chore(deps): update dependency @anthropic-ai/claude-agent-sdk to v0.3.220

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@anthropic-ai/claude-agent-sdk	0.3.168 → 0.3.220

---

Release Notes

anthropics/claude-agent-sdk-typescript (@​anthropic-ai/claude-agent-sdk)

v0.3.220

Compare Source

• Updated to parity with Claude Code v2.1.220

v0.3.219

Compare Source

• Added opt-in cancel_queued to the interrupt control request (capability interrupt_cancel_queued_v1): cancels queued and pending-dispatch messages alongside the abort
• Added fast_mode_disabled_reason to result and init messages so SDK hosts can explain why fast mode is off
• Added DirectoryAdded lifecycle hook event to the control protocol, fired when a new working directory is registered mid-session
• Fixed the initialize response reporting fast_mode_state from the spawn-time model after a model switch
• Added sandbox.network.strictAllowlist to SDK settings types for deterministically denying non-allowlisted hosts in sandboxed commands
• Added workflowSizeGuideline to SDK settings types for setting the advisory dynamic-workflow size guideline

v0.3.218

Compare Source

• SkillToolOutput now reports background: true when a forked skill was dispatched as a detached background agent
• Fixed the result event's api_error_status reporting null for rate-limit and overloaded errors delivered mid-stream; it now reports 429/529
• Added canonicalModel and provider to each modelUsage entry in result messages so downstream billing can look up the correct rate table for costUSD

v0.3.217

Compare Source

• Changed subagents to no longer spawn nested subagents by default (depth cap lowered from 5 to 1); set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH to allow deeper nesting
• Added a cap on concurrently-running subagents (default 20, override with CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS)
• Fixed Remote Control sessions not re-sending pending permission prompts to clients that connect after the prompt appeared

v0.3.216

Compare Source

• Added optional skippedLinks count to rewindFiles responses for paths the rewind safety guards refused to restore or delete
• Added tool_result_meta sidecar to user messages (non_execution_kind, user_feedback) so consumers can classify denied, interrupted, or cancelled tool calls without string-matching result prose
• Added optional user_message_uuid and request_sent_wall_ms fields to the success result message for cross-host request-latency correlation

v0.3.215

Compare Source

• Updated to parity with Claude Code v2.1.215

v0.3.214

• set_permission_mode now rejects unrecognized permission modes with an error instead of silently adopting them; the 'manual' alias is accepted at every ingress
• Added optional subkind: 'scheduled-trigger' to the task-notification member of SDKMessageOrigin, marking deliveries that are the fired prompt of a user-configured scheduled task
• applyFlagSettings({effortLevel}) now accepts 'max' in its TypeScript type (runtime already supported it)
• Assistant messages truncated by interrupt() now carry aborted: true, so consumers can distinguish a mid-stream partial from a completed message
• Added optional subagent_type and subagent_retry fields to tool_progress messages so clients can show a subagent waiting out an API rate-limit retry
• The system/init message's plugins entries and the reload_plugins response now include each plugin's manifest version
• SessionStart hooks now report source "fork" instead of "resume" when the session begins as a fork

v0.3.213

• Updated to parity with Claude Code v2.1.213

v0.3.212

Compare Source

• Fixed dash-leading resumeSessionAt and sessionId values being passed to the CLI as separate argv tokens; both now use equals-form (--flag=value)
• Agent tool output now includes the resolved model when a mid-turn model swap changed the subagent's model

v0.3.211

Compare Source

• Fixed --replay-user-messages with --include-partial-messages emitting the turn-start user replay after the first content block instead of before the turn's content events
• Added SDKAssistantMessage.timestamp (ISO-8601) to the live stream, matching SDKUserMessage; older emitters omit it, consumers should fall back to receive time
• Added rate-limit message prefix buckets (USAGE_LIMIT_ERROR_PREFIXES and siblings) as @alpha exports for classifying rate-limit messages without hand-mirrored lists
• Improved process-exit errors to include the CLI's stderr output, so a failed child reports its actual cause instead of only an exit code

v0.3.210

Compare Source

• Added timedOutAfterMs to BashToolOutput, set when a command is auto-backgrounded on timeout

v0.3.209

Compare Source

• Updated to parity with Claude Code v2.1.209

v0.3.208

Compare Source

• Fixed a caller abort during a pending SDK hook callback being converted into hook success, which let PreToolUse-gated tools execute after the abort
• Fixed a per-query resource leak in the SDK's process tracking when spawning the CLI fails (nonexistent or inaccessible executable path)
• Fixed an SDK UserPromptSubmit hook callback exceeding its timeout killing the entire query with an empty error; it now blocks the prompt with a clear timeout message and the session continues
• Fixed extraArgs values that look like flags (e.g. resume: '--version') being parsed as their own CLI flags; dash-leading values are now bound with equals-form argv
• Fixed an abort-listener leak: streaming queries sharing one AbortController no longer accumulate abort listeners on its signal after each completed query
• Fixed createSdkMcpServer docs pointing at a nonexistent env var; the MCP tool-call timeout knob is MCP_TOOL_TIMEOUT
• Fixed an uncaught exception when writing to stdin after the Claude Code subprocess has exited

