Bug Fixes
- Fixed argv flag injection via
resumeandsession_idoptions:--resumeand--session-idare now passed as single=-joined argv tokens (e.g.--resume=<value>) so that a dash-prefixed value is never misinterpreted as an independent CLI flag (#1123)
Internal/Other Changes
- Hardened build scripts against command injection via
CLAUDE_CLI_VERSION: Added version validation (_cli_version_validation.py) and eliminated shell interpolation indownload_cli.pyandupdate_cli_version.pyso that a malformed version string cannot inject shell or Python code during builds (#1117) - CI now lints and typechecks
scripts/alongsidesrc/andtests/ - CI CLI install steps now fail properly when
curlerrors (addedshell: bashforpipefail) - Updated bundled Claude CLI to version 2.1.212
PyPI: https://pypi.org/project/claude-agent-sdk/0.2.121/
pip install claude-agent-sdk==0.2.121