@anthropic-ai/claude-agent-sdk 0.3.266 → 0.3.268

package/manifest.json

@@ -1,54 +1,52 @@
 {
-  "version": "2.1.266",
+  "version": "2.1.268",
   "manifestSignatureEnforcement": "flag",
-  "commit": "eb01d60909645dfca0bf35a844b946aabaa3a75e",
-  "buildDate": "2026-09-08T23:11:11Z",
+  "commit": "8d19e585f3f1e02a7e31642695321906d38609a3",
+  "buildDate": "2026-09-10T17:38:45Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "553d1b9e9e7068b275c0a783c7e139ff6503096f286e674c8c919379fb0eca62",
-      "size": 199422144
+      "checksum": "06a96d5423f83770f120859f1c58e60d7252cc4c122aa13043b7e7cd716bc76a",
+      "size": 202081536
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "e8010163be47e29681e768946865130482e82bb47b2c5e7d0f217bacd25b526d",
-      "size": 208075488
+      "checksum": "f94c0d5ab0ab79f28e8dc9129ae7c980c2c1af65f3ea67ee6e9256bed3da67e9",
+      "size": 210766944
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "6e44c5d3c97efaa1ee35ab8dd875a907681707e5cc4f6ca0da3d13a917bbcedb",
-      "size": 215670184
+      "checksum": "116fd031f939ef1e09edf170d62c489e1cc28ed6bfbda49f948773ba168c8f62",
+      "size": 218291624
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "19842705e989393fce936804df6d2ab034860e24b8f8880357981d87ffd83fac",
-      "size": 215940592
+      "checksum": "9691a2b7bd796712ca8cffb8e32e54ff7fc45b662540233171a16a94a0425653",
+      "size": 218602992
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "7736377f052bffce3113570dc80a9fa1661f911fb0f6730e3b3b550db1991f10",
-      "size": 208615064
+      "checksum": "a1cb086b8b65ff5e2068eb764d2aff7c8a48f914df4741dd9bdb2d3aa5db971b",
+      "size": 211236504
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "1b92f53d2380955bf43cf50c261f88ae69e865b620e214be217cb346d0faaff1",
-      "size": 209956816
+      "checksum": "1e9b0013268c023266438653eb4beac34d71311a451a9f45988e5f176fdf2e24",
+      "size": 212623312
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "d2c5f7b3b6a12819097ceb6efbce2a390157166003fcaee32dbde0e6d7b45ef7",
-      "size": 218971808
+      "checksum": "1e472bcfd49449e73ef76698c87f6583055aeb88dc41ca190a9c12c6791b5eea",
+      "size": 221637792
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "ca711c1637af25d5ab517bc499603355fdaccf3884728228960aaeab3f601294",
-      "size": 210214048
+      "checksum": "30f0dbc7f1520ff0af1a2eb0167e11f09363a49f5dfd2f719ccd95e05809112c",
+      "size": 212880032
     }
   },
   "sdkCompat": {
     "testedWrapperVersions": [
-      "0.3.224",
-      "0.3.225",
       "0.3.226",
       "0.3.227"
     ],