v0.3.207

Compare Source

• Fixed canUseTool returning {behavior: 'allow'} without updatedInput being rejected as a deny with a raw ZodError message; the tool now runs with the original input per the documented contract
• The Agent tool's structured result now has a published SDK type (AgentToolCompletedOutput) that matches the emitted object exactly

v0.3.206

Compare Source

• Added command_lifecycle frames to stream-json and SDK sessions, reporting each uuid-stamped message's terminal state (queued/started/completed/cancelled/discarded); zero-API results no longer report stale duration_api_ms

v0.3.205

Compare Source

• Interrupt control responses now include still_queued (UUIDs of queued async messages that will still run), Query.interrupt() returns the typed receipt, and system/init advertises an interrupt_receipt_v1 capability for feature detection
• Added structured name and body fields to peer-message session events, exposing the sender display name and decoded message body

v0.3.204

Compare Source

• Added terminal_reason values tool_deferred_unavailable (deferred tool resume found the tool gone — previously an is_error result with no reason, read as a clean completion by lifecycle sweeps) and turn_setup_failed (the turn-input builder threw before the turn started). Both classify as dead turns, so commands consumed by them report command_lifecycle state cancelled
• Fixed the post-merge cancel backstop cancelling every member of a coalesced prompt batch when a cancel named only one: uncancelled siblings now re-merge and run (previously they were reported cancelled — on remote transports that acknowledged them as processed, silently dropping messages nobody cancelled)
• Added terminal_reason values api_error, malformed_tool_use_exhausted, budget_exhausted, and structured_output_retry_exhausted. Turns that die on an exhausted-API-retry or malformed-tool-use give-up previously reported completed; budget and structured-output exhaustion results previously omitted terminal_reason. Commands consumed by such turns now report command_lifecycle state cancelled instead of completed (dup-over-loss)
• Updated to parity with Claude Code v2.1.204

v0.3.203

Compare Source

• Added a background_tasks_changed system message with the full set of live background tasks on every membership change, so consumers can track background activity as a level instead of pairing task_started/task_notification edges
• Fixed stable releases shipping a sdk.d.ts with unresolved type references that broke consumer typechecking with skipLibCheck disabled

v0.3.202

Compare Source

• Added parent_agent_id field to subagent session messages for building depth-2+ agent trees from disk-persisted metadata
• Fixed apply_flag_settings with a non-object settings value crashing the session instead of returning a control error

v0.3.201

Compare Source

• Updated to parity with Claude Code v2.1.201

v0.3.200

Compare Source

• Added 'manual' as an accepted alias for the 'default' permission mode in SDK inputs
• Fixed onSetPermissionMode callback not firing for SDK-hosted Remote Control sessions
• Fixed set_model control request accepting unrecognized model strings; invalid models are now rejected before latching

v0.3.199

Compare Source

• Added requestId to canUseTool callback options for correlating out-of-band permission responses, and support for returning null to suppress the SDK's automatic control response
• Added blocked field to workflow_agent progress events indicating when an agent was blocked by the auto-mode safety classifier
• Added mode:"mask" and per-credential injectHosts to sandbox.credentials settings types for injecting masked credentials into sandboxed commands

v0.3.198

Compare Source

• Added a runtime warning when canUseTool is configured alongside allowedTools or bypassPermissions, which shadow the callback
• Added per-server request_timeout_ms option to mcp_set_servers control request
• Fixed SDKUserMessage.isSynthetic not being mapped to isMeta on ingestion, which could cause synthetic messages to be treated as real user messages
• Fixed workflow progress events silently dropping earliest agents from the list while the phase counter remained correct

v0.3.197

Compare Source

• Updated to parity with Claude Code v2.1.197

v0.3.196

Compare Source

• Added prompt_id field to hook input payloads for correlating hook events with OpenTelemetry prompt-level events
• Fixed control protocol deduplication dropping tool-use IDs after 1000 resolutions, which could cause duplicate tool_result deliveries in long-running sessions

v0.3.195

Compare Source

• Added Query.reinitialize() to re-send the initialize control request and redeliver pending permission/dialog prompts after a transport gap
• Fixed commands_changed event not being emitted for synced skills when the skill list resolves before the change-detector subscribes

v0.3.193

Compare Source

• Added promptSuggestions option to Browser SDK query() to opt the remote CLI into emitting follow-up suggestions
• Fixed brief console window flashes on Windows when spawning CLI subprocesses

