@code-yeongyu/senpi 2026.9.3 → 2026.9.4

package/node_modules/@anthropic-ai/claude-agent-sdk/sdk.d.ts

@@ -11,7 +11,7 @@ import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';
 import type { UUID } from 'crypto';
 import type { Writable } from 'stream';
 import * as z from 'zod/v4';
-import type { ZodRawShape } from 'zod';
+import type { ZodRawShape } from 'zod/v3';
 import type { ZodRawShape as ZodRawShape_2 } from 'zod/v4';
 
 export declare class AbortError extends Error {
@@ -53,7 +53,7 @@ export declare type AgentDefinition = {
      */
     prompt: string;
     /**
-     * Model alias (e.g. 'fable', 'opus', 'sonnet', 'haiku') or full model ID (e.g. 'claude-fable-5'). If omitted or 'inherit', uses the main model
+     * Model alias (e.g. 'fable', 'opus', 'sonnet', 'haiku') or full model ID (e.g. 'claude-fable-5'). 'inherit' uses the main model; if omitted, uses the default subagent model when one is configured, else the main model
      */
     model?: string;
     mcpServers?: AgentMcpServerSpec[];
@@ -112,7 +112,7 @@ export declare type AgentInfo = {
      */
     description: string;
     /**
-     * Model alias this agent uses. If omitted, inherits the parent's model
+     * Model this agent uses: an alias or model ID, or 'inherit' for the parent's model. If omitted, uses the default subagent model when one is configured, else the parent's model
      */
     model?: string;
 };
@@ -395,6 +395,8 @@ declare namespace coreTypes {
         PermissionUpdateDestination,
         PermissionUpdate,
         PostCompactHookInput,
+        PostModelSwitchHookInput,
+        PostModelSwitchHookSpecificOutput,
         PostToolBatchHookInput,
         PostToolBatchHookSpecificOutput,
         PostToolBatchToolCall,
@@ -403,6 +405,8 @@ declare namespace coreTypes {
         PostToolUseHookInput,
         PostToolUseHookSpecificOutput,
         PreCompactHookInput,
+        PreModelSwitchHookInput,
+        PreModelSwitchHookSpecificOutput,
         PreToolUseHookInput,
         PreToolUseHookSpecificOutput,
         RewindFilesResult,
@@ -426,6 +430,7 @@ declare namespace coreTypes {
         SDKHookStartedMessage,
         SDKInformationalMessage,
         SDKLocalCommandOutputMessage,
+        SDKMcpResourceLink,
         SDKMemoryRecallMessage,
         SDKMessageOrigin,
         SDKMessage,
@@ -499,8 +504,9 @@ declare namespace coreTypes {
  * Creates an MCP server instance that can be used with the SDK transport.
  * This allows SDK users to define custom tools that run in the same process.
  *
- * Tool calls are bounded by the MCP tool-call timeout — the MCP_TOOL_TIMEOUT
- * env var (ms), effectively unbounded by default.
+ * Tool calls are bounded by the MCP tool-call timeout — `options.timeout`
+ * (ms) for this server, else the MCP_TOOL_TIMEOUT env var, effectively
+ * unbounded by default.
  */
 export declare function createSdkMcpServer(_options: CreateSdkMcpServerOptions): McpSdkServerConfigWithInstance;
 
@@ -523,6 +529,15 @@ declare type CreateSdkMcpServerOptions = {
      * works and is OR'd with this.
      */
     alwaysLoad?: boolean;
+    /**
+     * Per-server tool-call timeout in milliseconds. Overrides the
+     * MCP_TOOL_TIMEOUT environment variable for this server. Hard wall-clock
+     * limit per call; progress notifications do not extend it. Values below
+     * 1000ms are ignored (falls through to MCP_TOOL_TIMEOUT or the default).
+     * Applies when the server is first registered; changing it for an
+     * already-registered server has no effect until it is removed and re-added.
+     */
+    timeout?: number;
 };
 
 export declare type CwdChangedHookInput = BaseHookInput & {
@@ -836,7 +851,7 @@ export declare type GetSubagentMessagesOptions = {
     sessionStore?: SessionStore;
 };
 
-export declare const HOOK_EVENTS: readonly ['PreToolUse', 'PostToolUse', 'PostToolUseFailure', 'PostToolBatch', 'Notification', 'UserPromptSubmit', 'UserPromptExpansion', 'SessionStart', 'SessionEnd', 'Stop', 'StopFailure', 'SubagentStart', 'SubagentStop', 'PreCompact', 'PostCompact', 'PermissionRequest', 'PermissionDenied', 'Setup', 'TeammateIdle', 'TaskCreated', 'TaskCompleted', 'Elicitation', 'ElicitationResult', 'ConfigChange', 'WorktreeCreate', 'WorktreeRemove', 'InstructionsLoaded', 'CwdChanged', 'FileChanged', 'DirectoryAdded', 'MessageDisplay'];
+export declare const HOOK_EVENTS: readonly ['PreToolUse', 'PostToolUse', 'PostToolUseFailure', 'PostToolBatch', 'Notification', 'UserPromptSubmit', 'UserPromptExpansion', 'SessionStart', 'SessionEnd', 'Stop', 'StopFailure', 'SubagentStart', 'SubagentStop', 'PreCompact', 'PostCompact', 'PreModelSwitch', 'PostModelSwitch', 'PermissionRequest', 'PermissionDenied', 'Setup', 'TeammateIdle', 'TaskCreated', 'TaskCompleted', 'Elicitation', 'ElicitationResult', 'ConfigChange', 'WorktreeCreate', 'WorktreeRemove', 'InstructionsLoaded', 'CwdChanged', 'FileChanged', 'DirectoryAdded', 'MessageDisplay'];
 
 /**
  * Hook callback function for responding to events during execution.
@@ -855,9 +870,9 @@ export declare interface HookCallbackMatcher {
     timeout?: number;
 }
 
-export declare type HookEvent = 'PreToolUse' | 'PostToolUse' | 'PostToolUseFailure' | 'PostToolBatch' | 'Notification' | 'UserPromptSubmit' | 'UserPromptExpansion' | 'SessionStart' | 'SessionEnd' | 'Stop' | 'StopFailure' | 'SubagentStart' | 'SubagentStop' | 'PreCompact' | 'PostCompact' | 'PermissionRequest' | 'PermissionDenied' | 'Setup' | 'TeammateIdle' | 'TaskCreated' | 'TaskCompleted' | 'Elicitation' | 'ElicitationResult' | 'ConfigChange' | 'WorktreeCreate' | 'WorktreeRemove' | 'InstructionsLoaded' | 'CwdChanged' | 'FileChanged' | 'DirectoryAdded' | 'MessageDisplay';
+export declare type HookEvent = 'PreToolUse' | 'PostToolUse' | 'PostToolUseFailure' | 'PostToolBatch' | 'Notification' | 'UserPromptSubmit' | 'UserPromptExpansion' | 'SessionStart' | 'SessionEnd' | 'Stop' | 'StopFailure' | 'SubagentStart' | 'SubagentStop' | 'PreCompact' | 'PostCompact' | 'PreModelSwitch' | 'PostModelSwitch' | 'PermissionRequest' | 'PermissionDenied' | 'Setup' | 'TeammateIdle' | 'TaskCreated' | 'TaskCompleted' | 'Elicitation' | 'ElicitationResult' | 'ConfigChange' | 'WorktreeCreate' | 'WorktreeRemove' | 'InstructionsLoaded' | 'CwdChanged' | 'FileChanged' | 'DirectoryAdded' | 'MessageDisplay';
 
-export declare type HookInput = PreToolUseHookInput | PostToolUseHookInput | PostToolUseFailureHookInput | PostToolBatchHookInput | PermissionDeniedHookInput | NotificationHookInput | UserPromptSubmitHookInput | UserPromptExpansionHookInput | SessionStartHookInput | SessionEndHookInput | StopHookInput | StopFailureHookInput | SubagentStartHookInput | SubagentStopHookInput | PreCompactHookInput | PostCompactHookInput | PermissionRequestHookInput | SetupHookInput | TeammateIdleHookInput | TaskCreatedHookInput | TaskCompletedHookInput | ElicitationHookInput | ElicitationResultHookInput | ConfigChangeHookInput | InstructionsLoadedHookInput | WorktreeCreateHookInput | WorktreeRemoveHookInput | CwdChangedHookInput | FileChangedHookInput | DirectoryAddedHookInput | MessageDisplayHookInput;
+export declare type HookInput = PreToolUseHookInput | PostToolUseHookInput | PostToolUseFailureHookInput | PostToolBatchHookInput | PermissionDeniedHookInput | NotificationHookInput | UserPromptSubmitHookInput | UserPromptExpansionHookInput | SessionStartHookInput | SessionEndHookInput | StopHookInput | StopFailureHookInput | SubagentStartHookInput | SubagentStopHookInput | PreCompactHookInput | PostCompactHookInput | PreModelSwitchHookInput | PostModelSwitchHookInput | PermissionRequestHookInput | SetupHookInput | TeammateIdleHookInput | TaskCreatedHookInput | TaskCompletedHookInput | ElicitationHookInput | ElicitationResultHookInput | ConfigChangeHookInput | InstructionsLoadedHookInput | WorktreeCreateHookInput | WorktreeRemoveHookInput | CwdChangedHookInput | FileChangedHookInput | DirectoryAddedHookInput | MessageDisplayHookInput;
 
 export declare type HookJSONOutput = AsyncHookJSONOutput | SyncHookJSONOutput;
 
@@ -1075,6 +1090,10 @@ export declare type McpHttpServerConfig = {
 export declare type McpSdkServerConfig = {
     type: 'sdk';
     name: string;
+    /**
+     * Per-server tool-call timeout in milliseconds. Overrides the MCP_TOOL_TIMEOUT environment variable for this server. Hard wall-clock limit per call; progress notifications do not extend it. Values below 1000ms are ignored (falls through to MCP_TOOL_TIMEOUT or the default). Applies when the server is first registered; changing it for an already-registered server has no effect until it is removed and re-added.
+     */
+    timeout?: number;
 };
 
