Sync with Python SDK v0.2.134: validate skill names in ClaudeAgentOptions#skills

[ya-luotao]

Summary

Brings the Ruby SDK to parity with Python SDK v0.2.134.

Ported: anthropics/claude-agent-sdk-python#1145 — validate skill names in ClaudeAgentOptions.skills (v0.2.129)

Skill names from skills: [...] were formatted into the --allowedTools value unchecked. The CLI splits that value into permission rules on commas and spaces outside parentheses, and its tokenizer honors no escape sequences, so a name carrying one of those delimiters cannot be passed through reliably. CommandBuilder#skills_defaults now validates each name and fails closed.

Rejected: parentheses, commas, control characters (C0, DEL, C1), U+FEFF, empty names; a literal * and wildcard suffixes (:*, *); and shapes that parse but can never match the listed skill — surrounding whitespace, a leading /, consecutive backslashes, a trailing unpaired backslash, and byte sequences that cannot form valid UTF-8.

Unaffected: ordinary names, including plugin-qualified names, interior spaces, single backslashes, and non-ASCII.

Breaking: skills: ['*'] and skills: ['plugin:*'] now raise — use skills: 'all', or a Skill(...) rule in allowed_tools for prefix matching. skills: [' name'] and skills: ['/name'] now raise as well; both previously built a rule that could never match, so the skill was silently unavailable.

Ruby adaptations

• Python ValueError → ArgumentError; TypeError kept for non-String entries. The existing ArgumentError for non-Array/non-'all' shapes is unchanged (Python's tuple/set/generator/bare-string cases collapse into that one check in Ruby).
• Python's surrogate check becomes an invalid-UTF-8 check: a lone surrogate is unrepresentable in valid UTF-8. Valid non-UTF-8 names (e.g. UTF-16) are converted so the later argv join(",") cannot raise Encoding::CompatibilityError.
• Edge-whitespace checks use [[:space:]] (Unicode-aware) since Ruby's String#strip is ASCII-only — " pdf" rejects like Python.

Not applicable from v0.2.129–v0.2.134

All remaining upstream commits are bundled-CLI version bumps (2.1.221 → 2.1.226) and changelog updates; the Ruby gem does not bundle the CLI.

Test plan

• Ported the upstream parametrized rejection/acceptance cases to spec/unit/command_builder_spec.rb (16 new examples), plus Ruby-specific cases: NBSP edge whitespace, invalid byte sequences, UTF-16 name conversion.
• bundle exec rspec — 1226 examples, 0 failures. bundle exec rubocop — clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TS6ALBqEGJc3rGqNjnXGqD