Tag
15 posts tagged.
An MCP stdio server that holds a timer or a pool open does not exit when its client dies. Measured on SDK 1.30.0 and Node 24.8.0: it is reparented to init and keeps running. StdioServerTransport registers no stdin end-of-file listener. Here is the reproduction and the four-line fix.
You gave your agent a shell tool, used execFile so there is no shell, and allowlisted the programs. It is still not safe. If the agent controls the argument array, tar's own --checkpoint-action=exec runs any command with no metacharacters. Here is the reproduction and the per-binary argument policy that stops it, measured on Node 24.8.0.
If your agent has a read_file tool, you probably guard it with path.resolve plus startsWith. It blocks the obvious traversal and is defeated by a symlink and by a sibling directory sharing the prefix. Both reproduced on Node 24.8.0, with the guard that passes all nine cases.
A grep bisect tells you when today's code landed, not when the behaviour changed. Here is the argv-capture harness that dates it properly, and the worked example where grepping made a maintainer look wrong and running the versions proved him right.
The skills option validates every name before the session starts, and its wildcard guard tests for exactly two endings. Eight of eleven wildcard shapes get through, become a Skill(name) rule that names no skill, and say nothing. Measured first-party on 0.3.272, with the bisect.
Since @anthropic-ai/claude-agent-sdk 0.3.257 a malformed hook entry is deleted from settings.json and the rest of the file loads normally, so the hook just never runs. PreToolUse and PermissionRequest are the two exceptions, where the whole file is voided. Bisected against 0.3.252, with a runnable detector.
npm error notarget No matching version found for @anthropic-ai/sdk means you asked for a major that does not exist. Anthropic ships two SDKs on unrelated version lines: Python is on 1.5.0, npm has never left 0.x. Read from both registries, with the caret trap that follows.
TypeError: Invalid http_client argument means the anthropic Python SDK moved to httpx2 in 1.0.0. The rename is one import. The parts nobody mentions are that the guard printing that message only exists from 1.4.0, and that it cannot see your respx or OpenTelemetry layer at all (2026).
ImportError: cannot import name 'streamablehttp_client' means pip resolved MCP Python SDK 2.x against v1 client code. The rename is one underscore. The part nobody mentions is that passing your own httpx2 client silently drops the 300 second read timeout to 5 (2026).
permissions.blockReadsOutsideWorkingDirectories blocks reads outside your working directories in every permission mode, including bypassPermissions. Writing false does not turn it off, because the key is a logical OR across all settings sources. Plus the 53-hour macOS defect window, dated from the npm registry.
"TodoWrite no longer available" is not a bug. Claude Code v2.1.233 drops the five task-tracking tools on Sonnet 5 and newer unless you opt in. The gate follows the session, not the model, and the SDK opt-in line behaves differently in TypeScript and Python (2026).
"Checkpointer requires one or more of the following 'configurable' keys" means you compiled with a checkpointer and invoked without one. The message names three keys and only thread_id works. Measured in Python and TypeScript (2026).
