argus-code-review 0.3.0__tar.gz → 0.3.2__tar.gz

{argus_code_review-0.3.0 → argus_code_review-0.3.2}/CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.2] - 2026-10-21
+
+### Added
+
+- CLI `--expect-head-sha <sha>`: the review fails before any LLM spend unless the resolved head commit equals this 40-character lowercase SHA, so a service that reviews a specific commit never silently reviews a newer one if the PR head moves (TECH-7789). Also available as `run_review(..., expect_head_sha=...)`.
+- `ARGUS_NO_DOTENV` (truthy): stop all `.env` loading. It disables both `load_dotenv_early` and the `Settings` `env_file`, so a `.env` in the working directory cannot configure the process. For service workers that review untrusted checkouts, alongside the prompt-override and bench-override switches. Enforced on `Settings` itself, so every `Settings()` construction honors it.
+
+## [0.3.1] - 2026-10-19
+
+### Fixed
+
+- The cross-cutting reviewer no longer fails every round with `API Error: 400` (TECH-7686). Argus bundled Claude Code 2.1.139 (through `claude-agent-sdk` 0.1.81), and Anthropic's API rejects `claude-opus-5-5` from Claude Code older than 2.1.280 ("version 2.1.280 or newer is required", `claude_code_version_too_old`). That reviewer is the only one that runs opus through the SDK, so it returned no tokens and no findings. `claude-agent-sdk` is now pinned to 0.2.168, which bundles Claude Code 2.1.301. A new test asserts the bundled CLI is at least 2.1.280.
+
+### Changed
+
+- `claude-agent-sdk` 0.1.81 to 0.2.168. This adds `jsonschema>=4.20.0` as a transitive dependency and raises the `mcp` floor to 1.23.0; semgrep's exact `mcp==1.23.3` pin in the `prechecks` extra still satisfies it, with little headroom (see the comment in `pyproject.toml`).
+- A test that exercised the SDK's private hook-conversion helper now calls `claude_agent_sdk.types._hooks_to_internal_format`, where that logic moved. It is a private API and should be rechecked on each SDK bump.
+
 ## [0.3.0] - 2026-10-13
 
 ### Added
@@ -423,7 +441,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   packaged set.
 - `argus --version`, `argus prompts list`, and `argus prompts export`.
 
-[Unreleased]: https://github.com/redesignhealth/argus-review/compare/v0.3.0...HEAD
+[Unreleased]: https://github.com/redesignhealth/argus-review/compare/v0.3.1...HEAD
+[0.3.2]: https://github.com/redesignhealth/argus-review/compare/v0.3.1...v0.3.2
+[0.3.1]: https://github.com/redesignhealth/argus-review/compare/v0.3.0...v0.3.1
 [0.3.0]: https://github.com/redesignhealth/argus-review/compare/v0.2.11...v0.3.0
 [0.2.11]: https://github.com/redesignhealth/argus-review/compare/v0.2.10...v0.2.11
 [0.2.10]: https://github.com/redesignhealth/argus-review/compare/v0.2.9...v0.2.10

{argus_code_review-0.3.0 → argus_code_review-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: argus-code-review
-Version: 0.3.0
+Version: 0.3.2
 Summary: Self-orchestrated PR review agent using LangGraph + Claude Agent SDK
 Project-URL: Repository, https://github.com/redesignhealth/argus-review
 Project-URL: Issues, https://github.com/redesignhealth/argus-review/issues
@@ -16,7 +16,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: <3.14,>=3.12
 Requires-Dist: asyncpg>=0.29.0
-Requires-Dist: claude-agent-sdk==0.1.81
+Requires-Dist: claude-agent-sdk==0.2.168
 Requires-Dist: google-genai<2,>=1.55
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: langchain-anthropic>=1.2.0
@@ -280,6 +280,8 @@ Argus reads configuration from environment variables, or from a `.env` file
 in the working directory (add it to `.gitignore` — never commit it).
 [`.env.example`](.env.example) lists every variable Argus reads, required
 and optional, with comments — copy it to `.env` and fill in what you need.
+Set `ARGUS_NO_DOTENV=1` in the real environment to ignore `.env` files
+entirely (for service workers that run in a directory they do not control).
 
