@anthropic-ai/claude-agent-sdk 0.3.223 → 0.3.224
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bridge.mjs +94 -97
- package/browser-sdk.js +48 -48
- package/manifest.json +21 -21
- package/manifest.zst.json +25 -25
- package/package.json +10 -10
- package/sdk.d.ts +170 -5
- package/sdk.mjs +84 -82
package/manifest.json
CHANGED
|
@@ -1,52 +1,51 @@
|
|
|
1
1
|
{
|
|
2
|
-
"version": "2.1.
|
|
3
|
-
"commit": "
|
|
4
|
-
"buildDate": "2026-08-
|
|
2
|
+
"version": "2.1.224",
|
|
3
|
+
"commit": "8a2a469b68f918917492973f3b16bd1682b9f82c",
|
|
4
|
+
"buildDate": "2026-08-06T01:47:12Z",
|
|
5
5
|
"platforms": {
|
|
6
6
|
"darwin-arm64": {
|
|
7
7
|
"binary": "claude",
|
|
8
|
-
"checksum": "
|
|
9
|
-
"size":
|
|
8
|
+
"checksum": "391df9d2ab04e4cf32199335720ac7715a582e91eaecfd4d2198a16f57ea59b3",
|
|
9
|
+
"size": 277495040
|
|
10
10
|
},
|
|
11
11
|
"darwin-x64": {
|
|
12
12
|
"binary": "claude",
|
|
13
|
-
"checksum": "
|
|
14
|
-
"size":
|
|
13
|
+
"checksum": "7ae17a768a7270c7bd6c5484587c3c650dff425b4beeeb03addc1f2a4a7d702a",
|
|
14
|
+
"size": 287105184
|
|
15
15
|
},
|
|
16
16
|
"linux-arm64": {
|
|
17
17
|
"binary": "claude",
|
|
18
|
-
"checksum": "
|
|
19
|
-
"size":
|
|
18
|
+
"checksum": "3e50836e227868746273653e0f8115cf5fc9cb34a081847c6040c81d80812c33",
|
|
19
|
+
"size": 292404152
|
|
20
20
|
},
|
|
21
21
|
"linux-x64": {
|
|
22
22
|
"binary": "claude",
|
|
23
|
-
"checksum": "
|
|
24
|
-
"size":
|
|
23
|
+
"checksum": "a2b5add7dc4bcd8eaa029f4e8bdac4df7769b4073698db7989d206baf9419c2d",
|
|
24
|
+
"size": 295676936
|
|
25
25
|
},
|
|
26
26
|
"linux-arm64-musl": {
|
|
27
27
|
"binary": "claude",
|
|
28
|
-
"checksum": "
|
|
29
|
-
"size":
|
|
28
|
+
"checksum": "5ab089acd0b8d56b08d9510aeecd96767a057fc7bc05221c968c81d8d21711f6",
|
|
29
|
+
"size": 285717864
|
|
30
30
|
},
|
|
31
31
|
"linux-x64-musl": {
|
|
32
32
|
"binary": "claude",
|
|
33
|
-
"checksum": "
|
|
34
|
-
"size":
|
|
33
|
+
"checksum": "979b08e51d814a4abaa36d8c3b570bdaa8c1dd2020b318c6f8334b631c2c4f19",
|
|
34
|
+
"size": 290284112
|
|
35
35
|
},
|
|
36
36
|
"win32-x64": {
|
|
37
37
|
"binary": "claude.exe",
|
|
38
|
-
"checksum": "
|
|
39
|
-
"size":
|
|
38
|
+
"checksum": "879f0d7e7eee606095051c0c00772fc1de41778f34835a9de43ea8e1caad9afb",
|
|
39
|
+
"size": 284981920
|
|
40
40
|
},
|
|
41
41
|
"win32-arm64": {
|
|
42
42
|
"binary": "claude.exe",
|
|
43
|
-
"checksum": "
|
|
44
|
-
"size":
|
|
43
|
+
"checksum": "105b33963dfdcd58c52e90562fb03face32b7b7e0d9caba74bc06b9d7b45c102",
|
|
44
|
+
"size": 279654560
|
|
45
45
|
}
|
|
46
46
|
},
|
|
47
47
|
"sdkCompat": {
|
|
48
48
|
"testedWrapperVersions": [
|
|
49
|
-
"0.3.182",
|
|
50
49
|
"0.3.183",
|
|
51
50
|
"0.3.185",
|
|
52
51
|
"0.3.186",
|
|
@@ -75,7 +74,8 @@
|
|
|
75
74
|
"0.3.217",
|
|
76
75
|
"0.3.218",
|
|
77
76
|
"0.3.220",
|
|
78
|
-
"0.3.221"
|
|
77
|
+
"0.3.221",
|
|
78
|
+
"0.3.222"
|
|
79
79
|
],
|
|
80
80
|
"harnessSchema": 1
|
|
81
81
|
}
|
package/manifest.zst.json
CHANGED
|
@@ -1,60 +1,59 @@
|
|
|
1
1
|
{
|
|
2
|
-
"version": "2.1.
