@anthropic-ai/claude-agent-sdk 0.3.223 → 0.3.225

package/manifest.json

@@ -1,53 +1,51 @@
 {
-  "version": "2.1.223",
-  "commit": "4535f69721056abf01650c73ee8a91c69ba00838",
-  "buildDate": "2026-08-05T21:55:19Z",
+  "version": "2.1.225",
+  "commit": "d4b76e8c52c2391af51b60cc71a513246c40a129",
+  "buildDate": "2026-08-07T20:01:17Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "fcbe0b8d47570c501302dd1ad31cc26ac2810f022c45fa253936a6961dee32bf",
-      "size": 272553824
+      "checksum": "08d6e85dd2b80883bb8da93cbeae3dc79b4704d6b84a05d614bf1ff4a5155b69",
+      "size": 279661952
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "350e657428a6d34f7cf71f6738c5ebb6a1952ccb12fc1747f64297e065b1846f",
-      "size": 282118560
+      "checksum": "0065d7155f83a3a5b0e0153ca3b70ad902b33dc06747c8b4e4d0bad58c6e0ec5",
+      "size": 289284768
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "60e83d8db0e894d0e54413e5e7daa256d180db660f51e139a51b614fc30cf3ac",
-      "size": 287423416
+      "checksum": "209d4279c0a3dbb48bee6017d99430269ec6aba59cd8735b1fda0f9664139a45",
+      "size": 294566840
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "98226474f802e3094d6a86c5ade8883c16206d0fcb5c400b7401c800063e99d7",
-      "size": 290728968
+      "checksum": "0a3be8d18cb0f5357d38ce2d588601753a60b44cc9c622579ed8b8405dee231e",
+      "size": 297831432
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "f41692eab23ebcd836d342fbc494d8783b1f19efb13d04fbf8461d2806ccb586",
-      "size": 280737128
+      "checksum": "9189e2776d4120288b85a6682d2b26910daa4e937baa48bd75afb3fe3115291e",
+      "size": 287880552
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "8a4e561e8af19746d2defcf1a5661f5c0384c9c26dadd87d45e11b67802ad147",
-      "size": 285336144
+      "checksum": "ae2258be1a2d4eeef291514195af5b50a55801cc0561347c3873c4df5c9646f8",
+      "size": 292438608
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "a708ba811c4cc46907df358e22f2aa6da3dbc28192747e4d3c4a0869752fe722",
-      "size": 280233632
+      "checksum": "234a59d6ea4262bb4af65d28acf19d795906295d11249750161875fbede3576d",
+      "size": 287053472
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "8efb44f04fda50fac3c7602276903e44ff82d48f1a29a41f1a5d98891a01864b",
-      "size": 274906784
+      "checksum": "1152d683ed9ae20d7140ddc2db04d48e5f16ed214e2b07a8bc95c363c7e63bff",
+      "size": 281726112
     }
   },
   "sdkCompat": {
     "testedWrapperVersions": [
-      "0.3.182",
-      "0.3.183",
       "0.3.185",
       "0.3.186",
       "0.3.187",
@@ -72,10 +70,12 @@
       "0.3.212",
       "0.3.214",
       "0.3.215",
+      "0.3.216",
       "0.3.217",
       "0.3.218",
       "0.3.220",
-      "0.3.221"
+      "0.3.221",
+      "0.3.222"
     ],
     "harnessSchema": 1
   }

package/manifest.zst.json

@@ -1,61 +1,59 @@
 {
-  "version": "2.1.223",
-  "commit": "4535f69721056abf01650c73ee8a91c69ba00838",
-  "buildDate": "2026-08-05T21:57:22Z",
+  "version": "2.1.225",
+  "commit": "d4b76e8c52c2391af51b60cc71a513246c40a129",
+  "buildDate": "2026-08-07T20:03:23Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude.zst",
-      "checksum": "66736b64309852d44c184d5e3b431dd291581a6be9850715a8d3c3ce2aba4a61",
-      "size": 54612115,
+      "checksum": "7cef5c083019c8ed8e58505c8987388fca2b97cbd3b156b6be77d3a3b8ae10eb",
+      "size": 55963833,
       "bundle": {
-        "checksum": "1aa06b34b3da404d607488aa9a4b946a4f3b0383d549615928a5355f83af89a5",
-        "size": 54613585
+        "checksum": "11f2aa153892c0c72b42de714f8b83b5fb65f969649f3c9f594e89d6845245c1",
+        "size": 55954834
       }
     },
     "darwin-x64": {
       "binary": "claude.zst",
-      "checksum": "17278d93f4cd9bf7b6243f2d69ae60f7e14bd41672c461857fcb959cce787866",
-      "size": 59287050,
+      "checksum": "3d2774dc46981cf10056bd7dd5adfce9a001d7ad6e46088f90c0e4846071f39e",
+      "size": 60638677,
       "bundle": {
-        "checksum": "1e115e67b3b9230b0f5877e038b40ed0df9cf6a2cd390e4a3da207d028c9c998",
-        "size": 59285846
+        "checksum": "3333a5d1127541eecc8ec0273ee2dd238b35443faa90ba1969276083e6243482",
+        "size": 60635363
       }
     },
     "linux-arm64": {
       "binary": "claude.zst",
-      "checksum": "50cefaeb32af65d8da9036f152110357101c24e8705ac0fb311daf37b6b0a574",