 Three keys are required for a first run:
 

{argus_code_review-0.3.0 → argus_code_review-0.3.2}/README.md

@@ -229,6 +229,8 @@ Argus reads configuration from environment variables, or from a `.env` file
 in the working directory (add it to `.gitignore` — never commit it).
 [`.env.example`](.env.example) lists every variable Argus reads, required
 and optional, with comments — copy it to `.env` and fill in what you need.
+Set `ARGUS_NO_DOTENV=1` in the real environment to ignore `.env` files
+entirely (for service workers that run in a directory they do not control).
 
 Three keys are required for a first run:
 

{argus_code_review-0.3.0 → argus_code_review-0.3.2}/argus/cli.py

@@ -70,6 +70,8 @@ import time
 from pathlib import Path
 from typing import TYPE_CHECKING, Final
 
+from argus.dotenv_utils import TRUTHY_STRINGS
+
 if TYPE_CHECKING:
     from argus.config import Settings
     from argus.models import ReviewRequest, ReviewResponse
@@ -79,6 +81,7 @@ logging.basicConfig(
     format="%(asctime)s [%(levelname)s] %(name)s: %(message)s",
     datefmt="%H:%M:%S",
 )
+
 logger = logging.getLogger("argus_review_local")
 
 # Hard wall-clock backstop: if the entire review has not completed within this
@@ -229,6 +232,7 @@ async def run(
     request: "ReviewRequest",
     review_override_sha: str | None = None,
     review_override_reason: str | None = None,
+    expect_head_sha: str | None = None,
 ) -> "ReviewResponse":
     """Run the review pipeline (storage backend resolved automatically:
     Postgres if ``ARGUS_DB_URL`` is set, HTTP shim if the storage URLs are
@@ -240,6 +244,7 @@ async def run(
         flow_run_id=None,
         review_override_sha=review_override_sha,
         review_override_reason=review_override_reason,
+        expect_head_sha=expect_head_sha,
     )
 
 
@@ -363,6 +368,16 @@ def _add_review_args(parser: argparse.ArgumentParser) -> None:
         default=None,
         help="Reason for --review-override-sha (1-500 characters); recorded in the scope receipt.",
     )
+    parser.add_argument(
+        "--expect-head-sha",
+        dest="expect_head_sha",
+        default=None,
+        help=(
+            "Fail before any review spend unless the resolved head commit equals this "
+            "40-character lowercase SHA. For services that review a specific commit and "
+            "must not silently review a newer one if the PR head moved."
+        ),
+    )
     parser.add_argument(
         "--no-prompt-overrides",
         action="store_true",
@@ -483,10 +498,11 @@ def _validate_review_args(parser: argparse.ArgumentParser, args: argparse.Namesp
     """Cross-flag validation that argparse's own declarative options can't express."""
     if args.post and args.sha and not args.pr:
         parser.error("--post requires --pr (a PR to comment on); --sha alone has nowhere to post")
-    from argus.scope import validate_override
+    from argus.scope import validate_expect_head_sha, validate_override
 
     try:
         validate_override(args.review_override_sha, args.review_override_reason)
+        validate_expect_head_sha(args.expect_head_sha)
     except ValueError as exc:
         parser.error(str(exc))
 
@@ -676,6 +692,7 @@ def _run_review(parser: argparse.ArgumentParser, args: argparse.Namespace) -> No
                 request,
                 review_override_sha=args.review_override_sha,
                 review_override_reason=args.review_override_reason,
+                expect_head_sha=args.expect_head_sha,
             )
         )
     except HistoryBackendConnectivityError as exc:
@@ -720,7 +737,7 @@ def _packaged_prompt_names() -> list[str]:
 # argus.config.Settings). Kept in sync here so `argus prompts list`/`export`
 # (deliberately Settings-free, see below) treats the env var identically to
 # `argus review`, which resolves it through Settings.
-_PYDANTIC_TRUTHY_STRINGS = frozenset({"1", "true", "t", "yes", "y", "on"})
+_PYDANTIC_TRUTHY_STRINGS = TRUTHY_STRINGS
 
 
 def _is_truthy_env_value(value: str) -> bool:

