@anthropic-ai/claude-agent-sdk 0.3.241 → 0.3.243

package/manifest.json

@@ -1,54 +1,51 @@
 {
-  "version": "2.1.241",
-  "commit": "c87e2742fc9ad269ec8920460d00a091b1e410f0",
-  "buildDate": "2026-08-22T23:04:33Z",
+  "version": "2.1.243",
+  "commit": "8565f923a3ec61dc4c61bf7bfd995521c702c9fc",
+  "buildDate": "2026-08-24T21:17:40Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "1495eb7c42d3b4451f5f1cd38b6d498d22a4a38c802bc2be5c1cf1795e64820d",
-      "size": 325055632
+      "checksum": "1f72dc749e59d1e8b1aa0ecdc2b3a65e599698af9087be4ac1054f57602c304d",
+      "size": 361529696
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "cf01b8cace66485ef5b476f14d96f69af61194a38c3df8412a80eb8f1316c10d",
-      "size": 333784816
+      "checksum": "37104a799bffa316fdfe6d4e99855031ad9bb5193d0d8e7e3bbb02ee4f33119f",
+      "size": 370454352
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "2db0cb893ebed8ef8aee46656da45bc6801fa2586293dae64abfa3ade894a2fe",
-      "size": 339794152
+      "checksum": "de5c21631e079b78c0b98f02a6a556acb37908425f4b80d7348cf3cd86ea5236",
+      "size": 377085072
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "0771bd866cff82b76581fc0499f6529e1a36845078f144f8c81dccb3bc7037b8",
-      "size": 342636848
+      "checksum": "4b0dafeedd0b469c41988e200036fd773e7553ba960349c9f02a82c6d1f2ba27",
+      "size": 377568472
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "e12c773a5173319f99ceb2b00445d30216e3529e1fd1fe12b4bfced1fc3f8b04",
-      "size": 332939032
+      "checksum": "e643408878084f6e0c1c460f20b3405699bab1a66b3f63e50c1868bef12d64ae",
+      "size": 369964608
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "820351f6b5fd78314240c21c6f20077c77091e5ffbcd7cd246e969ec417ffb2c",
-      "size": 336756704
+      "checksum": "9e10f7c2b42e4a6ff22d49bf88151d6b4ad7a034deb90554e28174196189fe08",
+      "size": 371500808
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "c49a05922a787c33478067a5164002932235f6611948523b55ae1fbdb303ac1f",
-      "size": 337745056
+      "checksum": "895a32a66e8a35a85fc7b9488e9858387cfd96829efda0cab96d14ba8e28c200",
+      "size": 370827424
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "540f12dd4031fa964cd8f05c7e37d43c13677800faf4cad2fec553bd7bb7833a",
-      "size": 325645472
+      "checksum": "600cd1d6817f2ba5f8340e2d50876c79430fba0947874e99a7cd2c9fc1c88ece",
+      "size": 360182944
     }
   },
   "sdkCompat": {
     "testedWrapperVersions": [
-      "0.3.204",
-      "0.3.205",
-      "0.3.206",
       "0.3.207",
       "0.3.208",
       "0.3.209",
@@ -66,6 +63,7 @@
       "0.3.222",
       "0.3.223",
       "0.3.224",
+      "0.3.225",
       "0.3.226",
       "0.3.227"
     ],

