Claude Agent SDK for Python 0.2

Apply the Python 3 baseline first. These rules cover Claude Agent SDK for Python 0.2 permissions, tools, hooks, MCP servers, sessions, subagents, filesystem scope, sandboxing, and operations.

Options and permission policy

• Build ClaudeAgentOptions from trusted server policy and do not let user text select permission mode, settings sources, plugins, skills, extra_args, or executable paths. Set permission_mode explicitly; use "default" when unresolved approval requests must reach application policy, and never use an automatic classifier as the only authorization check.
• On 0.2.158 and later, set verbatim_prompts=True when composing prompts from user, tool, or third-party text so @path mentions and slash commands in it are not expanded. Claude Code older than 2.1.248 ignores the option, and the SDK only logs a warning, which it skips when CLAUDE_AGENT_SDK_SKIP_VERSION_CHECK is set or the version probe fails; check a custom cli_path version yourself and refuse to start a CLI that ignores it. Supply required trusted context explicitly because this also skips turn-start attachments; it does not make the text trustworthy or remove tool capabilities.
• Set ClaudeAgentOptions.system_prompt and any agent or skill instructions only from reviewed application policy. Keep user, tool, retrieved, and third-party text in the query() input or tool-result data with clear provenance; never concatenate it into authoritative instructions or let it select permissions, tools, or settings. Treat any request inside that lower-trust content to change instructions or grant