Allow websockets 16 and 17

[NikhilShahi]

Summary

websockets = ">=13,<16" (from #58) kept the SDK from installing next to anything that needs websockets 16 or later. Anthropic's browser toolset quickstart (anthropics/claude-quickstarts, browser-toolset/python/requirements.txt) needs websockets>=16.1, so pip install hyperbrowser there fails:

And because you require websockets>=16.1, we can conclude that your requirements are unsatisfiable.

That also blocks hyperbrowser-claude-toolsets, which depends on this SDK.

Changes

• websockets = ">=13,<18": every release through 17.2, the newest.
  • The SDK uses only connect(url, additional_headers=, open_timeout=, sock=), send(str), recv(), close() and ConnectionClosed, all unchanged through 17.2.
  • websockets 16.0's only breaking change was dropping Python 3.9. 17.0's changes (keyword-only booleans, ClientConnection(socket=) renamed sock, removed 9.0 aliases, header encoding) touch none of those calls.
  • pip keeps picking 13.1 on Python 3.8 and 15.0.1 on 3.9.
• websockets 17.1 deprecates calling the synchronous connect() outside a with block, unless legacy=True is passed. So the sync file-watch and terminal connections pass legacy=True where connect() accepts it (SYNC_WEBSOCKET_CONNECT_OPTIONS). Behaviour is the same, without the DeprecationWarning. The async client is unaffected.
• poetry.lock: only the content hash changes. The locked websockets stays 13.1, which is valid for the whole Python range. Relocking from scratch with Poetry 2.4.1 also rewrites unrelated cryptography/cffi entries, the same on main, so that's left out.
• Version 1.12.0: a minor release, since the allowed websockets range widens.

Tests

• Non-E2E suite (as quality.yml runs it), with the websockets pip resolves for each Python:

  Python	websockets	Result
  3.8	13.1	808 passed
  3.9	15.0.1	808 passed
  3.10	16.1.1	808 passed
  3.11–3.14	17.2	808 passed

• New tests in test_sandbox_wire_contract.py:

  • a real local websocket echo through the sync connect() with DeprecationWarning as an error (it fails on 17.2 without legacy=True);
  • the sync terminal attach passes the option.

• Sandbox E2E against production (test_terminal_smoke, test_async_terminal_smoke, test_files, test_async_files, which cover the websocket file-watch and PTY paths): 4/4 passed on websockets 15.0.1, 16.1.1 and 17.2, with websockets DeprecationWarnings as errors.

• Typing and packaging: typing tests (mypy 1.14.1, Pyright 1.1.411) pass; ruff check (0.3.7) passes; poetry check --lock passes; the build passes twine check; the wheel declares websockets (>=13,<18).

• Next to the quickstart: the 1.12.0 wheel installs next to its requirements.txt (websockets 17.2, anthropic 1.13.0). 1.11.1 does not.

🤖 Generated with Claude Code