package/manifest.zst.json

@@ -1,62 +1,59 @@
 {
-  "version": "2.1.241",
-  "commit": "c87e2742fc9ad269ec8920460d00a091b1e410f0",
-  "buildDate": "2026-08-22T23:07:04Z",
+  "version": "2.1.243",
+  "commit": "8565f923a3ec61dc4c61bf7bfd995521c702c9fc",
+  "buildDate": "2026-08-24T21:19:43Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude.zst",
-      "checksum": "239155f84019476e9624d864769cf6946f94f7a707c33d57246e1e74ab94f817",
-      "size": 64578859,
+      "checksum": "773eefe08fa510cf546353a01bf4809222487937e44873c9f29292e3b4285dfd",
+      "size": 75209294,
       "bundle": {
-        "checksum": "a01fb958a662a9a896faaef18a878f1885b7c3b8c81d16b01a7090f57ad879cd",
-        "size": 64579256
+        "checksum": "85e893c690b8a43f7f88a4e16b263af780ac9b443bbb40ecaf71800e94b56660",
+        "size": 75207654
       }
     },
     "darwin-x64": {
       "binary": "claude.zst",
-      "checksum": "0aaf39f605514391192973c7c97e6c8ae6d432f05e7d91e914dcc5f582cab2b8",
-      "size": 69188990,
+      "checksum": "f2b3ae356b8842861d484d8da5ab70571418495c8e04a5b8c154ea12a3abfef6",
+      "size": 79734686,
       "bundle": {
-        "checksum": "573ae01fea364f9e29a5d5c0ceba8310854556d237b5974d3c8264d5caebf76d",
-        "size": 69175655
+        "checksum": "b2add43cc7882ac6137dad8ee108599b866c40a57ec94f871666e4b1398305de",
+        "size": 79732042
       }
     },
     "linux-arm64": {
       "binary": "claude.zst",
-      "checksum": "af0c1a3e5392c6852f9fc59a337920c8e6efcc9886b87770c9694f460a60dab8",
-      "size": 73495746
+      "checksum": "62c27c3af281c20c628a187c1bfe39f32f861404550d9dcabae247e7594e9d9c",
+      "size": 84387988
     },
     "linux-x64": {
       "binary": "claude.zst",
-      "checksum": "947ceafc4e7593baa87120fdd9bf0859a08d6fc35ce8ceb65e0194a8acce66c3",
-      "size": 74487570
+      "checksum": "d0640bf2ef7331051d59119d98c6f8381d9d81f8a9da2a5a8873fadbaa51e670",
+      "size": 84658246
     },
     "linux-arm64-musl": {
       "binary": "claude.zst",
-      "checksum": "e5c998409e79245dd3d737284a0e2b676e50e1f90bfa9f0b2ec69767509ee344",
-      "size": 72016241
+      "checksum": "d527c593a07937a4fa2cbe3eb482c8d2f3578b2106aa40856736e7c788b01a59",
+      "size": 82637291
     },
     "linux-x64-musl": {
       "binary": "claude.zst",
-      "checksum": "84d6488d6fe327fcd4f9344725f01bf38831769ce0777e8ca99ba1a763e7d689",
-      "size": 73100955
+      "checksum": "fd7af21b3e18d73161376054e8f23c20fc662fe4285befffe488b57ea4fd2571",
+      "size": 83481201
     },
     "win32-x64": {
       "binary": "claude.exe.zst",
-      "checksum": "df55188ea12a03b35a3db7481bd726615dc982eca0b8d0b55fe5c432304384a7",
-      "size": 76706997
+      "checksum": "6b2e8e6274d4b2eb3d2b5088163caf9117dc60dab46227ca9e7065bc12e72d7a",
+      "size": 86411851
     },
     "win32-arm64": {
       "binary": "claude.exe.zst",
-      "checksum": "389f2ec9a83a0f8bb90d3a766f3861ef40250aaeb20e5a3404eecd30d0b08178",
-      "size": 73204306
+      "checksum": "9829ebcfbfad320934429c259afdb8f245c281af6f73e423088f7188600d9e47",
+      "size": 83255622
     }
   },
   "sdkCompat": {
     "testedWrapperVersions": [
-      "0.3.204",
-      "0.3.205",
-      "0.3.206",
       "0.3.207",
       "0.3.208",
       "0.3.209",
@@ -74,6 +71,7 @@
       "0.3.222",
       "0.3.223",
       "0.3.224",
+      "0.3.225",
       "0.3.226",
       "0.3.227"
     ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anthropic-ai/claude-agent-sdk",
-  "version": "0.3.241",
+  "version": "0.3.243",
   "main": "sdk.mjs",
   "types": "sdk.d.ts",
   "exports": {
@@ -57,14 +57,14 @@
     "zod": "^4.0.0"
   },
   "optionalDependencies": {
-    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.241",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.241",
-    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.241",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.241",
-    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.241",
-    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.241",
-    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.241",
-    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.241"
+    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.243",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.243",
+    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.243",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.243",
+    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.243",
+    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.243",
+    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.243",
+    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.243"
   },
   "files": [
     "sdk.mjs",
@@ -80,5 +80,5 @@
     "manifest.json",
     "manifest.zst.json"
   ],
-  "claudeCodeVersion": "2.1.241"
+  "claudeCodeVersion": "2.1.243"
 }