{argus_code_review-0.3.0 → argus_code_review-0.3.2}/argus/config.py

@@ -10,7 +10,7 @@ from __future__ import annotations
 from functools import lru_cache
 
 from pydantic import Field
-from pydantic_settings import BaseSettings, SettingsConfigDict
+from pydantic_settings import BaseSettings, PydanticBaseSettingsSource, SettingsConfigDict
 
 # Single source of truth for the reviewer-subprocess wall-clock budget.
 # ``argus.runners._SUBPROCESS_TIMEOUT_S`` (the fallback used when no Settings
@@ -209,6 +209,26 @@ class Settings(BaseSettings):
         env_file_encoding="utf-8",
     )
 
+    @classmethod
+    def settings_customise_sources(
+        cls,
+        settings_cls: type[BaseSettings],
+        init_settings: PydanticBaseSettingsSource,
+        env_settings: PydanticBaseSettingsSource,
+        dotenv_settings: PydanticBaseSettingsSource,
+        file_secret_settings: PydanticBaseSettingsSource,
+    ) -> tuple[PydanticBaseSettingsSource, ...]:
+        """Drop the ``.env`` source when ``ARGUS_NO_DOTENV`` is truthy.
+
+        Enforced here, on the class, so every ``Settings()`` construction honors the
+        kill switch, not just the cached accessor.
+        """
+        from argus.dotenv_utils import dotenv_disabled
+
+        if dotenv_disabled():
+            return (init_settings, env_settings, file_secret_settings)
+        return (init_settings, env_settings, dotenv_settings, file_secret_settings)
+
     @property
     def db_url(self) -> str | None:
         """Resolved Postgres URL: ``ARGUS_DB_URL`` wins over ``SUPABASE_DB_URL``."""

{argus_code_review-0.3.0 → argus_code_review-0.3.2}/argus/dotenv_utils.py

@@ -13,6 +13,22 @@ import os
 from pathlib import Path
 
 
+# The strings pydantic treats as True for a bool setting; shared with the CLI so the
+# two truthy checks cannot drift.
+TRUTHY_STRINGS = frozenset({"1", "true", "t", "yes", "y", "on"})
+
+
+def dotenv_disabled() -> bool:
+    """True when ``ARGUS_NO_DOTENV`` is truthy.
+
+    Official/service runs review untrusted checkouts from a working directory
+    that may contain a ``.env``; this switch stops every ``.env`` load (both
+    :func:`load_dotenv_early` and the pydantic ``Settings`` env_file) so the
+    process environment is the only configuration source.
+    """
+    return os.environ.get("ARGUS_NO_DOTENV", "").strip().lower() in TRUTHY_STRINGS
+
+
 def _preferred_env_filename() -> str:
     """Pick the default env filename based on ENVIRONMENT."""
     env = (os.environ.get("ENVIRONMENT") or "").lower()
@@ -61,11 +77,15 @@ def load_dotenv_early(
     """Load dotenv file early (before importing settings/clients).
 
     This is a no-op when:
+    - ``ARGUS_NO_DOTENV`` is truthy, or
     - running in AWS Lambda (secrets are expected to come from SSM/env), or
     - running in pytest and `skip_in_test=True`, or
     - python-dotenv isn't installed, or
     - no env file can be found.
     """
+    if dotenv_disabled():
+        return None
+
     # Never load local dotenv inside Lambda.
     if os.environ.get("AWS_LAMBDA_FUNCTION_NAME"):
         return None

{argus_code_review-0.3.0 → argus_code_review-0.3.2}/argus/graph.py

@@ -85,6 +85,7 @@ from argus.models import (
 from argus.scope import (
     SCOPE_PROMPT,
     SHA40,
+    validate_expect_head_sha,
     ScopeAssessment,
     ScopeUnverified,
     build_scope_input,
@@ -3605,6 +3606,7 @@ async def run_review(
     *,
     review_override_sha: str | None = None,
     review_override_reason: str | None = None,
+    expect_head_sha: str | None = None,
 ) -> ReviewResponse:
     """Execute the v3 review pipeline via LangGraph StateGraph.
 