 /**
@@ -1288,6 +1307,10 @@ export declare type ModelInfo = {
 export declare type ModelUsage = {
     inputTokens: number;
     outputTokens: number;
+    /**
+     * Thinking tokens, already counted inside outputTokens. Counts only turns run on CLI versions that record this field: absent when none did, and partial for a resumed session that began on an older version.
+     */
+    thinkingTokens?: number;
     cacheReadInputTokens: number;
     cacheCreationInputTokens: number;
     webSearchRequests: number;
@@ -1302,6 +1325,10 @@ export declare type ModelUsage = {
      * API provider that served this model (e.g. 'firstParty', 'bedrock', 'vertex', 'foundry', 'anthropicAws', 'mantle', 'gateway').
      */
     provider?: string;
+    /**
+     * Which price table the most recent request for this model was priced at: Claude Code's built-in list prices ('list'), the organization's managed-settings modelPricing rates or multiplier ('managed'), or neither ('unknown' — no pricing row and no built-in price matched the model ID, so costUSD is a guess at the default model's rate). Overwritten per request like canonicalModel, so a consumer that differences the cumulative costUSD per turn gets that turn's basis. Absent until this process has priced a request for the model (e.g. right after --resume) and on builds that predate the field; treat as 'list'.
+     */
+    costBasis?: 'list' | 'managed' | 'unknown';
 };
 
 export declare type NonNullableUsage = {
@@ -1623,6 +1650,26 @@ export declare type Options = {
      * explicit declaration overrides).
      */
     supportedDialogKinds?: string[];
+    /**
+     * Declares that this consumer renders a per-task stop control wired to
+     * the `stop_task` control request, so the user can stop an individual
+     * background task.
+     *
+     * When declared, an interrupt on an open-input (interactive
+     * stream-json) session spares running background agents/workflows —
+     * Stop only aborts the current turn, and tasks are stopped one at a
+     * time through the consumer's own affordance. Closed-input exception:
+     * on a one-shot run (the string `prompt` form and `-p`, which close
+     * stdin), hold-back tasks are still killed when the held result is
+     * released, regardless of this declaration — with stdin closed, a
+     * `stop_task` control could never be delivered, so the fail-closed
+     * kill stands. The CLI also fails closed on absence: without the
+     * declaration, an interrupt kills background tasks, because a spared
+     * runaway task would otherwise be unstoppable from this consumer short
+     * of ending the session. First-attached-client
+     * wins on multi-client sessions; later initializes do not change it.
+     */
+    perTaskStopAffordance?: boolean;
     /**
      * When false, disables session persistence to disk. Sessions will not be
      * saved to ~/.claude/projects/ and cannot be resumed later. Useful for
@@ -1801,6 +1848,15 @@ export declare type Options = {
      * will be routed through this MCP tool instead of the default handler.
      */
     permissionPromptToolName?: string;
+    /**
+     * Who answers permission prompts. `'host'` (default): this process, through
+     * `canUseTool` or `permissionPromptToolName`. `'none'`: nobody — the
+     * permission mode (including auto mode's classifier), rules and hooks still
+     * decide, and anything that would otherwise prompt is denied immediately
+     * with a message telling Claude the session has no approval surface;
+     * `canUseTool` is never called.
+     */
+    permissionPrompts?: 'host' | 'none';
     /**
      * Load plugins for this session. Plugins provide custom commands, agents,
      * skills, and hooks that extend Claude Code's capabilities.
@@ -2092,7 +2148,7 @@ export declare type Options = {
      *
      * @example Custom prompt with cache boundary
      * ```typescript
-     * import { SYSTEM_PROMPT_DYNAMIC_BOUNDARY } from '@anthropic-ai/claude-code'
+     * import { SYSTEM_PROMPT_DYNAMIC_BOUNDARY } from '@anthropic-ai/claude-agent-sdk'
      * systemPrompt: [
      *   staticInstructions,
      *   SYSTEM_PROMPT_DYNAMIC_BOUNDARY,
@@ -2117,12 +2173,62 @@ export declare type Options = {
      *   excludeDynamicSections: true,
      * }
      * ```
+     *
+     * `snapshot` — whether the conversation's system prompt is recorded once (in
+     * the session transcript) and reused verbatim on every later request and
+     * `resume` / `continue`, instead of being rendered fresh each time.
+     * **Recommended: `snapshot: true`.** A system prompt that changes
+     * mid-conversation (a CLI upgrade between launches, a flag flip, a different
+     * `append`) invalidates the prompt prefix and, with extended thinking,
+     * discards the model's earlier reasoning; a recorded prompt cannot change
+     * until the conversation is compacted. (It also keeps the API prompt-cache
+     * prefix stable.)
+     *
+     * How it interacts with `append` (and a custom `prompt`):
+     * - **Omitted (default):** passing an `append` or a custom prompt turns the
+     *   recording off, so your appended text is applied fresh on every launch —
+     *   today's behavior. Only the bare `claude_code` preset is recorded by
+     *   default.
+     * - **`snapshot: true`:** if the conversation already has a recorded prompt,
+     *   that record is sent as-is (a different `append` or `prompt` passed on a
+     *   later launch of the same session is ignored until compaction or a new
+     *   session); otherwise Claude Code renders its prompt with your `append`
+     *   included, sends that, and records it for the rest of the conversation.
+     * - **`snapshot: false`:** never record; render fresh every request.
+     * A bare string / `string[]` prompt is always `false`; use
+     * `{ type: 'custom', prompt, snapshot: true }` to opt a custom prompt in.
+     * With a recorded prompt, a mid-session model switch or `set_settings`
+     * agent/system-prompt change does not change the prompt either; it takes
+     * effect at the next compaction or in a new session. System-prompt
+     * recording is rolling out: where it is not yet enabled for the account
+     * (and on Bedrock / Vertex / Foundry today) `snapshot` is accepted and has no
+     * effect, so it is safe to set now.
+     *
+     * @example Recommended: preset with an append, recorded for the conversation
+     * ```typescript
+     * systemPrompt: {
+     *   type: 'preset',
+     *   preset: 'claude_code',
+     *   append: 'Always explain your reasoning.',
+     *   snapshot: true,
+     * }
+     * ```
+     *
+     * @example Custom prompt, recorded for the conversation
+     * ```typescript
+     * systemPrompt: { type: 'custom', prompt: 'You are a release bot.', snapshot: true }
+     * ```
      */
     systemPrompt?: string | string[] | {
+        type: 'custom';
+        prompt: string | string[];
+        snapshot?: boolean;
+    } | {
         type: 'preset';
         preset: 'claude_code';
         append?: string;
         excludeDynamicSections?: boolean;
+        snapshot?: boolean;
     };
     /**
      * Custom title for a new session. When provided, the session uses this title
@@ -2280,6 +2386,52 @@ export declare type PostCompactHookInput = BaseHookInput & {
     compact_summary: string;
 };
 
+export declare type PostModelSwitchHookInput = (BaseHookInput & {
+    hook_event_name: 'PostModelSwitch';
+}) & {
+    /**
+     * Resolved model id the session was running before the switch
+     */
+    from_model: string;
+    /**
+     * Resolved model id the session runs after the switch
+     */
+    to_model: string;
+    /**
+     * What was asked for (alias such as "opus", a full id, or null for "default")
+     */
+    requested_model: string | null;
+    /**
+     * command: /model <name>, the /config Model row, or enabling fast mode when that promotes the model; picker: an interactive model picker; sdk: headless set_model (SDK, Remote Control, IDE); auto: automatic fallback or other programmatic change; resume: model restored while resuming a session
+     */
+    source: 'command' | 'picker' | 'sdk' | 'auto' | 'resume';
+    /**
+     * Prompt tokens the next request re-sends: the last main-thread response's input + cache_read + cache_creation + output tokens (0 before the first response; for a server-side tool loop, its last iteration's window, not the summed totals)
+     */
+    context_tokens: number;
+    /**
+     * Whether the current model's prompt cache is likely still warm (a switch then forfeits it)
+     */
+    prompt_cache_warm: boolean;
+    cache_ttl: '5m' | '1h';
+    /**
+     * Estimated cost of re-caching context_tokens on to_model at its cache-write rate — the managed modelPricing when set, otherwise list price; excludes the response
+     */
+    estimated_cache_write_usd: number;
+    /**
+     * configured: priced at the managed modelPricing setting; catalog: list price; default: to_model unknown, the default tier was assumed
+     */
+    pricing: 'configured' | 'catalog' | 'default';
+};
+
+export declare type PostModelSwitchHookSpecificOutput = {
+    hookEventName: 'PostModelSwitch';
+    /**
+     * Reaches the model with the next request the new model serves
+     */
+    additionalContext?: string;
+};
+
 /**
  * Hook input for the PostToolBatch event. Fired once after every tool call in a batch has resolved, before the next model request. PostToolUse fires per-tool and may run concurrently for parallel tool calls; PostToolBatch fires exactly once with the full batch.
  */
@@ -2353,6 +2505,53 @@ export declare type PreCompactHookInput = BaseHookInput & {
     custom_instructions: string | null;
 };
 
