argus-cloud-optimizer 0.5.0__tar.gz → 0.6.0__tar.gz

{argus_cloud_optimizer-0.5.0 → argus_cloud_optimizer-0.6.0}/.env.example

@@ -70,11 +70,13 @@ DRY_RUN=false
 
 # -----------------------------------------------------------------------------
 # Remediation — Policy Engine + Jira Integration
-# Policies are YAML files in ARGUS_POLICIES_DIR. Argus never executes changes;
+# Policies are YAML files in ARGUS_POLICY_DIR. Argus never executes changes;
 # it creates Jira tickets for human review. See config/policies/ for examples
 # and CONTRIBUTING.md for how to write policies.
 # -----------------------------------------------------------------------------
-ARGUS_POLICIES_DIR=./config/policies        # directory containing policy YAML files
+# Opt-in: create Jira tickets automatically after every scan (default: false).
+# `argus policies apply --confirm` works without this; it is already explicit.
+REMEDIATION_ENABLED=false
 
 # Jira credentials — required for `argus policies apply --confirm`
 # Create an API token at: https://id.atlassian.com/manage-profile/security/api-tokens
@@ -84,6 +86,8 @@ JIRA_API_TOKEN=                             # Atlassian API token (not your pass
 
 # Directory containing your *.yaml policy files (one policy per file).
 # Copy from config/policies.example/ to get started, then customise.
+# Used by both `argus policies ...` and scheduled scans. The older name
+# ARGUS_POLICIES_DIR is still accepted; if both are set, this one wins.
 ARGUS_POLICY_DIR=./config/policies
 
 # Path to integrations config (project key, labels, priority map).

{argus_cloud_optimizer-0.5.0/argus_cloud_optimizer.egg-info → argus_cloud_optimizer-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: argus-cloud-optimizer
-Version: 0.5.0
+Version: 0.6.0
 Summary: Argus — AI Cloud Detective for AWS, GCP, and Azure
 Author-email: Vamshi Siddarth Gaddam <vamshisiddarth02@gmail.com>
 License-Expression: MIT
@@ -101,7 +101,17 @@ Top findings
 
 ---
 
-## 🆕 What's new in v0.5.0
+## 🆕 What's new in v0.6.0
+
+> **Breaking:** scheduled scans now create Jira tickets only when `REMEDIATION_ENABLED=true` (default `false`). If you ran v0.5.0 with Jira configured, set it to keep tickets flowing. `argus policies apply --confirm` is unaffected.
+
+- **Dry runs never touch Jira** — `DRY_RUN=true` / `--dry-run` previously still created real tickets when Jira was configured.
+- **One summary log line per remediation run**, with `error_type` on failures.
+- **`ARGUS_POLICY_DIR`** is read by both the CLI and scheduled scans (`ARGUS_POLICIES_DIR` still accepted).
+
+[Full changelog →](CHANGELOG.md) · [Project status →](docs/roadmap.md)
+
+### v0.5.0
 
 > **Remediation is now first-class.** Argus goes beyond reporting — it generates Jira tickets, suggests exact resize targets, and tracks acceptance rates.
 