@@ -3620,6 +3622,7 @@ async def run_review(
     import uuid
 
     override = validate_override(review_override_sha, review_override_reason)
+    validate_expect_head_sha(expect_head_sha)
 
     # Fail fast on a bad ARGUS_DB_URL / ARGUS_HISTORY_DB_PATH, before any of
     # the pipeline's LLM cost runs. Both history-backend implementations
@@ -3690,6 +3693,13 @@ async def run_review(
     else:
         head_sha_for_worktree = None
 
+    if expect_head_sha is not None and expect_head_sha != head_sha_for_worktree:
+        raise ValueError(
+            f"expect_head_sha {expect_head_sha[:12]} does not match the resolved head "
+            f"{(head_sha_for_worktree or 'none')[:12]}; the PR head moved, refusing to review "
+            "a different commit"
+        )
+
     if override and override[0] != head_sha_for_worktree:
         raise ValueError(
             f"--review-override-sha {override[0][:12]} does not match the resolved head "

{argus_code_review-0.3.0 → argus_code_review-0.3.2}/argus/runners.py

@@ -219,10 +219,12 @@ _TURN_BUDGET_SYSTEM_PROMPT_LINE_CLAUDE = (
 # Tool-call budget warning thresholds and truthful messages for Claude-path
 # sessions.
 #
-# In claude-agent-sdk 0.1.81, supported tool-lifecycle hooks that can inject
-# feedback via hookSpecificOutput.additionalContext are PostToolUse and
-# PostToolUseFailure. PostToolBatch is the exact-per-turn future option in
-# Claude Code, but is untyped and unsupported in this SDK version.
+# In claude-agent-sdk 0.2.168, the hook events in the HookEvent literal that
+# ClaudeAgentOptions.hooks is typed to accept, and that can inject feedback via
+# hookSpecificOutput.additionalContext, are PostToolUse and PostToolUseFailure.
+# PostToolBatch would give exact per-turn nudges and has a typed hookSpecificOutput
+# (PostToolBatchHookSpecificOutput), but it is not in the HookEvent literal, so it
+# is not used here.
 # We attach to PostToolUse and PostToolUseFailure to track combined tool
 # invocations and inject non-blocking convergence/stop nudges.
 #
@@ -284,10 +286,12 @@ def _make_tool_budget_nudge_hooks(
     """Create PostToolUse and PostToolUseFailure hooks that inject non-blocking
     nudge warnings into Claude-path sessions when tool-call counts cross budget thresholds.
 
-    In claude-agent-sdk 0.1.81, supported tool-lifecycle hooks that can inject
-    feedback via hookSpecificOutput.additionalContext are PostToolUse and
-    PostToolUseFailure. PostToolBatch is the exact-per-turn future option in
-    Claude Code, but is untyped and unsupported in this SDK version.
+    In claude-agent-sdk 0.2.168, the hook events in the HookEvent literal that
+    ClaudeAgentOptions.hooks is typed to accept, and that can inject feedback via
+    hookSpecificOutput.additionalContext, are PostToolUse and PostToolUseFailure.
+    PostToolBatch would give exact per-turn nudges and has a typed hookSpecificOutput
+    (PostToolBatchHookSpecificOutput), but it is not in the HookEvent literal, so it
+    is not used here.
 
     One callback is shared by both events, closing over combined tool-call count
     and one-shot flags. Subagent tool calls (bearing agent_id) are skipped.

{argus_code_review-0.3.0 → argus_code_review-0.3.2}/argus/scope.py

@@ -50,6 +50,13 @@ class ScopeAssessment(BaseModel):
     rationale: str
 
 
+def validate_expect_head_sha(sha: str | None) -> str | None:
+    """Return ``sha`` unchanged if it is ``None`` or a 40-char lowercase hex SHA, else raise."""
+    if sha is not None and not SHA40.fullmatch(sha):
+        raise ValueError("expect_head_sha must be a 40-character lowercase hex SHA")
+    return sha
+
+
 def validate_override(sha: str | None, reason: str | None) -> tuple[str, str] | None:
     """Return ``(sha, reason)`` for a valid human override pair, ``None`` if neither is set."""
     if sha is None and reason is None:

