build(deps): bump claude-agent-sdk from 0.2.126 to 0.2.129 in /claude-agent-sdk

[dependabot]

Bumps claude-agent-sdk from 0.2.126 to 0.2.129.

Release notes

Sourced from claude-agent-sdk's releases.

v0.2.129

Breaking Changes

• Skill name validation in ClaudeAgentOptions.skills: Skill names containing parentheses, commas, control characters, wildcards (*, :*), leading /, surrounding whitespace, or surrogate code points now raise ValueError at connect time. skills=["plugin:*"] and skills=["*"] should be replaced with skills="all" or a Skill(...) rule in allowed_tools. Names with leading whitespace or / previously built rules that could never match (silently disabling the skill) and now raise explicitly (#1145)

Bug Fixes

• Validated skill names to prevent --allowedTools injection: Skill names from ClaudeAgentOptions(skills=[...]) were passed unchecked into the CLI's --allowedTools value, which splits on commas and spaces. A crafted name could inject extra permission rules. The transport now validates each name and rejects delimiter-carrying or malformed values (#1145)

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.221

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.129/

pip install claude-agent-sdk==0.2.129

v0.2.128

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.220

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.128/

pip install claude-agent-sdk==0.2.128

v0.2.127

Bug Fixes

• Fixed premature stdin closure when background tasks are in flight: query() no longer closes stdin on the first result frame when background tasks (e.g. run_in_background: true subagents) are still running. Previously, closing stdin too early caused SDK-MCP tool calls from background tasks to fail with "Stream closed" and silently bypassed PreToolUse hooks. Stdin now stays open until all in-flight tasks complete and the final result frame arrives (#1103)

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.219

---

... (truncated)

Changelog

Sourced from claude-agent-sdk's changelog.

0.2.129

Breaking Changes

• Skill name validation in ClaudeAgentOptions.skills: Skill names containing parentheses, commas, control characters, wildcards (*, :*), leading /, surrounding whitespace, or surrogate code points now raise ValueError at connect time. skills=["plugin:*"] and skills=["*"] should be replaced with skills="all" or a Skill(...) rule in allowed_tools. Names with leading whitespace or / previously built rules that could never match (silently disabling the skill) and now raise explicitly (#1145)

Bug Fixes

• Validated skill names to prevent --allowedTools injection: Skill names from ClaudeAgentOptions(skills=[...]) were passed unchecked into the CLI's --allowedTools value, which splits on commas and spaces. A crafted name could inject extra permission rules. The transport now validates each name and rejects delimiter-carrying or malformed values (#1145)

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.221

0.2.128

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.220

0.2.127

Bug Fixes

• Fixed premature stdin closure when background tasks are in flight: query() no longer closes stdin on the first result frame when background tasks (e.g. run_in_background: true subagents) are still running. Previously, closing stdin too early caused SDK-MCP tool calls from background tasks to fail with "Stream closed" and silently bypassed PreToolUse hooks. Stdin now stays open until all in-flight tasks complete and the final result frame arrives (#1103)

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.219

Commits

• 60ecf63 docs: update changelog for v0.2.129
• 562dba6 chore: release v0.2.129
• 0fd46ab chore: bump bundled CLI version to 2.1.221
• cbed47d fix(transport): validate skill names in ClaudeAgentOptions.skills (#1145)
• f8b9ec9 docs: update changelog for v0.2.128
• ec77673 chore: release v0.2.128
• cadaa63 chore: bump bundled CLI version to 2.1.220
• 3145cc6 docs: update changelog for v0.2.127
• 26b1a5c chore: release v0.2.127
• f277fd8 chore: bump bundled CLI version to 2.1.219
• Additional commits viewable in compare view