@anthropic-ai/sdk 0.106.0 → 0.108.0

package/src/resources/messages/messages.ts

@@ -44,7 +44,7 @@ export class Messages extends APIResource {
    * conversations.
    *
    * Learn more about the Messages API in our
-   * [user guide](https://docs.claude.com/en/docs/initial-setup)
+   * [user guide](https://platform.claude.com/docs/en/get-started)
    *
    * @example
    * ```ts
@@ -174,7 +174,7 @@ export class Messages extends APIResource {
    * including tools, images, and documents, without creating it.
    *
    * Learn more about token counting in our
-   * [user guide](https://docs.claude.com/en/docs/build-with-claude/token-counting)
+   * [user guide](https://platform.claude.com/docs/en/build-with-claude/token-counting)
    *
    * @example
    * ```ts
@@ -185,8 +185,16 @@ export class Messages extends APIResource {
    *   });
    * ```
    */
-  countTokens(body: MessageCountTokensParams, options?: RequestOptions): APIPromise<MessageTokensCount> {
-    return this._client.post('/v1/messages/count_tokens', { body, ...options });
+  countTokens(params: MessageCountTokensParams, options?: RequestOptions): APIPromise<MessageTokensCount> {
+    const { user_profile_id, ...body } = params;
+    return this._client.post('/v1/messages/count_tokens', {
+      body,
+      ...options,
+      headers: buildHeaders([
+        { ...(user_profile_id != null ? { 'anthropic-user-profile-id': user_profile_id } : undefined) },
+        options?.headers,
+      ]),
+    });
   }
 }
 
@@ -294,7 +302,7 @@ export interface CacheControlEphemeral {
    * - `1h`: 1 hour
    *
    * Defaults to `5m`. See
-   * [prompt caching pricing](https://docs.claude.com/en/docs/build-with-claude/prompt-caching)
+   * [prompt caching pricing](https://platform.claude.com/docs/en/build-with-claude/prompt-caching)
    * for details.
    */
   ttl?: '5m' | '1h';
@@ -1153,6 +1161,8 @@ export type MessageCountTokensTool =
   | WebSearchTool20260209
   | WebFetchTool20260209
   | WebFetchTool20260309
+  | WebSearchTool20260318
+  | WebFetchTool20260318
   | ToolSearchToolBm25_20251119
   | ToolSearchToolRegex20251119;
 
@@ -1246,6 +1256,7 @@ export interface MidConversationSystemBlockParam {
  * details and options.
  */
 export type Model =
+  | 'claude-sonnet-5'
   | 'claude-fable-5'
   | 'claude-mythos-5'
   | 'claude-opus-4-8'
@@ -1772,7 +1783,7 @@ export interface ThinkingConfigEnabled {
    * Must be ≥1024 and less than `max_tokens`.
    *
    * See
-   * [extended thinking](https://docs.claude.com/en/docs/build-with-claude/extended-thinking)
+   * [extended thinking](https://platform.claude.com/docs/en/build-with-claude/extended-thinking)
    * for details.
    */
   budget_tokens: number;
@@ -1796,7 +1807,7 @@ export interface ThinkingConfigEnabled {
  * tokens and counts towards your `max_tokens` limit.
  *
  * See
- * [extended thinking](https://docs.claude.com/en/docs/build-with-claude/extended-thinking)
+ * [extended thinking](https://platform.claude.com/docs/en/build-with-claude/extended-thinking)
  * for details.
  */
 export type ThinkingConfigParam = ThinkingConfigEnabled | ThinkingConfigDisabled | ThinkingConfigAdaptive;
@@ -2266,6 +2277,8 @@ export type ToolUnion =
   | WebSearchTool20260209
   | WebFetchTool20260209
   | WebFetchTool20260309
+  | WebSearchTool20260318
+  | WebFetchTool20260318
   | ToolSearchToolBm25_20251119
   | ToolSearchToolRegex20251119;
 
@@ -2610,6 +2623,81 @@ export interface WebFetchTool20260309 {
   use_cache?: boolean;
 }
 