package/manifest.zst.json

@@ -1,62 +1,60 @@
 {
-  "version": "2.1.266",
+  "version": "2.1.268",
   "manifestSignatureEnforcement": "flag",
-  "commit": "eb01d60909645dfca0bf35a844b946aabaa3a75e",
-  "buildDate": "2026-09-08T23:12:14Z",
+  "commit": "8d19e585f3f1e02a7e31642695321906d38609a3",
+  "buildDate": "2026-09-10T17:39:52Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude.zst",
-      "checksum": "fec3b87dcf30dd612d07f304aa3134057a6ebc37caabdb46f001559c094cbe0a",
-      "size": 66235285,
+      "checksum": "3e816cb773480b1c4aeadc1841be32a48fdcb3fec1ea56f59440bfb6faf457df",
+      "size": 67166011,
       "bundle": {
-        "checksum": "1fd53335cc23bbc951f5a07748f84ceae4847374a84ef3a8cc1808367a2cb110",
-        "size": 66237126
+        "checksum": "0f3074519ba4406a1c49349620b83ec7f5ac4fd478862df84e29ca6710661e99",
+        "size": 67167063
       }
     },
     "darwin-x64": {
       "binary": "claude.zst",
-      "checksum": "fce3bad16eb9c803d836a3239cc51cab80b2f9ad2265a4f7141331069e3dee57",
-      "size": 70277891,
+      "checksum": "ca8221fe78907f5d614f2bd17423ab25245d6a5c641a53ebdb7c9c9e53ffb86a",
+      "size": 71216486,
       "bundle": {
-        "checksum": "7be9b10333fe856400f18c3f269bde9fd21babee8d5a07084d8f4951fe295625",
-        "size": 70275565
+        "checksum": "2ad4c1df5a66acc116034232d335d305c42e38baedb737363a9d0f5e82b558be",
+        "size": 71218953
       }
     },
     "linux-arm64": {
       "binary": "claude.zst",
-      "checksum": "7d8bc13e8109a781b0d90245871fec32925c99956c458f05efe1043f9ec2c626",
-      "size": 75447030
+      "checksum": "d1ddeff370da9df19480e700b94c2ee0c298fa538607d5f6be01e025e9a233e0",
+      "size": 76373529
     },
     "linux-x64": {
       "binary": "claude.zst",
-      "checksum": "44ed095b31d64f2ed539b2847f3e3a6f2f02f5d7a447f0a895a998c7a2878f37",
-      "size": 76051094
+      "checksum": "9e2eca59e1ac7c7d9d9b8a031e4498de137e1da0a2fa3d8a69c00f071bd4495d",
+      "size": 76977785
     },
     "linux-arm64-musl": {
       "binary": "claude.zst",
-      "checksum": "ea6aee7861e4ad0179279ec4878af9b726a1932ee503a77e5af4a613d00b5085",
-      "size": 73931273
+      "checksum": "24a52891b9963d34b0fcb21f4a07228dc61e84a6f1c1d7475199fc004763143c",
+      "size": 74855137
     },
     "linux-x64-musl": {
       "binary": "claude.zst",
-      "checksum": "e87cb524e808ea07f24a401f7d47feeca6fb52d349837506b96ff7cafcf555da",
-      "size": 74565322
+      "checksum": "9574030b5f9c07b9d9b8d3ba55c0e12051df56faec14135aaa36ada7c226caf0",
+      "size": 75492207
     },
     "win32-x64": {
       "binary": "claude.exe.zst",
-      "checksum": "b6be4b20d80c3535c1245cb3f2f7eca58f83929ce4a66969de15d5d0f2bd1fe8",
-      "size": 78432170
+      "checksum": "02657300b90b53ab28bc478e1880b792c1650f3ad0b7bae6ffe461120e82d0f1",
+      "size": 79365973
     },
     "win32-arm64": {
       "binary": "claude.exe.zst",
-      "checksum": "365ff027777116ab9b5d58bd68f8a7db67f9bb9f59319b4ebed87793cbd67726",
-      "size": 75211940
+      "checksum": "8d32284fdb5255b158ae88755a717aa3b1521fde1235af57727bfdbb7b7642c0",
+      "size": 76145008
     }
   },
   "sdkCompat": {
     "testedWrapperVersions": [
-      "0.3.224",
-      "0.3.225",
       "0.3.226",
       "0.3.227"
     ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anthropic-ai/claude-agent-sdk",
-  "version": "0.3.266",
+  "version": "0.3.268",
   "main": "sdk.mjs",
   "types": "sdk.d.ts",
   "exports": {
@@ -57,14 +57,14 @@
     "zod": "^4.0.0"
   },
   "optionalDependencies": {
-    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.266",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.266",
-    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.266",
-    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.266",
-    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.266",
-    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.266",
-    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.266",
-    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.266"
+    "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.268",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.268",
+    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.268",
+    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.268",
+    "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.268",
+    "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.268",
+    "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.268",
+    "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.268"
   },
   "files": [
     "sdk.mjs",
@@ -80,5 +80,5 @@
     "manifest.json",
     "manifest.zst.json"
   ],
-  "claudeCodeVersion": "2.1.266"
+  "claudeCodeVersion": "2.1.268"
 }

