From b6c6ad6815bf5e3267c6068b86fe8a1a99ef45de Mon Sep 17 00:00:00 2001 From: itswl Date: Fri, 13 Nov 2026 23:41:35 +0800 Subject: [PATCH] =?UTF-8?q?deps:=20fastapi=200.162.6,=20ruff=200.17.4,=20c?= =?UTF-8?q?laude-agent-sdk=200.2.181=20(CLI=202.1.323)=20=E2=80=94=20Depen?= =?UTF-8?q?dabot=20#59=20#60=20#61=20relocked?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The bot raised the floors and pins in requirements.txt (and the investigator's pyproject) without the locks, so every PR failed the lock check and its image build. Same recipe as before: the bot's diffs, the new versions installed into each venv (pins follow the bot; floors take the newest), the three locks regenerated. Only the intended pins moved. The SDK bump was checked offline on a built image against a recording stand-in model: the turn completes, an allowed read runs, a protected write is refused by the hook and never runs, an @path is not inlined, a /command reaches the model as text, and the guards still register with on_failure. Its Python changes are CLI discovery on Windows, settings that fail to load now raising (this engine passes none), and a client-app label that stays off until a later CLI. The new CLI adds a defer_loading DeferredToolPlaceholder beside the closed list of fourteen; called anyway it answers "No such tool available". Recorded in the closed-list note. --- ...03-the-investigators-built-in-tools-are-a-closed-list.md | 6 ++++++ hookjudge/requirements.lock | 4 ++-- hookjudge/requirements.txt | 4 ++-- hookprobe/pyproject.toml | 4 ++-- hookprobe/requirements.lock | 6 +++--- hookprobe/requirements.txt | 6 +++--- hookrelay/requirements.lock | 4 ++-- hookrelay/requirements.txt | 4 ++-- 8 files changed, 22 insertions(+), 16 deletions(-) diff --git a/.agents/notes/implemented/2026-11-03-the-investigators-built-in-tools-are-a-closed-list.md b/.agents/notes/implemented/2026-11-03-the-investigators-built-in-tools-are-a-closed-list.md index 2e3eca4..a498317 100644 --- a/.agents/notes/implemented/2026-11-03-the-investigators-built-in-tools-are-a-closed-list.md +++ b/.agents/notes/implemented/2026-11-03-the-investigators-built-in-tools-are-a-closed-list.md @@ -44,6 +44,12 @@ and Monitor and ToolSearch are refused as tools that do not exist. - The CLI ignores a name it does not know. A tool that a later CLI renames therefore drops out silently, and an SDK bump has to be checked against what the new CLI offers. It still accepts `Task` as the old name for `Agent`. +- Checked at SDK 0.2.181 (CLI 2.1.323, 2026-11-13): the request now carries a + fifteenth entry beside the fourteen, `DeferredToolPlaceholder`, marked + `defer_loading` and described as "Reserved placeholder that keeps deferred + tool loading active; never call this tool". It is not a capability: a + stand-in model scripted to call it got `No such tool available: + DeferredToolPlaceholder` back. The list stays fourteen. - An operator who wants a tool off the list, such as NotebookEdit or a scheduler, adds it in the engine. There is no setting for it, on purpose. - Not changed: the console's live plan still reads TodoWrite calls, which no diff --git a/hookjudge/requirements.lock b/hookjudge/requirements.lock index 1deaab4..0488a1f 100644 --- a/hookjudge/requirements.lock +++ b/hookjudge/requirements.lock @@ -12,7 +12,7 @@ click==8.4.2 coverage==7.16.2 cyclonedx-python-lib==11.12.0 defusedxml==0.7.1 -fastapi==0.162.0 +fastapi==0.162.6 filelock==4.2.4 h11==0.16.0 httpcore==1.0.9 @@ -48,7 +48,7 @@ python-dotenv==1.2.3 PyYAML==6.0.3 requests==2.34.2 rich==15.0.0 -ruff==0.17.3 +ruff==0.17.4 sortedcontainers==2.4.0 starlette==1.6.0 stevedore==5.9.0 diff --git a/hookjudge/requirements.txt b/hookjudge/requirements.txt index 89bd29a..38d5218 100644 --- a/hookjudge/requirements.txt +++ b/hookjudge/requirements.txt @@ -1,5 +1,5 @@ # Four runtime dependencies, chosen to stay four. -fastapi>=0.162.0 +fastapi>=0.162.2 uvicorn[standard]>=0.54.0 aiosqlite>=0.22.1 httpx>=0.28.1 @@ -8,7 +8,7 @@ httpx>=0.28.1 pytest>=9.2.0 pytest-asyncio>=1.4.1.post1 pytest-cov>=7.1.0 -ruff==0.17.3 +ruff==0.17.4 bandit>=1.9.4 pip-audit>=2.10.1 mypy>=2.4.1 diff --git a/hookprobe/pyproject.toml b/hookprobe/pyproject.toml index bdfe44b..7e77850 100644 --- a/hookprobe/pyproject.toml +++ b/hookprobe/pyproject.toml @@ -9,9 +9,9 @@ description = "Single-purpose deep-analysis agent runner: OpenClaw-compatible co readme = "README.md" requires-python = ">=3.12" dependencies = [ - "fastapi>=0.162.0", + "fastapi>=0.162.2", "uvicorn[standard]>=0.54.0", - "claude-agent-sdk>=0.2.176", + "claude-agent-sdk>=0.2.180", ] [tool.setuptools] diff --git a/hookprobe/requirements.lock b/hookprobe/requirements.lock index 130fa4d..dd56a86 100644 --- a/hookprobe/requirements.lock +++ b/hookprobe/requirements.lock @@ -9,13 +9,13 @@ CacheControl==0.14.4 certifi==2026.10.19 cffi==2.1.1 charset-normalizer==3.5.1 -claude-agent-sdk==0.2.179 +claude-agent-sdk==0.2.181 click==8.4.2 coverage==7.16.2 cryptography==50.0.0 cyclonedx-python-lib==11.12.0 defusedxml==0.7.1 -fastapi==0.162.0 +fastapi==0.162.6 filelock==4.2.4 h11==0.16.0 httpcore==1.0.9 @@ -61,7 +61,7 @@ referencing==0.37.0 requests==2.34.2 rich==15.0.0 rpds-py==2026.6.3 -ruff==0.17.3 +ruff==0.17.4 sniffio==1.3.1 sortedcontainers==2.4.0 sse-starlette==3.4.8 diff --git a/hookprobe/requirements.txt b/hookprobe/requirements.txt index fb096f5..76e7810 100644 --- a/hookprobe/requirements.txt +++ b/hookprobe/requirements.txt @@ -1,15 +1,15 @@ # Three runtime dependencies, chosen to stay three. The agent loop, built-in # tools, MCP client and SKILL.md loading all come from the Claude Agent SDK — # hookprobe itself is only a contract shell around one engine call. -fastapi>=0.162.0 +fastapi>=0.162.2 uvicorn[standard]>=0.54.0 -claude-agent-sdk>=0.2.176 +claude-agent-sdk>=0.2.180 # Test + lint (tests never import the SDK; they inject fake engines) pytest>=9.2.0 httpx>=0.28.1 pytest-cov>=7.1.0 -ruff==0.17.3 +ruff==0.17.4 bandit>=1.9.4 pip-audit>=2.10.1 mypy>=2.4.1 diff --git a/hookrelay/requirements.lock b/hookrelay/requirements.lock index 0b05688..d4d828d 100644 --- a/hookrelay/requirements.lock +++ b/hookrelay/requirements.lock @@ -12,7 +12,7 @@ click==8.4.2 coverage==7.16.2 cyclonedx-python-lib==11.12.0 defusedxml==0.7.1 -fastapi==0.162.0 +fastapi==0.162.6 filelock==4.2.4 h11==0.16.0 httpcore==1.0.9 @@ -48,7 +48,7 @@ python-dotenv==1.2.3 PyYAML==6.0.3 requests==2.34.2 rich==15.0.0 -ruff==0.17.3 +ruff==0.17.4 sortedcontainers==2.4.0 starlette==1.6.0 stevedore==5.9.0 diff --git a/hookrelay/requirements.txt b/hookrelay/requirements.txt index aabb421..f0a697a 100644 --- a/hookrelay/requirements.txt +++ b/hookrelay/requirements.txt @@ -1,5 +1,5 @@ # Runtime — five dependencies, chosen to stay five. -fastapi>=0.162.0 +fastapi>=0.162.2 uvicorn[standard]>=0.54.0 aiosqlite>=0.22.1 httpx>=0.28.1 @@ -9,7 +9,7 @@ pyyaml>=6.0.3 pytest>=9.2.0 pytest-asyncio>=1.4.1.post1 pytest-cov>=7.1.0 -ruff==0.17.3 +ruff==0.17.4 bandit>=1.9.4 pip-audit>=2.10.1 mypy>=2.4.1