+export interface WebFetchTool20260318 {
+  /**
+   * Name of the tool.
+   *
+   * This is how the tool will be called by the model and in `tool_use` blocks.
+   */
+  name: 'web_fetch';
+
+  type: 'web_fetch_20260318';
+
+  allowed_callers?: Array<
+    'direct' | 'code_execution_20250825' | 'code_execution_20260120' | 'code_execution_20260521'
+  >;
+
+  /**
+   * List of domains to allow fetching from
+   */
+  allowed_domains?: Array<string> | null;
+
+  /**
+   * List of domains to block fetching from
+   */
+  blocked_domains?: Array<string> | null;
+
+  /**
+   * Create a cache control breakpoint at this content block.
+   */
+  cache_control?: CacheControlEphemeral | null;
+
+  /**
+   * Citations configuration for fetched documents. Citations are disabled by
+   * default.
+   */
+  citations?: CitationsConfigParam | null;
+
+  /**
+   * If true, tool will not be included in initial system prompt. Only loaded when
+   * returned via tool_reference from tool search.
+   */
+  defer_loading?: boolean;
+
+  /**
+   * Maximum number of tokens used by including web page text content in the context.
+   * The limit is approximate and does not apply to binary content such as PDFs.
+   */
+  max_content_tokens?: number | null;
+
+  /**
+   * Maximum number of times the tool can be used in the API request.
+   */
+  max_uses?: number | null;
+
+  /**
+   * How this tool's result blocks appear in the API response when the result was
+   * consumed by a completed code_execution call in the same turn. 'full' returns the
+   * complete content (default). 'excluded' drops the nested server_tool_use and
+   * result block pair entirely. Results from direct calls, or from code_execution
+   * calls that paused before completing, are always returned in full so they can be
+   * sent back on the next turn.
+   */
+  response_inclusion?: 'full' | 'excluded';
+
+  /**
+   * When true, guarantees schema validation on tool names and inputs
+   */
+  strict?: boolean;
+
+  /**
+   * Whether to use cached content. Set to false to bypass the cache and fetch fresh
+   * content. Only set to false when the user explicitly requests fresh content or
+   * when fetching rapidly-changing sources.
+   */
+  use_cache?: boolean;
+}
+
 export interface WebFetchToolResultBlock {
   /**
    * Tool invocation directly from the model.
@@ -2814,6 +2902,70 @@ export namespace WebSearchTool20260209 {
   export type UserLocation = Messages.UserLocation;
 }
 
+export interface WebSearchTool20260318 {
+  /**
+   * Name of the tool.
+   *
+   * This is how the tool will be called by the model and in `tool_use` blocks.
+   */
+  name: 'web_search';
+
+  type: 'web_search_20260318';
+
+  allowed_callers?: Array<
+    'direct' | 'code_execution_20250825' | 'code_execution_20260120' | 'code_execution_20260521'
+  >;
+
+  /**
+   * If provided, only these domains will be included in results. Cannot be used
+   * alongside `blocked_domains`.
+   */
+  allowed_domains?: Array<string> | null;
+
+  /**
+   * If provided, these domains will never appear in results. Cannot be used
+   * alongside `allowed_domains`.
+   */
+  blocked_domains?: Array<string> | null;
+
+  /**
+   * Create a cache control breakpoint at this content block.
+   */
+  cache_control?: CacheControlEphemeral | null;
+
+  /**
+   * If true, tool will not be included in initial system prompt. Only loaded when
+   * returned via tool_reference from tool search.
+   */
+  defer_loading?: boolean;
+
+  /**
+   * Maximum number of times the tool can be used in the API request.
+   */
+  max_uses?: number | null;
+
+  /**
+   * How this tool's result blocks appear in the API response when the result was
+   * consumed by a completed code_execution call in the same turn. 'full' returns the
+   * complete content (default). 'excluded' drops the nested server_tool_use and
+   * result block pair entirely. Results from direct calls, or from code_execution
+   * calls that paused before completing, are always returned in full so they can be
+   * sent back on the next turn.
+   */
+  response_inclusion?: 'full' | 'excluded';
+
+  /**
+   * When true, guarantees schema validation on tool names and inputs
+   */
+  strict?: boolean;
+
+  /**
+   * Parameters for the user's location. Used to provide more relevant search
+   * results.
+   */
+  user_location?: UserLocation | null;
+}
+
 export interface WebSearchToolRequestError {
   error_code: WebSearchToolResultErrorCode;
 