package/sdk-tools.d.ts

@@ -448,6 +448,8 @@ export type ArtifactOutput =
       contract?: string;
       updated?: boolean;
       audience?: string;
+      seq?: number;
+      unchanged?: true;
       liveSubscription?: string;
     }
   | {
@@ -730,6 +732,8 @@ export interface BashInput {
   /**
    * Clear, concise description of what this command does in active voice. Never use words like "complex" or "risk" in the description - just describe what it does.
    *
+   * Say what the command does in plain words: do not echo the command's text, its flags, or file paths - the user reads this description, often without seeing the command.
+   *
    * For simple commands (git, npm, standard CLI tools), keep it brief (5-10 words):
    * - ls → "List files in current directory"
    * - git status → "Show working tree status"
@@ -2936,7 +2940,7 @@ export interface ProposeSkillsInput {
            */
           target?: string;
           /**
-           * One short sentence saying when to use this skill: aim for under 200 characters, never more than 1024. Shown on the review card and saved as the skill's description, which is what decides when the skill is used. For an improvement, reuse the existing skill's description unless the change alters when the skill applies.
+           * One short sentence saying when to use this skill: aim for under 200 characters, never more than 1024, and no angle brackets. Shown on the review card and saved as the skill's description, which is what decides when the skill is used. For an improvement, reuse the existing skill's description unless the change alters when the skill applies.
            */
           description: string;
           /**
@@ -2961,7 +2965,7 @@ export interface ProposeSkillsInput {
            */
           target?: string;
           /**
-           * One short sentence saying when to use this skill: aim for under 200 characters, never more than 1024. Shown on the review card and saved as the skill's description, which is what decides when the skill is used. For an improvement, reuse the existing skill's description unless the change alters when the skill applies.
+           * One short sentence saying when to use this skill: aim for under 200 characters, never more than 1024, and no angle brackets. Shown on the review card and saved as the skill's description, which is what decides when the skill is used. For an improvement, reuse the existing skill's description unless the change alters when the skill applies.
            */
           description: string;
           /**
@@ -2984,7 +2988,7 @@ export interface ProposeSkillsInput {
            */
           target?: string;
           /**
-           * One short sentence saying when to use this skill: aim for under 200 characters, never more than 1024. Shown on the review card and saved as the skill's description, which is what decides when the skill is used. For an improvement, reuse the existing skill's description unless the change alters when the skill applies.
+           * One short sentence saying when to use this skill: aim for under 200 characters, never more than 1024, and no angle brackets. Shown on the review card and saved as the skill's description, which is what decides when the skill is used. For an improvement, reuse the existing skill's description unless the change alters when the skill applies.
            */
           description: string;
           /**
@@ -3009,7 +3013,7 @@ export interface ProposeSkillsInput {
            */
           target?: string;
           /**
-           * One short sentence saying when to use this skill: aim for under 200 characters, never more than 1024. Shown on the review card and saved as the skill's description, which is what decides when the skill is used. For an improvement, reuse the existing skill's description unless the change alters when the skill applies.
+           * One short sentence saying when to use this skill: aim for under 200 characters, never more than 1024, and no angle brackets. Shown on the review card and saved as the skill's description, which is what decides when the skill is used. For an improvement, reuse the existing skill's description unless the change alters when the skill applies.
            */
           description: string;
           /**
@@ -3032,7 +3036,7 @@ export interface ProposeSkillsInput {
            */
           target?: string;
           /**
-           * One short sentence saying when to use this skill: aim for under 200 characters, never more than 1024. Shown on the review card and saved as the skill's description, which is what decides when the skill is used. For an improvement, reuse the existing skill's description unless the change alters when the skill applies.
+           * One short sentence saying when to use this skill: aim for under 200 characters, never more than 1024, and no angle brackets. Shown on the review card and saved as the skill's description, which is what decides when the skill is used. For an improvement, reuse the existing skill's description unless the change alters when the skill applies.
            */
           description: string;
           /**
@@ -3055,7 +3059,7 @@ export interface ProposeSkillsInput {
            */
           target?: string;
           /**
-           * One short sentence saying when to use this skill: aim for under 200 characters, never more than 1024. Shown on the review card and saved as the skill's description, which is what decides when the skill is used. For an improvement, reuse the existing skill's description unless the change alters when the skill applies.
+           * One short sentence saying when to use this skill: aim for under 200 characters, never more than 1024, and no angle brackets. Shown on the review card and saved as the skill's description, which is what decides when the skill is used. For an improvement, reuse the existing skill's description unless the change alters when the skill applies.
            */
           description: string;
           /**
@@ -3100,9 +3104,13 @@ export interface ArtifactInput {
    */
   file_path?: string;
   /**
-   * Browser-tab icon: one or two emoji (e.g. "📊"). No markup. Required on a page's first publish; omit on a redeploy (same file path this session, or `url`) to keep the artifact's icon — pass a new one only when the user asks.
+   * The artifact's emoji: one or two emoji (e.g. "📊"). No markup. Required on a page's first publish; omit on a redeploy (same file path this session, or `url`) to keep the artifact's emoji — pass a new one only when the user asks.
    */
   favicon?: string;
+  /**
+   * Optional. One short generic word for the artifact's tab icon, such as chart, calendar, recipe, code or map — a plain signifier, not a product or brand name. Omit when republishing to keep the current icon.
+   */
+  icon?: string;
   /**
    * list only: maximum artifacts to return (default 25).
    */
@@ -3120,7 +3128,7 @@ export interface ArtifactInput {
    */
   description?: string;
   /**
-   * A short name for the version this publish makes, max 60 chars (e.g. "Draft to legal"). Shown in the version picker. Optional — a few words, not a description.
+   * A short name for this publish, max 60 chars (e.g. "Draft to legal"). Optional — a few words, not a description.
    */
   label?: string;
   /**

