the sandbox; `mask` shows sandboxed commands a sentinel-substituted copy (whole-file, or only the spans captured by `extract`) and the host proxy swaps sentinel→real on egress to `injectHosts`. On macOS and Windows `mask` currently degrades to `deny`.
+                 */
+                mode: 'deny' | 'mask';
+                /**
+                 * Optional regex for structured masking when mode is `mask`. Applied globally to the file; capture group 1 of each match is a credential value, and only those captured spans are replaced with sentinels — the rest of the file is preserved so a tool that parses it (.netrc, JSON, YAML) still succeeds. Without `extract`, the entire file content is replaced with one sentinel (whole-file masking, suited to single-secret files). If the regex matches nothing, behavior is governed by `onExtractNoMatch` (default `warn`). Accepted but ignored for `deny`.
+                 */
+                extract?: string;
+                /**
+                 * What to do when `extract` matches nothing in the file. `warn` (default) emits a stderr warning and leaves the file readable as-is inside the sandbox (fail-open, for credentials that may be legitimately absent); `deny` degrades the entry to mode `deny` so the file is unreadable (fail-closed) — under `sandbox.filesystem.disabled` it is treated as `error`, since read-denies are dropped in that mode; `error` aborts at sandbox setup so nothing runs until the config is fixed. Only meaningful when mode is `mask` and `extract` is set; accepted but ignored otherwise.
                  */
-                mode: 'deny';
+                onExtractNoMatch?: 'warn' | 'deny' | 'error';
+                /**
+                 * If true, verbatim occurrences of each captured credential value outside the regex-matched spans are also replaced with the corresponding sentinel — for a secret repeated where the regex does not reach (e.g. pasted into a comment). Matches raw substrings, so short or common values may corrupt unrelated content; intended for long, high-entropy secrets. Defaults to false. Only meaningful when mode is `mask` and `extract` is set; accepted but ignored otherwise.
+                 */
+                maskDuplicates?: boolean;
+                /**
+                 * Optional narrowing of where the proxy substitutes this credential. Only meaningful when mode is `mask`; accepted but ignored for `deny`. If unset, defaults to `network.allowedDomains` — the credential is injected at every reachable host. Each entry must be reachable via `network.allowedDomains` (sandbox-runtime validates this).
+                 */
+                injectHosts?: string[];
             }[];
             /**
              * Environment variables to protect. `deny` unsets the variable for sandboxed commands; `mask` substitutes a sentinel inside the sandbox and injects the real value at the proxy.
@@ -7022,7 +7064,7 @@ export declare interface Transport {
  *
  * @alpha
  */
-export declare const USAGE_LIMIT_ERROR_PREFIXES: readonly ["You've hit your", "You've reached your", "You're out of usage credits", "Your org is out of usage · add funds to continue", "Your org is out of usage · contact your admin", "Your seat type doesn't include usage credits", "Your seat type doesn't include usage", "Your usage allocation has been disabled by your admin", "Your group's usage limit is set to $0", "Fable 5 requires usage credits", "You're out of extra usage", "Your seat type doesn't include extra usage"];
+export declare const USAGE_LIMIT_ERROR_PREFIXES: readonly ["You've hit your", "You've reached your", "You're out of usage credits", 'Your org is out of usage · add funds to continue', 'Your org is out of usage · contact your admin', "Your seat type doesn't include usage credits", "Your seat type doesn't include usage", 'Your usage allocation has been disabled by your admin', "Your group's usage limit is set to $0", 'Fable 5 requires usage credits', "You're out of extra usage", "Your seat type doesn't include extra usage"];
 
 /**
  * Overage-transition notifications ("now drawing from credits"). Toast only;
@@ -7030,7 +7072,7 @@ export declare const USAGE_LIMIT_ERROR_PREFIXES: readonly ["You've hit your", "Y
  *
  * @alpha
  */
-export declare const USAGE_TRANSITION_PREFIXES: readonly ["You're now using usage credits", "You're now using your usage allocation", "Now using your usage allocation", "Now using usage credits", "You're now using extra usage", "Now using extra usage"];
+export declare const USAGE_TRANSITION_PREFIXES: readonly ["You're now using usage credits", "You're now using your usage allocation", 'Now using your usage allocation', 'Now using usage credits', "You're now using extra usage", 'Now using extra usage'];
 
 /**
  * Approaching-limit warnings (severity:'warning'). Footer/toast only; these