|
|
3
|
-
"commit": "
|
|
4
|
-
"buildDate": "2026-08-
|
|
2
|
+
"version": "2.1.224",
|
|
3
|
+
"commit": "8a2a469b68f918917492973f3b16bd1682b9f82c",
|
|
4
|
+
"buildDate": "2026-08-06T01:49:17Z",
|
|
5
5
|
"platforms": {
|
|
6
6
|
"darwin-arm64": {
|
|
7
7
|
"binary": "claude.zst",
|
|
8
|
-
"checksum": "
|
|
9
|
-
"size":
|
|
8
|
+
"checksum": "2177a1f22cc1c9da651e8f95c9ec786512a45431b68c8db7ea0b82b8d972dd3c",
|
|
9
|
+
"size": 55620049,
|
|
10
10
|
"bundle": {
|
|
11
|
-
"checksum": "
|
|
12
|
-
"size":
|
|
11
|
+
"checksum": "fb158f58172b7912cefccf8c260d0d46e8b1ed9f4bd9656eb10cc1f0d9cf665b",
|
|
12
|
+
"size": 55619295
|
|
13
13
|
}
|
|
14
14
|
},
|
|
15
15
|
"darwin-x64": {
|
|
16
16
|
"binary": "claude.zst",
|
|
17
|
-
"checksum": "
|
|
18
|
-
"size":
|
|
17
|
+
"checksum": "515ddec30105358055c7455ee425d78751c33f651a43d70dfb6757a7d57199cf",
|
|
18
|
+
"size": 60311453,
|
|
19
19
|
"bundle": {
|
|
20
|
-
"checksum": "
|
|
21
|
-
"size":
|
|
20
|
+
"checksum": "4d61e167caf6b6a8d3c5636abaa184aab3a6da076a79e72181f37617d21003ff",
|
|
21
|
+
"size": 60314967
|
|
22
22
|
}
|
|
23
23
|
},
|
|
24
24
|
"linux-arm64": {
|
|
25
25
|
"binary": "claude.zst",
|
|
26
|
-
"checksum": "
|
|
27
|
-
"size":
|
|
26
|
+
"checksum": "77745c2569ec09e0e167319b995c2d2efadcb4645b54e015cdb099ee12762a9c",
|
|
27
|
+
"size": 64445944
|
|
28
28
|
},
|
|
29
29
|
"linux-x64": {
|
|
30
30
|
"binary": "claude.zst",
|
|
31
|
-
"checksum": "
|
|
32
|
-
"size":
|
|
31
|
+
"checksum": "7ee86a44c50f684686c65a6cc9e73c28ee7b3bd7cfd8d28ab2efeca3e2e627ff",
|
|
32
|
+
"size": 65748329
|
|
33
33
|
},
|
|
34
34
|
"linux-arm64-musl": {
|
|
35
35
|
"binary": "claude.zst",
|
|
36
|
-
"checksum": "
|
|
37
|
-
"size":
|
|
36
|
+
"checksum": "7d7cc2c37732cd150e073ff26c36ea75d2b6905edc027225f767e492f07f1ddc",
|
|
37
|
+
"size": 63234828
|
|
38
38
|
},
|
|
39
39
|
"linux-x64-musl": {
|
|
40
40
|
"binary": "claude.zst",
|
|
41
|
-
"checksum": "
|
|
42
|
-
"size":
|
|
41
|
+
"checksum": "6655b0d15c00b7d5ea828d0c1eb15707285351463419e7dca0b3c2816e0eab76",
|
|
42
|
+
"size": 64611539
|
|
43
43
|
},
|
|
44
44
|
"win32-x64": {
|
|
45
45
|
"binary": "claude.exe.zst",
|
|
46
|
-
"checksum": "
|
|
47
|
-
"size":
|
|
46
|
+
"checksum": "0cbb70b604d3a80263de752c549032259b87a5dffcc55b3cade98dc188bbce19",
|
|
47
|
+
"size": 66001608
|
|
48
48
|
},
|
|
49
49
|
"win32-arm64": {
|
|
50
50
|
"binary": "claude.exe.zst",
|
|
51
|
-
"checksum": "
|
|
52
|
-
"size":
|
|
51
|
+
"checksum": "aa146b4d97044e8a86e30501da6c00030349c51bb325e2d98bf6f71736590767",
|
|
52
|
+
"size": 64170553
|
|
53
53
|
}
|
|
54
54
|
},
|
|
55
55
|
"sdkCompat": {
|
|
56
56
|
"testedWrapperVersions": [
|
|
57
|
-
"0.3.182",
|
|
58
57
|
"0.3.183",
|
|
59
58
|
"0.3.185",
|
|
60
59
|
"0.3.186",
|
|
@@ -83,7 +82,8 @@
|
|
|
83
82
|
"0.3.217",
|
|
84
83
|
"0.3.218",
|
|
85
84
|
"0.3.220",
|
|
86
|
-
"0.3.221"
|
|
85
|
+
"0.3.221",
|
|
86
|
+
"0.3.222"
|
|
87
87
|
],
|
|
88
88
|
"harnessSchema": 1
|
|
89
89
|
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@anthropic-ai/claude-agent-sdk",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.224",
|
|
4
4
|
"main": "sdk.mjs",
|
|
5
5
|
"types": "sdk.d.ts",
|
|
6
6
|
"exports": {
|
|
@@ -57,14 +57,14 @@
|
|
|
57
57
|
"zod": "^4.0.0"
|
|
58
58
|
},
|
|
59
59
|
"optionalDependencies": {
|
|
60
|
-
"@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.
|
|
61
|
-
