argus-code-review 0.3.0__tar.gz → 0.3.1__tar.gz

{argus_code_review-0.3.0 → argus_code_review-0.3.1}/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.1] - 2026-10-19
+
+### Fixed
+
+- The cross-cutting reviewer no longer fails every round with `API Error: 400` (TECH-7686). Argus bundled Claude Code 2.1.139 (through `claude-agent-sdk` 0.1.81), and Anthropic's API rejects `claude-opus-5-5` from Claude Code older than 2.1.280 ("version 2.1.280 or newer is required", `claude_code_version_too_old`). That reviewer is the only one that runs opus through the SDK, so it returned no tokens and no findings. `claude-agent-sdk` is now pinned to 0.2.168, which bundles Claude Code 2.1.301. A new test asserts the bundled CLI is at least 2.1.280.
+
+### Changed
+
+- `claude-agent-sdk` 0.1.81 to 0.2.168. This adds `jsonschema>=4.20.0` as a transitive dependency and raises the `mcp` floor to 1.23.0; semgrep's exact `mcp==1.23.3` pin in the `prechecks` extra still satisfies it, with little headroom (see the comment in `pyproject.toml`).
+- A test that exercised the SDK's private hook-conversion helper now calls `claude_agent_sdk.types._hooks_to_internal_format`, where that logic moved. It is a private API and should be rechecked on each SDK bump.
+
 ## [0.3.0] - 2026-10-13
 
 ### Added
@@ -423,7 +434,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   packaged set.
 - `argus --version`, `argus prompts list`, and `argus prompts export`.
 
-[Unreleased]: https://github.com/redesignhealth/argus-review/compare/v0.3.0...HEAD
+[Unreleased]: https://github.com/redesignhealth/argus-review/compare/v0.3.1...HEAD
+[0.3.1]: https://github.com/redesignhealth/argus-review/compare/v0.3.0...v0.3.1
 [0.3.0]: https://github.com/redesignhealth/argus-review/compare/v0.2.11...v0.3.0
 [0.2.11]: https://github.com/redesignhealth/argus-review/compare/v0.2.10...v0.2.11
 [0.2.10]: https://github.com/redesignhealth/argus-review/compare/v0.2.9...v0.2.10

{argus_code_review-0.3.0 → argus_code_review-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: argus-code-review
-Version: 0.3.0
+Version: 0.3.1
 Summary: Self-orchestrated PR review agent using LangGraph + Claude Agent SDK
 Project-URL: Repository, https://github.com/redesignhealth/argus-review
 Project-URL: Issues, https://github.com/redesignhealth/argus-review/issues
@@ -16,7 +16,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: <3.14,>=3.12
 Requires-Dist: asyncpg>=0.29.0
-Requires-Dist: claude-agent-sdk==0.1.81
+Requires-Dist: claude-agent-sdk==0.2.168
 Requires-Dist: google-genai<2,>=1.55
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: langchain-anthropic>=1.2.0

{argus_code_review-0.3.0 → argus_code_review-0.3.1}/argus/runners.py

@@ -219,10 +219,12 @@ _TURN_BUDGET_SYSTEM_PROMPT_LINE_CLAUDE = (
 # Tool-call budget warning thresholds and truthful messages for Claude-path
 # sessions.
 #
-# In claude-agent-sdk 0.1.81, supported tool-lifecycle hooks that can inject
-# feedback via hookSpecificOutput.additionalContext are PostToolUse and
-# PostToolUseFailure. PostToolBatch is the exact-per-turn future option in
-# Claude Code, but is untyped and unsupported in this SDK version.
+# In claude-agent-sdk 0.2.168, the hook events in the HookEvent literal that
+# ClaudeAgentOptions.hooks is typed to accept, and that can inject feedback via
+# hookSpecificOutput.additionalContext, are PostToolUse and PostToolUseFailure.
+# PostToolBatch would give exact per-turn nudges and has a typed hookSpecificOutput
+# (PostToolBatchHookSpecificOutput), but it is not in the HookEvent literal, so it
+# is not used here.
 # We attach to PostToolUse and PostToolUseFailure to track combined tool
 # invocations and inject non-blocking convergence/stop nudges.
 #
@@ -284,10 +286,12 @@ def _make_tool_budget_nudge_hooks(
     """Create PostToolUse and PostToolUseFailure hooks that inject non-blocking
     nudge warnings into Claude-path sessions when tool-call counts cross budget thresholds.
 
-    In claude-agent-sdk 0.1.81, supported tool-lifecycle hooks that can inject
-    feedback via hookSpecificOutput.additionalContext are PostToolUse and
-    PostToolUseFailure. PostToolBatch is the exact-per-turn future option in
-    Claude Code, but is untyped and unsupported in this SDK version.
+    In claude-agent-sdk 0.2.168, the hook events in the HookEvent literal that
+    ClaudeAgentOptions.hooks is typed to accept, and that can inject feedback via
+    hookSpecificOutput.additionalContext, are PostToolUse and PostToolUseFailure.
+    PostToolBatch would give exact per-turn nudges and has a typed hookSpecificOutput
+    (PostToolBatchHookSpecificOutput), but it is not in the HookEvent literal, so it
+    is not used here.
 
     One callback is shared by both events, closing over combined tool-call count
     and one-shot flags. Subagent tool calls (bearing agent_id) are skipped.

