Fix CI lint failures and CodeQL noise

- tests: split compound asserts (PT018), use pytest.raises (PT017),
  rename unused lambda params with _ prefix (ARG005).
- sdk/base.py: drop redundant '...' from Protocol method bodies.
- sdk/__init__.py: annotate substring URL match as intentional dispatch
  hint (endpoint is trusted operator config, not attacker input).

Author: anticomputer

src/seclab_taskflow_agent/sdk/__init__.py

@@ -66,6 +66,10 @@ def resolve_backend_name(
     the optional dependency is installed) > ``openai_agents``.
     """
     name = explicit or os.getenv(_ENV_VAR)
+    # lgtm[py/incomplete-url-substring-sanitization]
+    # Endpoint is trusted operator config (YAML `endpoint:` / CAPI env),
+    # not attacker-controlled input; this is a startup dispatch hint,
+    # not a security boundary.
     if not name and endpoint and "api.githubcopilot.com" in endpoint:
         with contextlib.suppress(ImportError):
             __import__("copilot")

src/seclab_taskflow_agent/sdk/base.py

@@ -78,7 +78,6 @@ class AgentBackend(Protocol):
 
     def validate(self, spec: AgentSpec) -> None:
         """Reject any spec field the backend cannot honour."""
-        ...
 
     async def build(
         self,
@@ -88,7 +87,6 @@ async def build(
         agent_hooks: Any = None,
     ) -> Any:
         """Construct a backend-native agent from a neutral spec."""
-        ...
 
     def run_streamed(
         self,
@@ -98,8 +96,6 @@ def run_streamed(
         max_turns: int,
     ) -> AsyncIterator[StreamEvent]:
         """Run the agent against *prompt*, yielding neutral stream events."""
-        ...
 
     async def aclose(self, agent: Any) -> None:
         """Release any resources held by *agent*."""
-        ...

src/seclab_taskflow_agent/sdk/openai_agents/backend.py

@@ -54,8 +54,8 @@ class OpenAIAgentsBackend:
     name = "openai_agents"
 
     def validate(self, spec: AgentSpec) -> None:
-        # The openai-agents adapter supports every YAML field this
-        # runner exposes, so there's nothing to reject up front.
+        # openai-agents accepts every field the YAML grammar exposes,
+        # so there's nothing to reject up front.
         del spec
 
     async def build(

tests/test_sdk_openai_adapter.py

@@ -203,7 +203,8 @@ def run_streamed(self, prompt: str, *, max_turns: int):  # noqa: ARG002
             return res
 
     _collect(backend.run_streamed(_CapturingAgent(), "p", max_turns=1))
-    assert captured and captured[0].cancel_called is True
+    assert captured
+    assert captured[0].cancel_called is True
 
 
 def test_aclose_closes_taskagent_client(backend):

tests/test_stream.py

@@ -37,7 +37,8 @@ async def on_tool_end(self, ctx: Any, agent: Any, tool: Any, result: Any) -> Non
 def test_bridge_emits_envelope_and_name():
     hooks = _RecordingHooks()
     asyncio.run(bridge_copilot_tool_event(ToolEnd(tool_name="echo", text="hi"), hooks))
-    assert len(hooks.starts) == 1 and hooks.starts[0][2].name == "echo"
+    assert len(hooks.starts) == 1
+    assert hooks.starts[0][2].name == "echo"
     assert len(hooks.ends) == 1
     _, _, tool, payload = hooks.ends[0]
     assert tool.name == "echo"
@@ -93,13 +94,14 @@ async def _fake_render(text: str, **_kw: Any) -> None:
     _drive(backend, hooks)
 
     assert "hi" in rendered
-    assert hooks.ends and json.loads(hooks.ends[0][3]) == {"text": "r"}
+    assert hooks.ends
+    assert json.loads(hooks.ends[0][3]) == {"text": "r"}
 
 
 def test_drive_retries_then_succeeds_on_timeout(monkeypatch):
     monkeypatch.setattr(
         "seclab_taskflow_agent._stream.render_model_output",
-        lambda *a, **kw: _noop(),
+        lambda *_a, **_kw: _noop(),
     )
     backend = _ScriptedBackend([BackendTimeoutError("once"), [TextDelta(text="ok")]])
     _drive(backend, max_api_retry=2)
@@ -109,7 +111,7 @@ def test_drive_retries_then_succeeds_on_timeout(monkeypatch):
 def test_drive_raises_after_retries_exhausted(monkeypatch):
     monkeypatch.setattr(
         "seclab_taskflow_agent._stream.render_model_output",
-        lambda *a, **kw: _noop(),
+        lambda *_a, **_kw: _noop(),
     )
     backend = _ScriptedBackend([BackendTimeoutError("a"), BackendTimeoutError("b")])
     with pytest.raises(BackendTimeoutError):
@@ -119,7 +121,7 @@ def test_drive_raises_after_retries_exhausted(monkeypatch):
 def test_drive_caps_rate_limit_backoff(monkeypatch):
     monkeypatch.setattr(
         "seclab_taskflow_agent._stream.render_model_output",
-        lambda *a, **kw: _noop(),
+        lambda *_a, **_kw: _noop(),
     )
     sleeps: list[float] = []
 
@@ -135,7 +137,8 @@ async def _fake_sleep(n: float) -> None:
         ]
     )
     _drive(backend, initial_rate_limit_backoff=1, max_rate_limit_backoff=4)
-    assert sleeps and all(s <= 4 for s in sleeps)
+    assert sleeps
+    assert all(s <= 4 for s in sleeps)
 
 
 async def _noop() -> None:
@@ -156,7 +159,7 @@ async def run_streamed(self, _agent: Any, _prompt: str, *, max_turns: int) -> An
 def test_drive_raises_on_stream_idle_timeout(monkeypatch):
     monkeypatch.setattr(
         "seclab_taskflow_agent._stream.render_model_output",
-        lambda *a, **kw: _noop(),
+        lambda *_a, **_kw: _noop(),
     )
     # Force a tiny idle timeout so the test runs quickly.
     monkeypatch.setattr("seclab_taskflow_agent._stream.STREAM_IDLE_TIMEOUT", 0.05)
@@ -182,7 +185,7 @@ def test_drive_raises_on_stream_idle_timeout(monkeypatch):
 def test_drive_pings_watchdog_per_event(monkeypatch):
     monkeypatch.setattr(
         "seclab_taskflow_agent._stream.render_model_output",
-        lambda *a, **kw: _noop(),
+        lambda *_a, **_kw: _noop(),
     )
     pings: list[int] = []
     monkeypatch.setattr(

tests/test_watchdog.py

@@ -7,6 +7,8 @@
 
 import time
 
+import pytest
+
 from seclab_taskflow_agent import _watchdog
 
 
@@ -38,8 +40,7 @@ def _fake_exit(code: int) -> None:
     # Simulate a stale timestamp so the first iteration decides to exit.
     monkeypatch.setattr(_watchdog, "_last_activity", time.monotonic() - 10_000)
 
-    try:
+    with pytest.raises(SystemExit) as excinfo:
         _watchdog._watchdog_loop(timeout=1)
-    except SystemExit as exc:
-        assert exc.code == 2
+    assert excinfo.value.code == 2
     assert exits == [2]