fix(deps): upgrade claude-agent-sdk to 0.3.283 with Zod-safe MCP schemas #62

Why

PR #61 pinned @anthropic-ai/claude-agent-sdk at 0.3.239. With ^0.3.239 it resolves to 0.3.283, and that version's createSdkMcpServer makes MCP tools/list fail with -32603 Cannot read properties of undefined (reading 'push') on the Video Mode video-edit server. Nearly every Claude SDK feature in this epic arrived between 0.3.240 and 0.3.283. This issue blocks all C* issues.

Scope

1. Find the root cause first. Raise the pin locally and reproduce with pnpm test:api test/integration/video-codex-bridge.test.ts. Identify which tool schema breaks. src-api/src/shared/mcp/video-edit-server.ts mixes raw shapes with schemas imported from @neumar/video-ir (ContentGraphSchema, TimelineOpSchema, …). Candidates: a z.object passed where a raw shape is expected, .optional()/.describe() wrappers around imported objects, or a second Zod instance (the lockfile also carries [email protected]; check pnpm why zod). Also check whether the 0.3.282 @anthropic-ai/claude-agent-sdk/core entry, which uses the installed zod and MCP SDK, changes anything.
2. Fix the schemas at the source. No casts or wrappers that hide the problem. If the bug is upstream, file it with a minimal repro and link it here.
3. Add a regression test that runs tools/list against every createSdkMcpServer factory under src-api/src/shared/mcp/ (about 42 call sites).
4. Pin exactly at "0.3.283" (the runbook's pre-1.0 policy).
5. Go through the behavior changes below. Each one is either handled in code or noted as "no change needed" in the PR:
   • 0.3.268: TaskCreate/TodoWrite are default tools only on older models. On Opus 5.5 / Sonnet 5 they must appear in tools/allowedTools, so check the video and other custom allowlists.
   • 0.3.265: a cd made by the agent now persists across turns.
   • 0.3.267: systemPrompt append recording is on by default. Decide whether the per-turn buildSystemPromptAppend needs snapshot: false.
   • 0.3.243: Read tool PDF content now arrives inside tool_result. Check the renderers.
   • 0.3.283: set_max_thinking_tokens without a value no longer resets the budget; send null to reset.
   • 0.3.281: Settings.attribution is boolean | {...}.

Acceptance criteria

• Root cause written up in the PR description
• tools/list regression test covers every SDK MCP server factory
• src-api/package.json pins 0.3.283; the lockfile changes only as needed
• Every behavior-change item above is addressed

Verification

pnpm test:api, pnpm test:fast, pnpm test:gate, pnpm validate, pnpm --filter neumar-api lint, pnpm --filter neumar-api exec tsc -p tsconfig.json --noEmit. Manual smoke test: a Claude chat turn, a Video Mode turn listing video-edit tools, and a Codex-on-Video bridge turn.

Changelog: https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md

Plan: dev-doc/plan/2026-09-27-post-upgrade-sdk-feature-adoption.md (the section for this issue ID). The plan's parallel-agent protocol applies: one worktree and branch off main per issue, one PR that closes it, a regression test, only edited files formatted, and pnpm validate before the PR. Don't bump any dependency unless the issue says to.