{argus_code_review-0.3.0 → argus_code_review-0.3.2}/pyproject.toml

@@ -20,10 +20,15 @@ classifiers = [
 ]
 dependencies = [
     # Claude Agent SDK for orchestrator + subagent dispatch.
-    # Pinned to ==0.1.81: regenerating the lock on a sliding
-    # exclude-newer window would otherwise downgrade to 0.1.75 and
-    # potentially miss API surface added in 0.1.76+.
-    "claude-agent-sdk==0.1.81",
+    # Pinned exactly: the SDK bundles the Claude Code CLI, and Anthropic's
+    # API rejects claude-opus-5-5 from Claude Code older than 2.1.280
+    # (claude_code_version_too_old, TECH-7686). 0.2.158 is the first SDK
+    # release that bundles CLI 2.1.280 (0.1.81 bundled 2.1.139), but its CLI
+    # prints an unrecognized_model warning for claude-sonnet-5-5. 0.2.168
+    # bundles CLI 2.1.301, on which both sonnet-5-5 and opus-5-5 were verified
+    # clean. Do not lower the pin below a release bundling >= 2.1.280
+    # (enforced by tests/test_sdk_bundled_cli_version.py).
+    "claude-agent-sdk==0.2.168",
     # LangGraph for pipeline orchestration
     "langgraph>=1.0.10,<2",
     "langgraph-checkpoint-postgres>=2.0.0",
@@ -152,8 +157,12 @@ prechecks = [
 # transitives jsonschema/importlib-metadata/pywin32 -- to that version for
 # EVERY install of this package, not just prechecks users. This is provably
 # safe, not a functional regression: claude-agent-sdk (core, always
-# installed) only requires mcp>=1.19.0, and 1.23.3 satisfies that floor, so
-# nothing here depends on an mcp feature added after 1.23.3. Investigated
+# installed) requires mcp>=1.23.0,<3 (and jsonschema>=4.20.0) as of 0.2.168,
+# and 1.23.3 satisfies that floor, so nothing here depends on an mcp feature
+# added after 1.23.3. Headroom is thin: semgrep's exact mcp==1.23.3 pin now
+# sits just above the SDK's 1.23.0 floor, so a future SDK bump that raises the
+# mcp floor above 1.23.3 will conflict with the prechecks extra and need the
+# semgrep pin revisited at that point. Investigated
 # uv's `conflicts` mechanism (declaring dev/prechecks mutually exclusive) as
 # a way to fork the resolution and keep the newer mcp for non-prechecks
 # installs -- it has no effect here, because 1.23.3 already satisfies both

{argus_code_review-0.3.0 → argus_code_review-0.3.2}/tests/test_cli_args.py

@@ -343,3 +343,26 @@ class TestPromptsSubcommand:
     def test_prompts_export_force_defaults_off(self) -> None:
         args = _parse(["prompts", "export", "/tmp/out"])
         assert args.force is False
+
+
+class TestExpectHeadShaFlag:
+    def test_defaults_to_none(self) -> None:
+        assert _parse(["review", "owner/repo", "--pr", "1"]).expect_head_sha is None
+
+    def test_flag_parses(self) -> None:
+        sha = "a" * 40
+        args = _parse(["review", "owner/repo", "--pr", "1", "--expect-head-sha", sha])
+        assert args.expect_head_sha == sha
+
+    def test_malformed_sha_is_a_parser_error(self) -> None:
+        parser = _build_parser()
+        for bad in ("a" * 39, "A" * 40, "g" * 40, ""):
+            args = _parse(["review", "owner/repo", "--pr", "1", "--expect-head-sha", bad])
+            with pytest.raises(SystemExit) as exc:
+                _validate_review_args(parser, args)
+            assert exc.value.code == 2
+
+    def test_valid_sha_passes_validation(self) -> None:
+        parser = _build_parser()
+        args = _parse(["review", "owner/repo", "--pr", "1", "--expect-head-sha", "a" * 40])
+        _validate_review_args(parser, args)

