$ the-wire · showcase
Agent SDK sessions return every parallel tool call; security-guidance survives edge-case paths
By RepoJournal · Filed · About Anthropic · Composed from the cited sources · methodology
The day's substantive fixes are in session reading and the security-guidance plugin's file lookup, with the rest of the wire made up of routine dependency bumps and CI plumbing.
fix(sessions): return every parallel tool call and result from get_session_messages anthropics/claude-agent-sdk-python
get_session_messages and get_session_messages_from_store used to drop tool calls and results from any turn that ran tools in parallel: with three parallel calls they returned one of the three results and between one and three of the calls, so some returned calls arrived with no result. The reader now returns the whole turn; the on-disk transcript had it all along.
security-guidance: find the earlier version of a file reached through a symlinked folder anthropics/claude-plugins-official
When the tool's path and the session directory named the same repo through different symlinks (/tmp and /var on macOS), the relative path between the two spellings left the repo and the earlier-version lookup came back empty, so a rewrite re-reported code already in the file. The lookup now retries with both paths resolved, leaving the first attempt unchanged.
Merge pull request #6591 from anthropics/mhegazy/sg-stop-pathspec anthropics/claude-plugins-official
The Stop review in security-guidance keeps working when the set of changed paths is too large to fit in a single command.
Merge pull request #6604 from anthropics/mhegazy/sg-baseline-subdir anthropics/claude-plugins-official
Rewritten files under a repository subdirectory now resolve to their earlier version, the same lookup that already worked from the repo root. Two further changes report which pattern rules fired on every Stop row and how long the launcher waits for interpreter probes.
ci: publish to PyPI with trusted publishing instead of an API token anthropics/claude-agent-sdk-python
Release uploads now use PyPI trusted publishing: the publish job takes id-token: write and no longer sets TWINE_USERNAME/TWINE_PASSWORD, so twine exchanges a GitHub OIDC token for a short-lived upload token and the long-lived repository secret goes away. The upload path itself is untouched, hash-pinned twine 7.0.0, sdist first, then wheels, with --skip-existing. Quiet elsewhere: claude-code-act...
Action items
- → Upgrade claude-agent-sdk-python to the release containing PR #1422 if you read parallel-tool transcripts via get_sess... anthropics/claude-agent-sdk-python [plan]