{argus_code_review-0.3.0 → argus_code_review-0.3.1}/pyproject.toml

@@ -20,10 +20,15 @@ classifiers = [
 ]
 dependencies = [
     # Claude Agent SDK for orchestrator + subagent dispatch.
-    # Pinned to ==0.1.81: regenerating the lock on a sliding
-    # exclude-newer window would otherwise downgrade to 0.1.75 and
-    # potentially miss API surface added in 0.1.76+.
-    "claude-agent-sdk==0.1.81",
+    # Pinned exactly: the SDK bundles the Claude Code CLI, and Anthropic's
+    # API rejects claude-opus-5-5 from Claude Code older than 2.1.280
+    # (claude_code_version_too_old, TECH-7686). 0.2.158 is the first SDK
+    # release that bundles CLI 2.1.280 (0.1.81 bundled 2.1.139), but its CLI
+    # prints an unrecognized_model warning for claude-sonnet-5-5. 0.2.168
+    # bundles CLI 2.1.301, on which both sonnet-5-5 and opus-5-5 were verified
+    # clean. Do not lower the pin below a release bundling >= 2.1.280
+    # (enforced by tests/test_sdk_bundled_cli_version.py).
+    "claude-agent-sdk==0.2.168",
     # LangGraph for pipeline orchestration
     "langgraph>=1.0.10,<2",
     "langgraph-checkpoint-postgres>=2.0.0",
@@ -152,8 +157,12 @@ prechecks = [
 # transitives jsonschema/importlib-metadata/pywin32 -- to that version for
 # EVERY install of this package, not just prechecks users. This is provably
 # safe, not a functional regression: claude-agent-sdk (core, always
-# installed) only requires mcp>=1.19.0, and 1.23.3 satisfies that floor, so
-# nothing here depends on an mcp feature added after 1.23.3. Investigated
+# installed) requires mcp>=1.23.0,<3 (and jsonschema>=4.20.0) as of 0.2.168,
+# and 1.23.3 satisfies that floor, so nothing here depends on an mcp feature
+# added after 1.23.3. Headroom is thin: semgrep's exact mcp==1.23.3 pin now
+# sits just above the SDK's 1.23.0 floor, so a future SDK bump that raises the
+# mcp floor above 1.23.3 will conflict with the prechecks extra and need the
+# semgrep pin revisited at that point. Investigated
 # uv's `conflicts` mechanism (declaring dev/prechecks mutually exclusive) as
 # a way to fork the resolution and keep the newer mcp for non-prechecks
 # installs -- it has no effect here, because 1.23.3 already satisfies both

{argus_code_review-0.3.0 → argus_code_review-0.3.1}/tests/test_runners_turn_budget.py

@@ -39,7 +39,6 @@ import pytest
 from claude_agent_sdk import (
     AssistantMessage,
     ClaudeAgentOptions,
-    ClaudeSDKClient,
     HookMatcher,
     ResultMessage,
     ToolResultBlock,
@@ -47,9 +46,10 @@ from claude_agent_sdk import (
     UserMessage,
 )
 
-# Pinned internal import: the exact SDK pin (0.1.81) is load-bearing;
+# Pinned internal import: the exact SDK pin (0.2.168) is load-bearing;
 # this test and internal import must be revisited whenever claude-agent-sdk is bumped.
 from claude_agent_sdk._internal.query import _convert_hook_output_for_cli
+from claude_agent_sdk.types import _hooks_to_internal_format
 from claude_agent_sdk.types import (
     HookContext,
     HookEvent,
@@ -692,8 +692,9 @@ class TestClaudeAgentSdkHookContract:
         assert isinstance(hooks["PostToolUse"][0], HookMatcher)
         assert isinstance(hooks["PostToolUseFailure"][0], HookMatcher)
 
-        client = ClaudeSDKClient(options=ClaudeAgentOptions(hooks=hooks))
-        internal = client._convert_hooks_to_internal_format(hooks)
+        # claude-agent-sdk 0.2.x moved this from a ClaudeSDKClient method to a
+        # module-level helper in claude_agent_sdk.types (TECH-7686).
+        internal = _hooks_to_internal_format(hooks)
         assert "PostToolUse" in internal
         assert "PostToolUseFailure" in internal
         assert len(internal["PostToolUse"]) == 1

argus_code_review-0.3.1/tests/test_sdk_bundled_cli_version.py

@@ -0,0 +1,30 @@
+"""Guard: the SDK-bundled Claude Code CLI must be new enough for claude-opus-5-5.
+
+Anthropic's API rejects claude-opus-5-5 from Claude Code older than 2.1.280
+(HTTP 400, ``claude_code_version_too_old``). The Claude Agent SDK bundles the
+CLI, so the SDK pin determines it. Pinned SDK 0.2.168 bundles 2.1.301; 2.1.280 is
+the minimum for opus-5-5. See TECH-7686.
+"""
+
+import re
+import subprocess
+from pathlib import Path
+
+import claude_agent_sdk
+
+MIN_BUNDLED_CLI = (2, 1, 280)
+
+
+def test_bundled_claude_cli_supports_opus_5_5() -> None:
+    cli = Path(claude_agent_sdk.__file__).parent / "_bundled" / "claude"
+    assert cli.exists(), f"bundled Claude Code CLI missing at {cli}"
+    out = subprocess.run(
+        [str(cli), "--version"], capture_output=True, text=True, timeout=60, check=True
+    ).stdout
+    match = re.search(r"(\d+)\.(\d+)\.(\d+)", out)
+    assert match, f"could not parse CLI version from {out!r}"
+    version = tuple(int(g) for g in match.groups())
+    assert version >= MIN_BUNDLED_CLI, (
+        f"bundled Claude Code {version} is older than {MIN_BUNDLED_CLI}; "
+        "claude-opus-5-5 requests will be rejected (TECH-7686)"
+    )