"@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.
|
|
62
|
-
"@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.
|
|
63
|
-
"@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.
|
|
64
|
-
"@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.
|
|
65
|
-
"@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.
|
|
66
|
-
"@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.
|
|
67
|
-
"@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.
|
|
60
|
+
"@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.224",
|
|
61
|
+
"@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.224",
|
|
62
|
+
"@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.224",
|
|
63
|
+
"@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.224",
|
|
64
|
+
"@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.224",
|
|
65
|
+
"@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.224",
|
|
66
|
+
"@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.224",
|
|
67
|
+
"@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.224"
|
|
68
68
|
},
|
|
69
69
|
"files": [
|
|
70
70
|
"sdk.mjs",
|
|
@@ -80,5 +80,5 @@
|
|
|
80
80
|
"manifest.json",
|
|
81
81
|
"manifest.zst.json"
|
|
82
82
|
],
|
|
83
|
-
"claudeCodeVersion": "2.1.
|
|
83
|
+
"claudeCodeVersion": "2.1.224"
|
|
84
84
|
}
|
package/sdk.d.ts
CHANGED
|
@@ -10,7 +10,7 @@ import type { Readable } from 'stream';
|
|
|
10
10
|
import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';
|
|
11
11
|
import type { UUID } from 'crypto';
|
|
12
12
|
import type { Writable } from 'stream';
|
|
13
|
-
import
|
|
13
|
+
import * as z from 'zod/v4';
|
|
14
14
|
import type { ZodRawShape } from 'zod';
|
|
15
15
|
import type { ZodRawShape as ZodRawShape_2 } from 'zod/v4';
|
|
16
16
|
|
|
@@ -2770,6 +2770,10 @@ declare const SandboxCredentialsConfigSchema: () => z.ZodOptional<z.ZodObject<{
|
|
|
2770
2770
|
error: "error";
|
|
2771
2771
|
warn: "warn";
|
|
2772
2772
|
}>>;
|
|
2773
|
+
decode: z.ZodOptional<z.ZodEnum<{
|
|
2774
|
+
jwt: "jwt";
|
|
2775
|
+
}>>;
|
|
2776
|
+
maskClaims: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
2773
2777
|
maskDuplicates: z.ZodOptional<z.ZodBoolean>;
|
|
2774
2778
|
injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
2775
2779
|
}, z.core.$strip>>>>;
|
|
@@ -2779,9 +2783,38 @@ declare const SandboxCredentialsConfigSchema: () => z.ZodOptional<z.ZodObject<{
|
|
|
2779
2783
|
deny: "deny";
|
|
2780
2784
|
mask: "mask";
|
|
2781
2785
|
}>;
|
|
2786
|
+
extract: z.ZodOptional<z.ZodString>;
|
|
2787
|
+
onExtractNoMatch: z.ZodOptional<z.ZodEnum<{
|
|
2788
|
+
deny: "deny";
|
|
2789
|
+
error: "error";
|
|
2790
|
+
warn: "warn";
|
|
2791
|
+
}>>;
|
|
2792
|
+
decode: z.ZodOptional<z.ZodEnum<{
|
|
2793
|
+
jwt: "jwt";
|
|
2794
|
+
}>>;
|
|
2795
|
+
maskClaims: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
2782
2796
|
injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
2783
2797
|
}, z.core.$strip>>>>;
|
|
2784
2798
|
allowPlaintextInject: z.ZodOptional<z.ZodBoolean>;
|
|
2799
|
+
awsPairs: z.ZodOptional<z.ZodArray<z.ZodObject<{
|
|
2800
|
+
accessKeyIdVar: z.ZodString;
|
|
2801
|
+
secretAccessKeyVar: z.ZodString;
|
|
2802
|
+
sessionTokenVar: z.ZodOptional<z.ZodString>;
|
|
2803
|
+
}, z.core.$strip>>>;
|
|
2804
|
+
sigv4: z.ZodOptional<z.ZodObject<{
|
|
2805
|
+
streaming: z.ZodOptional<z.ZodEnum<{
|
|
2806
|
+
deny: "deny";
|
|
2807
|
+
