[cryptotavares]

Description

Summary: Upgrade the Claude Agent SDK from ^0.3.220 to ^0.3.310, the newest stable release eligible under the repository’s three-day minimum-age policy.

Version selection

The npm registry check at 2026-10-27T17:40:32.851Z uses cutoff 2026-10-24T17:40:32.839Z.

Release	Published at	Decision
0.3.310	2026-10-23T21:21:54.828Z	Select: newest stable release older than three days.
0.3.311 (latest)	2026-10-26T19:49:59.951Z	Exclude: release is too young.

Install command: corepack yarn add '@anthropic-ai/claude-agent-sdk@^0.3.310'.
Yarn applies npmMinimalAgeGate: 4320 without overrides or new preapprovals.

Changes

• Update the SDK range in package.json to ^0.3.310.
• Resolve the SDK and all eight optional platform packages to 0.3.310 in yarn.lock.
• Update the workspace dependency entry and SDK checksum.

flowchart TD
    A[Request SDK upgrade] --> B[Apply three-day minimum-age policy]
    B --> C[Select SDK 0.3.310]
    C --> D[Resolve eight matching platform packages]
    D --> E[Validate compatibility and built package types]
    classDef new fill:#fff3cd,stroke:#d39e00
    class C,D new

Loading

Yellow boxes are new.

Outcome

Item	Before	After
SDK range	^0.3.220	^0.3.310
Locked SDK and optional platform packages	0.3.220	0.3.310
Source compatibility edits	—	None required by the independent review.

Decisions for reviewers

Decision	Reason
Select 0.3.310	It meets the existing three-day rule; 0.3.311 does not.
Keep the dependency-only scope	Independent review finds no upgrade defects and no new peer requirements.

Review guide

Order	File	Check
1	package.json	Verify the SDK version range.
2	yarn.lock	Verify the SDK, eight platform packages, workspace entry, and checksum.

Verification and review

Environment: Node v24.22.1, Yarn 4.16.0, native Darwin ARM64.

Checks completed by the parent session against these changes:

• corepack yarn typecheck — passes.
• corepack yarn lint — passes.
• corepack yarn test — 652 tests pass; four tests skip. Coverage thresholds pass.
• corepack yarn build — passes.
• A consumer of the built public types compiles.
• The native Darwin ARM64 CLI reports 2.1.310; this checks only the CLI version.

The initial test run precedes the build. Its ATTW step reports This package does not contain types, with exit code zero. That initial ATTW result does not validate the published types.

Finalization validates the built package separately:

• corepack yarn attw --pack — exits zero.
• node node_modules/@arethetypeswrong/cli/dist/index.js --pack --format json — confirms types.kind: "included" and an empty problems array. Root declarations resolve for Node10, Node16 CJS, Node16 ESM, and bundler modes.
• git diff --check — passes.
• A fresh npm registry read confirms the selection and publication timestamps at the stated cutoff.

Independent review reports no findings requiring fixes. It covers old/new metadata and declarations, adapter/query/public aliases, translator fields, judge options and structured output, host SDK version discovery, and Docker bridge compatibility. Existing peer warnings are unchanged.

Live model execution and Docker runtime execution are not verified. No paid model calls, Langfuse writes, or wallet/browser sessions are performed.

Preexisting follow-up

src/adapters/claude-message-translator.ts:253 reads elapsed_seconds. Both SDK versions expose elapsed_time_seconds. The existing test fixture also uses the wrong field. This predates the upgrade and belongs in a separate PR.

References

• SDK 0.3.310 npm metadata
• SDK 0.3.311 npm metadata
• Repository policy: .yarnrc.yml:18–27.

Checklist

• Tests are included if applicable — existing tests validate this dependency-only upgrade.
• Changelog changes omitted as requested.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​anthropic-ai/​claude-agent-sdk@​0.3.220 ⏵ 0.3.310	+1		+2

View full report

[cryptotavares]

CI compatibility failure diagnosis — shared dependency drift

Run 40555627897, Compatibility test (22.x), job 122371407968, fails during Install dependencies via Yarn, before tests run.

The workflow at .github/workflows/build-lint-test.yml:109–111 removes yarn.lock and resolves all dependency ranges again. Yarn finishes resolution, fetching, and linking. The unchanged plugin-allow-scripts post-install hook then exits 1:

@lavamoat/allow-scripts has detected dependencies without configuration. explicit configuration required.

packages missing configuration:
- @langfuse/otel>@opentelemetry/otlp-exporter-base>@opentelemetry/otlp-transformer>protobufjs [1 location(s)]

Cause: Fresh resolution selects @langfuse/otel@5.14.0 from the existing ^5.3.0 range. Langfuse adds the @opentelemetry/otlp-exporter-base peer in 5.12.0, published 2026-10-05T08:13:38.964Z. LavaMoat traverses peer dependencies and selects the shorter canonical path through that peer. The resolved chain reaches otlp-exporter-base@0.217.0, otlp-transformer@0.217.0, and protobufjs@8.0.1, which has a postinstall script. The existing explicit deny policy covers the older, longer path through exporter-trace-otlp-http, not the new canonical path.

Base comparison and reproduction:

• Base main run 34505911833 for 804e4607aae55941d655e8015ba7321524a99959 passes all compatibility jobs on September 10. Its Node22 log resolves Langfuse 5.11.0, before the new peer exists.
• An isolated local lockfile-free install uses a byte-identical copy of the base package.json, including the old SDK range ^0.3.220. On Node v24.22.1 and Yarn 4.16.0, YARN_ENABLE_IMMUTABLE_INSTALLS=false corepack yarn install reproduces the identical missing-policy error. A direct corepack yarn run allow-scripts invocation confirms exit code 1.
• The reproduction keeps npmMinimalAgeGate: 4320, scripts disabled, the same plugin, and the existing preapproval names. No policy bypass is used.
• Base and PR both resolve the SDK to 0.3.310 when the lockfile is absent: the old caret range already admits it. Workflow, Yarn policy, plugin, and LavaMoat configuration have no branch changes.

Disposition: This is a reproducible base dependency-policy incompatibility caused by fresh Langfuse resolution, not an SDK-upgrade regression. No source changes or follow-up commit are required for this upgrade. The failure is deterministic, so this investigation does not rerun or bypass CI. The compatibility check remains failing; 20.x/24.x are cancelled by fail-fast. Build and lint on Node24, and regular tests on Node20/22/24, pass. The PR remains draft.

[cryptotavares]

Updated LavaMoat policy in f82a6e5 via yarn allow-scripts auto. The newly resolved protobufjs lifecycle-script path is explicitly set to false. Verified yarn allow-scripts, installation and the full test suite against a fresh dependency resolution (652 passed, 4 skipped), then restored the branch lockfile and passed immutable installation and lint. CI is rerunning on this commit.