package/sdk-tools.d.ts

@@ -103,6 +103,22 @@ export type ToolOutputSchemas =
 export type AgentOutput =
   | {
       agentId: string;
+      /**
+       * @internal Count of leading harness-authored content blocks (hand-back provenance bookkeeping; not a stable consumer field)
+       */
+      harnessNoteCount?: number;
+      /**
+       * @internal Count of trailing harness-authored content blocks (hand-back provenance bookkeeping; not a stable consumer field)
+       */
+      harnessTailCount?: number;
+      /**
+       * @internal Fingerprint binding the harness section counts to the exact content they were computed against; a hook rewrite invalidates the counts rather than misplacing rewritten bytes
+       */
+      harnessSectionHash?: string;
+      /**
+       * @internal The handoff review was skipped because the provenance frame covers this delivery (tengu_auto_mode_config.classifyHandoff: false); the tool_result mapper MUST compose the frame when set, regardless of a fresh flag read
+       */
+      handoffReviewSkipped?: boolean;
       agentType?: string;
       content: {
         type: "text";
@@ -234,6 +250,13 @@ export type FileReadOutput =
          */
         truncatedByTokenCap?: boolean;
       };
+      /**
+       * Set when this Read completed a saved Artifact source file: the Artifact and the version of it that now counts as viewed.
+       */
+      artifactRead?: {
+        slug: string;
+        ver: string;
+      };
     }
   | {
       type: "image";
@@ -323,6 +346,27 @@ export type FileReadOutput =
          */
         outputDir: string;
       };
+      /**
+       * Document page number of the first extracted page (1 when no range was requested); labels the page images in the model-facing tool_result
+       */
+      firstPage?: number;
+      /**
+       * Extracted page images, in page order. Present only transiently in-process: the page image bytes are delivered solely as image blocks in the model-facing tool_result content and are not retained on the tool_use_result, so this key is absent on the emitted/persisted result
+       */
+      pages?: {
+        /**
+         * Base64-encoded page image; empty when the page could not be processed
+         */
+        base64: string;
+        /**
+         * The MIME type of the image
+         */
+        mediaType: "image/jpeg" | "image/png" | "image/gif" | "image/webp";
+        /**
+         * Why the page could not be processed as an image; set only when base64 is empty
+         */
+        error?: string;
+      }[];
     }
   | {
       type: "file_unchanged";
@@ -455,6 +499,7 @@ export type ArtifactOutput =
         trigger_id?: string;
         durable_since?: string;
         status?: number;
+        detail?: string;
         note?: string;
         events?: string[];
       };
@@ -505,6 +550,8 @@ export type ArtifactOutput =
         next_in_s?: number;
         last_failure?: string;
         reason?: string;
+        detail?: string;
+        server_message?: string;
         at?: number;
       }[];
     }
@@ -2570,7 +2617,7 @@ export interface SendFeedbackInput {
    */
   title: string;
   /**
-   * Labeled bullets, in order: **What happened:** (observed vs. expected, exact error text if short); **What the user said:** (quoted, or "User didn't comment; observed by the model."); **Repro:** (minimal steps); **Evidence:** (request IDs, timestamps, paths, versions — omit if none); optionally a final **Cause:** only if verified in-session. One to three lines per bullet. No narrative paragraphs, no speculation, no secrets.
+   * Labeled bullets, in order: **What happened:** (observed vs. expected, exact error text if short); **What the user said:** (quoted, or "User didn't comment; observed by the model."); **Repro:** (minimal steps); **Evidence:** (request IDs, timestamps, paths, versions; omit if none); optionally a final **Cause:** only if verified in-session. One to three lines per bullet. No narrative paragraphs, no speculation, no secrets.
    */
   details: string;
   /**
@@ -2578,7 +2625,7 @@ export interface SendFeedbackInput {
    */
   area?: string;
   /**
-   * When the report is about MODEL BEHAVIOR (not a product bug), the closest failure mode — or `other` when it is a model-behavior issue that fits no listed value. Omit only when the report is a product/tool bug with no model-behavior component.
+   * When the report is about MODEL BEHAVIOR (not a product bug), the closest failure mode, or `other` when it is a model-behavior issue that fits no listed value. Omit only when the report is a product/tool bug with no model-behavior component.
    */
   failure_mode?:
     | "instruction_following"
@@ -2598,7 +2645,7 @@ export interface SendFeedbackInput {
     | "unwanted_scope"
     | "other";
   /**
-   * What kind of task the session was doing when the issue occurred — or `other` when it is a clear task that fits no listed value. Omit only if genuinely unclear.
+   * What kind of task the session was doing when the issue occurred, or `other` when it is a clear task that fits no listed value. Omit only if genuinely unclear.
    */
   task_category?: "code_edit" | "debug" | "explain" | "plan" | "shell" | "search" | "review" | "other";
 }
@@ -2797,6 +2844,10 @@ export interface ScheduleWakeupInput {
    * Set to true to end the dynamic loop immediately instead of scheduling another wakeup. When true, all other fields are ignored and no further wakeups fire.
    */
   stop?: boolean;
+  /**
+   * true = nothing changed (you checked and there is nothing to report). false = something happened worth keeping (edited a file, posted a message, advanced state, surfaced a finding). Consecutive noop:true ticks are collapsed in the user's terminal view and tracked as a streak. Required unless `stop` is true.
+   */
+  noop?: boolean;
 }
 export interface RemoteTriggerInput {
   action: "list" | "get" | "create" | "update" | "run" | "create_webhook_trigger" | "list_runs" | "get_run_log";
@@ -3059,7 +3110,7 @@ export interface ArtifactInput {
    */
   prompt?: string;
   /**
-   * Last-resort overwrite that DISCARDS the newer published version — another session's publish, or someone's save from a page that can publish new versions of itself. On a conflict the fix is to merge your changes onto the newer content (handed to you in the rejection, or re-read) and publish again — not force. Pass force:true only when the user has explicitly said to discard that specific version; never to get past a conflict on your own judgment. The tracked baseVersion is still sent; with force:true the server treats it as informational and overwrites, unless it refuses force over a version saved from inside the page. Omit (or false) so a concurrent write conflicts instead of being silently clobbered.
+   * Last-resort overwrite that DISCARDS the newer published version's page — another session's publish, or someone's save from a page that can publish new versions of itself. On a conflict the fix is to merge your changes onto the newer content (handed to you in the rejection, or re-read) and publish again — not force. Pass force:true only when the user has explicitly said to discard that specific version; never to get past a conflict on your own judgment. The tracked baseVersion is still sent; with force:true the server treats it as informational and overwrites, unless it refuses force over a version saved from inside the page. Omit (or false) so a concurrent write conflicts instead of being silently clobbered.
    */
   force?: boolean;
   /**
@@ -3987,12 +4038,32 @@ export interface REPLOutput {
     base64: string;
     mediaType: string;
   }[];
+  /**
+   * Count of inner-Read images dropped by the per-result image cap; surfaced as a note in the tool_result
+   */
+  imagesOmitted?: number;
+  /**
+   * Pages of inner page-range Reads that could not be processed as an image; surfaced as one note each in the tool_result
+   */
+  imagePagesFailed?: {
+    page: number;
+    file?: string;
+    error?: string;
+  }[];
+  /**
+   * Count of failed-page notes dropped by the per-result note cap; surfaced as a note in the tool_result
+   */
+  imagePagesFailedOmitted?: number;
   /**
    * PDFs returned by inner Read calls — surfaced as document content blocks
    */
   documents?: {
     base64: string;
   }[];
+  /**
+   * Count of inner-Read PDFs dropped by the per-result document cap; surfaced as a note in the tool_result
+   */
+  documentsOmitted?: number;
 }
 export interface WorkflowOutput {
   status: "async_launched" | "remote_launched";