@@ -2895,11 +3047,12 @@ export interface MessageCreateParamsBase {
    * only specifies the absolute maximum number of tokens to generate.
    *
    * Set to `0` to populate the
-   * [prompt cache](https://docs.claude.com/en/docs/build-with-claude/prompt-caching#pre-warming-the-cache)
+   * [prompt cache](https://platform.claude.com/docs/en/build-with-claude/prompt-caching#pre-warming-the-cache)
    * without generating a response.
    *
    * Different models have different maximum values for this parameter. See
-   * [models](https://docs.claude.com/en/docs/models-overview) for details.
+   * [models](https://platform.claude.com/docs/en/about-claude/models/overview) for
+   * details.
    */
   max_tokens: number;
 
@@ -2961,12 +3114,13 @@ export interface MessageCreateParamsBase {
    * { "role": "user", "content": [{ "type": "text", "text": "Hello, Claude" }] }
    * ```
    *
-   * See [input examples](https://docs.claude.com/en/api/messages-examples).
+   * See
+   * [input examples](https://platform.claude.com/docs/en/build-with-claude/working-with-messages).
    *
    * Note that if you want to include a
-   * [system prompt](https://docs.claude.com/en/docs/system-prompts), you can use the
-   * top-level `system` parameter — there is no `"system"` role for input messages in
-   * the Messages API.
+   * [system prompt](https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/claude-prompting-best-practices#give-claude-a-role),
+   * you can use the top-level `system` parameter — there is no `"system"` role for
+   * input messages in the Messages API.
    *
    * There is a limit of 100,000 messages in a single request.
    */
@@ -3013,7 +3167,8 @@ export interface MessageCreateParamsBase {
    * standard capacity for this request.
    *
    * Anthropic offers different levels of service for your API requests. See
-   * [service-tiers](https://docs.claude.com/en/api/service-tiers) for details.
+   * [service-tiers](https://platform.claude.com/docs/en/api/service-tiers) for
+   * details.
    */
   service_tier?: 'auto' | 'standard_only';
 
@@ -3034,7 +3189,8 @@ export interface MessageCreateParamsBase {
    * Body param: Whether to incrementally stream the response using server-sent
    * events.
    *
-   * See [streaming](https://docs.claude.com/en/api/messages-streaming) for details.
+   * See [streaming](https://platform.claude.com/docs/en/build-with-claude/streaming)
+   * for details.
    */
   stream?: boolean;
 
@@ -3043,7 +3199,7 @@ export interface MessageCreateParamsBase {
    *
    * A system prompt is a way of providing context and instructions to Claude, such
    * as specifying a particular goal or role. See our
-   * [guide to system prompts](https://docs.claude.com/en/docs/system-prompts).
+   * [guide to system prompts](https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/claude-prompting-best-practices#give-claude-a-role).
    */
   system?: string | Array<TextBlockParam>;
 
@@ -3062,7 +3218,7 @@ export interface MessageCreateParamsBase {
    * tokens and counts towards your `max_tokens` limit.
    *
    * See
-   * [extended thinking](https://docs.claude.com/en/docs/build-with-claude/extended-thinking)
+   * [extended thinking](https://platform.claude.com/docs/en/build-with-claude/extended-thinking)
    * for details.
    */
   thinking?: ThinkingConfigParam;
@@ -3083,9 +3239,9 @@ export interface MessageCreateParamsBase {
    *
    * There are two types of tools: **client tools** and **server tools**. The
    * behavior described below applies to client tools. For
-   * [server tools](https://docs.claude.com/en/docs/agents-and-tools/tool-use/overview#server-tools),
+   * [server tools](https://platform.claude.com/docs/en/agents-and-tools/tool-use/server-tools),
    * see their individual documentation as each has its own behavior (e.g., the
-   * [web search tool](https://docs.claude.com/en/docs/agents-and-tools/tool-use/web-search-tool)).
+   * [web search tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool)).
    *
    * Each tool definition includes:
    *
@@ -3148,7 +3304,9 @@ export interface MessageCreateParamsBase {
    * functions, or more generally whenever you want the model to produce a particular
    * JSON structure of output.
    *
-   * See our [guide](https://docs.claude.com/en/docs/tool-use) for more details.
+   * See our
+   * [guide](https://platform.claude.com/docs/en/agents-and-tools/tool-use/overview)
+   * for more details.
    */
   tools?: Array<ToolUnion>;
 