@@ -159,25 +169,29 @@ argus policies apply --report scan_report.json --confirm
 argus policies stats   # acceptance rate per policy from audit log
 ```
 
+To create tickets automatically after every scheduled scan (Lambda, Cloud Run, Azure Function), set `REMEDIATION_ENABLED=true`. It is off by default; `apply --confirm` above works without it.
+
 ### Bundled policies (13)
 
-| Policy | Cloud | Action | Cost threshold |
-|--------|-------|--------|---------------|
-| `aws-ec2-stop-idle-14d` | AWS | stop | $20/mo |
-| `aws-rds-resize-high-cost-idle` | AWS | resize | $100/mo |
-| `aws-ebs-delete-unattached-30d` | AWS | delete | $5/mo |
-| `aws-elb-delete-idle` | AWS | delete | $20/mo |
-| `aws-elasticache-delete-idle-30d` | AWS | delete | $50/mo |
-| `aws-lambda-delete-unused-30d` | AWS | delete | $0 |
-| `aws-redshift-snapshot-delete-14d` | AWS | snapshot_delete | $100/mo |
-| `gcp-compute-stop-idle-7d` | GCP | stop | $20/mo |
-| `gcp-sql-stop-idle-14d` | GCP | stop | $20/mo |
-| `gcp-gke-reduce-nodes-underutilised` | GCP | reduce_nodes | $200/mo |
-| `azure-vm-stop-idle-14d` | Azure | stop | $20/mo |
-| `azure-sql-resize-underutilised` | Azure | resize | $50/mo |
-| `azure-aks-reduce-nodes-underutilised` | Azure | reduce_nodes | $150/mo |
-
-All policies exclude `environment: prod` and `argus-exempt: "true"` tags by default. Add your own in `config/policies/` — see [CONTRIBUTING.md](CONTRIBUTING.md).
+| Policy | Cloud | Action | Cost floor | Idle days |
+|--------|-------|--------|-----------|-----------|
+| `aws-redshift-snapshot-delete-14d` | AWS | snapshot_delete | $100/mo | 14 |
+| `aws-rds-resize-high-cost-idle` | AWS | resize | $100/mo | — |
+| `aws-ebs-delete-unattached-30d` | AWS | snapshot_delete | — | 30 |
+| `aws-elasticache-delete-idle-30d` | AWS | delete | — | 30 |
+| `aws-elb-delete-idle` | AWS | delete | $10/mo | — |
+| `aws-ec2-stop-idle-14d` | AWS | stop | — | 14 |
+| `aws-lambda-delete-unused-30d` | AWS | delete | — | 30 |
+| `gcp-gke-reduce-nodes-underutilised` | GCP | reduce_nodes | $200/mo | — |
+| `gcp-sql-stop-idle-14d` | GCP | stop | — | 14 |
+| `gcp-compute-stop-idle-7d` | GCP | stop | — | 7 |
+| `azure-aks-reduce-nodes-underutilised` | Azure | reduce_nodes | $150/mo | — |
+| `azure-sql-resize-underutilised` | Azure | resize | $50/mo | — |
+| `azure-vm-stop-idle-14d` | Azure | stop | — | 14 |
+
+Each policy also has AI-priority and metric conditions; see [Policies](https://vamshisiddarth.github.io/argus/remediation/policies/#bundled-policies) for the full table.
+
+All policies skip resources tagged `environment: prod` (or `production`) and resources tagged `argus-exempt: "true"` — either tag on its own is enough. Add your own in `config/policies/` — see [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ### Safety guarantees
 
@@ -239,7 +253,7 @@ docker run --rm \
 
 ```bash
 pip install argus-cloud-optimizer
-argus --version   # argus 0.5.0
+argus --version   # argus 0.6.0
 argus --help
 ```
 
@@ -304,7 +318,7 @@ argus chat                                       # auto-detects cloud
 ```
 
 ```
-Argus v0.5.0 — AI Cloud Detective
+Argus v0.6.0 — AI Cloud Detective
 Cloud: AWS  |  Accounts: prod (123456789012)  |  Budget: $1.00/session
 Tip: end a line with \ to continue on the next line.
 Type your question, or /help for commands.

{argus_cloud_optimizer-0.5.0 → argus_cloud_optimizer-0.6.0}/README.md

@@ -37,7 +37,17 @@ Top findings
 
 ---
 
-## 🆕 What's new in v0.5.0
+## 🆕 What's new in v0.6.0
+
+> **Breaking:** scheduled scans now create Jira tickets only when `REMEDIATION_ENABLED=true` (default `false`). If you ran v0.5.0 with Jira configured, set it to keep tickets flowing. `argus policies apply --confirm` is unaffected.
+
+- **Dry runs never touch Jira** — `DRY_RUN=true` / `--dry-run` previously still created real tickets when Jira was configured.
+- **One summary log line per remediation run**, with `error_type` on failures.
+- **`ARGUS_POLICY_DIR`** is read by both the CLI and scheduled scans (`ARGUS_POLICIES_DIR` still accepted).
+
+[Full changelog →](CHANGELOG.md) · [Project status →](docs/roadmap.md)
+
+### v0.5.0
 
 > **Remediation is now first-class.** Argus goes beyond reporting — it generates Jira tickets, suggests exact resize targets, and tracks acceptance rates.
 
@@ -95,25 +105,29 @@ argus policies apply --report scan_report.json --confirm
 argus policies stats   # acceptance rate per policy from audit log
 ```
 
+To create tickets automatically after every scheduled scan (Lambda, Cloud Run, Azure Function), set `REMEDIATION_ENABLED=true`. It is off by default; `apply --confirm` above works without it.
+
 ### Bundled policies (13)
 
