chore: address follow-ups from the built-in agent removal

[alDuncanson]

Four small fixes noted while removing the built-in agent in #92.

Stacked on #92. Base is fix/remove-builtin-agent, so the diff stays reviewable on its own. Retarget to main once #92 merges.

task commands accept the ID positionally

handler task get <id> failed with Missing option '--task', which reads as a bug next to card get --url and server show NAME. All five task commands — get, cancel, resubscribe, notification set, notification get — now take the ID either way:

handler task get task-123 --server my-agent     # new
handler task get --server my-agent --task task-123   # still works

Both forms together are fine when they agree, and an error when they differ, rather than silently preferring one:

$ handler task get task-abc --task task-xyz --url ...
Error: Conflicting task IDs: 'task-abc' was given positionally and 'task-xyz' with --task.

$ handler task get --url ...
Error: Missing task ID. Pass it positionally (e.g. `task-123`) or with --task.

--task is unchanged, so nothing breaks. One side effect worth noting: --params '{"task_id": ...}' now works on its own, since the resolver runs before the payload merge and the check happens after. Previously --task was required even when the payload already carried the ID.

MCP serverInfo reported the mcp library version

Clients inspecting serverInfo saw "version": "1.29.0" — the mcp package version, not Handler's. FastMCP exposes no version parameter, and the low-level server falls back to the library version when its own is unset, so it is set explicitly on the underlying server.

Verified over stdio: {"name": "Handler", "version": "0.2.0", ...}.

Snapshots no longer break on every release

The three TUI snapshots embedded the rendered footer version, so any version bump invalidated all of them and required a --snapshot-update as part of every release. The snapshot environment now freezes it, consistent with how the fixtures already freeze agent version, protocol version, and timestamps.

Verified by resolving the package at a synthetic 9.9.9 and running the suite — all 3 snapshots and the footer assertion pass, where previously all 4 would fail. The footer test itself still asserts real version rendering, now derived from __version__ rather than hardcoded.

starlette is declared directly

webhook.py imports starlette but received it transitively through a2a-sdk[http-server]. A change in that extra would have broken handler server run push with no signal here. No resolution change — it was already in the tree.

Verification

ruff, ruff format, ty, and 422 tests pass (up from 415; 7 new tests cover the positional ID, the conflict and missing cases, and --params-only).

Lockfile checked against main: no package resolves older, so the dependabot cryptography 50.0.0 and aiohttp 3.14.3 bumps are preserved.

🤖 Generated with Claude Code