@@ -3183,7 +3341,8 @@ export interface MessageCreateParamsNonStreaming extends MessageCreateParamsBase
    * Body param: Whether to incrementally stream the response using server-sent
    * events.
    *
-   * See [streaming](https://docs.claude.com/en/api/messages-streaming) for details.
+   * See [streaming](https://platform.claude.com/docs/en/build-with-claude/streaming)
+   * for details.
    */
   stream?: false;
 }
@@ -3193,7 +3352,8 @@ export interface MessageCreateParamsStreaming extends MessageCreateParamsBase {
    * Body param: Whether to incrementally stream the response using server-sent
    * events.
    *
-   * See [streaming](https://docs.claude.com/en/api/messages-streaming) for details.
+   * See [streaming](https://platform.claude.com/docs/en/build-with-claude/streaming)
+   * for details.
    */
   stream: true;
 }
@@ -3202,7 +3362,7 @@ export type MessageStreamParams = ParseableMessageCreateParams;
 
 export interface MessageCountTokensParams {
   /**
-   * Input messages.
+   * Body param: Input messages.
    *
    * Our models are trained to operate on alternating `user` and `assistant`
    * conversational turns. When creating a new `Message`, you specify the prior
@@ -3259,19 +3419,20 @@ export interface MessageCountTokensParams {
    * { "role": "user", "content": [{ "type": "text", "text": "Hello, Claude" }] }
    * ```
    *
-   * See [input examples](https://docs.claude.com/en/api/messages-examples).
+   * See
+   * [input examples](https://platform.claude.com/docs/en/build-with-claude/working-with-messages).
    *
    * Note that if you want to include a
-   * [system prompt](https://docs.claude.com/en/docs/system-prompts), you can use the
-   * top-level `system` parameter — there is no `"system"` role for input messages in
-   * the Messages API.
+   * [system prompt](https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/claude-prompting-best-practices#give-claude-a-role),
+   * you can use the top-level `system` parameter — there is no `"system"` role for
+   * input messages in the Messages API.
    *
    * There is a limit of 100,000 messages in a single request.
    */
   messages: Array<MessageParam>;
 
   /**
-   * The model that will complete your prompt.
+   * Body param: The model that will complete your prompt.
    *
    * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
    * details and options.
@@ -3279,46 +3440,47 @@ export interface MessageCountTokensParams {
   model: Model;
 
   /**
-   * Top-level cache control automatically applies a cache_control marker to the last
-   * cacheable block in the request.
+   * Body param: Top-level cache control automatically applies a cache_control marker
+   * to the last cacheable block in the request.
    */
   cache_control?: CacheControlEphemeral | null;
 
   /**
-   * Configuration options for the model's output, such as the output format.
+   * Body param: Configuration options for the model's output, such as the output
+   * format.
    */
   output_config?: OutputConfig;
 
   /**
-   * System prompt.
+   * Body param: System prompt.
    *
    * A system prompt is a way of providing context and instructions to Claude, such
    * as specifying a particular goal or role. See our
-   * [guide to system prompts](https://docs.claude.com/en/docs/system-prompts).
+   * [guide to system prompts](https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/claude-prompting-best-practices#give-claude-a-role).
    */
   system?: string | Array<TextBlockParam>;
 
   /**
-   * Configuration for enabling Claude's extended thinking.
+   * Body param: Configuration for enabling Claude's extended thinking.
    *
    * When enabled, responses include `thinking` content blocks showing Claude's
    * thinking process before the final answer. Requires a minimum budget of 1,024
    * tokens and counts towards your `max_tokens` limit.
    *
    * See
-   * [extended thinking](https://docs.claude.com/en/docs/build-with-claude/extended-thinking)
+   * [extended thinking](https://platform.claude.com/docs/en/build-with-claude/extended-thinking)
    * for details.
    */
   thinking?: ThinkingConfigParam;
 