-      "size": 63439231
+      "checksum": "15907252edb6577bda10482e2aa1677928aa243e823ccb6577c5158bbae7f272",
+      "size": 64830045
     },
     "linux-x64": {
       "binary": "claude.zst",
-      "checksum": "5f3ccf27ecbf3eca26611380ec5c4bd922fb20fd12a1749744922ff595661aad",
-      "size": 64854874
+      "checksum": "56f6febbbda34e715dcecdc5ad9a2ef8b65f678e735675881f84ecb0ca79a610",
+      "size": 66133582
     },
     "linux-arm64-musl": {
       "binary": "claude.zst",
-      "checksum": "de4dcb573dfc16096bc19cdae9eb64e4f66306d018ac69feb3aa4b1bdf9eab2a",
-      "size": 62226768
+      "checksum": "cc449538fb17e65223c531fdd4b319078c8ed3067356a5df48b64672697eb0fc",
+      "size": 63542121
     },
     "linux-x64-musl": {
       "binary": "claude.zst",
-      "checksum": "acc2132f74191d17baa52ebbedae63bab7dd9f0b841444a24f3437f771b4edee",
-      "size": 63735968
+      "checksum": "74a5cc57c143ef730e284c5b4351bdb26da2f3436be54835a4e3acea29cb3377",
+      "size": 64976182
     },
     "win32-x64": {
       "binary": "claude.exe.zst",
-      "checksum": "a3b7fa65d3b4cc5624314c0a3af20aa1a4876bf2bdc0e3d68f2b75516ad4887a",
-      "size": 65087938
+      "checksum": "0e62dd09aeccceefade7dee10c2d390718e38da4f61258fe8313d9e687afa67e",
+      "size": 66322446
     },
     "win32-arm64": {
       "binary": "claude.exe.zst",
-      "checksum": "28c57b3dbb7d6f01b152f0947a5cbe382f77cdac026ef3a22cb8430fc06ac1d4",
-      "size": 63251656
+      "checksum": "0dbe13b41228e85c14d9dc6f47b42eeaaaa027d77ce669f4ae9ac01a724a5812",
+      "size": 64477363
     }
   },
   "sdkCompat": {
     "testedWrapperVersions": [
-      "0.3.182",
-      "0.3.183",
       "0.3.185",
       "0.3.186",
       "0.3.187",
@@ -80,10 +78,12 @@
       "0.3.212",
       "0.3.214",
       "0.3.215",
+      "0.3.216",
       "0.3.217",
       "0.3.218",
       "0.3.220",
-      "0.3.221"
+      "0.3.221",
+      "0.3.222"
     ],
     "harnessSchema": 1
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anthropic-ai/claude-agent-sdk",
-  "version": "0.3.223",
+  "version": "0.3.225",
   "main": "sdk.mjs",
   "types": "sdk.d.ts",
   "exports": {
@@ -57,14 +57,14 @@
     "zod": "^4.0.0"
   },
   "optionalDependencies": {
-    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.223",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.223",
-    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.223",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.223",
-    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.223",
-    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.223",
-    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.223",
-    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.223"
+    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.225",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.225",
+    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.225",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.225",
+    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.225",
+    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.225",
+    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.225",
+    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.225"
   },
   "files": [
     "sdk.mjs",
@@ -80,5 +80,5 @@
     "manifest.json",
     "manifest.zst.json"
   ],
-  "claudeCodeVersion": "2.1.223"
+  "claudeCodeVersion": "2.1.225"
 }

package/sdk-tools.d.ts

@@ -2661,7 +2661,7 @@ export interface ScheduleWakeupInput {
   stop?: boolean;
 }
 export interface RemoteTriggerInput {
-  action: "list" | "get" | "create" | "update" | "run";
+  action: "list" | "get" | "create" | "update" | "run" | "create_webhook_trigger";
   /**
    * Required for get, update, and run
    */

package/sdk.d.ts

@@ -10,7 +10,7 @@ import type { Readable } from 'stream';
 import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';
 import type { UUID } from 'crypto';
 import type { Writable } from 'stream';
-import { z } from 'zod/v4';
+import * as z from 'zod/v4';
 import type { ZodRawShape } from 'zod';
 import type { ZodRawShape as ZodRawShape_2 } from 'zod/v4';
 
@@ -1300,20 +1300,44 @@ export declare type NotificationHookSpecificOutput = {
 /**
  * Callback for handling MCP elicitation requests.