package/sdk.d.ts

@@ -241,6 +241,16 @@ export declare type CanUseTool = (toolName: string, input: Record<string, unknow
      * read and write access to files in ~/Downloads").
      */
     description?: string;
+    /**
+     * The ask must not be approvable by a single stray keystroke: open the
+     * prompt on its decline option and offer no one-key approve shortcut.
+     */
+    defaultToNo?: boolean;
+    /**
+     * The ask must not offer a persistent "don't ask again" choice: the
+     * rule it would write grants more than this ask's own action.
+     */
+    suppressAlwaysAllowRule?: boolean;
     /**
      * Unique identifier for this specific tool call within the assistant message.
      * Multiple tool calls in the same assistant message will have different toolUseIDs.
@@ -293,11 +303,11 @@ declare type ControlErrorResponse = {
      */
     error: string;
     /**
-     * Permission requests still awaiting a response. Sent on the `initialize` response so a client joining an already-initialized session learns about in-flight prompts.
+     * can_use_tool requests this CLI process has issued and not yet resolved, so a client joining an already-initialized session learns about in-flight prompts. Always present (possibly empty) on a success `initialize` response from Claude Code v2.1.268 or later; earlier versions could omit it, so treat absence as an older CLI rather than as "nothing pending". A prompt inherited from a previous worker of the same session can remain answerable without appearing here and without a control_cancel_request; session_state "requires_action" on the same reply signals one the CLI is holding, but not every inherited prompt is signalled.
      */
     pending_permission_requests?: SDKControlRequest[];
     /**
-     * request_user_dialog requests still awaiting a response. Sent on the `initialize` response (sibling of pending_permission_requests) so a client joining an already-initialized session can re-arm in-flight dialogs. Receivers must tolerate the same request_id also arriving as a live or replayed control_request frame and render it once.
+     * request_user_dialog requests this CLI process has issued and not yet resolved (sibling of pending_permission_requests, with the same inherited-prompt caveat), so a client joining an already-initialized session can re-arm in-flight dialogs. Always present (possibly empty) on a success `initialize` response from Claude Code v2.1.268 or later; earlier versions could omit it, so treat absence as an older CLI rather than as "nothing pending". Receivers must tolerate the same request_id also arriving as a live or replayed control_request frame and render it once.
      */
     pending_user_dialog_requests?: SDKControlRequest[];
 };
@@ -316,11 +326,11 @@ declare type ControlResponse = {
      */
     response?: Record<string, unknown>;
     /**
-     * Permission requests still awaiting a response. Sent on the `initialize` response so a client joining an already-initialized session learns about in-flight prompts.
+     * can_use_tool requests this CLI process has issued and not yet resolved, so a client joining an already-initialized session learns about in-flight prompts. Always present (possibly empty) on a success `initialize` response from Claude Code v2.1.268 or later; earlier versions could omit it, so treat absence as an older CLI rather than as "nothing pending". A prompt inherited from a previous worker of the same session can remain answerable without appearing here and without a control_cancel_request; session_state "requires_action" on the same reply signals one the CLI is holding, but not every inherited prompt is signalled.
      */
     pending_permission_requests?: SDKControlRequest[];
     /**
-     * request_user_dialog requests still awaiting a response. Sent on the `initialize` response (sibling of pending_permission_requests) so a client joining an already-initialized session can re-arm in-flight dialogs. Receivers must tolerate the same request_id also arriving as a live or replayed control_request frame and render it once.
+     * request_user_dialog requests this CLI process has issued and not yet resolved (sibling of pending_permission_requests, with the same inherited-prompt caveat), so a client joining an already-initialized session can re-arm in-flight dialogs. Always present (possibly empty) on a success `initialize` response from Claude Code v2.1.268 or later; earlier versions could omit it, so treat absence as an older CLI rather than as "nothing pending". Receivers must tolerate the same request_id also arriving as a live or replayed control_request frame and render it once.
      */
     pending_user_dialog_requests?: SDKControlRequest[];
 };
@@ -2814,9 +2824,19 @@ export declare interface Query extends AsyncGenerator<SDKMessage, void> {
      * Reload plugins from disk and return the refreshed commands, agents,
      * plugins, and MCP server status.
      *
-     * @returns The refreshed session components after plugin reload
+     * With `holdOnCacheImpact`, the CLI first runs the check the interactive
+     * /reload-plugins makes: when applying would change the session's tool
+     * list while the conversation's prompt cache depends on it, nothing is
+     * applied and the response carries `held: true` with `cache_impact`
+     * describing what applying would change; call again without the option
+     * to apply anyway.
+     *
+     * @returns The refreshed session components after plugin reload, or the
+     * unchanged ones with `held: true` when the reload was held
      */
-    reloadPlugins(): Promise<SDKControlReloadPluginsResponse>;
+    reloadPlugins(options?: {
+        holdOnCacheImpact?: boolean;
+    }): Promise<SDKControlReloadPluginsResponse>;
     /**
      * Reload skills from disk and return the refreshed skill list.
      *
@@ -3328,13 +3348,17 @@ export declare type SDKAssistantMessage = {
     session_id: string;
     request_id?: string;
     /**
-     * Client uuid of the user message this turn is answering (submitMessage options.uuid), stamped on a reply frame each time that send changes — the turn's FIRST reply frame, and then, for a turn started by a synthetic (meta) prompt, the first reply frame after each queued user message folded in mid-turn takes the echo over. In complete-message mode the frame is the first assistant message; with --include-partial-messages the stamp normally rides the first non-ping stream event instead (see SDKPartialAssistantMessage), and a turn that produces no stream events still stamps its first assistant message — so a consumer can bind the reply to the send it answers without waiting for the result; the server keeps the first stamp it sees per uuid. A turn started by a typed prompt keeps that uuid for its whole turn, so it stamps its first reply frame only. A meta turn's own uuid is stamped only when the host vouches it is the client event's own (on a hosted session, the uuid the session server persisted: delivered content such as a Slack owner ping, a Slack-bot observation or a client-injected synthetic turn), never for a prompt the CLI minted itself such as the boot-time rescue turn; either way a user message folded into a meta turn takes the echo over from it (the rescue turn absorbing messages sent while the session was down; a bot-observation turn absorbing a human's post), and the first reply frame after that fold carries the folded message's uuid — the first reply that message got. Wrapper-level sibling — never inside `message.content` — so it is not replayed to the model. Absent on every other frame of the turn, on subagent frames (parent_tool_use_id set), on turns that neither had a client uuid nor folded a user message in, and from older producers.
+     * Client uuid of the user message this turn is answering (submitMessage options.uuid), stamped on a reply frame each time that send changes — the turn's FIRST reply frame, and then, for a turn started by a synthetic (meta) prompt, the first reply frame after each queued user message folded in mid-turn takes the echo over. In complete-message mode the frame is the first assistant message; with --include-partial-messages the stamp normally rides the first non-ping stream event instead (see SDKPartialAssistantMessage), and a turn that produces no stream events still stamps its first assistant message — so a consumer can bind the reply to the send it answers without waiting for the result; the server keeps the first stamp it sees per uuid. A turn started by a typed prompt keeps that uuid for its whole turn, so it stamps its first reply frame only. A meta turn's own uuid is stamped only when the host vouches it is the client event's own (on a hosted session, the uuid the session server persisted: delivered content such as a Slack owner ping, a Slack-bot observation or a client-injected synthetic turn), never for a prompt the CLI minted itself — except that the boot-time rescue turn re-running a turn a worker restart interrupted mid-way stamps the interrupted turn's own last user prompt (with resume_reason), the send that re-run answers; either way a user message folded into a meta turn takes the echo over from it (the rescue turn absorbing messages sent while the session was down; a bot-observation turn absorbing a human's post), and the first reply frame after that fold carries the folded message's uuid — the first reply that message got. Wrapper-level sibling — never inside `message.content` — so it is not replayed to the model. Absent on every other frame of the turn, on subagent frames (parent_tool_use_id set), on turns that neither had a client uuid nor folded a user message in, and from older producers.
      */
     user_message_uuid?: string;
     /**
      * Client uuids of every user message whose prompt this turn has consumed so far, in consumption order — all members of a prompt batch the host merged into this one turn (several messages sent close together run as one turn whose user_message_uuid is the LAST member's), then any user message folded into the turn before this frame — so a consumer that sent any of them can bind this reply to its own send by finding its uuid anywhere in the list. Always contains user_message_uuid; at most 64 entries. Present exactly when user_message_uuid is, on the same frames; absent from older producers (fall back to user_message_uuid).
      */
     user_message_uuids?: string[];
+    /**
+     * Why this frame's turn is the automatic re-run of a turn a worker restart interrupted (CLAUDE_CODE_RESUME_INTERRUPTED_TURN): the host's CLAUDE_CODE_RESUME_REASON when it set one (host_draining, checkpoint_restore, container_recreated, …), else 'interrupted_turn'. Stamped on the same reply frames as user_message_uuid (which on such a re-run names the interrupted turn's own last user prompt), so a consumer can tell the re-run's first reply from the interrupted attempt's. Absent on every other turn, on thinking_tokens frames, and from older producers.
+     */
+    resume_reason?: string;
     /**
      * This turn continued the preceding truncated assistant turn inside its trailing signed thinking block (max-output-tokens recovery). Its thinking signatures are cumulative over that preceding thinking-only turn, so a history replayed through the bridge must carry this flag back for the normalizer to keep the run's prefix on the wire. Wrapper-level sibling — never inside `message.content` — so it is not replayed to the model.
      */
@@ -3383,7 +3407,7 @@ export declare type SDKAssistantMessage = {
 