   /**
-   * How the model should use the provided tools. The model can use a specific tool,
-   * any available tool, decide by itself, or not use tools at all.
+   * Body param: How the model should use the provided tools. The model can use a
+   * specific tool, any available tool, decide by itself, or not use tools at all.
    */
   tool_choice?: ToolChoice;
 
   /**
-   * Definitions of tools that the model may use.
+   * Body param: Definitions of tools that the model may use.
    *
    * If you include `tools` in your API request, the model may return `tool_use`
    * content blocks that represent the model's use of those tools. You can then run
@@ -3327,9 +3489,9 @@ export interface MessageCountTokensParams {
    *
    * There are two types of tools: **client tools** and **server tools**. The
    * behavior described below applies to client tools. For
-   * [server tools](https://docs.claude.com/en/docs/agents-and-tools/tool-use/overview#server-tools),
+   * [server tools](https://platform.claude.com/docs/en/agents-and-tools/tool-use/server-tools),
    * see their individual documentation as each has its own behavior (e.g., the
-   * [web search tool](https://docs.claude.com/en/docs/agents-and-tools/tool-use/web-search-tool)).
+   * [web search tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool)).
    *
    * Each tool definition includes:
    *
@@ -3392,9 +3554,18 @@ export interface MessageCountTokensParams {
    * functions, or more generally whenever you want the model to produce a particular
    * JSON structure of output.
    *
-   * See our [guide](https://docs.claude.com/en/docs/tool-use) for more details.
+   * See our
+   * [guide](https://platform.claude.com/docs/en/agents-and-tools/tool-use/overview)
+   * for more details.
    */
   tools?: Array<MessageCountTokensTool>;
+
+  /**
+   * Header param: The user profile ID to attribute this request to. Use when acting
+   * on behalf of a party other than your organization. Requires the `user-profiles`
+   * beta header.
+   */
+  user_profile_id?: string;
 }
 
 Messages.Batches = Batches;
@@ -3548,6 +3719,7 @@ export declare namespace Messages {
     type WebFetchTool20250910 as WebFetchTool20250910,
     type WebFetchTool20260209 as WebFetchTool20260209,
     type WebFetchTool20260309 as WebFetchTool20260309,
+    type WebFetchTool20260318 as WebFetchTool20260318,
     type WebFetchToolResultBlock as WebFetchToolResultBlock,
     type WebFetchToolResultBlockParam as WebFetchToolResultBlockParam,
     type WebFetchToolResultErrorBlock as WebFetchToolResultErrorBlock,
@@ -3557,6 +3729,7 @@ export declare namespace Messages {
     type WebSearchResultBlockParam as WebSearchResultBlockParam,
     type WebSearchTool20250305 as WebSearchTool20250305,
     type WebSearchTool20260209 as WebSearchTool20260209,
+    type WebSearchTool20260318 as WebSearchTool20260318,
     type WebSearchToolRequestError as WebSearchToolRequestError,
     type WebSearchToolResultBlock as WebSearchToolResultBlock,
     type WebSearchToolResultBlockContent as WebSearchToolResultBlockContent,