{argus_code_review-0.3.0 → argus_code_review-0.3.2}/tests/test_cli_preflight.py

@@ -229,6 +229,7 @@ class TestRunReviewConnectivityErrorExit:
             output=None,
             review_override_sha=None,
             review_override_reason=None,
+            expect_head_sha=None,
         )
         parser = MagicMock()
 

argus_code_review-0.3.2/tests/test_dotenv_utils.py

@@ -0,0 +1,93 @@
+"""Tests for ``ARGUS_NO_DOTENV``: the kill switch for every ``.env`` load."""
+
+from __future__ import annotations
+
+from collections.abc import Iterator
+from pathlib import Path
+
+import pytest
+
+from argus.config import Settings, clear_cache, get_settings
+from argus.dotenv_utils import dotenv_disabled, load_dotenv_early
+
+_SENTINEL = "ARGUS_TEST_DOTENV_SENTINEL"
+
+
+@pytest.mark.parametrize("value", ["1", "true", "TRUE", " yes ", "On", "t", "y"])
+def test_dotenv_disabled_truthy_values(value: str, monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("ARGUS_NO_DOTENV", value)
+    assert dotenv_disabled() is True
+
+
+@pytest.mark.parametrize("value", ["", "0", "false", "no", "off", "enabled", "2"])
+def test_dotenv_disabled_falsy_values(value: str, monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("ARGUS_NO_DOTENV", value)
+    assert dotenv_disabled() is False
+
+
+def test_dotenv_disabled_unset(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.delenv("ARGUS_NO_DOTENV", raising=False)
+    assert dotenv_disabled() is False
+
+
+def test_load_dotenv_early_is_a_noop_when_disabled(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    (tmp_path / ".env").write_text(f"{_SENTINEL}=loaded\n")
+    monkeypatch.delenv(_SENTINEL, raising=False)
+    monkeypatch.setenv("ARGUS_NO_DOTENV", "1")
+    assert load_dotenv_early(start=tmp_path, env_filename=".env") is None
+    import os
+
+    assert _SENTINEL not in os.environ
+
+
+def test_load_dotenv_early_still_loads_when_not_disabled(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    import os
+
+    (tmp_path / ".env").write_text(f"{_SENTINEL}=loaded\n")
+    monkeypatch.delenv(_SENTINEL, raising=False)
+    monkeypatch.delenv("ARGUS_NO_DOTENV", raising=False)
+    try:
+        assert load_dotenv_early(start=tmp_path, env_filename=".env") is not None
+        assert os.environ[_SENTINEL] == "loaded"
+    finally:
+        os.environ.pop(_SENTINEL, None)
+
+
+class TestSettingsHonorKillSwitch:
+    @pytest.fixture(autouse=True)
+    def _isolate(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Iterator[None]:
+        (tmp_path / ".env").write_text("ARGUS_GEMINI_CACHE_TTL=7\n")
+        monkeypatch.chdir(tmp_path)
+        monkeypatch.delenv("ARGUS_GEMINI_CACHE_TTL", raising=False)
+        clear_cache()
+        yield
+        clear_cache()
+
+    def test_cached_settings_read_dotenv_by_default(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.delenv("ARGUS_NO_DOTENV", raising=False)
+        assert get_settings().ARGUS_GEMINI_CACHE_TTL == 7
+
+    def test_cached_settings_ignore_dotenv_when_disabled(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        monkeypatch.setenv("ARGUS_NO_DOTENV", "true")
+        default = Settings.model_fields["ARGUS_GEMINI_CACHE_TTL"].default
+        assert get_settings().ARGUS_GEMINI_CACHE_TTL == default
+
+    def test_direct_settings_construction_also_ignores_dotenv(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        monkeypatch.setenv("ARGUS_NO_DOTENV", "1")
+        default = Settings.model_fields["ARGUS_GEMINI_CACHE_TTL"].default
+        assert Settings().ARGUS_GEMINI_CACHE_TTL == default
+
+    def test_real_environment_still_wins_when_disabled(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        monkeypatch.setenv("ARGUS_NO_DOTENV", "1")
+        monkeypatch.setenv("ARGUS_GEMINI_CACHE_TTL", "42")
+        assert Settings().ARGUS_GEMINI_CACHE_TTL == 42

{argus_code_review-0.3.0 → argus_code_review-0.3.2}/tests/test_runners_turn_budget.py

@@ -39,7 +39,6 @@ import pytest
 from claude_agent_sdk import (
     AssistantMessage,
     ClaudeAgentOptions,
-    ClaudeSDKClient,
     HookMatcher,
     ResultMessage,
     ToolResultBlock,
@@ -47,9 +46,10 @@ from claude_agent_sdk import (
     UserMessage,
 )
 