passthrough: "passthrough";
|
|
2808
|
+
}>>;
|
|
2809
|
+
presigned: z.ZodOptional<z.ZodEnum<{
|
|
2810
|
+
deny: "deny";
|
|
2811
|
+
passthrough: "passthrough";
|
|
2812
|
+
}>>;
|
|
2813
|
+
sigv4a: z.ZodOptional<z.ZodEnum<{
|
|
2814
|
+
deny: "deny";
|
|
2815
|
+
passthrough: "passthrough";
|
|
2816
|
+
}>>;
|
|
2817
|
+
}, z.core.$strip>>;
|
|
2785
2818
|
}, z.core.$strip>>;
|
|
2786
2819
|
|
|
2787
2820
|
export declare type SandboxFilesystemConfig = NonNullable<z.infer<ReturnType<typeof SandboxFilesystemConfigSchema>>>;
|
|
@@ -2869,6 +2902,10 @@ declare const SandboxSettingsSchema: () => z.ZodObject<{
|
|
|
2869
2902
|
error: "error";
|
|
2870
2903
|
warn: "warn";
|
|
2871
2904
|
}>>;
|
|
2905
|
+
decode: z.ZodOptional<z.ZodEnum<{
|
|
2906
|
+
jwt: "jwt";
|
|
2907
|
+
}>>;
|
|
2908
|
+
maskClaims: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
2872
2909
|
maskDuplicates: z.ZodOptional<z.ZodBoolean>;
|
|
2873
2910
|
injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
2874
2911
|
}, z.core.$strip>>>>;
|
|
@@ -2878,9 +2915,38 @@ declare const SandboxSettingsSchema: () => z.ZodObject<{
|
|
|
2878
2915
|
deny: "deny";
|
|
2879
2916
|
mask: "mask";
|
|
2880
2917
|
}>;
|
|
2918
|
+
extract: z.ZodOptional<z.ZodString>;
|
|
2919
|
+
onExtractNoMatch: z.ZodOptional<z.ZodEnum<{
|
|
2920
|
+
deny: "deny";
|
|
2921
|
+
error: "error";
|
|
2922
|
+
warn: "warn";
|
|
2923
|
+
}>>;
|
|
2924
|
+
decode: z.ZodOptional<z.ZodEnum<{
|
|
2925
|
+
jwt: "jwt";
|
|
2926
|
+
}>>;
|
|
2927
|
+
maskClaims: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
2881
2928
|
injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
2882
2929
|
}, z.core.$strip>>>>;
|
|
2883
2930
|
allowPlaintextInject: z.ZodOptional<z.ZodBoolean>;
|
|
2931
|
+
awsPairs: z.ZodOptional<z.ZodArray<z.ZodObject<{
|
|
2932
|
+
accessKeyIdVar: z.ZodString;
|
|
2933
|
+
secretAccessKeyVar: z.ZodString;
|
|
2934
|
+
sessionTokenVar: z.ZodOptional<z.ZodString>;
|
|
2935
|
+
}, z.core.$strip>>>;
|
|
2936
|
+
sigv4: z.ZodOptional<z.ZodObject<{
|
|
2937
|
+
streaming: z.ZodOptional<z.ZodEnum<{
|
|
2938
|
+
deny: "deny";
|
|
2939
|
+
passthrough: "passthrough";
|
|
2940
|
+
}>>;
|
|
2941
|
+
presigned: z.ZodOptional<z.ZodEnum<{
|
|
2942
|
+
deny: "deny";
|
|
2943
|
+
passthrough: "passthrough";
|
|
2944
|
+
}>>;
|
|
2945
|
+
sigv4a: z.ZodOptional<z.ZodEnum<{
|
|
2946
|
+
deny: "deny";
|
|
2947
|
+
passthrough: "passthrough";
|
|
2948
|
+
}>>;
|
|
2949
|
+
}, z.core.$strip>>;
|
|
2884
2950
|
}, z.core.$strip>>;
|
|
2885
2951
|
ignoreViolations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
|
|
2886
2952
|
enableWeakerNestedSandbox: z.ZodOptional<z.ZodBoolean>;
|
|
@@ -4128,9 +4194,9 @@ export declare type SDKMessageOrigin = {
|
|
|
4128
4194
|
} | {
|
|
4129
4195
|
kind: 'task-notification';
|
|
4130
4196
|
/**
|
|
4131
|
-
* Present when the delivery is the fired stored prompt of a scheduled task/routine (stamped from server-asserted provenance; the schedule attests storage, not authorship). The harness frames
|
|
4197
|
+
* Present when the delivery is the fired stored prompt of a scheduled task/routine ('scheduled-trigger', stamped from server-asserted provenance; the schedule attests storage, not authorship), or a coordinator co-member SendMessage delivery ('peer-send-message': model-authored text from another of the same user's sessions, verified by the server-stamped receiver co-membership — task-notification for prompt authority, but distinguishable so the receive-side crossSessionInbound setting can apply to it). The harness frames a scheduled-trigger delivery as the session's assigned task instead of the generic background-notification frame. Absent on webhook, PR-steward, plugin, and background-event deliveries.