 };
 
-export declare type SDKAssistantMessageError = 'authentication_failed' | 'oauth_org_not_allowed' | 'account_on_hold' | 'billing_error' | 'rate_limit' | 'overloaded' | 'invalid_request' | 'model_not_found' | 'server_error' | 'unknown' | 'max_output_tokens';
+export declare type SDKAssistantMessageError = 'authentication_failed' | 'oauth_org_not_allowed' | 'account_on_hold' | 'verification_required' | 'billing_error' | 'rate_limit' | 'overloaded' | 'invalid_request' | 'model_not_found' | 'server_error' | 'unknown' | 'max_output_tokens' | 'cloud_credential_error';
 
 export declare type SDKAuthStatusMessage = {
     type: 'auth_status';
@@ -3644,6 +3668,10 @@ export declare type SDKControlGetContextUsageResponse = {
         tokens: number;
         color: string;
         isDeferred?: boolean;
+        /**
+         * What the row is, the same classification the /context result's context_usage rows carry: 'used' content occupies the window; 'free' is the remaining window; 'buffer' is the compaction reserve; 'deferred' rows are out-of-window tool schemas. Classify on this, never on the English name.
+         */
+        kind: 'used' | 'free' | 'buffer' | 'deferred';
     }[];
     totalTokens: number;
     maxTokens: number;
@@ -4054,6 +4082,7 @@ export declare type SDKControlInitializeResponse = {
     agents: coreTypes.AgentInfo[];
     output_style: string;
     available_output_styles: string[];
+
     models: coreTypes.ModelInfo[];
 