-| Policy | Cloud | Action | Cost threshold |
-|--------|-------|--------|---------------|
-| `aws-ec2-stop-idle-14d` | AWS | stop | $20/mo |
-| `aws-rds-resize-high-cost-idle` | AWS | resize | $100/mo |
-| `aws-ebs-delete-unattached-30d` | AWS | delete | $5/mo |
-| `aws-elb-delete-idle` | AWS | delete | $20/mo |
-| `aws-elasticache-delete-idle-30d` | AWS | delete | $50/mo |
-| `aws-lambda-delete-unused-30d` | AWS | delete | $0 |
-| `aws-redshift-snapshot-delete-14d` | AWS | snapshot_delete | $100/mo |
-| `gcp-compute-stop-idle-7d` | GCP | stop | $20/mo |
-| `gcp-sql-stop-idle-14d` | GCP | stop | $20/mo |
-| `gcp-gke-reduce-nodes-underutilised` | GCP | reduce_nodes | $200/mo |
-| `azure-vm-stop-idle-14d` | Azure | stop | $20/mo |
-| `azure-sql-resize-underutilised` | Azure | resize | $50/mo |
-| `azure-aks-reduce-nodes-underutilised` | Azure | reduce_nodes | $150/mo |
-
-All policies exclude `environment: prod` and `argus-exempt: "true"` tags by default. Add your own in `config/policies/` — see [CONTRIBUTING.md](CONTRIBUTING.md).
+| Policy | Cloud | Action | Cost floor | Idle days |
+|--------|-------|--------|-----------|-----------|
+| `aws-redshift-snapshot-delete-14d` | AWS | snapshot_delete | $100/mo | 14 |
+| `aws-rds-resize-high-cost-idle` | AWS | resize | $100/mo | — |
+| `aws-ebs-delete-unattached-30d` | AWS | snapshot_delete | — | 30 |
+| `aws-elasticache-delete-idle-30d` | AWS | delete | — | 30 |
+| `aws-elb-delete-idle` | AWS | delete | $10/mo | — |
+| `aws-ec2-stop-idle-14d` | AWS | stop | — | 14 |
+| `aws-lambda-delete-unused-30d` | AWS | delete | — | 30 |
+| `gcp-gke-reduce-nodes-underutilised` | GCP | reduce_nodes | $200/mo | — |
+| `gcp-sql-stop-idle-14d` | GCP | stop | — | 14 |
+| `gcp-compute-stop-idle-7d` | GCP | stop | — | 7 |
+| `azure-aks-reduce-nodes-underutilised` | Azure | reduce_nodes | $150/mo | — |
+| `azure-sql-resize-underutilised` | Azure | resize | $50/mo | — |
+| `azure-vm-stop-idle-14d` | Azure | stop | — | 14 |
+
+Each policy also has AI-priority and metric conditions; see [Policies](https://vamshisiddarth.github.io/argus/remediation/policies/#bundled-policies) for the full table.
+
+All policies skip resources tagged `environment: prod` (or `production`) and resources tagged `argus-exempt: "true"` — either tag on its own is enough. Add your own in `config/policies/` — see [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ### Safety guarantees
 
@@ -175,7 +189,7 @@ docker run --rm \
 
 ```bash
 pip install argus-cloud-optimizer
-argus --version   # argus 0.5.0
+argus --version   # argus 0.6.0
 argus --help
 ```
 
@@ -240,7 +254,7 @@ argus chat                                       # auto-detects cloud
 ```
 
 ```
-Argus v0.5.0 — AI Cloud Detective
+Argus v0.6.0 — AI Cloud Detective
 Cloud: AWS  |  Accounts: prod (123456789012)  |  Budget: $1.00/session
 Tip: end a line with \ to continue on the next line.
 Type your question, or /help for commands.