|
|
4132
4198
|
*/
|
|
4133
|
-
subkind?: 'scheduled-trigger';
|
|
4199
|
+
subkind?: 'scheduled-trigger' | 'peer-send-message';
|
|
4134
4200
|
} | {
|
|
4135
4201
|
kind: 'coordinator';
|
|
4136
4202
|
} | {
|
|
@@ -5775,8 +5841,19 @@ export declare interface Settings {
|
|
|
5775
5841
|
* Specific commit SHA to use
|
|
5776
5842
|
*/
|
|
5777
5843
|
sha?: string;
|
|
5844
|
+
} | {
|
|
5845
|
+
source: 'archive';
|
|
5846
|
+
/**
|
|
5847
|
+
* HTTPS URL of a zip archive containing the plugin. The plugin root (the directory holding .claude-plugin/) may be at the top of the archive or nested one directory deep — a single wrapping directory is stripped.
|
|
5848
|
+
*/
|
|
5849
|
+
url: string;
|
|
5850
|
+
/**
|
|
5851
|
+
* SHA-256 digest of the archive. When set, every download is verified against it and the install is refused on mismatch. It also serves as the version identity when neither plugin.json nor the marketplace entry declares a `version`. Recommended. Note the update signal is the version string (plugin.json version, else the entry version, else this digest) — changing only the digest while a version is declared does not trigger an update.
|
|
5852
|
+
*/
|
|
5853
|
+
sha256?: string;
|
|
5778
5854
|
} | {
|
|
5779
5855
|
source: 'unsupported';
|
|
5856
|
+
error?: string;
|
|
5780
5857
|
};
|
|
5781
5858
|
description?: string;
|
|
5782
5859
|
version?: string;
|
|
@@ -5975,8 +6052,19 @@ export declare interface Settings {
|
|
|
5975
6052
|
* Specific commit SHA to use
|
|
5976
6053
|
*/
|
|
5977
6054
|
sha?: string;
|
|
6055
|
+
} | {
|
|
6056
|
+
source: 'archive';
|
|
6057
|
+
/**
|
|
6058
|
+
* HTTPS URL of a zip archive containing the plugin. The plugin root (the directory holding .claude-plugin/) may be at the top of the archive or nested one directory deep — a single wrapping directory is stripped.
|
|
6059
|
+
*/
|
|
6060
|
+
url: string;
|
|
6061
|
+
/**
|
|
6062
|
+
* SHA-256 digest of the archive. When set, every download is verified against it and the install is refused on mismatch. It also serves as the version identity when neither plugin.json nor the marketplace entry declares a `version`. Recommended. Note the update signal is the version string (plugin.json version, else the entry version, else this digest) — changing only the digest while a version is declared does not trigger an update.
|
|
6063
|
+
*/
|
|
6064
|
+
sha256?: string;
|
|
5978
6065
|
} | {
|
|
5979
6066
|
source: 'unsupported';
|
|
6067
|
+
error?: string;
|
|
5980
6068
|
};
|
|
5981
6069
|
description?: string;
|
|
5982
6070
|
version?: string;
|
|
@@ -6165,8 +6253,19 @@ export declare interface Settings {
|
|
|
6165
6253
|
* Specific commit SHA to use
|
|
6166
6254
|
*/
|
|
6167
6255
|
sha?: string;
|
|
6256
|
+
} | {
|
|
6257
|
+
source: 'archive';
|
|
6258
|
+
/**
|
|
6259
|
+
* HTTPS URL of a zip archive containing the plugin. The plugin root (the directory holding .claude-plugin/) may be at the top of the archive or nested one directory deep — a single wrapping directory is stripped.