  * Called when an MCP server requests user input and no hook handles it.
+ *
+ * Return `null` ONLY after the consumer has already sent the
+ * control_response out-of-band (e.g. a signed HTTP POST echoing
+ * `requestId`); the SDK will skip its own transport write. Same contract as
+ * {@link CanUseTool}. Fail-closed: an accidental null means no response is
+ * sent and the elicitation stays pending until the server times it out.
  */
 export declare type OnElicitation = (request: ElicitationRequest, options: {
     signal: AbortSignal;
-}) => Promise<ElicitationResult>;
+    /**
+     * The control_request envelope's `request_id`. A control_response sent
+     * out-of-band (e.g. a signed HTTP POST instead of the SDK's WS write)
+     * must echo this value for the worker to match it.
+     */
+    requestId: string;
+}) => Promise<ElicitationResult | null>;
 
 /**
  * Callback for handling `request_user_dialog` control requests.
  * Called when the CLI asks the host to render a blocking dialog.
- * If not provided, dialogs are answered as cancelled and the CLI applies
- * each dialog's default behavior.
+ * If not provided, the dialog is left unanswered so a renderer-bearing
+ * client (or the worker's park deadline) can settle it.
+ *
+ * Return `null` ONLY after the consumer has already sent the
+ * control_response out-of-band (e.g. a signed HTTP POST echoing
+ * `requestId`); the SDK will skip its own transport write. Same contract as
+ * {@link CanUseTool}. Fail-closed: an accidental null means no response is
+ * sent and the dialog stays parked until the worker's deadline.
  */
 export declare type OnUserDialog = (request: UserDialogRequest, options: {
     signal: AbortSignal;
-}) => Promise<UserDialogResult>;
+    /**
+     * The control_request envelope's `request_id`. A control_response sent
+     * out-of-band (e.g. a signed HTTP POST instead of the SDK's WS write)
+     * must echo this value for the worker to match it.
+     */
+    requestId: string;
+}) => Promise<UserDialogResult | null>;
 
 /**
  * Options for the query function.
