Anthropic SDK for Ruby 1.67.0

Apply the Ruby 4.0 baseline first. These additional rules target the anthropic 1.67.0 gem on Ruby 4.0; the gem's minimum Ruby requirement is 3.2.0. Use the APIs and defaults of this exact SDK version.

Client and credential boundaries

• Construct Anthropic::Client only in trusted server code. Supply api_key:, auth_token:, credentials:, or config: from deployment-controlled secrets and configuration; never deserialize a client configuration supplied by an end user or model.
• Select one intended authentication mechanism. Explicit static credentials override credentials:, and ambient ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN overrides automatic profile/federation discovery; remove obsolete credentials when adopting federation.
• Protect credential profiles, identity-token files, and config: paths from application-user writes. For user_oauth profiles, arrange external credential rotation: this version does not implement refresh-token renewal for those files.
• Allowlist the effective HTTPS API origin, including base_url:, ANTHROPIC_BASE_URL, and profile configuration. Control ANTHROPIC_CUSTOM_HEADERS and proxy settings through deployment policy, and enforce approved destinations on redirects as well as initial requests.
• Build request_options: from trusted values. Its extra_body, extra_query, and extra_headers override ordinary parameters and headers; never merge request payloads into these options or expose client.request as a general authenticated HTTP proxy.
• Install only reviewed client and per-request middleware. Middleware