package/src/tools/agent-toolset/fs-util.ts

@@ -34,6 +34,7 @@ async function realpathOrSelf(p: string): Promise<string> {
 export async function canonicalize(abs: string): Promise<string> {
   const tail: string[] = [];
   let prefix = abs;
+  let hops = 0;
   for (;;) {
     let real: string;
     try {
@@ -47,7 +48,12 @@ export async function canonicalize(abs: string): Promise<string> {
       }
       if (isLink) {
         // Resolve the symlink ourselves and retry; `tail` (the part below it)
-        // still applies to the link's target.
+        // still applies to the link's target. The hop cap matches Linux
+        // MAXSYMLINKS — the same threshold at which `realpath` itself would
+        // have returned ELOOP — so a cycle of unresolvable links terminates.
+        if (++hops > 40) {
+          throw new ToolError(`path ${JSON.stringify(abs)} has too many levels of symbolic links`);
+        }
         prefix = path.resolve(path.dirname(prefix), await fs.readlink(prefix));
         continue;
       }
@@ -64,9 +70,10 @@ export async function canonicalize(abs: string): Promise<string> {
 /**
  * Resolve `p` and confine it to `root`.
  *
- * Unless `allowOutside` is set, absolute inputs are rejected and the
- * **canonical** path is returned — every symlink in `p` (including the leaf,
- * even a dangling one) is resolved before the confinement check, and the
+ * Absolute and relative inputs go through the same canonicalise-then-contain
+ * check — an absolute path that lands inside `root` is permitted, only paths
+ * that resolve *outside* are rejected. Every symlink in `p` (including the
+ * leaf, even a dangling one) is resolved before the confinement check, and the
  * resolved path is what the caller then operates on, so a symlink inside `root`
  * that points outside it can neither pass the check nor be followed afterwards.
  *
@@ -81,18 +88,11 @@ export async function confineToRoot(
   opts?: { allowOutside?: boolean },
 ): Promise<string> {
   const allowOutside = opts?.allowOutside ?? false;
-  if (path.isAbsolute(p)) {
-    if (!allowOutside) {
-      throw new ToolError(`absolute path ${JSON.stringify(p)} not permitted`);
-    }
-    return path.resolve(p);
-  }
   const realRoot = await realpathOrSelf(path.resolve(root));
   const abs = path.resolve(realRoot, p);
   if (allowOutside) return abs;
   const real = await canonicalize(abs);
-  const rootSep = realRoot.endsWith(path.sep) ? realRoot : realRoot + path.sep;
-  if (real !== realRoot && !real.startsWith(rootSep)) {
+  if (real !== realRoot && !real.startsWith(realRoot + path.sep)) {
     throw new ToolError(`path ${JSON.stringify(p)} escapes workdir`);
   }
   return real;

package/src/tools/agent-toolset/node.ts

@@ -95,9 +95,8 @@ export interface AgentToolContext {
   /** Base directory for resolving relative tool paths. */
   workdir: string;
   /**
-   * When `false` (default), the file tools reject absolute paths and paths
-   * that escape `workdir` (symlinks resolved). Does **not** constrain
-   * {@link betaBashTool}.
+   * When `false` (default), the file tools reject paths that resolve outside
+   * `workdir` (symlinks resolved). Does **not** constrain {@link betaBashTool}.
    */
   unrestrictedPaths?: boolean;
   /**
@@ -161,12 +160,14 @@ export function betaAgentToolset20260401(ctx: AgentToolContext): BetaRunnableToo
 }
 
 /**
- * Resolve `p` relative to `ctx.workdir`. Unless `unrestrictedPaths` is set,
- * absolute inputs are rejected and the **canonical** path is returned — every
- * symlink in `p` (including the leaf, even a dangling one) is resolved before
- * the workdir check, and the resolved path is what the tool then operates on, so
- * a symlink inside the workdir that points outside it can neither pass the check
- * nor be followed afterwards. See the trust model on {@link AgentToolContext}.
+ * Resolve `p` against `ctx.workdir`. Absolute and relative inputs go through
+ * the same canonicalise-then-contain check — an absolute path that lands inside
+ * the workdir is permitted, only paths that resolve *outside* are rejected.
+ * Every symlink in `p` (including the leaf, even a dangling one) is resolved
+ * before the workdir check, and the resolved path is what the tool then operates
+ * on, so a symlink inside the workdir that points outside it can neither pass
+ * the check nor be followed afterwards. See the trust model on
+ * {@link AgentToolContext}.
  *
  * Residual TOCTOU: a component could still be swapped for a symlink between this
  * call and the eventual `fs` operation. Closing that fully needs per-component
@@ -589,6 +590,9 @@ export function betaGlobTool(ctx: AgentToolContext): BetaRunnableTool {
       if (!ctx.unrestrictedPaths && pat.split(/[\\/]/).includes('..')) {
         throw new ToolError('glob: ".." is not permitted in the pattern');
       }
+      // Compare canonical against canonical: a workdir that is itself a
+      // symlink would otherwise falsely reject every realpath'd match below.
+      const realRoot = ctx.unrestrictedPaths ? root : await fs.realpath(root).catch(() => root);
       const matches: { path: string; mtime: number }[] = [];
       try {
         // Native `fs.glob` (Node 22+). `exclude` prunes the noisy dirs the
@@ -600,9 +604,22 @@ export function betaGlobTool(ctx: AgentToolContext): BetaRunnableTool {
         })) {
           if (!entry.isFile()) continue;
           const full = path.join(entry.parentPath, entry.name);
-          // Defense in depth: drop any match that resolved outside the search
-          // root (e.g. via a symlinked directory in the tree) when confined.
-          if (!ctx.unrestrictedPaths && !isWithin(root, full)) continue;
+          // Drop any match that resolves outside the search root. A pattern
+          // that *names* a symlinked directory (the model controls the
+          // pattern, and the bash tool in the same session can plant the
+          // link) makes `fs.glob` descend through it and report entries with
+          // the raw parent path, so a lexical check on `full` alone would
+          // pass `root/link_out/secret` even though it lives outside the
+          // jail. Resolve-failure (ELOOP, EACCES, a racing unlink) is a deny.
+          if (!ctx.unrestrictedPaths) {
+            let real: string;
+            try {
+              real = await fs.realpath(full);
+            } catch {
+              continue;
+            }
+            if (!isWithin(realRoot, real)) continue;
+          }
           let mtime = 0;
           try {
             mtime = (await fs.stat(full)).mtimeMs;