+export declare type PreModelSwitchHookInput = (BaseHookInput & {
+    hook_event_name: 'PreModelSwitch';
+}) & {
+    /**
+     * Resolved model id the session was running before the switch
+     */
+    from_model: string;
+    /**
+     * Resolved model id the session runs after the switch
+     */
+    to_model: string;
+    /**
+     * What was asked for (alias such as "opus", a full id, or null for "default")
+     */
+    requested_model: string | null;
+    /**
+     * command: /model <name>, the /config Model row, or enabling fast mode when that promotes the model; picker: an interactive model picker; sdk: headless set_model (SDK, Remote Control, IDE)
+     */
+    source: 'command' | 'picker' | 'sdk';
+    /**
+     * Prompt tokens the next request re-sends: the last main-thread response's input + cache_read + cache_creation + output tokens (0 before the first response; for a server-side tool loop, its last iteration's window, not the summed totals)
+     */
+    context_tokens: number;
+    /**
+     * Whether the current model's prompt cache is likely still warm (a switch then forfeits it)
+     */
+    prompt_cache_warm: boolean;
+    cache_ttl: '5m' | '1h';
+    /**
+     * Estimated cost of re-caching context_tokens on to_model at its cache-write rate — the managed modelPricing when set, otherwise list price; excludes the response
+     */
+    estimated_cache_write_usd: number;
+    /**
+     * configured: priced at the managed modelPricing setting; catalog: list price; default: to_model unknown, the default tier was assumed
+     */
+    pricing: 'configured' | 'catalog' | 'default';
+};
+
+export declare type PreModelSwitchHookSpecificOutput = {
+    hookEventName: 'PreModelSwitch';
+    /**
+     * Same contract as PreToolUse: allow proceeds (skipping the interactive cache-miss confirm), deny cancels the switch, ask asks the user to confirm (a headless session refuses instead)
+     */
+    permissionDecision?: 'allow' | 'deny' | 'ask';
+    permissionDecisionReason?: string;
+};
+
 export declare type PreToolUseHookInput = BaseHookInput & {
     hook_event_name: 'PreToolUse';
     tool_name: string;
@@ -2481,6 +2680,17 @@ export declare interface Query extends AsyncGenerator<SDKMessage, void> {
     applyFlagSettings(settings: {
         [K in keyof Settings]?: K extends 'effortLevel' ? EffortLevel | null : Settings[K] | null;
     }): Promise<void>;
+    /**
+     * Merge settings into a settings FILE through the CLI's own writer — the
+     * same path /config uses (canonical store root, gitignore upkeep,
+     * hardened write) — and live-apply them. Unlike applyFlagSettings, which
+     * only touches the session-scoped flag layer. The handler accepts only an
+     * explicit key allowlist (currently just outputStyle) with string values
+     * — deletion is not supported — and refuses remote transports and
+     * sessions whose --setting-sources exclude the target source. Rejects
+     * with the gate's or writer's error otherwise.
+     */
+    updateSettings(source: 'localSettings', settings: Record<string, unknown>): Promise<void>;
     /**
      * Get the full initialization result, including supported commands, models,
      * account info, and output style configuration.
@@ -2542,9 +2752,15 @@ export declare interface Query extends AsyncGenerator<SDKMessage, void> {
      * Get a breakdown of current context window usage by category
      * (system prompt, tools, messages, MCP tools, memory files, etc.).
      *
+     * `detail: 'full'` counts each category with the token-count API;
+     * `'summary'` answers from the last response's usage and local estimates
+     * without the per-category token-count calls. Defaults to `'full'`.
+     *
      * @returns Context usage breakdown including token counts per category and total usage
      */
-    getContextUsage(): Promise<SDKControlGetContextUsageResponse>;
+    getContextUsage(opts?: {
+        detail?: 'summary' | 'full';
+    }): Promise<SDKControlGetContextUsageResponse>;
     /**
      * Get the structured data behind the `/usage` command: session cost and
      * token usage totals plus claude.ai plan rate-limit utilization windows
@@ -2688,6 +2904,8 @@ export declare interface Query extends AsyncGenerator<SDKMessage, void> {
      * @param toolUseId - Optional tool_use block id to target a single task
      * @returns true when at least one task was backgrounded; false only
      *   when `toolUseId` was given and it matched no foreground task
+     * @throws when background tasks are disabled for the session
+     *   (`CLAUDE_CODE_DISABLE_BACKGROUND_TASKS`) — nothing is backgrounded
      */
     backgroundTasks(toolUseId?: string): Promise<boolean>;
     /**
@@ -2822,7 +3040,7 @@ export declare type RewindFilesResult = {
 export declare type SandboxCredentialsConfig = NonNullable<z.infer<ReturnType<typeof SandboxCredentialsConfigSchema>>>;
 
 declare const SandboxCredentialsConfigSchema: () => z.ZodOptional<z.ZodObject<{
-    files: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
+    files: z.ZodOptional<z.ZodArray<z.ZodPreprocess<z.ZodObject<{
         path: z.ZodString;
         mode: z.ZodEnum<{
             deny: "deny";
@@ -2841,7 +3059,7 @@ declare const SandboxCredentialsConfigSchema: () => z.ZodOptional<z.ZodObject<{
         maskDuplicates: z.ZodOptional<z.ZodBoolean>;
         injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>>>;
-    envVars: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
+    envVars: z.ZodOptional<z.ZodArray<z.ZodPreprocess<z.ZodObject<{
         name: z.ZodString;
         mode: z.ZodEnum<{
             deny: "deny";
@@ -2954,7 +3172,7 @@ declare const SandboxSettingsSchema: () => z.ZodObject<{
         disabled: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     credentials: z.ZodOptional<z.ZodObject<{
-        files: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
+        files: z.ZodOptional<z.ZodArray<z.ZodPreprocess<z.ZodObject<{
             path: z.ZodString;
             mode: z.ZodEnum<{
                 deny: "deny";
@@ -2973,7 +3191,7 @@ declare const SandboxSettingsSchema: () => z.ZodObject<{
             maskDuplicates: z.ZodOptional<z.ZodBoolean>;
             injectHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>>>>;
-        envVars: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
+        envVars: z.ZodOptional<z.ZodArray<z.ZodPreprocess<z.ZodObject<{
             name: z.ZodString;
             mode: z.ZodEnum<{
                 deny: "deny";
@@ -3021,8 +3239,8 @@ declare const SandboxSettingsSchema: () => z.ZodObject<{
         command: z.ZodString;
         args: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
-    bwrapPath: z.ZodCatch<z.ZodOptional<z.ZodPipe<z.ZodTransform<string | undefined, unknown>, z.ZodString>>>;
-    socatPath: z.ZodCatch<z.ZodOptional<z.ZodPipe<z.ZodTransform<string | undefined, unknown>, z.ZodString>>>;
+    bwrapPath: z.ZodCatch<z.ZodOptional<z.ZodPreprocess<z.ZodString>>>;
+    socatPath: z.ZodCatch<z.ZodOptional<z.ZodPreprocess<z.ZodString>>>;
 }, z.core.$loose>;
 
 /**
@@ -3070,6 +3288,14 @@ export declare type SDKAssistantMessage = {
     uuid: UUID;
     session_id: string;
     request_id?: string;
+    /**
+     * Client uuid of the user message that triggered this turn (submitMessage options.uuid), stamped on the turn's FIRST reply frame only — the first assistant message in complete-message mode; with --include-partial-messages the stamp normally rides the first non-ping stream event instead (see SDKPartialAssistantMessage), and a turn that produces no stream events still stamps its first assistant message — so a consumer can bind the reply to the send it answers without waiting for the result. Wrapper-level sibling — never inside `message.content` — so it is not replayed to the model. Absent on every later frame of the turn, on subagent frames (parent_tool_use_id set), on synthetic/scheduled (meta) turns, on turns without a client uuid, and from older producers.
+     */
+    user_message_uuid?: string;
+    /**
+     * Client uuids of every user message whose prompt this turn has consumed so far, in consumption order — all members of a prompt batch the host merged into this one turn (several messages sent close together run as one turn whose user_message_uuid is the LAST member's), so a consumer that sent any of them can bind this reply to its own send by finding its uuid anywhere in the list. Always contains user_message_uuid; at most 64 entries. Present exactly when user_message_uuid is, on the same first reply frame only; absent from older producers (fall back to user_message_uuid).
+     */
+    user_message_uuids?: string[];
     /**
      * This turn continued the preceding truncated assistant turn inside its trailing signed thinking block (max-output-tokens recovery). Its thinking signatures are cumulative over that preceding thinking-only turn, so a history replayed through the bridge must carry this flag back for the normalizer to keep the run's prefix on the wire. Wrapper-level sibling — never inside `message.content` — so it is not replayed to the model.
      */
@@ -3112,6 +3338,8 @@ export declare type SDKAssistantMessage = {
 
 
 
+
+
 };
 
 export declare type SDKAssistantMessageError = 'authentication_failed' | 'oauth_org_not_allowed' | 'account_on_hold' | 'billing_error' | 'rate_limit' | 'overloaded' | 'invalid_request' | 'model_not_found' | 'server_error' | 'unknown' | 'max_output_tokens';
@@ -3126,7 +3354,7 @@ export declare type SDKAuthStatusMessage = {
 };
 
