Python: feat(claude): bump claude-agent-sdk to 0.2.87

[giles17]

Motivation and Context

Upgrade the claude-agent-sdk dependency to support the latest upstream features and security fixes.

Description

• Widened version constraint to >=0.1.36,<0.3. The lower bound is kept at 0.1.36 to avoid forcing upgrades on existing users — the 0.1.x to 0.2.x transition was additive only (no breaking changes to the APIs we consume).
• Added xhigh effort level to the ClaudeAgentOptions Literal type (introduced for Opus 4.7).
• Exposed 7 new upstream SDK options in ClaudeAgentOptions: skills, session_id, task_budget, include_hook_events, strict_mcp_config, continue_conversation, fork_session. These pass through to SDKOptions via the existing generic loop — no explicit wiring needed.
• Used dict[str, int] for task_budget instead of the upstream TaskBudget type, since that type was only added in 0.2.93 and does not exist in 0.2.87.
• Lockfile pinned to 0.2.87 for CI and development.

Notable upstream additions (0.1.49 – 0.2.87)

• SessionStore adapter for external transcript mirroring
• Skills option for enabling/disabling skills
• Hook event streaming
• Deferred tool use (PreToolUse hooks can defer decisions)
• Strict MCP config mode
• Task budget for token pacing
• xhigh effort level (Opus 4.7)
• Security fix: mcp dependency floor raised to >=1.23.0 (CVE-2025-66416)

Contribution Checklist

• The code builds clean without any errors or warnings
• The PR follows the Contribution Guidelines
• All unit tests pass, and I have added new tests where possible
• Is this a breaking change? If yes, add "[BREAKING]" prefix to the title of the PR.

[moonbox3]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
packages/claude/agent_framework_claude
_agent.py	319	28	91%	407–408, 412, 424, 432–434, 436–437, 467–469, 488, 492, 494, 498, 507, 553, 556, 596, 601–602, 676, 763, 789–792
TOTAL	38517	4413	88%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
7700	34 💤	0 ❌	0 🔥	2m 6s ⏱️

[Copilot]

Pull request overview

This PR updates the Python Claude integration to use claude-agent-sdk v0.2.87 and surfaces newly available upstream configuration options in the ClaudeAgentOptions type to keep the integration aligned with the SDK’s expanded feature set.

Changes:

• Bump claude-agent-sdk requirement to >=0.2.87,<0.3 (and refresh uv.lock resolution).
• Extend ClaudeAgentOptions to include the new xhigh effort level and additional upstream SDK options (e.g., skills, session_id, task_budget, etc.).
• Add the TaskBudget type import for typing support.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
python/uv.lock	Updates the resolved dependency graph for claude-agent-sdk 0.2.87 (including new transitive deps like sniffio).
python/packages/claude/pyproject.toml	Bumps the claude-agent-sdk dependency constraint for the Claude integration package.
python/packages/claude/agent_framework_claude/_agent.py	Expands ClaudeAgentOptions typing surface to match new upstream SDK options and effort levels.

[github-actions]

Automated Code Review

Reviewers: 4 | Confidence: 91%

✓ Correctness

Clean dependency bump from claude-agent-sdk 0.1.x to 0.2.87. The changes are limited to: (1) widened version pin in pyproject.toml/uv.lock, (2) new TypedDict fields in ClaudeAgentOptions that pass through the existing options forwarding mechanism at _prepare_client_options lines 479-481, and (3) a TaskBudget type import in the TYPE_CHECKING block. The pass-through pattern (for key, value in self._default_options.items(): opts[key] = value) handles the new options without any additional logic. No correctness issues found.

✓ Security Reliability

Clean dependency bump from claude-agent-sdk 0.1.x to 0.2.87 with new typed configuration options exposed in ClaudeAgentOptions TypedDict. All new fields are optional, properly typed, and pass through as structured kwargs to SDKOptions (no string interpolation or shell execution). The resolved mcp dependency (1.27.2) addresses the noted CVE. No security or reliability concerns identified.

✓ Test Coverage

The PR adds 7 new passthrough options and a new effort level to the ClaudeAgentOptions TypedDict. These are forwarded to the SDK via an existing generic loop (lines 479-481) that is already tested implicitly. While there are no dedicated tests for the new options individually, the forwarding mechanism is covered by existing tests (e.g., test_prepare_client_options_with_instructions). The one gap worth noting is the potential interaction between the new session_id option and the existing resume mechanism — if both are set, both would be forwarded to the SDK — but this is a pre-existing design concern, not a regression introduced by this PR.

✗ Design Approach

The SDK bump itself looks fine, but the change currently exposes several new ClaudeAgentOptions keys through the same type used by run(..., options=...) without wiring those keys into the per-run path. That means callers can now pass session-related/runtime-looking options such as session_id, continue_conversation, or fork_session and get no effect, which is a design mismatch worth fixing before merge.

---

Automated review by giles17's agents