@@ -2770,6 +2794,10 @@ declare const SandboxCredentialsConfigSchema: () => z.ZodOptional<z.ZodObject<{
             error: "error";
             warn: "warn";
         }>>;
+        decode: z.ZodOptional<z.ZodEnum<{
+            jwt: "jwt";
+        }>>;
+        maskClaims: z.ZodOptional<z.ZodArray<z.ZodString>>;
         maskDuplicates: z.ZodOptional<z.ZodBoolean>;
         injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>>>;
@@ -2779,9 +2807,38 @@ declare const SandboxCredentialsConfigSchema: () => z.ZodOptional<z.ZodObject<{
             deny: "deny";
             mask: "mask";
         }>;
+        extract: z.ZodOptional<z.ZodString>;
+        onExtractNoMatch: z.ZodOptional<z.ZodEnum<{
+            deny: "deny";
+            error: "error";
+            warn: "warn";
+        }>>;
+        decode: z.ZodOptional<z.ZodEnum<{
+            jwt: "jwt";
+        }>>;
+        maskClaims: z.ZodOptional<z.ZodArray<z.ZodString>>;
         injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>>>;
     allowPlaintextInject: z.ZodOptional<z.ZodBoolean>;
+    awsPairs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        accessKeyIdVar: z.ZodString;
+        secretAccessKeyVar: z.ZodString;
+        sessionTokenVar: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    sigv4: z.ZodOptional<z.ZodObject<{
+        streaming: z.ZodOptional<z.ZodEnum<{
+            deny: "deny";
+            passthrough: "passthrough";
+        }>>;
+        presigned: z.ZodOptional<z.ZodEnum<{
+            deny: "deny";
+            passthrough: "passthrough";
+        }>>;
+        sigv4a: z.ZodOptional<z.ZodEnum<{
+            deny: "deny";
+            passthrough: "passthrough";
+        }>>;
+    }, z.core.$strip>>;
 }, z.core.$strip>>;
 
 export declare type SandboxFilesystemConfig = NonNullable<z.infer<ReturnType<typeof SandboxFilesystemConfigSchema>>>;
@@ -2869,6 +2926,10 @@ declare const SandboxSettingsSchema: () => z.ZodObject<{
                 error: "error";
                 warn: "warn";
             }>>;
+            decode: z.ZodOptional<z.ZodEnum<{
+                jwt: "jwt";
+            }>>;
+            maskClaims: z.ZodOptional<z.ZodArray<z.ZodString>>;
             maskDuplicates: z.ZodOptional<z.ZodBoolean>;
             injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>>>>;
@@ -2878,9 +2939,38 @@ declare const SandboxSettingsSchema: () => z.ZodObject<{
                 deny: "deny";
                 mask: "mask";
             }>;
+            extract: z.ZodOptional<z.ZodString>;
+            onExtractNoMatch: z.ZodOptional<z.ZodEnum<{
+                deny: "deny";
+                error: "error";
+                warn: "warn";
+            }>>;
+            decode: z.ZodOptional<z.ZodEnum<{
+                jwt: "jwt";
+            }>>;
+            maskClaims: z.ZodOptional<z.ZodArray<z.ZodString>>;
             injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>>>>;
         allowPlaintextInject: z.ZodOptional<z.ZodBoolean>;
+        awsPairs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            accessKeyIdVar: z.ZodString;
+            secretAccessKeyVar: z.ZodString;
+            sessionTokenVar: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>;
+        sigv4: z.ZodOptional<z.ZodObject<{
+            streaming: z.ZodOptional<z.ZodEnum<{
+                deny: "deny";
+                passthrough: "passthrough";
+            }>>;
+            presigned: z.ZodOptional<z.ZodEnum<{
+                deny: "deny";
+                passthrough: "passthrough";
+            }>>;
+            sigv4a: z.ZodOptional<z.ZodEnum<{
+                deny: "deny";
+                passthrough: "passthrough";
+            }>>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     ignoreViolations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
     enableWeakerNestedSandbox: z.ZodOptional<z.ZodBoolean>;
@@ -4128,9 +4218,9 @@ export declare type SDKMessageOrigin = {
 } | {
     kind: 'task-notification';
     /**
-     * Present when the delivery is the fired stored prompt of a scheduled task/routine (stamped from server-asserted provenance; the schedule attests storage, not authorship). The harness frames it as the session's assigned task instead of the generic background-notification frame. Absent on webhook, PR-steward, plugin, and background-event deliveries.
+     * Present when the delivery is the fired stored prompt of a scheduled task/routine ('scheduled-trigger', stamped from server-asserted provenance; the schedule attests storage, not authorship), or a coordinator co-member SendMessage delivery ('peer-send-message': model-authored text from another of the same user's sessions, verified by the server-stamped receiver co-membership — task-notification for prompt authority, but distinguishable so the receive-side crossSessionInbound setting can apply to it). The harness frames a scheduled-trigger delivery as the session's assigned task instead of the generic background-notification frame. Absent on webhook, PR-steward, plugin, and background-event deliveries.
      */
-    subkind?: 'scheduled-trigger';
+    subkind?: 'scheduled-trigger' | 'peer-send-message';
 } | {
     kind: 'coordinator';
 } | {
@@ -5775,8 +5865,19 @@ export declare interface Settings {
                          * Specific commit SHA to use
                          */
                         sha?: string;
+                    } | {
+                        source: 'archive';
+                        /**
+                         * HTTPS URL of a zip archive containing the plugin. The plugin root (the directory holding .claude-plugin/) may be at the top of the archive or nested one directory deep — a single wrapping directory is stripped.