-# Pinned internal import: the exact SDK pin (0.1.81) is load-bearing;
+# Pinned internal import: the exact SDK pin (0.2.168) is load-bearing;
 # this test and internal import must be revisited whenever claude-agent-sdk is bumped.
 from claude_agent_sdk._internal.query import _convert_hook_output_for_cli
+from claude_agent_sdk.types import _hooks_to_internal_format
 from claude_agent_sdk.types import (
     HookContext,
     HookEvent,
@@ -692,8 +692,9 @@ class TestClaudeAgentSdkHookContract:
         assert isinstance(hooks["PostToolUse"][0], HookMatcher)
         assert isinstance(hooks["PostToolUseFailure"][0], HookMatcher)
 
-        client = ClaudeSDKClient(options=ClaudeAgentOptions(hooks=hooks))
-        internal = client._convert_hooks_to_internal_format(hooks)
+        # claude-agent-sdk 0.2.x moved this from a ClaudeSDKClient method to a
+        # module-level helper in claude_agent_sdk.types (TECH-7686).
+        internal = _hooks_to_internal_format(hooks)
         assert "PostToolUse" in internal
         assert "PostToolUseFailure" in internal
         assert len(internal["PostToolUse"]) == 1

{argus_code_review-0.3.0 → argus_code_review-0.3.2}/tests/test_scope_gate.py

@@ -476,6 +476,22 @@ class TestRunReviewHaltAndReceipt:
         with pytest.raises(ValueError, match="stale"):
             await _run({}, review_override_sha="d" * 40, review_override_reason="r")
 
+    async def test_expect_head_sha_mismatch_fails_before_any_graph_run(self) -> None:
+        with pytest.raises(ValueError, match="head moved"):
+            await _run({}, expect_head_sha="d" * 40)
+
+    async def test_expect_head_sha_must_be_a_full_lowercase_sha(self) -> None:
+        for bad in (HEAD[:12], HEAD.upper(), "z" * 40):
+            with pytest.raises(ValueError, match="40-character"):
+                await _run({}, expect_head_sha=bad)
+
+    async def test_expect_head_sha_match_runs_the_review(self) -> None:
+        resp, _, _ = await _run(
+            {"response": _approve(), "head_sha": HEAD, "findings": [], "scope": _scope_dict()},
+            expect_head_sha=HEAD,
+        )
+        assert resp.scope is not None and resp.scope.head_sha == HEAD
+
     async def test_override_pair_is_required(self) -> None:
         with pytest.raises(ValueError, match="together"):
             await _run({}, review_override_sha=HEAD)

argus_code_review-0.3.2/tests/test_sdk_bundled_cli_version.py

@@ -0,0 +1,30 @@
+"""Guard: the SDK-bundled Claude Code CLI must be new enough for claude-opus-5-5.
+
+Anthropic's API rejects claude-opus-5-5 from Claude Code older than 2.1.280
+(HTTP 400, ``claude_code_version_too_old``). The Claude Agent SDK bundles the
+CLI, so the SDK pin determines it. Pinned SDK 0.2.168 bundles 2.1.301; 2.1.280 is
+the minimum for opus-5-5. See TECH-7686.
+"""
+
+import re
+import subprocess
+from pathlib import Path
+
+import claude_agent_sdk
+
+MIN_BUNDLED_CLI = (2, 1, 280)
+
+
+def test_bundled_claude_cli_supports_opus_5_5() -> None:
+    cli = Path(claude_agent_sdk.__file__).parent / "_bundled" / "claude"
+    assert cli.exists(), f"bundled Claude Code CLI missing at {cli}"
+    out = subprocess.run(
+        [str(cli), "--version"], capture_output=True, text=True, timeout=60, check=True
+    ).stdout
+    match = re.search(r"(\d+)\.(\d+)\.(\d+)", out)
+    assert match, f"could not parse CLI version from {out!r}"
+    version = tuple(int(g) for g in match.groups())
+    assert version >= MIN_BUNDLED_CLI, (
+        f"bundled Claude Code {version} is older than {MIN_BUNDLED_CLI}; "
+        "claude-opus-5-5 requests will be rejected (TECH-7686)"
+    )