v0.3.191

Compare Source

• Added old_source field to NotebookEdit tool results for replace and delete operations, enabling inline diffs
• Added seven_day_overage_included to SDKRateLimitInfo.rateLimitType for per-model weekly usage limits
• Added model_scoped array to usage response for per-model weekly limit windows with utilization and reset times
• Fixed fast mode reverting to standard after the first turn when settingSources includes user/project settings

v0.3.190

Compare Source

• Updated to parity with Claude Code v2.1.190

v0.3.187

Compare Source

• Added sandbox.credentials to SDK settings types for configuring credential file and environment variable denial in sandboxed commands

v0.3.186

Compare Source

• Added agent_id field to can_use_tool control requests — background agents now forward permission prompts to canUseTool instead of auto-denying, and stdin stays open while background tasks are running
• Added ReadMcpResourceDirTool tool type to SDK schemas — MCP resource directory listing is now a dedicated tool instead of a fallback inside ReadMcpResourceTool
• Added rewind_conversation control request for rewinding a conversation to a previous point with durable resume anchor support

v0.3.185

Compare Source

• Updated to parity with Claude Code v2.1.185

v0.3.183

• Updated to parity with Claude Code v2.1.183

v0.3.182

• Updated to parity with Claude Code v2.1.182

v0.3.181

Compare Source

• Added errorCode, canUserPurchaseCredits, and hasChargeableSavedPaymentMethod fields to SDKRateLimitInfo for detecting credits-required rate limits
• Added tool_use_meta.icon_url to assistant messages, populated from MCP server directory metadata
• Fixed SDK-hosted Remote Control sessions dropping file_attachments from inbound user messages

v0.3.179

Compare Source

• Added optional tool_use_meta sidecar to assistant messages with display-friendly names for tool calls, so SDK consumers can render human-readable labels instead of raw wire names
• Fixed -p mode exiting before a completed background agent's notification was delivered, causing interim text to ship as the final result
• Fixed remote (stream-json) sessions appearing busy for the entire duration of a background workflow — the turn result is now emitted at the turn boundary and the session reports idle while background tasks continue

v0.3.178

Compare Source

• Spawn failures on an existing native binary now explain the likely libc mismatch (musl binary on a glibc host) and suggest options.pathToClaudeCodeExecutable
• Permission-denied advisory messages now carry typed denial reasons (safetyCheck, asyncAgent), enabling SDK consumers to programmatically match denial causes
• Fixed UserPromptSubmit hook block feedback not being emitted to the SDK event stream — consumers can now see why a prompt was blocked by a hook instead of a silent hang
• Remote Control workers now send a worker_shutting_down system message on graceful exit so remote clients can show why the session ended
• Fixed MCP server-level specs (mcp__server, mcp__server__*) in disallowedTools being silently ignored — they now correctly remove all tools from the named server

v0.3.177

Compare Source

• Updated to parity with Claude Code v2.1.177

v0.3.176

Compare Source

• Fixed turn result messages being dropped when multiple turns complete while a background agent or workflow is running
• Fixed background agent, remote agent, and MCP task state not being restored when resuming a session via the SDK

v0.3.175

Compare Source

• Updated to parity with Claude Code v2.1.175

v0.3.174

Compare Source

• SDK consumers now receive the system/model_fallback message for all fallback triggers — overloaded, server_error, and last_resort in addition to model_not_found and permission_denied — and the message's trigger field gained the server_error and last_resort values

v0.3.173

Compare Source

• Updated to parity with Claude Code v2.1.173

v0.3.172

Compare Source

• SDK plugins option now accepts skipMcpDiscovery: true per plugin, so a host that manages a plugin's MCP connections itself can load skills/hooks from the plugin path without the engine re-reading its .mcp.json
• Fixed slash-followed-by-whitespace input (e.g. / add tests) being silently dropped instead of treated as a plain prompt

v0.3.170

Compare Source

• Added claude-fable-5 model and the fable alias to SDK model types. https://www.anthropic.com/news/claude-fable-5-mythos-5
• Updated to parity with Claude Code v2.1.170

v0.3.169

Compare Source

• Added an experimental usage_EXPERIMENTAL_MAY_CHANGE_DO_NOT_RELY_ON_THIS_API_YET() method on Query returning structured session cost, plan rate-limit, and local usage-behaviors data
• Added an sse option (SSEOptions) to BrowserQueryOptions as an alternative to websocket, for browser SDK consumers who prefer Server-Sent Events

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[greptile-apps]

PR author is in the excluded authors list.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 677b05f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​anthropic-ai/​claude-agent-sdk@​0.3.168 ⏵ 0.3.220	+6			+1

View full report

[wave-bugbot]

🟢 WAVE BugBot — clear

No confident findings on the changed lines.

_{Local review · $0 inference · wave-dispatch}

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[cursor]

Risk: low. Cursor Bugbot is not configured on this PR; evaluated using remaining signals. Approving this lockfile-only @anthropic-ai/claude-agent-sdk bump (0.3.168→0.3.197) with clean WAVE BugBot and Socket security results. No reviewers assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}