package/sdk.d.ts

@@ -3760,6 +3760,7 @@ export declare type SDKControlInitializeResponse = {
 
 
 
+
 };
 
 /**
@@ -3769,7 +3770,7 @@ declare type SDKControlInterruptRequest = {
     subtype: 'interrupt';
 
     /**
-     * When true, the interrupt also cancels every uuid-stamped main-thread command still in the queue or already dequeued for the imminent turn but not yet reachable by the abort (the first-command prewait window) — the same set the response would otherwise list under `still_queued`. Each is closed with a terminal 'cancelled' lifecycle and listed on the response's `cancelled` field. `still_queued` is then empty, except that a client driving a hosted session lists there what it can no longer recall (a send already in flight to that session, or the first prompt the session was created with). (The isFoldInFlight guard cancel_async_message uses does not apply here: this request also aborts the running turn, so a fold-in-flight uuid is never delivered and is swept with the rest. A fold-in-flight uuid's queued_command attachment may already appear in the aborted turn's transcript if the abort landed after the fold's attachment yield — pre-existing leave-queued semantics; it never runs as its own turn.) Uuid-less commands (task notifications) still in the queue are also dequeued but cannot be listed; a uuid-less command already in the prewait window is unreachable by either leg and still runs. When false or absent, queued commands survive the interrupt and are listed under `still_queued` — the interrupt_receipt_v1 contract is unchanged. A Stop-means-stop-everything client (a remote UI's Stop button) sets this true so one round-trip halts the session; a wrapper that wants per-uuid control leaves it false and follows up with cancel_async_message. Advertised by the `interrupt_cancel_queued_v1` capability on system/init; older CLIs ignore the field and behave as if false.
+     * When true, the interrupt also cancels every uuid-stamped main-thread command still in the queue or already dequeued for the imminent turn but not yet reachable by the abort (the first-command prewait window) — the same set the response would otherwise list under `still_queued`. Each is closed with a terminal 'cancelled' lifecycle and listed on the response's `cancelled` field. `still_queued` is then empty, except that a client driving a hosted session lists there what it can no longer recall (a send already in flight to that session, or the first prompt the session was created with) and, when the session's own sweep then cancels one of those or a send it had already delivered, follows up with a command_lifecycle 'cancelled' frame for it. (The isFoldInFlight guard cancel_async_message uses does not apply here: this request also aborts the running turn, so a fold-in-flight uuid is never delivered and is swept with the rest. A fold-in-flight uuid's queued_command attachment may already appear in the aborted turn's transcript if the abort landed after the fold's attachment yield — pre-existing leave-queued semantics; it never runs as its own turn.) Uuid-less commands (task notifications) still in the queue are also dequeued but cannot be listed; a uuid-less command already in the prewait window is unreachable by either leg and still runs. When false or absent, queued commands survive the interrupt and are listed under `still_queued` — the interrupt_receipt_v1 contract is unchanged. A Stop-means-stop-everything client (a remote UI's Stop button) sets this true so one round-trip halts the session; a wrapper that wants per-uuid control leaves it false and follows up with cancel_async_message. Advertised by the `interrupt_cancel_queued_v1` capability on system/init; older CLIs ignore the field and behave as if false.
      */
     cancel_queued?: boolean;
 };
@@ -3779,7 +3780,7 @@ declare type SDKControlInterruptRequest = {
  */
 export declare type SDKControlInterruptResponse = {
     /**
-     * Uuids of async user messages that survive this interrupt: commands still in the queue, plus any batch already dequeued for the imminent turn but not yet reachable by the abort. These WILL run unless cancelled first (or unless the request set cancel_queued:true, in which case every uuid-stamped survivor this process holds is removed, emitted a terminal `cancelled` synchronously, and listed under `cancelled` instead — leaving here only what a client driving a hosted session can no longer recall: a send already in flight to that session, or the first prompt the session was created with). Cancellation granularity: uuids still in the queue are individually cancellable via cancel_async_message; once a batch is dequeued and coalesced into one turn, cancelling a NON-representative member uuid is a no-op (its content still runs), while cancelling the batch-representative uuid drops the WHOLE coalesced batch — in both cases the cancel response reports cancelled:false because the message was no longer in the queue. Coverage caveats: only uuid-STAMPED messages appear (a message enqueued without a uuid still runs but is never listed, so [] does not mean "nothing will run"); only main-thread messages are listed (subagent-addressed messages are out of scope); and the list may include internally-enqueued uuids the client never sent (cron triggers, auto-resume continuations) — ignore unknown uuids rather than treating them as an error. Ordering: on a clean interrupt this receipt is written before the interrupted turn result; a turn that crashes during interrupt handling emits its error result on a direct-write path that may precede the receipt. Snapshot is taken synchronously with abort processing — probing the queue after the interrupted result instead always loses the race against the drain loop, which starts the next queued turn immediately.