{argus_cloud_optimizer-0.5.0 → argus_cloud_optimizer-0.6.0}/adapters/azure/cost_management.py

@@ -102,7 +102,7 @@ def _query_batch(
             aggregation={"totalCost": {"name": "PreTaxCost", "function": "Sum"}},  # type: ignore[dict-item]
             grouping=[QueryGrouping(type="Dimension", name="ResourceId")],
             filter=QueryFilter(
-                dimensions=QueryComparisonExpression(
+                dimensions=QueryComparisonExpression(  # type: ignore[call-overload]
                     name="ResourceId",
                     operator="In",
                     values=resource_ids,

{argus_cloud_optimizer-0.5.0 → argus_cloud_optimizer-0.6.0}/adapters/azure/monitor.py

@@ -372,8 +372,6 @@ def _discover_metrics(
     credential: Any = None,
 ) -> list[tuple[str, str]]:
     """Auto-discover available metrics for unknown Azure resource types."""
-    from azure.monitor.query import MetricsQueryClient
-
     cred = credential or DefaultAzureCredential()
     client = MetricsQueryClient(cred, connection_timeout=10, read_timeout=60)
     discovered: list[tuple[str, str]] = []

{argus_cloud_optimizer-0.5.0 → argus_cloud_optimizer-0.6.0/argus_cloud_optimizer.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: argus-cloud-optimizer
-Version: 0.5.0
+Version: 0.6.0
 Summary: Argus — AI Cloud Detective for AWS, GCP, and Azure
 Author-email: Vamshi Siddarth Gaddam <vamshisiddarth02@gmail.com>
 License-Expression: MIT
@@ -101,7 +101,17 @@ Top findings
 
 ---
 
-## 🆕 What's new in v0.5.0
+## 🆕 What's new in v0.6.0
+
+> **Breaking:** scheduled scans now create Jira tickets only when `REMEDIATION_ENABLED=true` (default `false`). If you ran v0.5.0 with Jira configured, set it to keep tickets flowing. `argus policies apply --confirm` is unaffected.
+
+- **Dry runs never touch Jira** — `DRY_RUN=true` / `--dry-run` previously still created real tickets when Jira was configured.
+- **One summary log line per remediation run**, with `error_type` on failures.
+- **`ARGUS_POLICY_DIR`** is read by both the CLI and scheduled scans (`ARGUS_POLICIES_DIR` still accepted).
+
+[Full changelog →](CHANGELOG.md) · [Project status →](docs/roadmap.md)
+
+### v0.5.0
 
 > **Remediation is now first-class.** Argus goes beyond reporting — it generates Jira tickets, suggests exact resize targets, and tracks acceptance rates.
 
@@ -159,25 +169,29 @@ argus policies apply --report scan_report.json --confirm
 argus policies stats   # acceptance rate per policy from audit log
 ```
 
+To create tickets automatically after every scheduled scan (Lambda, Cloud Run, Azure Function), set `REMEDIATION_ENABLED=true`. It is off by default; `apply --confirm` above works without it.
+
 ### Bundled policies (13)
 
-| Policy | Cloud | Action | Cost threshold |
-|--------|-------|--------|---------------|
-| `aws-ec2-stop-idle-14d` | AWS | stop | $20/mo |
-| `aws-rds-resize-high-cost-idle` | AWS | resize | $100/mo |
-| `aws-ebs-delete-unattached-30d` | AWS | delete | $5/mo |
-| `aws-elb-delete-idle` | AWS | delete | $20/mo |
-| `aws-elasticache-delete-idle-30d` | AWS | delete | $50/mo |
-| `aws-lambda-delete-unused-30d` | AWS | delete | $0 |
-| `aws-redshift-snapshot-delete-14d` | AWS | snapshot_delete | $100/mo |
-| `gcp-compute-stop-idle-7d` | GCP | stop | $20/mo |
-| `gcp-sql-stop-idle-14d` | GCP | stop | $20/mo |
-| `gcp-gke-reduce-nodes-underutilised` | GCP | reduce_nodes | $200/mo |
-| `azure-vm-stop-idle-14d` | Azure | stop | $20/mo |
-| `azure-sql-resize-underutilised` | Azure | resize | $50/mo |
-| `azure-aks-reduce-nodes-underutilised` | Azure | reduce_nodes | $150/mo |
-
-All policies exclude `environment: prod` and `argus-exempt: "true"` tags by default. Add your own in `config/policies/` — see [CONTRIBUTING.md](CONTRIBUTING.md).
+| Policy | Cloud | Action | Cost floor | Idle days |
+|--------|-------|--------|-----------|-----------|
+| `aws-redshift-snapshot-delete-14d` | AWS | snapshot_delete | $100/mo | 14 |
+| `aws-rds-resize-high-cost-idle` | AWS | resize | $100/mo | — |
+| `aws-ebs-delete-unattached-30d` | AWS | snapshot_delete | — | 30 |
+| `aws-elasticache-delete-idle-30d` | AWS | delete | — | 30 |
+| `aws-elb-delete-idle` | AWS | delete | $10/mo | — |
+| `aws-ec2-stop-idle-14d` | AWS | stop | — | 14 |
+| `aws-lambda-delete-unused-30d` | AWS | delete | — | 30 |
+| `gcp-gke-reduce-nodes-underutilised` | GCP | reduce_nodes | $200/mo | — |
+| `gcp-sql-stop-idle-14d` | GCP | stop | — | 14 |
+| `gcp-compute-stop-idle-7d` | GCP | stop | — | 7 |
+| `azure-aks-reduce-nodes-underutilised` | Azure | reduce_nodes | $150/mo | — |
+| `azure-sql-resize-underutilised` | Azure | resize | $50/mo | — |
+| `azure-vm-stop-idle-14d` | Azure | stop | — | 14 |
+
+Each policy also has AI-priority and metric conditions; see [Policies](https://vamshisiddarth.github.io/argus/remediation/policies/#bundled-policies) for the full table.
+
+All policies skip resources tagged `environment: prod` (or `production`) and resources tagged `argus-exempt: "true"` — either tag on its own is enough. Add your own in `config/policies/` — see [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ### Safety guarantees
 
@@ -239,7 +253,7 @@ docker run --rm \
 