 /**
- * The full set of live background tasks, emitted whenever membership changes (start, completion, kill, a foreground agent being backgrounded). A level signal, unlike the task_started/task_notification edge bookends: consumers that only need 'is background work running' should replace their set with each payload rather than pairing edges, so a missed bookend cannot wedge a stale running indicator. Ordering relative to the bookends for the same transition is unspecified (in practice the level precedes them) and the payload carries ids only, so do not correlate it with the edge stream. The level is per-process: nothing is emitted at startup, so consumers must reset to the empty set whenever the session's CLI process (re)starts and let the next membership change repopulate it. A host that re-initializes an already-running process (a repeated `initialize` control request, e.g. after reconnecting) is sent a snapshot of the current set right behind the success response to that request, even when it is empty, so it need not wait for a change; CLIs that predate this send nothing there.
+ * The full set of live background tasks, emitted whenever membership changes (start, completion, kill, a foreground agent being backgrounded) or an entry's `ambient` flag flips. A level signal, unlike the task_started/task_notification edge bookends: consumers that only need 'is background work running' should replace their set with each payload rather than pairing edges, so a missed bookend cannot wedge a stale running indicator. Ordering relative to the bookends for the same transition is unspecified (in practice the level precedes them) and the payload carries ids only, so do not correlate it with the edge stream. The level is per-process: nothing is emitted at startup, so consumers must reset to the empty set whenever the session's CLI process (re)starts and let the next membership change repopulate it. A host that re-initializes an already-running process (a repeated `initialize` control request, e.g. after reconnecting) is sent a snapshot of the current set right behind the success response to that request, even when it is empty, so it need not wait for a change; CLIs that predate this send nothing there.
  */
 export declare type SDKBackgroundTasksChangedMessage = {
     type: 'system';
@@ -3138,6 +3366,10 @@ export declare type SDKBackgroundTasksChangedMessage = {
         task_id: string;
         task_type: string;
         description: string;
+        /**
+         * True for housekeeping tasks the CLI does not surface as user work (every skip_transcript task, plus auto-started live-update watchers); hosts should exclude them from activity indicators.
+         */
+        ambient?: boolean;
     }[];
     uuid: UUID;
     session_id: string;
@@ -3355,6 +3587,10 @@ declare type SDKControlGetBinaryVersionRequest = {
  */
 declare type SDKControlGetContextUsageRequest = {
     subtype: 'get_context_usage';
+    /**
+     * 'full' counts each category with the token-count API; 'summary' answers from the last response's usage and local estimates without the per-category token-count calls. Defaults to 'full'.
+     */
+    detail?: 'summary' | 'full';
 };
 
 /**
@@ -3693,9 +3929,22 @@ declare type SDKControlInitializeRequest = {
     subtype: 'initialize';
     hooks?: Partial<Record<coreTypes.HookEvent, SDKHookCallbackMatcher[]>>;
     sdkMcpServers?: string[];
+    /**
+     * Settings for the SDK-hosted MCP servers named in sdkMcpServers, keyed by server name. Sent as a separate field so a CLI that predates it ignores it; entries whose name is not in sdkMcpServers, and values that do not match this shape, are ignored rather than rejected. Applied when the server is first registered.
+     */
+    sdkMcpServerConfigs?: Record<string, {
+        /**
+         * Per-server tool-call timeout in milliseconds. Overrides the MCP_TOOL_TIMEOUT environment variable for this server. Hard wall-clock limit per call; progress notifications do not extend it. Values below 1000ms are ignored (falls through to MCP_TOOL_TIMEOUT or the default). Applies when the server is first registered; changing it for an already-registered server has no effect until it is removed and re-added.
+         */
+        timeout?: number;
+    }>;
     jsonSchema?: Record<string, unknown>;
     systemPrompt?: string[];
     appendSystemPrompt?: string;
+    /**
+     * Record the conversation's system prompt once and reuse it verbatim on every later request and resume (recommended: true). Omitted: setting systemPrompt or appendSystemPrompt turns recording off so the appended text applies fresh each launch; only the bare claude_code preset is recorded. true: an existing record in the conversation is sent as-is (a later launch's different systemPrompt/appendSystemPrompt is ignored until compaction); otherwise the prompt is rendered with appendSystemPrompt included, sent, and recorded. false: never record. With a record, a mid-session model switch or set_settings agent/system-prompt change does not alter the prompt until compaction or a new session.
+     */
+    systemPromptSnapshot?: boolean;
     /**
      * Custom workflow body for the plan-mode system reminder. Replaces the default code-implementation phases; the CLI still wraps it with the read-only enforcement preamble and the ExitPlanMode protocol footer.
      */
@@ -3726,6 +3975,10 @@ declare type SDKControlInitializeRequest = {
      * Dialog kinds (request_user_dialog `dialog_kind` values) this consumer's onUserDialog can actually render. The CLI treats ABSENCE as 'cannot display' and fails closed: without the kind declared here, a dialog-gated flow degrades to its no-dialog behavior (for 'refusal_fallback_prompt', the classic refusal error) instead of parking a dialog the consumer may mishandle. First-attached-client-wins on multi-client sessions; later initializes do not change it.
      */
     supportedDialogKinds?: string[];
+    /**
+     * Declares that this consumer renders a per-task stop control wired to the `stop_task` control request, so the user can stop an individual background task. When declared, an interrupt on an open-input (interactive stream-json) session spares running background agents/workflows (Stop only aborts the turn). Closed-input exception: a one-shot run (string prompt / -p closes stdin) still kills hold-back tasks at the held-result release regardless of the declaration — with stdin closed, a stop_task control could never be delivered, so the fail-closed kill stands. ABSENCE also fails closed: the interrupt kills background tasks, since the user would otherwise have no way to stop a runaway one. First-attached-client-wins on multi-client sessions; later initializes do not change it.
+     */
+    perTaskStopAffordance?: boolean;
 
 };
 
@@ -3760,6 +4013,9 @@ export declare type SDKControlInitializeResponse = {
 
 
 
+
+
+
 };
 
 /**
@@ -3769,7 +4025,7 @@ declare type SDKControlInterruptRequest = {
     subtype: 'interrupt';
 
     /**
-     * When true, the interrupt also cancels every uuid-stamped main-thread command still in the queue or already dequeued for the imminent turn but not yet reachable by the abort (the first-command prewait window) — the same set the response would otherwise list under `still_queued`. Each is closed with a terminal 'cancelled' lifecycle and listed on the response's `cancelled` field. `still_queued` is then empty, except that a client driving a hosted session lists there what it can no longer recall (a send already in flight to that session, or the first prompt the session was created with). (The isFoldInFlight guard cancel_async_message uses does not apply here: this request also aborts the running turn, so a fold-in-flight uuid is never delivered and is swept with the rest. A fold-in-flight uuid's queued_command attachment may already appear in the aborted turn's transcript if the abort landed after the fold's attachment yield — pre-existing leave-queued semantics; it never runs as its own turn.) Uuid-less commands (task notifications) still in the queue are also dequeued but cannot be listed; a uuid-less command already in the prewait window is unreachable by either leg and still runs. When false or absent, queued commands survive the interrupt and are listed under `still_queued` — the interrupt_receipt_v1 contract is unchanged. A Stop-means-stop-everything client (a remote UI's Stop button) sets this true so one round-trip halts the session; a wrapper that wants per-uuid control leaves it false and follows up with cancel_async_message. Advertised by the `interrupt_cancel_queued_v1` capability on system/init; older CLIs ignore the field and behave as if false.
+     * When true, the interrupt also cancels every uuid-stamped main-thread command still in the queue or already dequeued for the imminent turn but not yet reachable by the abort (the first-command prewait window) — the same set the response would otherwise list under `still_queued`. Each is closed with a terminal 'cancelled' lifecycle and listed on the response's `cancelled` field. `still_queued` is then empty, except that a client driving a hosted session lists there what it can no longer recall (a send already in flight to that session, or the first prompt the session was created with) and, when the session's own sweep then cancels one of those or a send it had already delivered, follows up with a command_lifecycle 'cancelled' frame for it. (The isFoldInFlight guard cancel_async_message uses does not apply here: this request also aborts the running turn, so a fold-in-flight uuid is never delivered and is swept with the rest. A fold-in-flight uuid's queued_command attachment may already appear in the aborted turn's transcript if the abort landed after the fold's attachment yield — pre-existing leave-queued semantics; it never runs as its own turn.) Uuid-less commands (task notifications) still in the queue are also dequeued but cannot be listed; a uuid-less command already in the prewait window is unreachable by either leg and still runs. When false or absent, queued commands survive the interrupt and are listed under `still_queued` — the interrupt_receipt_v1 contract is unchanged. A Stop-means-stop-everything client (a remote UI's Stop button) sets this true so one round-trip halts the session; a wrapper that wants per-uuid control leaves it false and follows up with cancel_async_message. Advertised by the `interrupt_cancel_queued_v1` capability on system/init; older CLIs ignore the field and behave as if false.
      */
     cancel_queued?: boolean;
 };
@@ -3779,7 +4035,7 @@ declare type SDKControlInterruptRequest = {
  */
 export declare type SDKControlInterruptResponse = {
     /**
-     * Uuids of async user messages that survive this interrupt: commands still in the queue, plus any batch already dequeued for the imminent turn but not yet reachable by the abort. These WILL run unless cancelled first (or unless the request set cancel_queued:true, in which case every uuid-stamped survivor this process holds is removed, emitted a terminal `cancelled` synchronously, and listed under `cancelled` instead — leaving here only what a client driving a hosted session can no longer recall: a send already in flight to that session, or the first prompt the session was created with). Cancellation granularity: uuids still in the queue are individually cancellable via cancel_async_message; once a batch is dequeued and coalesced into one turn, cancelling a NON-representative member uuid is a no-op (its content still runs), while cancelling the batch-representative uuid drops the WHOLE coalesced batch — in both cases the cancel response reports cancelled:false because the message was no longer in the queue. Coverage caveats: only uuid-STAMPED messages appear (a message enqueued without a uuid still runs but is never listed, so [] does not mean "nothing will run"); only main-thread messages are listed (subagent-addressed messages are out of scope); and the list may include internally-enqueued uuids the client never sent (cron triggers, auto-resume continuations) — ignore unknown uuids rather than treating them as an error. Ordering: on a clean interrupt this receipt is written before the interrupted turn result; a turn that crashes during interrupt handling emits its error result on a direct-write path that may precede the receipt. Snapshot is taken synchronously with abort processing — probing the queue after the interrupted result instead always loses the race against the drain loop, which starts the next queued turn immediately.
+     * Uuids of async user messages that survive this interrupt: commands still in the queue, plus any batch already dequeued for the imminent turn but not yet reachable by the abort. These WILL run unless cancelled first (or unless the request set cancel_queued:true, in which case every uuid-stamped survivor this process holds is removed, emitted a terminal `cancelled` synchronously, and listed under `cancelled` instead — leaving here only what a client driving a hosted session can no longer recall: a send already in flight to that session, or the first prompt the session was created with; a send that client still holds on its own machine behind a send gate (today: waiting for the session to take the initial upload from that machine) has not gone out, so it is withdrawn and listed under `cancelled` like a queued one, and cancel_async_message can withdraw it too, while a plain interrupt leaves it held and lists it here). Cancellation granularity: uuids still in the queue are individually cancellable via cancel_async_message; once a batch is dequeued and coalesced into one turn, cancelling a NON-representative member uuid is a no-op (its content still runs), while cancelling the batch-representative uuid drops the WHOLE coalesced batch — in both cases the cancel response reports cancelled:false because the message was no longer in the queue. Coverage caveats: only uuid-STAMPED messages appear (a message enqueued without a uuid still runs but is never listed, so [] does not mean "nothing will run"); only main-thread messages are listed (subagent-addressed messages are out of scope); and the list may include internally-enqueued uuids the client never sent (cron triggers, auto-resume continuations) — ignore unknown uuids rather than treating them as an error. Ordering: on a clean interrupt this receipt is written before the interrupted turn result; a turn that crashes during interrupt handling emits its error result on a direct-write path that may precede the receipt. Snapshot is taken synchronously with abort processing — probing the queue after the interrupted result instead always loses the race against the drain loop, which starts the next queued turn immediately.
      */
     still_queued: string[];
     /**
@@ -3914,6 +4170,10 @@ declare type SDKControlPermissionRequest = {
      * True when the dialog must not offer the persistent "don't ask again" row for this ask: accepting it would write a whole-tool allow rule broader than the ask's own verb (PermissionAskDecision.suppressAlwaysAllowRule). Hosts rendering approve options should omit any persistent-rule affordance when set.
      */
     suppress_always_allow_rule?: boolean;
+    /**
+     * True when the ask must not be approvable by a single stray keystroke (PermissionAskDecision.defaultToNo): a terminal-style prompt opens on its decline option and takes no digit shortcut. Hosts rendering approve options should not pre-select approve when set.
+     */
+    default_to_no?: boolean;
     /**
      * Set when a user-configured ask RULE (permissions.ask) forced this prompt but the ask carries the tool's own decision_reason — the ask-rule substitution keeps the richer tool-minted ask, so the rule rides here instead of decision_reason_type 'rule'. Hosts making policy on decision_reason_type (e.g. auto-deny safetyCheck) or running host-side auto-approval should treat asks carrying this field as rule-forced: the user's stated intent is a human prompt. Values are producer-authored but render-unsafe like decision_reason; sanitize before display.
      */
@@ -4030,7 +4290,7 @@ export declare type SDKControlRequest = {
     request: SDKControlRequestInner;
 };
 