+     * Uuids of async user messages that survive this interrupt: commands still in the queue, plus any batch already dequeued for the imminent turn but not yet reachable by the abort. These WILL run unless cancelled first (or unless the request set cancel_queued:true, in which case every uuid-stamped survivor this process holds is removed, emitted a terminal `cancelled` synchronously, and listed under `cancelled` instead — leaving here only what a client driving a hosted session can no longer recall: a send already in flight to that session, or the first prompt the session was created with; a send that client still holds on its own machine behind a send gate (today: waiting for the session to take the initial upload from that machine) has not gone out, so it is withdrawn and listed under `cancelled` like a queued one, and cancel_async_message can withdraw it too, while a plain interrupt leaves it held and lists it here). Cancellation granularity: uuids still in the queue are individually cancellable via cancel_async_message; once a batch is dequeued and coalesced into one turn, cancelling a NON-representative member uuid is a no-op (its content still runs), while cancelling the batch-representative uuid drops the WHOLE coalesced batch — in both cases the cancel response reports cancelled:false because the message was no longer in the queue. Coverage caveats: only uuid-STAMPED messages appear (a message enqueued without a uuid still runs but is never listed, so [] does not mean "nothing will run"); only main-thread messages are listed (subagent-addressed messages are out of scope); and the list may include internally-enqueued uuids the client never sent (cron triggers, auto-resume continuations) — ignore unknown uuids rather than treating them as an error. Ordering: on a clean interrupt this receipt is written before the interrupted turn result; a turn that crashes during interrupt handling emits its error result on a direct-write path that may precede the receipt. Snapshot is taken synchronously with abort processing — probing the queue after the interrupted result instead always loses the race against the drain loop, which starts the next queued turn immediately.
      */
     still_queued: string[];
     /**
@@ -3914,6 +3915,10 @@ declare type SDKControlPermissionRequest = {
      * True when the dialog must not offer the persistent "don't ask again" row for this ask: accepting it would write a whole-tool allow rule broader than the ask's own verb (PermissionAskDecision.suppressAlwaysAllowRule). Hosts rendering approve options should omit any persistent-rule affordance when set.
      */
     suppress_always_allow_rule?: boolean;
+    /**
+     * True when the ask must not be approvable by a single stray keystroke (PermissionAskDecision.defaultToNo): a terminal-style prompt opens on its decline option and takes no digit shortcut. Hosts rendering approve options should not pre-select approve when set.
+     */
+    default_to_no?: boolean;
     /**
      * Set when a user-configured ask RULE (permissions.ask) forced this prompt but the ask carries the tool's own decision_reason — the ask-rule substitution keeps the richer tool-minted ask, so the rule rides here instead of decision_reason_type 'rule'. Hosts making policy on decision_reason_type (e.g. auto-deny safetyCheck) or running host-side auto-approval should treat asks carrying this field as rule-forced: the user's stated intent is a human prompt. Values are producer-authored but render-unsafe like decision_reason; sanitize before display.
      */
@@ -4353,7 +4358,7 @@ export declare type SDKMessageOrigin = {
      */
     name?: string;
     /**
-     * The sender's host-openable session id (the envelope's `from-session` attribute — e.g. a desktop `local_<uuid>` or a CCR `session_`/`ses_` id), set by the sender's host so a receiving UI can link this message back to the sending session. Sender-asserted like `from`: a navigation target only, never authority. Absent when the sender's host provides none and on messages from older senders.
+     * The sender's host-openable session id (the envelope's `from-session` attribute — e.g. a desktop `local_<uuid>` or a cloud session `session_`/`ses_` id), set by the sender's host so a receiving UI can link this message back to the sending session. Sender-asserted like `from`: a navigation target only, never authority. Absent when the sender's host provides none and on messages from older senders.
      */
     fromSession?: string;
 