 ```bash
 pip install argus-cloud-optimizer
-argus --version   # argus 0.5.0
+argus --version   # argus 0.6.0
 argus --help
 ```
 
@@ -304,7 +318,7 @@ argus chat                                       # auto-detects cloud
 ```
 
 ```
-Argus v0.5.0 — AI Cloud Detective
+Argus v0.6.0 — AI Cloud Detective
 Cloud: AWS  |  Accounts: prod (123456789012)  |  Budget: $1.00/session
 Tip: end a line with \ to continue on the next line.
 Type your question, or /help for commands.

argus_cloud_optimizer-0.6.0/core/__version__.py

@@ -0,0 +1 @@
+__version__ = "0.6.0"

{argus_cloud_optimizer-0.5.0 → argus_cloud_optimizer-0.6.0}/core/agent/loop.py

@@ -164,7 +164,8 @@ class AgentLoop:
                             findings_count=len(tc.arguments.get("findings", [])),
                             **self.tracker.summary(),
                         )
-                        return _parse_findings(tc.arguments, cloud=cloud)
+                        findings, summary = _parse_findings(tc.arguments, cloud=cloud)
+                        return _attach_accounts(findings, accounts), summary
 
                 # Persist the assistant turn before executing tools
                 messages.append(
@@ -471,6 +472,42 @@ def _compress_resource(r: dict) -> dict:
     return out
 
 
+def _attach_accounts(
+    findings: list[ResourceFinding], accounts: list[dict[str, Any]]
+) -> list[ResourceFinding]:
+    """
+    Stamp each finding with the account/project/subscription it came from.
+
+    One account per run (AWS, GCP, single-subscription Azure): every finding
+    belongs to it. Several accounts in one run (multi-subscription Azure):
+    match on the ``/subscriptions/<id>/`` segment of the resource ID.
+    Findings that can't be attributed keep ``account_id=None``.
+    """
+    if not accounts:
+        return findings
+    names = {str(a.get("id")): a.get("name") for a in accounts if a.get("id")}
+    only = next(iter(names)) if len(names) == 1 else None
+    for f in findings:
+        acct = only or _subscription_from_resource_id(f.resource_id, names)
+        if acct:
+            f.account_id = acct
+            f.account_name = names.get(acct) or acct
+    return findings
+
+
+def _subscription_from_resource_id(
+    resource_id: str, known: dict[str, Any]
+) -> str | None:
+    parts = resource_id.split("/")
+    for i, part in enumerate(parts[:-1]):
+        if part.lower() == "subscriptions":
+            sub = parts[i + 1].lower()
+            for acct in known:
+                if acct.lower() == sub:
+                    return acct
+    return None
+
+
 def _parse_findings(
     args: dict[str, Any],
     cloud: str,

{argus_cloud_optimizer-0.5.0 → argus_cloud_optimizer-0.6.0}/core/config.py

@@ -159,6 +159,19 @@ class ReportSettings(BaseSettings):
         )
 
 
+# ---------------------------------------------------------------------------
+# Remediation
+# ---------------------------------------------------------------------------
+
+
+class RemediationSettings(BaseSettings):
+    model_config = SettingsConfigDict(env_prefix="", env_file=".env", extra="ignore")
+
+    # Opt-in: the post-scan runner creates Jira tickets only when this is true.
+    # `argus policies apply --confirm` is already explicit and is not gated.
+    enabled: bool = Field(False, alias="REMEDIATION_ENABLED")
+
+
 # ---------------------------------------------------------------------------
 # Scan tuning
 # ---------------------------------------------------------------------------
@@ -212,6 +225,9 @@ class Settings(BaseSettings):
     report: ReportSettings = Field(default_factory=ReportSettings)  # type: ignore[arg-type]
     scan: ScanSettings = Field(default_factory=ScanSettings)  # type: ignore[arg-type]