-declare type SDKControlRequestInner = SDKControlInterruptRequest | SDKControlPermissionRequest | SDKControlInitializeRequest | SDKControlSetPermissionModeRequest | SDKControlSetModelRequest | SDKControlSetMaxThinkingTokensRequest | SDKControlRenameSessionRequest | SDKControlSetColorRequest | SDKControlMcpStatusRequest | SDKControlGetContextUsageRequest | SDKControlGetSessionCostRequest | SDKControlListModelsRequest | SDKControlGetUsageRequest | SDKControlGetBinaryVersionRequest | SDKControlMcpCallRequest | SDKControlFileSuggestionsRequest | SDKHookCallbackRequest | SDKControlMcpMessageRequest | SDKControlRewindFilesRequest | SDKControlCancelAsyncMessageRequest | SDKControlReadFileRequest | SDKControlSeedReadStateRequest | SDKControlMcpSetServersRequest | SDKControlRegisterRepoRootRequest | SDKControlReloadPluginsRequest | SDKControlReloadSkillsRequest | SDKControlMcpReconnectRequest | SDKControlMcpToggleRequest | SDKControlStopTaskRequest | SDKControlBackgroundTasksRequest | SDKControlApplyFlagSettingsRequest | SDKControlGetSettingsRequest | SDKControlElicitationRequest | SDKControlRequestUserDialogRequest;
+declare type SDKControlRequestInner = SDKControlInterruptRequest | SDKControlPermissionRequest | SDKControlInitializeRequest | SDKControlSetPermissionModeRequest | SDKControlSetModelRequest | SDKControlSetMaxThinkingTokensRequest | SDKControlRenameSessionRequest | SDKControlSetColorRequest | SDKControlMcpStatusRequest | SDKControlGetContextUsageRequest | SDKControlGetSessionCostRequest | SDKControlListModelsRequest | SDKControlGetUsageRequest | SDKControlGetBinaryVersionRequest | SDKControlMcpCallRequest | SDKControlFileSuggestionsRequest | SDKHookCallbackRequest | SDKControlMcpMessageRequest | SDKControlRewindFilesRequest | SDKControlCancelAsyncMessageRequest | SDKControlReadFileRequest | SDKControlSeedReadStateRequest | SDKControlMcpSetServersRequest | SDKControlRegisterRepoRootRequest | SDKControlReloadPluginsRequest | SDKControlReloadSkillsRequest | SDKControlMcpReconnectRequest | SDKControlMcpToggleRequest | SDKControlStopTaskRequest | SDKControlBackgroundTasksRequest | SDKControlApplyFlagSettingsRequest | SDKControlGetSettingsRequest | SDKControlUpdateSettingsRequest | SDKControlElicitationRequest | SDKControlRequestUserDialogRequest;
 
 /**
  * Progress for a long-running client-originated control_request (currently only side_question), correlated by request_id. status 'started' means the worker accepted the request and launched the work; 'api_retry' carries the same retry counters as SDKAPIRetryMessage and is present only for that status.
@@ -4142,6 +4402,18 @@ declare type SDKControlStopTaskRequest = {
     task_id: string;
 };
 
+/**
+ * Merges the provided settings into a settings file through the CLI's own writer (canonical store root, gitignore upkeep, hardened write) and live-applies them — the same path /config uses. Unlike apply_flag_settings, which only touches the session-scoped flag layer. The handler accepts an explicit key allowlist only (currently just outputStyle — the file feeds hook and permission-rule loading, so each key is a security decision), requires string values (key deletion is not supported), and refuses remote transports and sessions whose --setting-sources exclude the target source.
+ */
+declare type SDKControlUpdateSettingsRequest = {
+    subtype: 'update_settings';
+    /**
+     * Which settings file to write. Only the project's local settings file for now — the scope host UIs need so their writes land exactly where /config's do.
+     */
+    source: 'localSettings';
+    settings: Record<string, unknown>;
+};
+
 /**
  * Emitted by /clear, plan-mode exit, and fresh-session flows. The surface should mount a fresh transcript under new_conversation_id and reset any cached session title. From internal QueryEvent 'conversation_reset'.
  */
@@ -4289,6 +4561,16 @@ export declare type SDKLocalCommandOutputMessage = {
     session_id: string;
 };
 
+export declare type SDKMcpResourceLink = {
+    uri: string;
+    name: string;
+    title?: string;
+    description?: string;
+    mimeType?: string;
+    size?: number;
+    annotations?: Record<string, unknown>;
+};
+
 /**
  * MCP tool definition for SDK servers.
  * Contains a handler function, so not serializable.
@@ -4353,7 +4635,7 @@ export declare type SDKMessageOrigin = {
      */
     name?: string;
     /**
-     * The sender's host-openable session id (the envelope's `from-session` attribute — e.g. a desktop `local_<uuid>` or a CCR `session_`/`ses_` id), set by the sender's host so a receiving UI can link this message back to the sending session. Sender-asserted like `from`: a navigation target only, never authority. Absent when the sender's host provides none and on messages from older senders.
+     * The sender's host-openable session id (the envelope's `from-session` attribute — e.g. a desktop `local_<uuid>` or a cloud session `session_`/`ses_` id), set by the sender's host so a receiving UI can link this message back to the sending session. Sender-asserted like `from`: a navigation target only, never authority. Absent when the sender's host provides none and on messages from older senders.
      */
     fromSession?: string;
 
@@ -4372,7 +4654,7 @@ export declare type SDKMessageOrigin = {
 } | {
     kind: 'task-notification';
     /**
-     * Present when the delivery is the fired stored prompt of a scheduled task/routine ('scheduled-trigger', stamped from server-asserted provenance; the schedule attests storage, not authorship), a coordinator co-member SendMessage delivery ('peer-send-message': model-authored text from another of the same user's sessions, verified by the server-stamped receiver co-membership — task-notification for prompt authority, but distinguishable so the receive-side crossSessionInbound setting can apply to it), or a Claude Code Projects delivery that Anthropic servers composed for the project's coordinator session and addressed to one of its thread sessions ('projects-relay': the thread's first message, or a relay carrying project messages — stamped from server-asserted provenance). The harness frames a scheduled-trigger delivery as the session's assigned task and a projects-relay delivery that carries the server's relay stamps as a message from the coordinator session (one without them keeps the generic background-notification frame), instead of the generic background-notification frame. Absent on webhook, PR-steward, plugin, and background-event deliveries.
+     * Present when the delivery is the fired stored prompt of a scheduled task/routine ('scheduled-trigger', stamped from server-asserted provenance; the schedule attests storage, not authorship) or a coordinator co-member SendMessage delivery ('peer-send-message': model-authored text from another of the same user's sessions, verified by the server-stamped receiver co-membership — task-notification for prompt authority, but distinguishable so the receive-side crossSessionInbound setting can apply to it). The harness frames a scheduled-trigger delivery as the session's assigned task instead of the generic background-notification frame. Absent on webhook, PR-steward, plugin, and background-event deliveries.
      */
     subkind?: 'scheduled-trigger' | 'peer-send-message' | 'projects-relay';
 } | {
@@ -4486,6 +4768,14 @@ export declare type SDKPartialAssistantMessage = {
     uuid: UUID;
     session_id: string;
     ttft_ms?: number;
+    /**
+     * Client uuid of the user message that triggered this turn (submitMessage options.uuid), stamped on the turn's FIRST non-ping stream event only (the frame that triggers the turn's initial ack) so a consumer can bind the reply stream to the send it answers without waiting for the result. Absent on every later stream event of the turn, on synthetic/scheduled (meta) turns, on turns without a client uuid, and from older producers.
+     */
+    user_message_uuid?: string;
+    /**
+     * Client uuids of every user message whose prompt this turn has consumed so far, in consumption order — all members of a prompt batch the host merged into this one turn (several messages sent close together run as one turn whose user_message_uuid is the LAST member's), so a consumer that sent any of them can bind this reply to its own send by finding its uuid anywhere in the list. Always contains user_message_uuid; at most 64 entries. Present exactly when user_message_uuid is, on the same first non-ping stream event only; absent from older producers (fall back to user_message_uuid).
+     */
+    user_message_uuids?: string[];
 };
 
