Intel / repo

claude-agent-sdk-typescript v0.3.325

Source: github.com
Author: claude-code-publisher[bot]Top Viber
Date: Published Nov 13, 2026

Context

The change in version 0.3.325 of Anthropic's Claude SDK for TypeScript most likely to alter an existing app's behavior is in the `` option. The sandbox runs Claude's Bash commands under restrictions on which files they can write and which hosts they can reach. Until this release, turning it on also approved sandboxed Bash commands automatically. Now those commands go through the normal permission flow unless the app sets `autoAllowBashIfSandboxed: true`. The release notes say the SDK matches Claude Code 2.1.325, and the Claude Code changelog records the same change of default for that version.

For an app that runs without a person at the keyboard, the effect depends on how it handles permissions. The SDK's permissions guide says that in the default permission mode, Claude Code denies any tool call that needs approval unless an allow rule, a , a `canUseTool` callback or a permission-prompt tool approves it. An app that relied on the sandbox alone to let Bash run will now send those commands to its `canUseTool` callback, or have them denied if nothing approves them, until it sets `autoAllowBashIfSandboxed: true` or adds allow rules for the commands it expects. When this was written, the SDK's TypeScript reference still listed the setting's default as `true`, so the release notes are the more current statement.

The release removes a second automatic approval in the same direction. Read-only git commands aimed at a repository other than the working directory's, an added directory's or a trusted one now go through the permission flow instead of running without a check.

Key takeaways · AI-distilled

Claude Agent SDK 0.3.325 no longer auto-approves sandboxed Bash commands unless autoAllowBashIfSandboxed is set to true, so hosts that relied on the sandbox option alone lose automatic approval.
Read-only git commands in a repository outside the working directory, an additional directory or a trusted one now go through the permission flow instead of being auto-approved.
A fix makes deny rules (disallowedTools, permissions.deny, always_deny) apply to in-process SDK tools. Before it, a denied tool, its server or a glob match could remain in Claude's tool list and in system/init.
Sessions can now be archived and restored with archiveSession() and unarchiveSession(), and listSessions() and getSessionInfo() report an archived field.

Terms in this piece · Glossary

AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.
agent hook — A script the harness runs automatically at a fixed point in an agent's loop — before a tool call, after an edit, on session start.
MCP — The Model Context Protocol — an open standard that lets any AI assistant plug into any tool or data source without custom integration code.

Read the source github.com