Bump claude-agent-sdk to 0.1.63 and use top-level `skills` option

[olegbrok]

Summary

claude-agent-sdk v0.1.62 (2026-04-17) added a top-level skills parameter to ClaudeAgentOptions. It replaces the manual allowed_tools + setting_sources dance for enabling skills in a session. v0.1.63 (2026-04-18) bundled Claude CLI 2.1.114.

Current pin: claude-agent-sdk>=0.1.58 (pyproject.toml:37).

What changed upstream

• v0.1.62 — skills option on ClaudeAgentOptions: accepts \"all\" (every discovered skill), a list of skill names, or [] (disable all). Simplifies the SDK surface for skill-gated sessions.
• v0.1.63 — bundled CLI 2.1.114 (picks up 2.1.113's big feature drop: native binary spawn, subagent 10m stall timeout, bash deny rule hardening, MCP concurrent-call timeout fix, dangerouslyDisableSandbox security fix).

PinkyBot impact

We build ClaudeAgentOptions in src/pinky_daemon/streaming_session.py (line 223 sets allowed_tools from agent config). Skills are currently wired via MCP server registration + skill metadata per agent (see pinky_self skill surface). With the new option we could:

• Bump claude-agent-sdk>=0.1.63 in pyproject.toml
• In streaming_session.py, pass the agent's assigned skill names directly via options.skills=[\"skill-a\", \"skill-b\"] instead of (or in addition to) hand-crafted allowed_tools. Reduces duplication between our skill registry and the SDK's skill discovery.
• Regression-test skill loading per-agent after the switch — Barsik has 6 skills, other agents have varying sets.
• Pick up upstream Claude CLI security/perf fixes for free via 0.1.63 (subagent stall detection, MCP timeout fix, bash deny rule hardening).

Open questions

• Does options.skills=[...] compose with our MCP-backed skills (pinky-memory, pinky-messaging, etc.) or only file-based SKILL.md skills? Confirm before migration.
• If it's SKILL.md-only, value is smaller — the CLI bump is still worth it on security grounds.

Refs

• https://github.com/anthropics/claude-agent-sdk-python/releases/tag/v0.1.62
• https://github.com/anthropics/claude-code/releases/tag/v2.1.113

🤖 Opened by Barsik

[bradbrok]

Superseded — closing.

pyproject.toml now pins claude-agent-sdk>=0.1.68 (bumped via PR #322 / commit e6de25a). The 0.1.63 target in this issue is well past. The skills option evaluation from v0.1.62 can be tracked separately if desired.

🤖 Barsik heartbeat

---

Generated by Claude Code