 export declare type SDKPermissionDenial = {
@@ -4584,6 +4874,7 @@ export declare type SDKRateLimitInfo = {
     resetsAt?: number;
     rateLimitType?: 'five_hour' | 'seven_day' | 'seven_day_opus' | 'seven_day_sonnet' | 'seven_day_overage_included' | 'overage';
     utilization?: number;
+
     overageStatus?: 'allowed' | 'allowed_warning' | 'rejected';
     overageResetsAt?: number;
     overageDisabledReason?: 'overage_not_provisioned' | 'org_level_disabled' | 'org_level_disabled_until' | 'out_of_credits' | 'seat_tier_level_disabled' | 'member_level_disabled' | 'seat_tier_zero_credit_limit' | 'group_zero_credit_limit' | 'member_zero_credit_limit' | 'org_service_level_disabled' | 'no_limits_configured' | 'fetch_error' | 'unknown';
@@ -4620,7 +4911,19 @@ export declare type SDKResultError = {
     modelUsage: Record<string, ModelUsage>;
 
     permission_denials: SDKPermissionDenial[];
+    /**
+     * User-initiated sends still waiting in the command queue when this result was produced. Greater than 0 means at least one more user turn (and result) follows without further input, barring cancellation; 0 means none is pending, or the session is ending (end_session or a shutdown latched mid-turn discards the backlog). Queued sends may coalesce into fewer turns, so this counts pending sends, not remaining results. System-generated queue entries are not counted. Absent on fatal startup results and on surfaces without a command queue.
+     */
+    queued_turn_count?: number;
     errors: string[];
+    /**
+     * Client uuid of the user message that triggered this turn (submitMessage options.uuid), echoed back so a consumer can link this error result to the send it answers — the same join key the success variant echoes, carried alone (error turns have no request_sent_wall_ms to report). A delivery-failure result from the remote-session client echoes the failed send's queue key, which is client-minted when the host sent no uuid of its own. Absent on synthetic/scheduled (meta) turns, on turns without a client uuid, on session-scoped failures with no single triggering send (a crashed worker's zeroed result), and from older producers.
+     */
+    user_message_uuid?: string;
+    /**
+     * Client uuids of every user message whose prompt this turn consumed, in consumption order — all members of a prompt batch the host merged into this one turn (several messages sent close together run as one turn whose user_message_uuid is the LAST member's), then any queued user message folded into the running turn between tool rounds, once taken off the queue — so a consumer that sent any of them can bind this result to its own send by finding its uuid anywhere in the list. Always contains user_message_uuid; at most 64 entries; can be longer than the list on the turn's first reply frame. Present when a headless turn that ran echoes user_message_uuid; absent on delivery-failure and zeroed results and from older producers (fall back to user_message_uuid).
+     */
+    user_message_uuids?: string[];
     terminal_reason?: TerminalReason;
     fast_mode_state?: FastModeState;
     fast_mode_disabled_reason?: FastModeDisabledReason;
@@ -4643,6 +4946,7 @@ export declare type SDKResultSuccess = {
     ttft_stream_ms?: number;
     time_to_request_ms?: number;
     user_message_uuid?: string;
+    user_message_uuids?: string[];
     request_sent_wall_ms?: number;
     time_to_request_from_spawn_ms?: number;
     warm_spare_claimed?: boolean;
@@ -4666,6 +4970,10 @@ export declare type SDKResultSuccess = {
     modelUsage: Record<string, ModelUsage>;
 
     permission_denials: SDKPermissionDenial[];
+    /**
+     * User-initiated sends still waiting in the command queue when this result was produced. Greater than 0 means at least one more user turn (and result) follows without further input, barring cancellation; 0 means none is pending, or the session is ending (end_session or a shutdown latched mid-turn discards the backlog). Queued sends may coalesce into fewer turns, so this counts pending sends, not remaining results. System-generated queue entries are not counted. Absent on fatal startup results and on surfaces without a command queue.
+     */
+    queued_turn_count?: number;
     structured_output?: unknown;
     deferred_tool_use?: SDKDeferredToolUse;
     terminal_reason?: TerminalReason;
@@ -4810,12 +5118,13 @@ export declare type SDKSystemMessage = {
 
     fast_mode_state?: FastModeState;
     fast_mode_disabled_reason?: FastModeDisabledReason;
+
     /**
      * The effort level the session will send on its next request — after env overrides, session state, org caps and model-support downgrades; the same value get_settings reports as applied.effort. null when no effort parameter will be sent (a model without effort, CLAUDE_CODE_EFFORT_LEVEL=unset, or an internal numeric budget). Present on Remote Control bridge init frames (terminal- and Desktop/VS Code-hosted sessions); absent on hosts that do not publish it and on CLIs that predate the field. Re-emitted inits carry the current value — the newest frame wins.
      */
     effort?: ('low' | 'medium' | 'high' | 'xhigh' | 'max') | null;
     /**
-     * Protocol capabilities this CLI supports, so SDK consumers can feature-detect instead of version-sniffing. Open set — ignore unknown values; check each capability for exactly the behavior you use. 'interrupt_receipt_v1' = the interrupt control_response success payload carries still_queued (uuids of async user messages that survive the interrupt). 'interrupt_cancel_queued_v1' = the interrupt control_request honors cancel_queued:true (queued and pending-dispatch commands are cancelled alongside the abort, listed on the response's cancelled field; still_queued is then empty — including any uuid that was mid-fold at the interrupt instant, since this request also aborts and the fold never delivers it — except that a client driving a hosted session lists there what it can no longer recall: a send already in flight to that session, or the first prompt the session was created with). 'queued_notifications' = the CLI accepts inbound queued_notification stream messages and drains them via ReadNotifications (the CCR backend reads this from the persisted init event to decide whether it may send them). Absent on older CLIs.
+     * Protocol capabilities this CLI supports, so SDK consumers can feature-detect instead of version-sniffing. Open set — ignore unknown values; check each capability for exactly the behavior you use. 'interrupt_receipt_v1' = the interrupt control_response success payload carries still_queued (uuids of async user messages that survive the interrupt). 'interrupt_cancel_queued_v1' = the interrupt control_request honors cancel_queued:true (queued and pending-dispatch commands are cancelled alongside the abort, listed on the response's cancelled field; still_queued is then empty — including any uuid that was mid-fold at the interrupt instant, since this request also aborts and the fold never delivers it — except that a client driving a hosted session lists there what it can no longer recall: a send already in flight to that session, or the first prompt the session was created with). 'queued_notifications' = the CLI accepts inbound queued_notification stream messages and drains them via ReadNotifications (the cloud session backend reads this from the persisted init event to decide whether it may send them). Absent on older CLIs.
      */
     capabilities?: string[];
 
@@ -4823,6 +5132,8 @@ export declare type SDKSystemMessage = {
 
 
 
+
+
     uuid: UUID;
     session_id: string;
 };
@@ -4840,7 +5151,15 @@ export declare type SDKTaskNotificationMessage = {
         tool_uses: number;
         duration_ms: number;
     };
+    /**
+     * CLI-owned: for a backgrounded MCP task (task_type mcp_task) that completed, the `resource_link` content blocks of its final result — the files it returned by reference — collected from the raw result before the CLI renders it as the text the model reads. A backgrounded task's tool_result is the placeholder text and its real result arrives as this notification, so this is where a host learns which files that tool call produced; join to the originating call via tool_use_id. Same fields and caps as tool_use_result.resourceLinks (at most 50 links, 64 KiB serialized), absent when the result had none or the task is any other type. Never populated from the server's _meta.
+     */
+    resource_links?: SDKMcpResourceLink[];
     skip_transcript?: boolean;
+    /**
+     * True for housekeeping tasks the CLI does not surface as user work (every skip_transcript task, plus auto-started live-update watchers); hosts should exclude them from activity indicators.
+     */
+    ambient?: boolean;
     uuid: UUID;
     session_id: string;
 };
@@ -4861,6 +5180,9 @@ export declare type SDKTaskProgressMessage = {
         duration_ms: number;
     };
     last_tool_name?: string;
+    /**
+     * A one-line status for the task's row. For a local_agent task it is the model-generated progress summary (only when the agentProgressSummaries option is on); for a backgrounded mcp_task it is the MCP server's own bounded status message, emitted once per change without any option. Render it when present regardless of task type.
+     */
     summary?: string;
 
     uuid: UUID;
@@ -4895,6 +5217,10 @@ export declare type SDKTaskStartedMessage = {
      * Ambient/housekeeping task. Consumers should hide this from the inline transcript; it may still appear in a tasks panel.
      */
     skip_transcript?: boolean;
+    /**
+     * True for housekeeping tasks the CLI does not surface as user work (every skip_transcript task, plus auto-started live-update watchers); hosts should exclude them from activity indicators.
+     */
+    ambient?: boolean;
     uuid: UUID;
     session_id: string;
 };
@@ -5001,6 +5327,7 @@ export declare type SDKUserMessage = {
 
 
 