+                         */
+                        url: string;
+                        /**
+                         * SHA-256 digest of the archive. When set, every download is verified against it and the install is refused on mismatch. It also serves as the version identity when neither plugin.json nor the marketplace entry declares a `version`. Recommended. Note the update signal is the version string (plugin.json version, else the entry version, else this digest) — changing only the digest while a version is declared does not trigger an update.
+                         */
+                        sha256?: string;
                     } | {
                         source: 'unsupported';
+                        error?: string;
                     };
                     description?: string;
                     version?: string;
@@ -5975,8 +6076,19 @@ export declare interface Settings {
                  * Specific commit SHA to use
                  */
                 sha?: string;
+            } | {
+                source: 'archive';
+                /**
+                 * HTTPS URL of a zip archive containing the plugin. The plugin root (the directory holding .claude-plugin/) may be at the top of the archive or nested one directory deep — a single wrapping directory is stripped.
+                 */
+                url: string;
+                /**
+                 * SHA-256 digest of the archive. When set, every download is verified against it and the install is refused on mismatch. It also serves as the version identity when neither plugin.json nor the marketplace entry declares a `version`. Recommended. Note the update signal is the version string (plugin.json version, else the entry version, else this digest) — changing only the digest while a version is declared does not trigger an update.
+                 */
+                sha256?: string;
             } | {
                 source: 'unsupported';
+                error?: string;
             };
             description?: string;
             version?: string;
@@ -6165,8 +6277,19 @@ export declare interface Settings {
                  * Specific commit SHA to use
                  */
                 sha?: string;
+            } | {
+                source: 'archive';
+                /**
+                 * HTTPS URL of a zip archive containing the plugin. The plugin root (the directory holding .claude-plugin/) may be at the top of the archive or nested one directory deep — a single wrapping directory is stripped.
+                 */
+                url: string;
+                /**
+                 * SHA-256 digest of the archive. When set, every download is verified against it and the install is refused on mismatch. It also serves as the version identity when neither plugin.json nor the marketplace entry declares a `version`. Recommended. Note the update signal is the version string (plugin.json version, else the entry version, else this digest) — changing only the digest while a version is declared does not trigger an update.
+                 */
+                sha256?: string;
             } | {
                 source: 'unsupported';
+                error?: string;
             };
             description?: string;
             version?: string;
@@ -6324,11 +6447,19 @@ export declare interface Settings {
                  */
                 extract?: string;
                 /**
-                 * What to do when `extract` matches nothing in the file. `warn` (default) emits a stderr warning and leaves the file readable as-is inside the sandbox (fail-open, for credentials that may be legitimately absent); `deny` degrades the entry to mode `deny` so the file is unreadable (fail-closed) — under `sandbox.filesystem.disabled` it is treated as `error`, since read-denies are dropped in that mode; `error` aborts at sandbox setup so nothing runs until the config is fixed. Only meaningful when mode is `mask` and `extract` is set; accepted but ignored otherwise.
+                 * What to do when `extract` matches nothing in the file — or, with `decode`, when no candidate survives verification. `warn` (default) emits a stderr warning and leaves the file readable as-is inside the sandbox (fail-open, for credentials that may be legitimately absent); `deny` degrades the entry to mode `deny` so the file is unreadable (fail-closed) — under `sandbox.filesystem.disabled` it is treated as `error`, since read-denies are dropped in that mode; `error` aborts at sandbox setup so nothing runs until the config is fixed. Only meaningful when mode is `mask` and `extract` or `decode` is set; accepted but ignored otherwise.
                  */
                 onExtractNoMatch?: 'warn' | 'deny' | 'error';
                 /**
-                 * If true, verbatim occurrences of each captured credential value outside the regex-matched spans are also replaced with the corresponding sentinel — for a secret repeated where the regex does not reach (e.g. pasted into a comment). Matches raw substrings, so short or common values may corrupt unrelated content; intended for long, high-entropy secrets. Defaults to false. Only meaningful when mode is `mask` and `extract` is set; accepted but ignored otherwise.
+                 * Optional encoded-credential format for `mask` mode. `jwt`: candidates are located with a built-in JWT regex (or the explicit `extract` pattern, if set), verified to actually be JWTs before masking, and replaced with a structurally valid fake JWT so client-side token parsing inside the sandbox keeps working. If no candidate verifies, behavior is governed by `onExtractNoMatch` (default `warn`). Accepted but ignored for `deny`.