@@ -4372,7 +4377,7 @@ export declare type SDKMessageOrigin = {
 } | {
     kind: 'task-notification';
     /**
-     * Present when the delivery is the fired stored prompt of a scheduled task/routine ('scheduled-trigger', stamped from server-asserted provenance; the schedule attests storage, not authorship), a coordinator co-member SendMessage delivery ('peer-send-message': model-authored text from another of the same user's sessions, verified by the server-stamped receiver co-membership — task-notification for prompt authority, but distinguishable so the receive-side crossSessionInbound setting can apply to it), or a Claude Code Projects delivery that Anthropic servers composed for the project's coordinator session and addressed to one of its thread sessions ('projects-relay': the thread's first message, or a relay carrying project messages — stamped from server-asserted provenance). The harness frames a scheduled-trigger delivery as the session's assigned task and a projects-relay delivery that carries the server's relay stamps as a message from the coordinator session (one without them keeps the generic background-notification frame), instead of the generic background-notification frame. Absent on webhook, PR-steward, plugin, and background-event deliveries.
+     * Present when the delivery is the fired stored prompt of a scheduled task/routine ('scheduled-trigger', stamped from server-asserted provenance; the schedule attests storage, not authorship) or a coordinator co-member SendMessage delivery ('peer-send-message': model-authored text from another of the same user's sessions, verified by the server-stamped receiver co-membership — task-notification for prompt authority, but distinguishable so the receive-side crossSessionInbound setting can apply to it). The harness frames a scheduled-trigger delivery as the session's assigned task instead of the generic background-notification frame. Absent on webhook, PR-steward, plugin, and background-event deliveries.
      */
     subkind?: 'scheduled-trigger' | 'peer-send-message' | 'projects-relay';
 } | {
@@ -4584,6 +4589,7 @@ export declare type SDKRateLimitInfo = {
     resetsAt?: number;
     rateLimitType?: 'five_hour' | 'seven_day' | 'seven_day_opus' | 'seven_day_sonnet' | 'seven_day_overage_included' | 'overage';
     utilization?: number;
+
     overageStatus?: 'allowed' | 'allowed_warning' | 'rejected';
     overageResetsAt?: number;
     overageDisabledReason?: 'overage_not_provisioned' | 'org_level_disabled' | 'org_level_disabled_until' | 'out_of_credits' | 'seat_tier_level_disabled' | 'member_level_disabled' | 'seat_tier_zero_credit_limit' | 'group_zero_credit_limit' | 'member_zero_credit_limit' | 'org_service_level_disabled' | 'no_limits_configured' | 'fetch_error' | 'unknown';
@@ -4620,6 +4626,10 @@ export declare type SDKResultError = {
     modelUsage: Record<string, ModelUsage>;
 
     permission_denials: SDKPermissionDenial[];
+    /**
+     * User-initiated sends still waiting in the command queue when this result was produced. Greater than 0 means at least one more user turn (and result) follows without further input, barring cancellation; 0 means none is pending, or the session is ending (end_session or a shutdown latched mid-turn discards the backlog). Queued sends may coalesce into fewer turns, so this counts pending sends, not remaining results. System-generated queue entries are not counted. Absent on fatal startup results and on surfaces without a command queue.
+     */
+    queued_turn_count?: number;
     errors: string[];
     terminal_reason?: TerminalReason;
     fast_mode_state?: FastModeState;
@@ -4666,6 +4676,10 @@ export declare type SDKResultSuccess = {
     modelUsage: Record<string, ModelUsage>;
 