     /**
@@ -4263,6 +4292,7 @@ declare type SDKControlPermissionRequest = {
      * True when one-tap Approve/Deny must not be offered: the tool's approval card IS the user-interaction surface (Tool.requiresUserInteraction() — the user responds on the card itself), OR the pending ask is localDisplayOnly (its consent disclosure cannot ride this wire and only the local dialog renders it). Either way the user has to open the session to answer.
      */
     requires_user_interaction?: boolean;
+
 };
 
 /**
@@ -4321,6 +4351,10 @@ export declare type SDKControlReloadOutputStylesResponse = {
  */
 declare type SDKControlReloadPluginsRequest = {
     subtype: 'reload_plugins';
+    /**
+     * When true, the reload is not applied if applying it would change the session's tool list while the conversation's prompt cache depends on that list (the same check the interactive /reload-plugins makes before it asks for --force): the response then carries held: true and cache_impact, and the session keeps its current plugins. Default false: apply unconditionally.
+     */
+    hold_on_cache_impact?: boolean;
 };
 
 /**
@@ -4340,6 +4374,18 @@ export declare type SDKControlReloadPluginsResponse = {
     }[];
     mcpServers: coreTypes.McpServerStatus[];
     error_count: number;
+    /**
+     * Present only when the request asked to hold on cache impact and this CLI ran the check. True: the reload was not applied, the lists above describe the session as it still is, and cache_impact says what applying would change. False: the check found no impact and the reload was applied. Absent: the request did not ask, or the CLI predates the option and applied the reload unchecked.
+     */
+    held?: boolean;
+    /**
+     * What applying the held reload would change in the session's tool list: plugin MCP servers it would register or drop (scoped plugin:<plugin>:<server> names, plugin-authored — validate before showing) and whether it would add or remove the LSP tool (the may- forms mean the preview could not fully see the pending plugin set). Present only with held: true.
+     */
+    cache_impact?: {
+        mcp_servers_added: string[];
+        mcp_servers_removed: string[];
+        lsp_tool_change: ('adds' | 'may-add' | 'removes' | 'may-remove') | null;
+    };
 };
 
 /**
@@ -4867,6 +4913,10 @@ export declare type SDKPartialAssistantMessage = {
      * Client uuids of every user message whose prompt this turn has consumed so far, in consumption order — all members of a prompt batch the host merged into this one turn (several messages sent close together run as one turn whose user_message_uuid is the LAST member's), then any user message folded into the turn before this frame — so a consumer that sent any of them can bind this reply to its own send by finding its uuid anywhere in the list. Always contains user_message_uuid; at most 64 entries. Present exactly when user_message_uuid is, on the same frames; absent from older producers (fall back to user_message_uuid).
      */
     user_message_uuids?: string[];
+    /**
+     * Why this frame's turn is the automatic re-run of a turn a worker restart interrupted (CLAUDE_CODE_RESUME_INTERRUPTED_TURN): the host's CLAUDE_CODE_RESUME_REASON when it set one (host_draining, checkpoint_restore, container_recreated, …), else 'interrupted_turn'. Stamped on the same reply frames as user_message_uuid (which on such a re-run names the interrupted turn's own last user prompt), so a consumer can tell the re-run's first reply from the interrupted attempt's. Absent on every other turn, on thinking_tokens frames, and from older producers.
+     */
+    resume_reason?: string;
 };
 
 export declare type SDKPermissionDenial = {
@@ -4975,6 +5025,10 @@ export declare type SDKRateLimitInfo = {
 
 
 
