[mashkovd]

What

Bumps claude-agent-sdk from 0.2.110 to 0.2.128 — the current latest.
Deliberate, isolated bump per issue #44's own convention ("bump deliberately,
in an explicit commit").

Why now

This is the first bump attempted with any real confidence, because it's the
first time there's been something to test it against: #86 gave us CI, #88
gave us a lockfile, #89 established exactly how the bundled-CLI mechanism
works, #90/#91 gave us lint/type gates. Before this series, a harness bump
was an unverifiable leap of faith.

Breaking-change review

Read the SDK's changelog for every version between 0.2.111 and 0.2.128,
not just the target's entry. Nothing documented touches this codebase:

• 0.2.126 — ResultMessage.model_usage type changed from
  dict[str, Any] to dict[str, ModelUsage]. Grepped for model_usage
  anywhere in orchestrator/config: zero hits.
• 0.2.121 — --resume/--session-id flag format changed. Grepped for
  resume/session_id: zero hits.
• 0.2.124 — Windows security hardening. Irrelevant — the image is
  python:3.12-slim on Linux exclusively.

Bundled CLI moves too — re-verified, not assumed

The bump takes the bundled CLI from 2.1.191 to 2.1.220 as a side effect
(claude-agent-sdk ships its own CLI binary; see #89 for why the Dockerfile
no longer installs a separate one). Rather than assume the bundled-CLI
mechanism established in #89 still holds, re-ran the exact same checks
against a freshly built image:

$ docker run --rm IMG python -c "
import claude_agent_sdk._cli_version as v
print(v.__cli_version__)"
2.1.220

$ docker run --rm IMG python -c "
from claude_agent_sdk._internal.transport.subprocess_cli import SubprocessCLITransport
t = SubprocessCLITransport.__new__(SubprocessCLITransport); t._cli_path = None
print(t._find_cli())"
/app/.venv/lib/python3.12/site-packages/claude_agent_sdk/_bundled/claude

$ docker run --rm IMG sh -c 'which claude; echo rc=$?'
rc=1

node/npm/git/gh all present and unaffected. All three detect_auth()
branches (no creds → RuntimeError, OAuth token, API key) behave identically
to pre-bump.

Verification

• uv run --locked pytest -q → 243 passed, unchanged
• uv run --locked ruff check orchestrator config tests → clean
• uv run --locked mypy → clean
• Only claude-agent-sdk itself moved in uv.lock — no transitive
  dependency cascade
• Bundled CLI version and resolution re-verified in a fresh image build
• Auth policy branches re-verified in the fresh image
• CI green on this PR

[claude]

Claude encountered an error after 0s —— View job

---

I'll analyze this and get back to you.

[claude]

Claude finished @mashkovd's task in 20s —— View job

---

Reviewing PR #93

• Gather context (PR diff, description, CLAUDE.md)
• Classify diff triviality
• Post verdict

Verdict: trivial dependency bump — approved.

Diff is confined to pyproject.toml (version pin) and uv.lock (matching hashes) for claude-agent-sdk 0.2.110 → 0.2.128. No source/logic files changed. This matches the "trivial diff" criteria (dependency bump, no logic change), so I approved directly per review policy:

gh pr review 93 --approve --body "Pure dependency bump (claude-agent-sdk 0.2.110 → 0.2.128), only version pin and lockfile hashes changed, no logic touched."

[claude]

Pure dependency bump (claude-agent-sdk 0.2.110 → 0.2.128), only version pin and lockfile hashes changed, no logic touched.