|
|
6260
|
+
*/
|
|
6261
|
+
url: string;
|
|
6262
|
+
/**
|
|
6263
|
+
* SHA-256 digest of the archive. When set, every download is verified against it and the install is refused on mismatch. It also serves as the version identity when neither plugin.json nor the marketplace entry declares a `version`. Recommended. Note the update signal is the version string (plugin.json version, else the entry version, else this digest) — changing only the digest while a version is declared does not trigger an update.
|
|
6264
|
+
*/
|
|
6265
|
+
sha256?: string;
|
|
6168
6266
|
} | {
|
|
6169
6267
|
source: 'unsupported';
|
|
6268
|
+
error?: string;
|
|
6170
6269
|
};
|
|
6171
6270
|
description?: string;
|
|
6172
6271
|
version?: string;
|
|
@@ -6324,11 +6423,19 @@ export declare interface Settings {
|
|
|
6324
6423
|
*/
|
|
6325
6424
|
extract?: string;
|
|
6326
6425
|
/**
|
|
6327
|
-
* What to do when `extract` matches nothing in the file. `warn` (default) emits a stderr warning and leaves the file readable as-is inside the sandbox (fail-open, for credentials that may be legitimately absent); `deny` degrades the entry to mode `deny` so the file is unreadable (fail-closed) — under `sandbox.filesystem.disabled` it is treated as `error`, since read-denies are dropped in that mode; `error` aborts at sandbox setup so nothing runs until the config is fixed. Only meaningful when mode is `mask` and `extract` is set; accepted but ignored otherwise.
|
|
6426
|
+
* What to do when `extract` matches nothing in the file — or, with `decode`, when no candidate survives verification. `warn` (default) emits a stderr warning and leaves the file readable as-is inside the sandbox (fail-open, for credentials that may be legitimately absent); `deny` degrades the entry to mode `deny` so the file is unreadable (fail-closed) — under `sandbox.filesystem.disabled` it is treated as `error`, since read-denies are dropped in that mode; `error` aborts at sandbox setup so nothing runs until the config is fixed. Only meaningful when mode is `mask` and `extract` or `decode` is set; accepted but ignored otherwise.
|
|
6328
6427
|
*/
|
|
6329
6428
|
onExtractNoMatch?: 'warn' | 'deny' | 'error';
|
|
6330
6429
|
/**
|
|
6331
|
-
*
|
|
6430
|
+
* Optional encoded-credential format for `mask` mode. `jwt`: candidates are located with a built-in JWT regex (or the explicit `extract` pattern, if set), verified to actually be JWTs before masking, and replaced with a structurally valid fake JWT so client-side token parsing inside the sandbox keeps working. If no candidate verifies, behavior is governed by `onExtractNoMatch` (default `warn`). Accepted but ignored for `deny`.
|
|
6431
|
+
*/
|
|
6432
|
+
decode?: 'jwt';
|
|
6433
|
+
/**
|
|
6434
|
+
* Names of top-level payload claims to mask inside each decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel and the token is rebuilt around the modified payload; all other claims are preserved so a tool that decodes the token and reads a non-secret claim keeps working. Requires `decode`. If no named claim matches in any verified token, behavior is governed by `onExtractNoMatch` (default `warn`). Only meaningful when mode is `mask`; accepted but ignored for `deny`.
|
|
6435
|
+
*/
|
|
6436
|
+
maskClaims?: string[];
|
|
6437
|
+
/**
|
|
6438
|
+
* If true, verbatim occurrences of each captured credential value outside the regex-matched spans are also replaced with the corresponding sentinel — for a secret repeated where the regex does not reach (e.g. pasted into a comment). Matches raw substrings, so short or common values may corrupt unrelated content; intended for long, high-entropy secrets. Defaults to false. Only meaningful when mode is `mask` and `extract` or `decode` is set; accepted but ignored otherwise.
|
|
6332
6439
|
*/
|
|
6333
6440
|
maskDuplicates?: boolean;
|
|
6334
6441
|
/**
|
|
@@ -6348,6 +6455,22 @@ export declare interface Settings {
|
|
|
6348
6455
|
* Access mode for this environment variable. `deny` unsets the variable for sandboxed commands; `mask` shows sandboxed commands a sentinel value and the host proxy swaps sentinel→real on egress to `injectHosts`.