     permission_denials: SDKPermissionDenial[];
+    /**
+     * User-initiated sends still waiting in the command queue when this result was produced. Greater than 0 means at least one more user turn (and result) follows without further input, barring cancellation; 0 means none is pending, or the session is ending (end_session or a shutdown latched mid-turn discards the backlog). Queued sends may coalesce into fewer turns, so this counts pending sends, not remaining results. System-generated queue entries are not counted. Absent on fatal startup results and on surfaces without a command queue.
+     */
+    queued_turn_count?: number;
     structured_output?: unknown;
     deferred_tool_use?: SDKDeferredToolUse;
     terminal_reason?: TerminalReason;
@@ -4815,7 +4829,7 @@ export declare type SDKSystemMessage = {
      */
     effort?: ('low' | 'medium' | 'high' | 'xhigh' | 'max') | null;
     /**
-     * Protocol capabilities this CLI supports, so SDK consumers can feature-detect instead of version-sniffing. Open set — ignore unknown values; check each capability for exactly the behavior you use. 'interrupt_receipt_v1' = the interrupt control_response success payload carries still_queued (uuids of async user messages that survive the interrupt). 'interrupt_cancel_queued_v1' = the interrupt control_request honors cancel_queued:true (queued and pending-dispatch commands are cancelled alongside the abort, listed on the response's cancelled field; still_queued is then empty — including any uuid that was mid-fold at the interrupt instant, since this request also aborts and the fold never delivers it — except that a client driving a hosted session lists there what it can no longer recall: a send already in flight to that session, or the first prompt the session was created with). 'queued_notifications' = the CLI accepts inbound queued_notification stream messages and drains them via ReadNotifications (the CCR backend reads this from the persisted init event to decide whether it may send them). Absent on older CLIs.
+     * Protocol capabilities this CLI supports, so SDK consumers can feature-detect instead of version-sniffing. Open set — ignore unknown values; check each capability for exactly the behavior you use. 'interrupt_receipt_v1' = the interrupt control_response success payload carries still_queued (uuids of async user messages that survive the interrupt). 'interrupt_cancel_queued_v1' = the interrupt control_request honors cancel_queued:true (queued and pending-dispatch commands are cancelled alongside the abort, listed on the response's cancelled field; still_queued is then empty — including any uuid that was mid-fold at the interrupt instant, since this request also aborts and the fold never delivers it — except that a client driving a hosted session lists there what it can no longer recall: a send already in flight to that session, or the first prompt the session was created with). 'queued_notifications' = the CLI accepts inbound queued_notification stream messages and drains them via ReadNotifications (the cloud session backend reads this from the persisted init event to decide whether it may send them). Absent on older CLIs.
      */
     capabilities?: string[];
 
@@ -5058,7 +5072,7 @@ export declare type SDKUserMessageReplay = {
 };
 
 /**
- * Emitted by the bridge on opt-in graceful worker teardown (only when the teardown caller supplied a reason), before the heartbeat stops, so remote clients can show why the worker went away instead of waiting for heartbeat timeout. Absence is NOT a dead-host signal: handoffs (/update, /teleport, respawn), auto-disable, mode transitions, and internal fatal-error paths emit nothing by design. A dead host (battery, OOM, kill -9) never reaches teardown and never sends this either. NOTE: this event lands in the durable per-session event stream — a session that is later resumed may carry historical instances mid-stream. Clients MUST treat it as a live-tail signal only (honored when no further activity follows), not a one-shot session-lifetime fact. CC-2656.
+ * Emitted by the bridge on opt-in graceful worker teardown (only when the teardown caller supplied a reason), before the heartbeat stops, so remote clients can show why the worker went away instead of waiting for heartbeat timeout. Absence is NOT a dead-host signal: handoffs (/update, /teleport, respawn), auto-disable, mode transitions, and internal fatal-error paths emit nothing by design. A dead host (battery, OOM, kill -9) never reaches teardown and never sends this either. NOTE: this event lands in the durable per-session event stream — a session that is later resumed may carry historical instances mid-stream. Clients MUST treat it as a live-tail signal only (honored when no further activity follows), not a one-shot session-lifetime fact.
  */
 export declare type SDKWorkerShuttingDownMessage = {
     type: 'system';
@@ -5486,6 +5500,46 @@ export declare interface Settings {
     modelOverrides?: {
         [k: string]: string;
     };
+    /**
+     * Curate the /model picker: an ordered list of models with your own labels, independent of the built-in lineup and of Claude Code releases. availableModels still applies to these rows. Honored from managed, --settings/SDK, and user settings only (not from a project checkout); the highest-precedence of those that defines modelPicker wins outright (no merging across sources). Typically set in managed settings by enterprise administrators.
+     */
+    modelPicker?: {
+        /**
+         * Rows to show in the /model picker, in order.
+         */
+        options: {
+            /**
+             * Model to select, taken verbatim: an alias ("opus"), an Anthropic model ID, or a provider-format ID (Vertex, Bedrock, gateway). Same values --model accepts.
+             */
+            model: string;
+            /**
+             * Row title. Defaults to the model name.
+             */
+            label?: string;
+            /**
+             * Row subtitle. Defaults to a generic description.
+             */
+            description?: string;
+        }[];
+        /**
+         * When true, the picker shows only the Default row and these options — the built-in lineup, gateway-discovered models and ANTHROPIC_CUSTOM_MODEL_OPTION are hidden. When false or unset, these options are added after the built-in lineup.
+         */
+        replaceBuiltInOptions?: boolean;
+    };
+    /**
+     * Price usage at your organization's contracted rates instead of list price. Affects every spend figure Claude Code reports — /cost, the status line, the SDK total_cost_usd, --max-budget-usd, and the OpenTelemetry cost metric and events — which remain USD estimates, not an invoice (the per-Mtok price labels in /model stay at list). "overrides" maps a model ID to its USD-per-million-token rates (input, output, cacheRead, cacheWrite — all four required, each 0 to 10000; cacheWrite prices both 5-minute and 1-hour cache writes). A matching row is charged exactly as written; fast-mode and US-data-residency surcharges are not added on top. A key Claude Code itself uses for a built-in model — its ID such as "claude-sonnet-4-6", or its first-party, Bedrock (any or no region prefix), Vertex or Foundry ID — covers every dated and provider form of that model; any other key — a gateway model alias, or a spelling Claude Code does not itself use — matches that model ID only (case-insensitive), and such an exact match wins over a built-in row. On Bedrock an application inference profile is matched by its backing model. An invalid row or multiplier is reported and skipped; the rest still apply. "multiplier" in (0, 1] scales every computed cost, overridden or not (0.85 = 85% of the price). Only honored from managed settings (server-managed, MDM / OS policy, or managed-settings.json); ignored in user, project, local and --settings sources.
+     */
+    modelPricing?: {
+        multiplier?: number;
+        overrides?: {
+            [k: string]: {
+                input: number;
+                output: number;
+                cacheRead: number;
+                cacheWrite: number;
+            };
+        };
+    };
     /**
      * Whether to automatically approve all MCP servers in the project
      */
@@ -5605,6 +5659,7 @@ export declare interface Settings {
                 asyncRewake?: boolean;
 