+                 */
+                decode?: 'jwt';
+                /**
+                 * Names of top-level payload claims to mask inside each decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel and the token is rebuilt around the modified payload; all other claims are preserved so a tool that decodes the token and reads a non-secret claim keeps working. Requires `decode`. If no named claim matches in any verified token, behavior is governed by `onExtractNoMatch` (default `warn`). Only meaningful when mode is `mask`; accepted but ignored for `deny`.
+                 */
+                maskClaims?: string[];
+                /**
+                 * If true, verbatim occurrences of each captured credential value outside the regex-matched spans are also replaced with the corresponding sentinel — for a secret repeated where the regex does not reach (e.g. pasted into a comment). Matches raw substrings, so short or common values may corrupt unrelated content; intended for long, high-entropy secrets. Defaults to false. Only meaningful when mode is `mask` and `extract` or `decode` is set; accepted but ignored otherwise.
                  */
                 maskDuplicates?: boolean;
                 /**
@@ -6348,6 +6479,22 @@ export declare interface Settings {
                  * Access mode for this environment variable. `deny` unsets the variable for sandboxed commands; `mask` shows sandboxed commands a sentinel value and the host proxy swaps sentinel→real on egress to `injectHosts`.
                  */
                 mode: 'deny' | 'mask';
+                /**
+                 * Optional regex for structured masking when mode is `mask`. Applied globally to the value; capture group 1 of each match is a credential value, and only those captured spans are replaced with sentinels — the rest of the value is preserved so a tool that parses it (a `DATABASE_URL` connection string, a composite `KEY:SECRET` pair) still succeeds inside the sandbox. Without `extract`, the entire value is replaced with one sentinel (whole-value masking, suited to bare tokens). If the regex matches nothing, behavior is governed by `onExtractNoMatch` (default `warn`). Cannot be combined with `decode` (the decode path never consults it). Accepted but ignored for `deny`.
+                 */
+                extract?: string;
+                /**
+                 * What to do when `extract` matches nothing in the value. `warn` (default) emits a stderr warning and lets the variable pass through unmasked (fail-open, for credentials that may be legitimately absent); `deny` unsets the variable inside the sandbox (fail-closed); `error` aborts at sandbox setup so nothing runs until the config is fixed. Only meaningful when mode is `mask` and `extract` is set without `decode`. On a mask entry with `decode`, the runtime takes the decode path and never consults this field, so a fail-closed setting cannot be honored — `deny` and `error` are rejected there; only `warn` is accepted. In all other shapes the field is accepted but ignored.
+                 */
+                onExtractNoMatch?: 'warn' | 'deny' | 'error';
+                /**
+                 * Optional encoded-credential format for `mask` mode. `jwt`: the variable's whole value is verified to actually be a JWT and replaced with a structurally valid fake JWT so client-side token parsing inside the sandbox keeps working; the proxy swaps the whole fake token on egress. If the value does not verify, the variable is left unmasked with a stderr warning (fail-open). Cannot be combined with `extract` — the decode path never consults it. Accepted but ignored for `deny`.
+                 */
+                decode?: 'jwt';
+                /**
+                 * Names of top-level payload claims to mask inside the decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel and the token is rebuilt around the modified payload; all other claims are preserved so claim-reading clients keep working. Requires `decode`. If no named claim matches, the variable is left unmasked with a stderr warning (fail-open). Only meaningful when mode is `mask`; accepted but ignored for `deny`.
+                 */
+                maskClaims?: string[];
                 /**
                  * Optional narrowing of where the proxy substitutes this credential. Only meaningful when mode is `mask`; accepted but ignored for `deny`. If unset, defaults to `network.allowedDomains` — the credential is injected at every reachable host. Each entry must be reachable via `network.allowedDomains` (sandbox-runtime validates this).
                  */
@@ -6357,6 +6504,40 @@ export declare interface Settings {
              * Allow sentinel→real substitution on the plain-HTTP proxy path. Defaults to false: without TLS termination the upstream identity is unverified and the credential travels in cleartext. Set only for trusted-network test fixtures. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored.