+
     uuid?: UUID;
     session_id?: string;
     /**
@@ -5051,6 +5378,7 @@ export declare type SDKUserMessageReplay = {
 
 
 
+
     uuid: UUID;
     session_id: string;
     isReplay: true;
@@ -5058,7 +5386,7 @@ export declare type SDKUserMessageReplay = {
 };
 
 /**
- * Emitted by the bridge on opt-in graceful worker teardown (only when the teardown caller supplied a reason), before the heartbeat stops, so remote clients can show why the worker went away instead of waiting for heartbeat timeout. Absence is NOT a dead-host signal: handoffs (/update, /teleport, respawn), auto-disable, mode transitions, and internal fatal-error paths emit nothing by design. A dead host (battery, OOM, kill -9) never reaches teardown and never sends this either. NOTE: this event lands in the durable per-session event stream — a session that is later resumed may carry historical instances mid-stream. Clients MUST treat it as a live-tail signal only (honored when no further activity follows), not a one-shot session-lifetime fact. CC-2656.
+ * Emitted by the bridge on opt-in graceful worker teardown (only when the teardown caller supplied a reason), before the heartbeat stops, so remote clients can show why the worker went away instead of waiting for heartbeat timeout. Absence is NOT a dead-host signal: handoffs (/update, /teleport, respawn), auto-disable, mode transitions, and internal fatal-error paths emit nothing by design. A dead host (battery, OOM, kill -9) never reaches teardown and never sends this either. NOTE: this event lands in the durable per-session event stream — a session that is later resumed may carry historical instances mid-stream. Clients MUST treat it as a live-tail signal only (honored when no further activity follows), not a one-shot session-lifetime fact.
  */
 export declare type SDKWorkerShuttingDownMessage = {
     type: 'system';
@@ -5154,6 +5482,22 @@ export declare type SessionStartHookInput = BaseHookInput & {
     agent_type?: string;
     model?: string;
     session_title?: string;
+    /**
+     * resume/fork: seconds since the resumed transcript's last assistant response
+     */
+    seconds_since_last_response?: number;
+    /**
+     * resume/fork: the resumed transcript's last response input + cache_read + cache_creation + output tokens (for a server-side tool loop, its last iteration's window, not the summed totals)
+     */
+    context_tokens?: number;
+    /**
+     * resume/fork: seconds_since_last_response exceeds the prompt-cache TTL, so the first request re-caches context_tokens
+     */
+    prompt_cache_likely_expired?: boolean;
+    /**
+     * resume/fork: estimated cost of re-caching context_tokens on the session model — the managed modelPricing when set, otherwise list price; excludes the response
+     */
+    estimated_cache_write_usd?: number;
 };
 
 export declare type SessionStartHookSpecificOutput = {
@@ -5386,10 +5730,18 @@ export declare interface Settings {
      * Number of days to retain chat transcripts before automatic cleanup (default: 30). Minimum 1. Use a large value for long retention; use --no-session-persistence to disable transcript writes entirely.
      */
     cleanupPeriodDays?: number;
+    /**
+     * Retention ceiling in days for session transcripts created or last written by a desktop-host surface (Claude Desktop, Cowork), which are otherwise exempt from the cleanupPeriodDays sweep. 0 (the default) means no ceiling: such transcripts are kept until deleted another way. Unlike cleanupPeriodDays, 0 is allowed because this setting never disables writes — it only bounds an exemption from deletion. The ceiling is a hard cap: it also bounds an active archive grace, so the grace window of a release marker never keeps files past the ceiling. Ignored when cleanupPeriodDays is managed by org policy. A ceiling at or below cleanupPeriodDays effectively disables the exemption: those transcripts age out on the regular cleanupPeriodDays schedule, so the effective retention is whichever of the two periods is longer.
+     */
+    desktopSessionCleanupPeriodDays?: number;
     /**
      * Set to false to turn off syncing of the skills you have enabled on claude.ai. In your user settings (or managed settings): nothing more is downloaded, previously synced skills (~/.claude/skills/synced) can no longer be run, are hidden from every session started afterwards, and are moved to ~/.claude/skills/.trash at the next launch (deleted after cleanupPeriodDays; re-downloaded, not restored, if you re-enable). In .claude/settings.local.json or --settings: downloads stop and synced skills are blocked and hidden for sessions in that workspace or invocation only (nothing is moved). Not read from project settings (.claude/settings.json). Only false is honored — the feature is enabled server-side for your account, so setting true does not turn it on early. While it is on, synced skills are available in every session, re-synced every 10 minutes, and removed when you disable them on claude.ai. Only applies when signed in with your Claude account.
      */
     syncClaudeAiSkills?: boolean;
+    /**
+     * Set to false to turn off syncing of the plugins you have enabled on claude.ai. In your user settings (or managed settings): nothing more is downloaded, previously synced plugins (~/.claude/plugins/synced) are hidden from every session started afterwards and moved to ~/.claude/plugins/.trash at the next launch (deleted after cleanupPeriodDays; re-downloaded, not restored, if you re-enable). In .claude/settings.local.json or --settings: downloads stop and synced plugins are hidden for sessions in that workspace or invocation only (nothing is moved). Not read from project settings (.claude/settings.json). Only false is honored — the feature is enabled server-side for your account, so setting true does not turn it on early. While it is on, synced plugins load in every session like plugins you installed yourself (a plugin you installed with the same name takes precedence), are re-synced at each launch, and are removed when you disable them on claude.ai. Only applies when signed in with your Claude account.
+     */
+    syncClaudeAiPlugins?: boolean;
     /**
      * Per-skill description character cap in the skill listing sent to Claude (default: 1536). Descriptions longer than this are truncated. Raise to opt in to higher per-turn context cost.
      */
@@ -5458,6 +5810,10 @@ export declare interface Settings {
          * Disable the ability to bypass permission prompts
          */
         disableBypassPermissionsMode?: 'disable';
+        /**
+         * Refuse file-tool reads (Read, Grep, Glob, LSP) outside the working directories in every permission mode; true in any settings source wins. Also set when the user picks "block" on the one-time auto-mode prompt for a read outside the working directories.
+         */
+        blockReadsOutsideWorkingDirectories?: boolean;
         /**
          * Additional directories to include in the permission scope
          */
@@ -5486,6 +5842,50 @@ export declare interface Settings {
     modelOverrides?: {
         [k: string]: string;
     };
+    /**
+     * Curate the /model picker: an ordered list of models with your own labels, independent of the built-in lineup and of Claude Code releases. availableModels still applies to these rows. Honored from managed, --settings/SDK, and user settings only (not from a project checkout); the highest-precedence of those that defines modelPicker wins outright (no merging across sources). Typically set in managed settings by enterprise administrators.
+     */
+    modelPicker?: {
+        /**
+         * Rows to show in the /model picker, in order.
+         */
+        options: {
+            /**
+             * Model to select, taken verbatim: an alias ("opus"), an Anthropic model ID, or a provider-format ID (Vertex, Bedrock, gateway). Same values --model accepts.
+             */
+            model: string;
+            /**
+             * Row title. Defaults to the model name.
+             */
+            label?: string;
+            /**
+             * Row subtitle. Defaults to a generic description.
+             */
+            description?: string;
+            /**
+             * For a model this version of Claude Code does not know: the ID of a model it does know (e.g. "claude-opus-4-8") whose client-side handling — prompt profile, capability and effort defaults — applies to it. Changes neither the row's label nor the model ID sent. Without it, a model-catalog row for a model this version does not know is not offered until Claude Code is updated.
+             */
+            behavesAs?: string;
+        }[];
+        /**
+         * When true, the picker shows only the Default row and these options — the built-in lineup, gateway-discovered models and ANTHROPIC_CUSTOM_MODEL_OPTION are hidden. When false or unset, these options are added after the built-in lineup.
+         */
+        replaceBuiltInOptions?: boolean;
+    };
+    /**
+     * Price usage at your organization's contracted rates instead of list price. Affects every spend figure Claude Code reports — /cost, the status line, the SDK total_cost_usd, --max-budget-usd, and the OpenTelemetry cost metric and events — which remain USD estimates, not an invoice (the per-Mtok price labels in /model stay at list). "overrides" maps a model ID to its USD-per-million-token rates (input, output, cacheRead, cacheWrite — all four required, each 0 to 10000; cacheWrite prices both 5-minute and 1-hour cache writes). A matching row is charged exactly as written; fast-mode and US-data-residency surcharges are not added on top. A key Claude Code itself uses for a built-in model — its ID such as "claude-sonnet-4-6", or its first-party, Bedrock (any or no region prefix), Vertex or Foundry ID — covers every dated and provider form of that model; any other key — a gateway model alias, or a spelling Claude Code does not itself use — matches that model ID only (case-insensitive), and such an exact match wins over a built-in row. On Bedrock an application inference profile is matched by its backing model. An invalid row or multiplier is reported and skipped; the rest still apply. "multiplier" in (0, 1] scales every computed cost, overridden or not (0.85 = 85% of the price). Only honored from managed settings (server-managed, MDM / OS policy, or managed-settings.json), or — when none of those sets it — when supplied by a host application that manages the model provider; ignored in user, project, local and --settings sources.
+     */
+    modelPricing?: {
+        multiplier?: number;
+        overrides?: {
+            [k: string]: {
+                input: number;
+                output: number;
+                cacheRead: number;
+                cacheWrite: number;
+            };
+        };
+    };
     /**
      * Whether to automatically approve all MCP servers in the project
      */
@@ -5513,7 +5913,15 @@ export declare interface Settings {
      */
     disableBundledSkills?: boolean;
     /**
-     * Enterprise allowlist of MCP servers that can be used. Applies to all scopes including enterprise servers from managed-mcp.json. If undefined, all servers are allowed. If empty array, no servers are allowed. Denylist takes precedence - if a server is on both lists, it is denied.
+     * MCP servers the organization provides to every user, keyed by server name, each with the .mcp.json entry shape; only "http" and "sse" servers are accepted (nothing that names a program to run, no ${VAR} references). Honored from managed settings only; users cannot remove them, deniedMcpServers still applies, and they need no allowedMcpServers entry. Not read in Claude Desktop's Code tab on a third-party deployment or in Cowork sessions, where Claude Desktop supplies and locks the session's MCP servers itself.
+     */
+    managedMcpServers?: {
+        [k: string]: {
+            [k: string]: unknown;
+        };
+    };
+    /**
+     * Enterprise allowlist of the MCP servers users may use. Governs servers users add (user, project and local config, --mcp-config, agent frontmatter, plugins, claude.ai connectors); servers the organization itself delivers (managedMcpServers, and managed-mcp.json entries that use no ${VAR} expansion) are allowed without being listed; a managed-mcp.json entry that uses ${VAR} expansion is still checked against this list. If undefined, all servers are allowed. If empty array, users can use no servers of their own. Denylist takes precedence - if a server is on both lists, it is denied.
      */
     allowedMcpServers?: {
         /**
@@ -5605,6 +6013,7 @@ export declare interface Settings {
                 asyncRewake?: boolean;
 