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.106.0'; // x-release-please-version
+export const VERSION = '0.108.0'; // x-release-please-version

package/tools/agent-toolset/fs-util.d.mts

@@ -19,9 +19,10 @@ export declare function canonicalize(abs: string): Promise<string>;
 /**
  * Resolve `p` and confine it to `root`.
  *
- * Unless `allowOutside` is set, absolute inputs are rejected and the
- * **canonical** path is returned — every symlink in `p` (including the leaf,
- * even a dangling one) is resolved before the confinement check, and the
+ * Absolute and relative inputs go through the same canonicalise-then-contain
+ * check — an absolute path that lands inside `root` is permitted, only paths
+ * that resolve *outside* are rejected. Every symlink in `p` (including the
+ * leaf, even a dangling one) is resolved before the confinement check, and the
  * resolved path is what the caller then operates on, so a symlink inside `root`
  * that points outside it can neither pass the check nor be followed afterwards.
  *

package/tools/agent-toolset/fs-util.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"fs-util.d.mts","sourceRoot":"","sources":["../../src/tools/agent-toolset/fs-util.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,uFAAuF;AACvF,eAAO,MAAM,eAAe,MAAQ,CAAC;AACrC,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,MAAQ,CAAC;AAWtC;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA4B/D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAChC,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBxF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAwBjE"}
+{"version":3,"file":"fs-util.d.mts","sourceRoot":"","sources":["../../src/tools/agent-toolset/fs-util.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,uFAAuF;AACvF,eAAO,MAAM,eAAe,MAAQ,CAAC;AACrC,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,MAAQ,CAAC;AAWtC;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkC/D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAChC,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBxF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAwBjE"}

package/tools/agent-toolset/fs-util.d.ts

@@ -19,9 +19,10 @@ export declare function canonicalize(abs: string): Promise<string>;
 /**
  * Resolve `p` and confine it to `root`.
  *
- * Unless `allowOutside` is set, absolute inputs are rejected and the
- * **canonical** path is returned — every symlink in `p` (including the leaf,
- * even a dangling one) is resolved before the confinement check, and the
+ * Absolute and relative inputs go through the same canonicalise-then-contain
+ * check — an absolute path that lands inside `root` is permitted, only paths
+ * that resolve *outside* are rejected. Every symlink in `p` (including the
+ * leaf, even a dangling one) is resolved before the confinement check, and the
  * resolved path is what the caller then operates on, so a symlink inside `root`
  * that points outside it can neither pass the check nor be followed afterwards.
  *

package/tools/agent-toolset/fs-util.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs-util.d.ts","sourceRoot":"","sources":["../../src/tools/agent-toolset/fs-util.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,uFAAuF;AACvF,eAAO,MAAM,eAAe,MAAQ,CAAC;AACrC,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,MAAQ,CAAC;AAWtC;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA4B/D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAChC,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBxF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAwBjE"}
+{"version":3,"file":"fs-util.d.ts","sourceRoot":"","sources":["../../src/tools/agent-toolset/fs-util.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,uFAAuF;AACvF,eAAO,MAAM,eAAe,MAAQ,CAAC;AACrC,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,MAAQ,CAAC;AAWtC;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkC/D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAChC,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBxF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAwBjE"}