fix(deps): require claude-agent-sdk 0.2.129

pyproject.toml

@@ -38,7 +38,7 @@ dependencies = [
     "fastapi>=0.135",
     "uvicorn>=0.44",
     "websockets>=15.0",
-    "claude-agent-sdk>=0.2.127,<0.3",
+    "claude-agent-sdk>=0.2.129,<0.3",
     "Pillow>=10.0",
     # Federation crypto (sealed_box_v1): X25519, Ed25519, HKDF, XChaCha20-Poly1305.
     "cryptography>=41.0",

tests/test_admin_update.py

@@ -775,6 +775,23 @@ def test_pin_higher_than_installed_yields_drift_entry(self):
         assert entry["installed"] == installed
         assert str(major) in entry["specifier"]
 
+    def test_claude_agent_sdk_security_floor_flags_pre_fix_install(self):
+        """The security floor must make a stale pre-fix SDK visible."""
+        from pinky_daemon.api import _check_installed_deps_drift
+
+        with tempfile.TemporaryDirectory() as tmp:
+            self._write_pyproject(tmp, ["claude-agent-sdk>=0.2.129,<0.3"])
+            with patch("importlib.metadata.version", return_value="0.2.128"):
+                drifts = _check_installed_deps_drift(tmp)
+
+        assert drifts == [
+            {
+                "package": "claude-agent-sdk",
+                "specifier": "<0.3,>=0.2.129",
+                "installed": "0.2.128",
+            }
+        ]
+
     def test_missing_package_records_installed_none(self):
         """A pyproject dep that isn't installed at all shows up with
         installed=None — distinct from a version mismatch."""

tests/test_packaging_dependencies.py

@@ -17,5 +17,5 @@ def test_slack_socket_mode_dependencies_are_in_base_install() -> None:
     assert project["optional-dependencies"]["slack"] == []
 
 
-def test_claude_agent_sdk_excludes_pretooluse_bypass_version() -> None:
-    assert "claude-agent-sdk>=0.2.127,<0.3" in _project()["dependencies"]
+def test_claude_agent_sdk_excludes_allowed_tools_injection_versions() -> None:
+    assert "claude-agent-sdk>=0.2.129,<0.3" in _project()["dependencies"]