|
|
6349
6456
|
*/
|
|
6350
6457
|
mode: 'deny' | 'mask';
|
|
6458
|
+
/**
|
|
6459
|
+
* Optional regex for structured masking when mode is `mask`. Applied globally to the value; capture group 1 of each match is a credential value, and only those captured spans are replaced with sentinels — the rest of the value is preserved so a tool that parses it (a `DATABASE_URL` connection string, a composite `KEY:SECRET` pair) still succeeds inside the sandbox. Without `extract`, the entire value is replaced with one sentinel (whole-value masking, suited to bare tokens). If the regex matches nothing, behavior is governed by `onExtractNoMatch` (default `warn`). Cannot be combined with `decode` (the decode path never consults it). Accepted but ignored for `deny`.
|
|
6460
|
+
*/
|
|
6461
|
+
extract?: string;
|
|
6462
|
+
/**
|
|
6463
|
+
* What to do when `extract` matches nothing in the value. `warn` (default) emits a stderr warning and lets the variable pass through unmasked (fail-open, for credentials that may be legitimately absent); `deny` unsets the variable inside the sandbox (fail-closed); `error` aborts at sandbox setup so nothing runs until the config is fixed. Only meaningful when mode is `mask` and `extract` is set without `decode`. On a mask entry with `decode`, the runtime takes the decode path and never consults this field, so a fail-closed setting cannot be honored — `deny` and `error` are rejected there; only `warn` is accepted. In all other shapes the field is accepted but ignored.
|
|
6464
|
+
*/
|
|
6465
|
+
onExtractNoMatch?: 'warn' | 'deny' | 'error';
|
|
6466
|
+
/**
|
|
6467
|
+
* Optional encoded-credential format for `mask` mode. `jwt`: the variable's whole value is verified to actually be a JWT and replaced with a structurally valid fake JWT so client-side token parsing inside the sandbox keeps working; the proxy swaps the whole fake token on egress. If the value does not verify, the variable is left unmasked with a stderr warning (fail-open). Cannot be combined with `extract` — the decode path never consults it. Accepted but ignored for `deny`.
|
|
6468
|
+
*/
|
|
6469
|
+
decode?: 'jwt';
|
|
6470
|
+
/**
|
|
6471
|
+
* Names of top-level payload claims to mask inside the decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel and the token is rebuilt around the modified payload; all other claims are preserved so claim-reading clients keep working. Requires `decode`. If no named claim matches, the variable is left unmasked with a stderr warning (fail-open). Only meaningful when mode is `mask`; accepted but ignored for `deny`.
|
|
6472
|
+
*/
|
|
6473
|
+
maskClaims?: string[];
|
|
6351
6474
|
/**
|
|
6352
6475
|
* Optional narrowing of where the proxy substitutes this credential. Only meaningful when mode is `mask`; accepted but ignored for `deny`. If unset, defaults to `network.allowedDomains` — the credential is injected at every reachable host. Each entry must be reachable via `network.allowedDomains` (sandbox-runtime validates this).
|
|
6353
6476
|
*/
|
|
@@ -6357,6 +6480,40 @@ export declare interface Settings {
|
|
|
6357
6480
|
* Allow sentinel→real substitution on the plain-HTTP proxy path. Defaults to false: without TLS termination the upstream identity is unverified and the credential travels in cleartext. Set only for trusted-network test fixtures. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored.
|
|
6358
6481
|
*/
|
|
6359
6482
|
allowPlaintextInject?: boolean;
|
|
6483
|
+
/**
|
|
6484
|
+
* Explicit groupings of masked env vars into AWS credential pairs for SigV4 re-signing, for non-standard variable names. The conventional AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN trio is paired automatically when masked. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored. A member is only usable when its env var is forwarded as a whole-value `mask` entry (an entry carrying `extract` or `decode` does not qualify — re-signing needs the whole real value). A pair whose key id or secret member is unusable never re-signs: it is dropped, unless it names a conventional AWS variable, in which case it is forwarded as an inert suppressor so implicit auto-pairing stays overridden. A pair whose ONLY unusable member is the session token still re-signs, without an x-amz-security-token (temporary-credential requests fail upstream until the entry is fixed).
|
|
6485
|
+
*/
|
|
6486
|
+
awsPairs?: {
|
|
6487
|
+
/**
|
|
6488
|
+
* Name of the masked env var holding the AWS access key id.
|
|
6489
|
+
*/
|
|
6490
|
+
accessKeyIdVar: string;
|
|
6491
|
+
/**
|
|
6492
|
+
* Name of the masked env var holding the AWS secret access key.