+    /**
+     * Which spend limit blocked the request when it is not the member's own cap: 'group_pool' means a pooled group budget shared by the member's team is used up (the denial otherwise looks like the member's own monthly cap). Absent on a plain member denial and from older CLIs.
+     */
+    limitScope?: 'service' | 'channel' | 'group_pool';
     errorCode?: 'credits_required';
     canUserPurchaseCredits?: boolean;
     hasChargeableSavedPaymentMethod?: boolean;
@@ -5016,7 +5070,15 @@ export declare type SDKResultError = {
      * Client uuids of every user message whose prompt this turn consumed, in consumption order — all members of a prompt batch the host merged into this one turn (several messages sent close together run as one turn whose user_message_uuid is the LAST member's), then any queued user message folded into the running turn between tool rounds, once taken off the queue — so a consumer that sent any of them can bind this result to its own send by finding its uuid anywhere in the list. Always contains user_message_uuid; at most 64 entries; can be longer than the list on the turn's first reply frame. Present when a headless turn that ran echoes user_message_uuid; absent on delivery-failure and zeroed results and from older producers (fall back to user_message_uuid).
      */
     user_message_uuids?: string[];
+    /**
+     * Why this turn was the automatic re-run of a turn a worker restart interrupted (CLAUDE_CODE_RESUME_INTERRUPTED_TURN): the host's CLAUDE_CODE_RESUME_REASON when it set one (host_draining, checkpoint_restore, container_recreated, …), else 'interrupted_turn'. Present on a headless re-run's result, success or error, with or without an echo (a re-run whose opener could not be vouched still carries the reason); absent on every other turn, on the Remote Control bridge's per-turn synthetic results, and from older producers.
+     */
+    resume_reason?: string;
     terminal_reason?: TerminalReason;
+    /**
+     * Delivery sequence of this result within the run: how many results the run numbered before this one, starting at 0, in the order the process writes them. A result held back while background work finishes is numbered when it is finally written, not when its text was produced; a result whose write fails still consumes its number, so a gap in a stream-json sequence means a result was lost. Distinct from num_turns, which counts model round-trips within one turn. Numbered by the process that hosts the run (`claude -p`, stream-json): a local client relaying a cloud session passes the cloud session's numbering through and its own locally built error results carry none; the in-process engine surface does not number yet. Absent from older producers.
+     */
+    result_index?: number;
     fast_mode_state?: FastModeState;
     fast_mode_disabled_reason?: FastModeDisabledReason;
     origin?: SDKMessageOrigin;
@@ -5039,6 +5101,8 @@ export declare type SDKResultSuccess = {
     time_to_request_ms?: number;
     user_message_uuid?: string;
     user_message_uuids?: string[];
+    resume_reason?: string;
+    local_command?: string;
     request_sent_wall_ms?: number;
     first_content_frame_ms?: number;
     first_stream_post_ms?: number;
@@ -5073,6 +5137,10 @@ export declare type SDKResultSuccess = {
     structured_output?: unknown;
     deferred_tool_use?: SDKDeferredToolUse;
     terminal_reason?: TerminalReason;
+    /**
+     * Delivery sequence of this result within the run: how many results the run numbered before this one, starting at 0, in the order the process writes them. A result held back while background work finishes is numbered when it is finally written, not when its text was produced; a result whose write fails still consumes its number, so a gap in a stream-json sequence means a result was lost. Distinct from num_turns, which counts model round-trips within one turn. Numbered by the process that hosts the run (`claude -p`, stream-json): a local client relaying a cloud session passes the cloud session's numbering through and its own locally built error results carry none; the in-process engine surface does not number yet. Absent from older producers.
+     */
+    result_index?: number;
     fast_mode_state?: FastModeState;
     fast_mode_disabled_reason?: FastModeDisabledReason;
     origin?: SDKMessageOrigin;
@@ -6472,6 +6540,14 @@ export declare interface Settings {
             [k: string]: unknown;
         };
     };
+    /**
+     * Managed plugins (plugin\@marketplace ids that managed enabledPlugins sets true) whose hooks run first, outermost, in the listed order: the first id listed sees every event before any other plugin and every result after it. Managed plugins not listed here or in appendPlugins follow the listed ones; user, project and marketplace plugins come after those; then appendPlugins; then the built-in plugins. The bundled sec-default\@builtin seats itself outermost (on a machine with managed settings and for Team and Enterprise organizations) unless this list is set, in which case list sec-default\@builtin where it should sit or leave it out. Any other id that is not an enabled managed plugin is skipped; an id listed in both keys is prepended. Only honored from managed settings (or, on a machine with none, from user settings for your own plugins); ignored in project, local and --settings sources.
+     */
+    prependPlugins?: string[];
+    /**
+     * Managed plugins (plugin\@marketplace ids that managed enabledPlugins sets true) whose hooks run last among plugins, innermost, in the listed order: the last id listed sits just above the built-in plugins and sees each event as every other plugin left it. Only honored from managed settings (or, on a machine with none, from user settings for your own plugins); ignored in project, local and --settings sources.
+     */
+    appendPlugins?: string[];
     /**
      * Additional marketplaces to make available for this repository. Typically used in repository .claude/settings.json to ensure team members have required plugin sources.
      */
@@ -7667,12 +7743,16 @@ export declare interface Settings {
      * Cloud gateway URL to pre-fill and auto-connect to during login, alongside forceLoginMethod: "gateway". Honored only from admin-controlled managed settings (MDM / managed-settings.json / policy helper); ignored in user, project, and remote-delivered settings.
      */
     forceLoginGatewayUrl?: string;
+    /**