              */
             allowPlaintextInject?: boolean;
+            /**
+             * Explicit groupings of masked env vars into AWS credential pairs for SigV4 re-signing, for non-standard variable names. The conventional AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN trio is paired automatically when masked. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored. A member is only usable when its env var is forwarded as a whole-value `mask` entry (an entry carrying `extract` or `decode` does not qualify — re-signing needs the whole real value). A pair whose key id or secret member is unusable never re-signs: it is dropped, unless it names a conventional AWS variable, in which case it is forwarded as an inert suppressor so implicit auto-pairing stays overridden. A pair whose ONLY unusable member is the session token still re-signs, without an x-amz-security-token (temporary-credential requests fail upstream until the entry is fixed).
+             */
+            awsPairs?: {
+                /**
+                 * Name of the masked env var holding the AWS access key id.
+                 */
+                accessKeyIdVar: string;
+                /**
+                 * Name of the masked env var holding the AWS secret access key.
+                 */
+                secretAccessKeyVar: string;
+                /**
+                 * Optional name of the masked env var holding the AWS session token (temporary credentials). When set, the proxy sends the real token as x-amz-security-token on re-signed requests and adds it to the signed header set if the client did not.
+                 */
+                sessionTokenVar?: string;
+            }[];
+            /**
+             * Policies for AWS SigV4 request shapes the proxy cannot re-sign (streaming, presigned, sigv4a) when they reference a masked credential pair: `deny` (default) or `passthrough`. Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings (.claude/settings.json and .claude/settings.local.json) are ignored.
+             */
+            sigv4?: {
+                /**
+                 * Policy for aws-chunked streaming uploads (x-amz-content-sha256: STREAMING-*): per-chunk signatures chain off the seed signature, so re-signing would require rewriting the body. `deny` (default) fails closed with a 403; `passthrough` forwards the request unre-signed (the upstream will reject its signature).
+                 */
+                streaming?: 'deny' | 'passthrough';
+                /**
+                 * Policy for presigned URLs (X-Amz-Algorithm/X-Amz-Signature in the query, no Authorization header): the signature lives in the URL itself. `deny` (default) or `passthrough`.
+                 */
+                presigned?: 'deny' | 'passthrough';
+                /**
+                 * Policy for SigV4A (AWS4-ECDSA-P256-SHA256) asymmetric signatures: there is no shared-key HMAC to recompute. `deny` (default) or `passthrough`.
+                 */
+                sigv4a?: 'deny' | 'passthrough';
+            };
         };
         ignoreViolations?: {
             [k: string]: string[];
@@ -6467,6 +6648,10 @@ export declare interface Settings {
      * Idle time before Claude's questions auto-continue with any answers selected so far. Defaults to never — auto-continue only runs when explicitly set to 60s/5m/10m.
      */
     askUserQuestionTimeout?: '60s' | '5m' | '10m' | 'never';
+    /**
+     * Max time a permission/user dialog forwarded to a remote client stays parked awaiting an answer, and how long a HELD cross-session message awaits approval, before either resolves to its safe no-action default (cancelled / dropped-with-denial). Defaults to 5m to match the long-standing remote-dialog deadline; "never" disables the deadline. Local-only permission prompts (no remote client) are unaffected. The CLAUDE_CODE_USER_DIALOG_TIMEOUT_MS env var, when set, overrides this. Read from trusted sources only (never a checked-in repo settings file).
+     */
+    dialogExpiry?: '60s' | '5m' | '10m' | 'never';
     /**
      * Name of an agent (built-in or custom) to use for the main thread. Applies the agent's system prompt, tool restrictions, and model.
      */
@@ -6708,6 +6893,10 @@ export declare interface Settings {
      * When no background service is running: 'transient' spawns one for this login session; 'ask' offers to install it persistently
      */
     daemonColdStart?: 'transient' | 'ask';
+    /**
+     * Inbound cross-session peer messages (SendMessage from your other sessions): 'accept' delivers them, 'hold' parks them for your review without letting Claude act, 'refuse' opts this session out. An explicit value always wins. Unset (mode parity): a message auto-delivers only when the sending session's permission-mode class matches yours (bypass↔bypass or prompting↔prompting); a mismatched sender's message is held for your approval; a sender that asserts no class is held only while this session bypasses permission prompts.
+     */
+    crossSessionInbound?: 'accept' | 'hold' | 'refuse';
     /**
      * Mirror local sessions to claude.ai as view-only (no remote control)
      */