|
|
6493
|
+
*/
|
|
6494
|
+
secretAccessKeyVar: string;
|
|
6495
|
+
/**
|
|
6496
|
+
* Optional name of the masked env var holding the AWS session token (temporary credentials). When set, the proxy sends the real token as x-amz-security-token on re-signed requests and adds it to the signed header set if the client did not.
|
|
6497
|
+
*/
|
|
6498
|
+
sessionTokenVar?: string;
|
|
6499
|
+
}[];
|
|
6500
|
+
/**
|
|
6501
|
+
* Policies for AWS SigV4 request shapes the proxy cannot re-sign (streaming, presigned, sigv4a) when they reference a masked credential pair: `deny` (default) or `passthrough`. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored.
|
|
6502
|
+
*/
|
|
6503
|
+
sigv4?: {
|
|
6504
|
+
/**
|
|
6505
|
+
* Policy for aws-chunked streaming uploads (x-amz-content-sha256: STREAMING-*): per-chunk signatures chain off the seed signature, so re-signing would require rewriting the body. `deny` (default) fails closed with a 403; `passthrough` forwards the request unre-signed (the upstream will reject its signature).
|
|
6506
|
+
*/
|
|
6507
|
+
streaming?: 'deny' | 'passthrough';
|
|
6508
|
+
/**
|
|
6509
|
+
* Policy for presigned URLs (X-Amz-Algorithm/X-Amz-Signature in the query, no Authorization header): the signature lives in the URL itself. `deny` (default) or `passthrough`.
|
|
6510
|
+
*/
|
|
6511
|
+
presigned?: 'deny' | 'passthrough';
|
|
6512
|
+
/**
|
|
6513
|
+
* Policy for SigV4A (AWS4-ECDSA-P256-SHA256) asymmetric signatures: there is no shared-key HMAC to recompute. `deny` (default) or `passthrough`.
|
|
6514
|
+
*/
|
|
6515
|
+
sigv4a?: 'deny' | 'passthrough';
|
|
6516
|
+
};
|
|
6360
6517
|
};
|
|
6361
6518
|
ignoreViolations?: {
|
|
6362
6519
|
[k: string]: string[];
|
|
@@ -6467,6 +6624,10 @@ export declare interface Settings {
|
|
|
6467
6624
|
* Idle time before Claude's questions auto-continue with any answers selected so far. Defaults to never — auto-continue only runs when explicitly set to 60s/5m/10m.
|
|
6468
6625
|
*/
|
|
6469
6626
|
askUserQuestionTimeout?: '60s' | '5m' | '10m' | 'never';
|
|
6627
|
+
/**
|
|
6628
|
+
* Max time a permission/user dialog forwarded to a remote client stays parked awaiting an answer, and how long a HELD cross-session message awaits approval, before either resolves to its safe no-action default (cancelled / dropped-with-denial). Defaults to 5m to match the long-standing remote-dialog deadline; "never" disables the deadline. Local-only permission prompts (no remote client) are unaffected. The CLAUDE_CODE_USER_DIALOG_TIMEOUT_MS env var, when set, overrides this. Read from trusted sources only (never a checked-in repo settings file).
|
|
6629
|
+
*/
|
|
6630
|
+
dialogExpiry?: '60s' | '5m' | '10m' | 'never';
|
|
6470
6631
|
/**
|
|
6471
6632
|
* Name of an agent (built-in or custom) to use for the main thread. Applies the agent's system prompt, tool restrictions, and model.
|
|
6472
6633
|
*/
|
|
@@ -6708,6 +6869,10 @@ export declare interface Settings {
|
|
|
6708
6869
|
* When no background service is running: 'transient' spawns one for this login session; 'ask' offers to install it persistently
|
|
6709
6870
|
*/
|
|
6710
6871
|
daemonColdStart?: 'transient' | 'ask';
|
|
6872
|
+
/**
|
|
6873
|
+
* Inbound cross-session peer messages (SendMessage from your other sessions): 'accept' delivers them, 'hold' parks them for your review without letting Claude act, 'refuse' opts this session out. An explicit value always wins. Unset (mode parity): a message auto-delivers only when the sending session's permission-mode class matches yours (bypass↔bypass or prompting↔prompting); a mismatched sender's message is held for your approval; a sender that asserts no class is held only while this session bypasses permission prompts.
|
|
6874
|
+
*/
|
|
6875
|
+
crossSessionInbound?: 'accept' | 'hold' | 'refuse';
|
|
6711
6876
|
/**
|
|
6712
6877
|
* Mirror local sessions to claude.ai as view-only (no remote control)
|
|
6713
6878
|
*/
|