     log: LogSettings = Field(default_factory=LogSettings)  # type: ignore[arg-type]
+    remediation: RemediationSettings = Field(
+        default_factory=RemediationSettings  # type: ignore[arg-type]
+    )
 
 
 @lru_cache(maxsize=1)

{argus_cloud_optimizer-0.5.0 → argus_cloud_optimizer-0.6.0}/core/models/finding.py

@@ -31,6 +31,10 @@ class ResourceFinding:
     name: str | None = None
     last_activity: datetime | None = None
     status: FindingStatus = "new"
+    # Set by the agent loop from the scanned account/project/subscription.
+    # Used by remediation `accounts` scope filters and runbook templates.
+    account_id: str | None = None
+    account_name: str | None = None
 
     def to_dict(self) -> dict[str, Any]:
         return {
@@ -50,6 +54,8 @@ class ResourceFinding:
             ),
             "scan_time": self.scan_time.isoformat(),
             "status": self.status,
+            "account_id": self.account_id,
+            "account_name": self.account_name,
         }
 
     @classmethod
@@ -73,4 +79,6 @@ class ResourceFinding:
             last_activity=last_activity,
             scan_time=scan_time,
             status=data.get("status", "new"),
+            account_id=data.get("account_id"),
+            account_name=data.get("account_name"),
         )

{argus_cloud_optimizer-0.5.0 → argus_cloud_optimizer-0.6.0}/core/remediation/engine.py

@@ -91,8 +91,7 @@ def _scope_includes(finding: ResourceFinding, scope: ScopeFilter) -> bool:
     if scope.cloud_platforms and finding.cloud not in scope.cloud_platforms:
         return False
 
-    account = getattr(finding, "account_id", None) or getattr(finding, "cloud", "")
-    if scope.accounts and account not in scope.accounts:
+    if scope.accounts and finding.account_id not in scope.accounts:
         return False
 
     if scope.regions and finding.region not in scope.regions:
@@ -108,30 +107,37 @@ def _scope_excludes(finding: ResourceFinding, scope: ScopeFilter) -> bool:
     if scope.cloud_platforms and finding.cloud in scope.cloud_platforms:
         return True
 
-    account = getattr(finding, "account_id", None) or getattr(finding, "cloud", "")
-    if scope.accounts and account in scope.accounts:
+    if scope.accounts and finding.account_id in scope.accounts:
         return True
 
     if scope.regions and finding.region in scope.regions:
         return True
 
-    if scope.tags and _tags_match(finding.tags, scope.tags):
+    if scope.tags and _any_tag_entry_matches(finding.tags, scope.tags):
         return True
 
     return False
 
 
+def _tag_entry_matches(resource_tags: dict, tag_entry: dict[str, list[str]]) -> bool:
+    """True if the resource satisfies every key in one tag entry."""
+    return all(resource_tags.get(key) in allowed for key, allowed in tag_entry.items())
+
+
 def _tags_match(
     resource_tags: dict,
     scope_tags: tuple[dict[str, list[str]], ...],
 ) -> bool:
-    """Return True if the resource has ALL tag conditions in scope_tags."""
-    for tag_entry in scope_tags:
-        for key, allowed_values in tag_entry.items():
-            resource_value = resource_tags.get(key)
-            if resource_value not in allowed_values:
-                return False
-    return True
+    """Include semantics: the resource must satisfy ALL tag entries."""
+    return all(_tag_entry_matches(resource_tags, entry) for entry in scope_tags)
+
+
+def _any_tag_entry_matches(
+    resource_tags: dict,
+    scope_tags: tuple[dict[str, list[str]], ...],
+) -> bool:
+    """Exclude semantics: matching ANY tag entry excludes the resource."""
+    return any(_tag_entry_matches(resource_tags, entry) for entry in scope_tags)
 
 