 
+
             } | {
                 /**
                  * LLM prompt hook type
@@ -5702,6 +6111,7 @@ export declare interface Settings {
                  * If true, hook runs once and is removed after execution
                  */
                 once?: boolean;
+
             } | {
                 /**
                  * MCP tool hook type
@@ -5782,11 +6192,11 @@ export declare interface Settings {
      */
     disableWorkflows?: boolean;
     /**
-     * Disable the Artifact tool (also via CLAUDE_CODE_DISABLE_ARTIFACT).
+     * Deprecated: use enableArtifact: false. Still honored — true disables the Artifact tool; false is ignored.
      */
     disableArtifact?: boolean;
     /**
-     * Enable or disable the Artifact tool for this user. Unset defaults to enabled once the feature is available.
+     * Turn the Artifact tool on or off. Off in any of managed, --settings, or user settings wins; project and local settings can only turn it off. Unset defaults to on once the feature is available.
      */
     enableArtifact?: boolean;
     /**
@@ -5826,7 +6236,7 @@ export declare interface Settings {
      */
     httpHookAllowedEnvVars?: string[];
     /**
-     * When true (and set in managed settings), only permission rules (allow/deny/ask) from managed settings are respected. User, project, local, and CLI argument permission rules are ignored.
+     * When true (and set in managed settings), permission rules from user, project, local, and --settings files and allow rules from --allowedTools are ignored; only managed settings can add allow rules through settings. --disallowedTools and other deny and ask rules from the command line or the current session still apply.
      */
     allowManagedPermissionRulesOnly?: boolean;
     /**
@@ -7103,6 +7513,10 @@ export declare interface Settings {
      * Controls whether the SDK parent tier (Options.managedSettings / --managed-settings) layers under this admin tier. "first-wins" (default): parent is dropped — admin tiers are the only policy source. "merge": parent's restrictive-only-filtered settings union under the admin winner. Has no effect when no admin tier exists (parent applies as the sole policy tier, still filtered restrictive-only).
      */
     parentSettingsBehavior?: 'first-wins' | 'merge';
+    /**
+     * Controls how the managed settings sources compose. "first-wins" (default): the highest-priority source present (server-managed > MDM (managed plist / HKLM) > managed-settings.json) is the managed tier alone. "merge": every present source deep-merges with fixed precedence server-managed > MDM > managed-settings.json — scalars take the highest source's value and arrays union, except fallbackModel, the restriction allowlists allowedMcpServers, availableModels, strictKnownMarketplaces and allowedChannelPlugins, and sandbox.credentials.awsPairs and sandbox.ripgrep (the highest source that sets one owns it whole), managedMcpServers (server names union; a name set by two sources takes the higher source's whole entry) and the auth pins forceLoginOrgUUID, forceLoginMethod and forceLoginGatewayUrl (highest source only). Honored only from the highest-priority source present; enable it only when every lower source is admin-controlled, since lower sources then contribute entries such as permissions.allow. HKCU and --managed-settings never take part in the merge.
+     */
+    managedSourcesBehavior?: 'first-wins' | 'merge';
     /**
      * Organization UUID to require for OAuth login. Accepts a single UUID string or an array of UUIDs (any one is permitted). When set in managed settings, login fails if the authenticated account does not belong to a listed organization.
      */
@@ -7365,11 +7779,22 @@ export declare interface Settings {
         verbs: string[];
     };
     /**
-     * Override spinner tips. tips: array of tip strings. excludeDefault: if true, only show custom tips (default: false).
+     * Add your organization's own tips to the spinner tip rotation. tips: strings or {id, text, cooldownSessions?, priority?} objects; tipsFile: a JSON file of the same; label: prefix shown before your tips; excludeDefault: if true, only show your tips (default: false).
      */
     spinnerTipsOverride?: {
         excludeDefault?: boolean;
-        tips: string[];
+        tips?: (string | {
+            [k: string]: unknown;
+        })[];
+        /**
+         * Absolute or ~/ local path to a JSON file holding an array of tips (same shapes as `tips`); honored from user, --settings and on-disk managed settings only. Read once per CLI process (restart to pick up edits).
+         */
+        tipsFile?: string;
+        /**
+         * Prefix shown before your tips in the spinner (default "Tip")
+         */
+        label?: string;
+        [k: string]: unknown;
     };
     /**
      * Whether to disable syntax highlighting in diffs
@@ -7401,6 +7826,14 @@ export declare interface Settings {
      * Whether /rename updates the terminal tab title (defaults to true). Set to false to keep auto-generated topic titles.
      */
     terminalTitleFromRename?: boolean;
+    /**
+     * Prompt cache TTL for the main conversation (interactive, -p and SDK turns, plus the helpers that run inline with it): "5m" or "1h". Unset = automatic: 1 hour on a Claude subscription within its usage limits, 5 minutes on an API key, Bedrock, Vertex or Foundry. 1-hour cache writes are billed at a higher rate; the cache stays warm across longer breaks. The CLAUDE_CODE_PROMPT_CACHE_TTL environment variable takes precedence.
+     */
+    promptCacheTtl?: '5m' | '1h';
+    /**
+     * Prompt cache TTL for everything outside the main conversation — subagents, workflows, background and helper requests: "5m" or "1h". Unset = automatic (5 minutes unless ENABLE_PROMPT_CACHING_1H=1). The CLAUDE_CODE_SUBAGENT_PROMPT_CACHE_TTL environment variable takes precedence.
+     */
+    subagentPromptCacheTtl?: '5m' | '1h';
     /**
      * When false, thinking is disabled. When absent or true, thinking is enabled automatically for supported models.
      */
@@ -7556,6 +7989,14 @@ export declare interface Settings {
      * Reduce or disable animations for accessibility (spinner shimmer, flash effects, etc.)
      */
     prefersReducedMotion?: boolean;
+    /**
+     * Clock format for times shown in the UI: "auto" (default, follows the locale), "12-hour", "24-hour", "24-hour-utc" ("18:05Z"), or a strftime pattern such as "%H:%M" (any value containing "%"; other values read as "auto"). A pattern replaces the time everywhere; message timestamps show only the pattern, so include %Y-%m-%d for the date. /config offers the presets; a pattern is set here.
+     */
+    timeFormat?: ('auto' | '12-hour' | '24-hour' | '24-hour-utc') | string;
+    /**
+     * IANA time zone for times shown in the UI, e.g. "UTC" or "Europe/Dublin". Default: the system time zone. An unknown name falls back to the system time zone.
+     */
+    timeZone?: string;
 
 
 
@@ -7585,6 +8026,7 @@ export declare interface Settings {
      * Disable auto mode
      */
     disableAutoMode?: 'disable';
+
     /**
      * SSH connection configurations for remote environments. Typically set in managed settings by enterprise administrators to pre-configure SSH connections for team members.
      */
@@ -7975,7 +8417,7 @@ export declare type SyncHookJSONOutput = {
     reason?: string;
 
 
-    hookSpecificOutput?: PreToolUseHookSpecificOutput | UserPromptSubmitHookSpecificOutput | UserPromptExpansionHookSpecificOutput | SessionStartHookSpecificOutput | SetupHookSpecificOutput | SubagentStartHookSpecificOutput | PostToolUseHookSpecificOutput | PostToolUseFailureHookSpecificOutput | PostToolBatchHookSpecificOutput | StopHookSpecificOutput | SubagentStopHookSpecificOutput | PermissionDeniedHookSpecificOutput | NotificationHookSpecificOutput | PermissionRequestHookSpecificOutput | ElicitationHookSpecificOutput | ElicitationResultHookSpecificOutput | CwdChangedHookSpecificOutput | FileChangedHookSpecificOutput | WorktreeCreateHookSpecificOutput | MessageDisplayHookSpecificOutput;
+    hookSpecificOutput?: PreToolUseHookSpecificOutput | UserPromptSubmitHookSpecificOutput | UserPromptExpansionHookSpecificOutput | SessionStartHookSpecificOutput | SetupHookSpecificOutput | PreModelSwitchHookSpecificOutput | PostModelSwitchHookSpecificOutput | SubagentStartHookSpecificOutput | PostToolUseHookSpecificOutput | PostToolUseFailureHookSpecificOutput | PostToolBatchHookSpecificOutput | StopHookSpecificOutput | SubagentStopHookSpecificOutput | PermissionDeniedHookSpecificOutput | NotificationHookSpecificOutput | PermissionRequestHookSpecificOutput | ElicitationHookSpecificOutput | ElicitationResultHookSpecificOutput | CwdChangedHookSpecificOutput | FileChangedHookSpecificOutput | WorktreeCreateHookSpecificOutput | MessageDisplayHookSpecificOutput;
 };
 
 /**