+     * IPv4 CIDR blocks (at most 4, each /8 to /32, not overlapping) your Cloud gateway sits in: the public block your organization numbers its internal network from, which lets /login reach a gateway there. A block must lie entirely outside private space, where /login accepts a gateway without this key. /login accepts a gateway inside a listed block over a direct connection only, and only when this machine's own address on that connection is inside the same block, so /login must happen from a machine whose own address is inside the block (not through a proxy, VPN pool, container or NAT segment outside it). A bar against copied settings files, not proof of location. Honored only from admin-controlled managed settings (MDM / managed-settings.json / policy helper); ignored in user, project, and remote-delivered settings.
+     */
+    gatewayInternalNetworks?: string[];
     /**
      * Controls whether the SDK parent tier (Options.managedSettings / --managed-settings) layers under this admin tier. "first-wins" (default): parent is dropped — admin tiers are the only policy source. "merge": parent's restrictive-only-filtered settings union under the admin winner. Has no effect when no admin tier exists (parent applies as the sole policy tier, still filtered restrictive-only).
      */
     parentSettingsBehavior?: 'first-wins' | 'merge';
     /**
-     * Controls how the managed settings sources compose. "first-wins" (default): the highest-priority source present (server-managed > MDM (managed plist / HKLM) > managed-settings.json) is the managed tier alone. "merge": every present source deep-merges with fixed precedence server-managed > MDM > managed-settings.json — scalars take the highest source's value (a restrictive boolean or enum — the allowManaged*Only locks, the disable* switches, the sandbox lock family — takes the strictest value any source sets) and arrays union, except fallbackModel, the restriction allowlists allowedMcpServers, availableModels, strictKnownMarketplaces and allowedChannelPlugins, and sandbox.credentials.awsPairs and sandbox.ripgrep (the highest source that sets one owns it whole), modelOverrides (the whole map of the highest source that sets it, dropped when that source sits below the one that sets availableModels), managedMcpServers (server names union; a name set by two sources takes the higher source's whole entry), and the keys taken from the highest source only: the auth pins forceLoginOrgUUID, forceLoginMethod and forceLoginGatewayUrl, the credential helpers apiKeyHelper, awsAuthRefresh, awsCredentialExport, gcpAuthRefresh, otelHeadersHelper and proxyAuthHelper, modelPicker, permissions.defaultMode, parentSettingsBehavior and the policyHelper configuration (env keeps its own per-key union). Honored only from the highest-priority source present; enable it only when every lower source is admin-controlled, since lower sources then contribute entries such as permissions.allow. HKCU and --managed-settings never take part in the merge.
+     * Controls how the managed settings sources compose. "first-wins" (default): the highest-priority source present (server-managed > MDM (managed plist / HKLM) > managed-settings.json) is the managed tier alone. "merge": every present source deep-merges with fixed precedence server-managed > MDM > managed-settings.json — scalars take the highest source's value (a restrictive boolean or enum — the allowManaged*Only locks, the disable* switches, the sandbox lock family — takes the strictest value any source sets) and arrays union, except fallbackModel, the restriction allowlists allowedMcpServers, availableModels, strictKnownMarketplaces and allowedChannelPlugins, and sandbox.credentials.awsPairs and sandbox.ripgrep (the highest source that sets one owns it whole), modelOverrides (the whole map of the highest source that sets it, dropped when that source sits below the one that sets availableModels), managedMcpServers (server names union; a name set by two sources takes the higher source's whole entry), and the keys taken from the highest source only: the auth pins forceLoginOrgUUID, forceLoginMethod, forceLoginGatewayUrl and gatewayInternalNetworks, the credential helpers apiKeyHelper, awsAuthRefresh, awsCredentialExport, gcpAuthRefresh, otelHeadersHelper and proxyAuthHelper, modelPicker, permissions.defaultMode, parentSettingsBehavior and the policyHelper configuration (env keeps its own per-key union). Honored only from the highest-priority source present; enable it only when every lower source is admin-controlled, since lower sources then contribute entries such as permissions.allow. HKCU and --managed-settings never take part in the merge.
      */
     managedSourcesBehavior?: 'first-wins' | 'merge';
     /**
@@ -8000,6 +8080,10 @@ export declare interface Settings {
      * Persisted effort level for supported models.
      */
     effortLevel?: 'low' | 'medium' | 'high' | 'xhigh';
+    /**
+     * Maximum effort level. Anything above it (an /effort or /model pick, --effort, CLAUDE_CODE_EFFORT_LEVEL, a model default) is clamped to it, on every provider including Bedrock, Vertex and Foundry. Combines with an organization's per-model effort cap by taking the lower of the two; across settings files the lowest value wins, and modelSettings.<model>.maxEffortLevel replaces it per model. Enforced client-side: an effort supplied through CLAUDE_CODE_EXTRA_BODY is not clamped.
+     */
+    maxEffortLevel?: 'low' | 'medium' | 'high' | 'xhigh' | 'max';
     /**
      * Per-model settings keyed by canonical model name.
      */
@@ -8009,6 +8093,10 @@ export declare interface Settings {
              * Persisted effort level for this model.
              */
             effortLevel?: 'low' | 'medium' | 'high' | 'xhigh';
+            /**
+             * Maximum effort level for this model. Within one settings file it replaces the top-level maxEffortLevel for the model ("max" exempts it); across settings files the lowest applicable value wins. Keyed like effortLevel: the canonical model name also matches its dated, [1m], Bedrock and Vertex spellings.
+             */
+            maxEffortLevel?: 'low' | 'medium' | 'high' | 'xhigh' | 'max';
             [k: string]: unknown;
         };
     };
@@ -8688,6 +8776,7 @@ export declare type ToolConfig = {
          */
         previewFormat?: 'markdown' | 'html';
 
+
     };
 };
 
@@ -8722,6 +8811,14 @@ export declare interface Transport {
      * control_responses matching this id — only the worker may answer.
      */
     expectControlResponse?(requestId: string): void;
+    /**
+     * Called by Query immediately before it yields `message` to the SDK
+     * consumer. Transports that keep a consumer-facing delivery cursor
+     * (BrowserSSETransport's getLastSequenceNum()) advance it here, so the
+     * cursor covers exactly the messages the consumer was handed — not ones
+     * still buffered between the transport and the consumer.
+     */
+    markDelivered?(message: object): void;
     /**
      * End the input stream
      */