 def _tier1_matches(finding: ResourceFinding, cond: Condition) -> bool:
@@ -212,7 +218,7 @@ def _build_proposal(finding: ResourceFinding, policy: Policy) -> ChangeProposal:
             action=policy.action,
             resource_id=finding.resource_id,
             region=finding.region,
-            account_id=getattr(finding, "account_id", None) or "",
+            account_id=finding.account_id or "",
         )
         or f"# No CLI template available for {finding.resource_type} / {policy.action}"
     )

{argus_cloud_optimizer-0.5.0 → argus_cloud_optimizer-0.6.0}/core/remediation/loader.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import logging
+import os
 from pathlib import Path
 
 import yaml
@@ -30,6 +31,32 @@ _VALID_ACTIONS = frozenset(
 
 _SUPPORTED_VERSIONS = frozenset({"1"})
 
+DEFAULT_POLICY_DIR = "./config/policies"
+POLICY_DIR_ENV = "ARGUS_POLICY_DIR"
+# Older name used by the CLI and .env.example before v0.6.0. Still honored.
+POLICY_DIR_ENV_ALIAS = "ARGUS_POLICIES_DIR"
+
+
+def resolve_policy_dir() -> str:
+    """
+    Return the policy directory from the environment.
+
+    Precedence: ARGUS_POLICY_DIR, then ARGUS_POLICIES_DIR, then
+    ./config/policies. Used by both the CLI and the post-scan runner so
+    `argus policies plan` and a scheduled scan always read the same folder.
+    """
+    primary = os.environ.get(POLICY_DIR_ENV, "").strip()
+    alias = os.environ.get(POLICY_DIR_ENV_ALIAS, "").strip()
+    if primary and alias and primary != alias:
+        logger.warning(
+            "policy_dir_env_conflict using=%s=%s ignored=%s=%s",
+            POLICY_DIR_ENV,
+            primary,
+            POLICY_DIR_ENV_ALIAS,
+            alias,
+        )
+    return primary or alias or DEFAULT_POLICY_DIR
+
 
 def load_policies(policies_dir: str | Path) -> list[Policy]:
     """

{argus_cloud_optimizer-0.5.0 → argus_cloud_optimizer-0.6.0}/core/reports/generator.py

@@ -17,6 +17,10 @@ def _registry() -> ResourceRegistry:
     return get_registry()
 
 
+# Report JSON schema version (see docs/reference/report-schema.md).
+# 1.0.1: findings gained optional account_id / account_name.
+SCHEMA_VERSION = "1.0.1"
+
 # Maximum findings shown as individual rows in the Slack digest
 SLACK_DIGEST_LIMIT = 5
 
@@ -48,7 +52,7 @@ def build_report(
     total_waste = sum(f.estimated_monthly_cost for f in sorted_findings)
 
     return {
-        "schema_version": "1.0",
+        "schema_version": SCHEMA_VERSION,
         "scan_id": str(uuid.uuid4()),
         "generated_at": datetime.now(tz=timezone.utc).isoformat(),
         "cloud": cloud,

{argus_cloud_optimizer-0.5.0 → argus_cloud_optimizer-0.6.0}/core/reports/multi_cloud.py

@@ -11,6 +11,8 @@ import uuid
 from datetime import datetime, timezone
 from typing import Any
 
+from core.reports.generator import SCHEMA_VERSION
+
 RESOURCE_TAXONOMY: dict[str, str] = {
     # Compute
     "AWS::EC2::Instance": "Compute Instance",
@@ -110,7 +112,7 @@ def merge_reports(reports: list[dict[str, Any]]) -> dict[str, Any]:
     total_waste = sum(f["estimated_monthly_cost"] for f in all_findings)
 
     return {
-        "schema_version": "1.0",
+        "schema_version": SCHEMA_VERSION,
         "scan_id": str(uuid.uuid4()),
         "generated_at": datetime.now(tz=timezone.utc).isoformat(),
         "cloud": "multi",
@@ -128,7 +130,7 @@ def merge_reports(reports: list[dict[str, Any]]) -> dict[str, Any]:
 
 def _empty_merged_report() -> dict[str, Any]:
     return {
-        "schema_version": "1.0",
+        "schema_version": SCHEMA_VERSION,
         "scan_id": str(uuid.uuid4()),
         "generated_at": datetime.now(tz=timezone.utc).isoformat(),
         "cloud": "multi",