Claude Agent SDK TypeScript v0.3.325：沙箱Bash命令不再自动批准
v0.3.325
推荐理由
v0.3.325改变了沙箱内Bash命令的默认行为（从自动批准变为需显式配置），这是破坏性变更。使用Agent SDK进行自动化开发的读者必须检查配置，否则可能面临命令被阻断或安全风险。
What's changed
变更内容
- Added archiveSession() and unarchiveSession(), and an archived field on the sessions that listSessions() and getSessionInfo() return
- Added refuseIfBusy to Query.reloadPlugins() so a host can have a reload refused while the session is busy
- Added managed_lock to plugin_errors entries on system/init, naming the managed enabledPlugins entry that dropped a plugin copy
- Added a system/informational warning, tagged hook_no_verdict, when a PreToolUse hook can't run or answer, or times out, without refusing its tool call
- Added invalid_config_file to the config_file_invalid startup failure result: the broken config file's path and its backup's path as fields
- Fixed deny rules (disallowedTools, permissions.deny, always_deny) that name an in-process SDK MCP tool or its server, or match it with a glob, leaving it in Claude's tool list and system/init
- Fixed supportedEffortLevels in model info listing effort levels above the organization's effort cap or the maxEffortLevel setting
- Changed the sandbox option: sandboxed Bash commands are no longer auto-approved unless autoAllowBashIfSandboxed: true is set
- Changed read-only git commands in a repository that isn't the working directory's, an additional directory's or a trusted one to go through the permission flow instead of being auto-approved
- Changed applyFlagSettings() to reject when a value would make Claude Code discard its settings layer, applying nothing and keeping settings from earlier calls
- Changed suggestions on canUseTool for Bash and Monitor: a list of rules alone is sent only when saving it would allow that command
- Changed the ProposeSkillsInput type: a proposal can carry edits, and skillMd is optional
- Updated to parity with Claude Code v2.1.325
- 新增 archiveSession() 和 unarchiveSession()，并在 listSessions() 和 getSessionInfo() 返回的会话对象中新增 archived 字段
- 在 Query.reloadPlugins() 中新增 refuseIfBusy 参数，以便在会话繁忙时主机可以拒绝重载请求
- 在 system/init 的 plugin_errors 条目中新增 managed_lock，用于指明导致插件副本被移除的已启用 enabledPlugins 托管项
- 当 PreToolUse 钩子无法运行、无法响应或超时，且未拒绝其工具调用时，新增带有 hook_no_verdict 标签的系统信息警告
- 在 config_file_invalid 启动失败结果中新增 invalid_config_file：包含损坏配置文件的路径及其备份路径作为字段
- 修复了 deny 规则（disallowedTools、permissions.deny、always_deny）：这些规则命名了进程内 SDK MCP 工具或其服务器，或使用通配符匹配，导致该工具仍保留在 Claude 的工具列表和 system/init 中
- 修复了 model info 中 supportedEffortLevels 的问题：列出高于组织努力上限或 maxEffortLevel 设置的努力级别
- 更改沙箱选项：除非设置 autoAllowBashIfSandboxed: true，否则沙箱化的 Bash 命令不再自动批准
- 更改非工作目录仓库、额外目录或受信任目录中的只读 git 命令的处理方式：改为通过权限流程处理，而非自动批准
- 更改 applyFlagSettings() 的行为：当某个值会导致 Claude Code 丢弃其设置层、不应用任何设置并保留之前调用的设置时，予以拒绝
- 更改 canUseTool 对 Bash 和 Monitor 的建议：仅当保存该建议允许执行该命令时，才发送规则列表
- 更改 ProposeSkillsInput 类型：提案可携带编辑内容，skillMd 变为可选字段
- 更新至与 Claude Code v2.1.325 保持一致
Update
更新
代码 · 7 行
npm install @anthropic-ai/[email protected]
# or
yarn add @anthropic-ai/[email protected]
# or
pnpm add @anthropic-ai/[email protected]
# or
bun add @anthropic-ai/[email protected]更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力