 
+
             } | {
                 /**
                  * LLM prompt hook type
@@ -5702,6 +5757,7 @@ export declare interface Settings {
                  * If true, hook runs once and is removed after execution
                  */
                 once?: boolean;
+
             } | {
                 /**
                  * MCP tool hook type
@@ -5782,11 +5838,11 @@ export declare interface Settings {
      */
     disableWorkflows?: boolean;
     /**
-     * Disable the Artifact tool (also via CLAUDE_CODE_DISABLE_ARTIFACT).
+     * Deprecated: use enableArtifact: false. Still honored — true disables the Artifact tool; false is ignored.
      */
     disableArtifact?: boolean;
     /**
-     * Enable or disable the Artifact tool for this user. Unset defaults to enabled once the feature is available.
+     * Turn the Artifact tool on or off. Off in any of managed, --settings, or user settings wins; project and local settings can only turn it off. Unset defaults to on once the feature is available.
      */
     enableArtifact?: boolean;
     /**
@@ -7103,6 +7159,10 @@ export declare interface Settings {
      * Controls whether the SDK parent tier (Options.managedSettings / --managed-settings) layers under this admin tier. "first-wins" (default): parent is dropped — admin tiers are the only policy source. "merge": parent's restrictive-only-filtered settings union under the admin winner. Has no effect when no admin tier exists (parent applies as the sole policy tier, still filtered restrictive-only).
      */
     parentSettingsBehavior?: 'first-wins' | 'merge';
+    /**
+     * Controls how the managed settings sources compose. "first-wins" (default): the highest-priority source present (server-managed > MDM (managed plist / HKLM) > managed-settings.json) is the managed tier alone. "merge": every present source deep-merges with fixed precedence server-managed > MDM > managed-settings.json — scalars take the highest source's value and arrays union, except fallbackModel and the restriction allowlists allowedMcpServers, availableModels, strictKnownMarketplaces and allowedChannelPlugins (the highest source that sets one owns it whole) and the auth pins forceLoginOrgUUID, forceLoginMethod and forceLoginGatewayUrl (highest source only). Honored only from the highest-priority source present; enable it only when every lower source is admin-controlled, since lower sources then contribute entries such as permissions.allow. HKCU and --managed-settings never take part in the merge.
+     */
+    managedSourcesBehavior?: 'first-wins' | 'merge';
     /**
      * Organization UUID to require for OAuth login. Accepts a single UUID string or an array of UUIDs (any one is permitted). When set in managed settings, login fails if the authenticated account does not belong to a listed organization.
      */
@@ -7401,6 +7461,14 @@ export declare interface Settings {
      * Whether /rename updates the terminal tab title (defaults to true). Set to false to keep auto-generated topic titles.
      */
     terminalTitleFromRename?: boolean;
+    /**
+     * Prompt cache TTL for the main conversation (interactive, -p and SDK turns, plus the helpers that run inline with it): "5m" or "1h". Unset = automatic: 1 hour on a Claude subscription within its usage limits, 5 minutes on an API key, Bedrock, Vertex or Foundry. 1-hour cache writes are billed at a higher rate; the cache stays warm across longer breaks. The CLAUDE_CODE_PROMPT_CACHE_TTL environment variable takes precedence.
+     */
+    promptCacheTtl?: '5m' | '1h';
+    /**
+     * Prompt cache TTL for everything outside the main conversation — subagents, workflows, background and helper requests: "5m" or "1h". Unset = automatic (5 minutes unless ENABLE_PROMPT_CACHING_1H=1). The CLAUDE_CODE_SUBAGENT_PROMPT_CACHE_TTL environment variable takes precedence.
+     */
+    subagentPromptCacheTtl?: '5m' | '1h';
     /**
      * When false, thinking is disabled. When absent or true, thinking is enabled automatically for supported models.
      */