fix(deps): allow watchfiles 1.x so agentex-sdk installs on Python 3.14

[michaelxu2288]

What

adk/pyproject.toml pins watchfiles>=0.24.0,<1.0. watchfiles 0.24.0 has no CPython 3.14 wheel, so uv tool install agentex-sdk on a 3.14 interpreter (Homebrew's default python3 today) falls back to a maturin source build and fails, although the package classifiers advertise 3.14. watchfiles 1.x publishes abi3 wheels that cover 3.14 and keeps the awatch API used in cli/handlers/run_handlers.py. Relax the pin to <2.0 and upgrade the locked release (uv lock --upgrade-package watchfiles, 0.24.0 -> 1.3.0). The uv.lock diff touches only the watchfiles entries.

Test

• Baseline, scratch venv on CPython 3.14.7: uv pip install agentex-sdk fails building watchfiles 0.24.0.
• watchfiles 1.3.0 installs from its abi3 wheel and imports on CPython 3.14.7.
• tests/lib/cli passes on 3.12 with watchfiles 1.3.0; ruff check clean.

Confidence Score: 5/5

The PR appears safe to merge, though the committed lock should be refreshed to match the package versions.

What we checked:

• Python 3.14 gets an old wheel: No. The lock selects watchfiles 1.3.0 and lists compatible wheels.

Summary

This PR widens Python 3.14 install support, changes when task creation replies and where production client requests go, and updates release and CI workflows. It also documents main as the integration branch and adds security scanning workflows.

• Allows watchfiles 1.x and refreshes the lockfile.
• Waits for task creation to finish before replying, while event sending stays asynchronous.
• Points production clients at the production service and updates release and CI automation.

_{Reviews (3) · Last reviewed commit: "fix(deps): allow watchfiles 1.x so agent..."}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​watchfiles@​0.24.0 ⏵ 1.3.0	+1

View full report

[greptile-apps]

Comments Outside Diff

These findings could not be posted inline.

•  Lock records old package versions uv.lock:18 ▶

  uv.lock records both workspace packages as 0.21.0, but their pyproject.toml files declare 0.28.2. A developer checking whether the lock is current gets a stale-lock result, and a normal uv sync has to rewrite it. Please regenerate the lock after the version bump.

[greptile-apps]

Want your agent to iterate on Greptile's feedback? Start a greploop in Cursor and it will work through the open comments and keep going until this PR reviews clean.