[dfkunstler]

Issue # (if applicable)

Closes #379.

Reason for this change

strands-agents-tools 0.9.0 (PyPI, 2026-11-04) removed strands_tools.file_read and strands_tools.file_write. The package imports both at start. A new install, such as uvx --from git+..., resolves 0.9.0 and the CLI and the MCP server stop with an ImportError before they do any work. The committed uv.lock pins 0.8.6, so it does not show the defect.

Description of changes

Set the limit strands-agents-tools>=0.2,<0.9 in packages/threat-composer-ai/pyproject.toml, and update the matching requires-dist line in uv.lock (one line).

This is a short-term fix. The long-term fix moves threat_composer_workdir_file_read.py and threat_composer_workdir_file_write.py to strands.vended_tools. That change is larger: the vended read tool has no modes, globs or multi-path reads, so it changes what the agents can do and needs an eval run. It will be a separate pull request.

I regenerated uv.lock with a newer uv than the repository used (lock revision 3 to 5), and it rewrote about 200 lines. I reverted that and edited the one specifier line by hand. uv lock --check passes.

Describe any new or updated permissions being added

None.

Description of how you validated changes

• uv lock --check exits 0.
• A fresh, uncached install of the package (uv run --no-project --no-config --refresh --with ./threat-composer-ai) resolves strands-agents-tools 0.8.12, and threat_composer_workdir_file_read and threat_composer_workdir_file_write import.
• uv run --frozen pytest tests/tools: 39 passed.
• Before the change, import strands_tools.file_read and import strands_tools.file_write fail on 0.9.0 with the ImportErrors in [BUG] threat-composer-ai fails at import because strands-agents-tools 0.9.0 removed strands_tools.file_read and file_write #379.
• No new test: the existing tests run against the locked 0.8.6, so they cannot catch a new upstream release (the canary in ci(ai): Add dependency canary and import smoke test (relates to #362) #366 would, but it was not merged). The eval and the full nx targets were not run; this changes no code.

Checklist

• The title follows type(scope): Subject. It becomes the commit message on main.
• The build passes locally. See "Verify a change" in AGENTS.md. (Package tests only; see above.)
• If behaviour changed, the docs are updated in this pull request, or the description says why not. (No behaviour change.)
• If this touches an area the threat model covers, the threat model is updated, or the description says why not. (It does not: a dependency bound only.)

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.