test(linear): address PR #87 re-review nice-to-have items

- test_config: cover the BotoCoreError branch of
  `resolve_linear_api_token` with an `EndpointConnectionError`
  case. The PR-#87 split into ClientError + BotoCoreError branches
  previously had no test on the BotoCoreError path.
- test_linear_reactions: new
  `test_sweep_preserves_just_posted_eyes_via_exclude_id` exercises
  the `exclude_id` filter — the existing sweep test never collided
  prior reaction ids with the newly posted one, so the branch was
  effectively dead code in tests. The new test plants the just-
  posted 👀 in the prior reactions list and asserts it survives the
  sweep while an older ❌ is deleted.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: bgagent

agent/tests/test_config.py

@@ -156,3 +156,22 @@ def test_other_client_error_logged_at_warn(self, monkeypatch):
             assert resolve_linear_api_token() == ""
         assert mock_log.call_count == 1
         assert mock_log.call_args[0][0] == "WARN"
+
+    def test_botocore_error_logged_at_warn(self, monkeypatch):
+        """The handler is split into ClientError + BotoCoreError branches.
+        BotoCoreError covers transient connectivity / endpoint problems —
+        log WARN and degrade gracefully rather than crashing the agent."""
+        monkeypatch.delenv("LINEAR_API_TOKEN", raising=False)
+        monkeypatch.setenv("LINEAR_API_TOKEN_SECRET_ARN", "arn:aws:sm:::secret/linear")
+
+        from botocore.exceptions import EndpointConnectionError
+
+        fake_client = MagicMock()
+        fake_client.get_secret_value.side_effect = EndpointConnectionError(
+            endpoint_url="https://secretsmanager.us-east-1.amazonaws.com",
+        )
+        with patch("boto3.client", return_value=fake_client), patch("config.log") as mock_log:
+            assert resolve_linear_api_token() == ""
+        assert mock_log.call_count == 1
+        assert mock_log.call_args[0][0] == "WARN"
+        assert "EndpointConnectionError" in mock_log.call_args[0][1]

agent/tests/test_linear_reactions.py

@@ -378,6 +378,39 @@ def test_viewer_id_cached_across_calls(self, monkeypatch):
             # Only one viewer query across both calls.
             assert sum("Viewer" in q for q in queries) == 1
 
+    def test_sweep_preserves_just_posted_eyes_via_exclude_id(self, monkeypatch):
+        """If Linear's reactions query happens to return our just-posted 👀
+        (e.g. on a tight retry where the prior run's reaction id was reused
+        by Linear), the sweep MUST NOT delete it — exclude_id is what keeps
+        the new marker safe. Tests would otherwise pass with exclude_id=None
+        because the prior reaction ids never collide with the new one."""
+        monkeypatch.setenv("LINEAR_API_TOKEN", "lin_api_test")
+        new_rid = "r-new-eyes"
+        prior_reactions = [
+            # The just-posted 👀 — sweep must SKIP this one.
+            {"id": new_rid, "emoji": EMOJI_STARTED, "user": {"id": "viewer-bot"}},
+            # An older bgagent ❌ from a prior run — sweep MUST delete this.
+            {"id": "r-old-x", "emoji": EMOJI_FAILURE, "user": {"id": "viewer-bot"}},
+        ]
+        with patch(
+            "linear_reactions.requests.post",
+            side_effect=[
+                _ok_response(reaction_id=new_rid),
+                _viewer_response("viewer-bot"),
+                _reactions_response(prior_reactions),
+                _ok_delete_response(),  # only one delete expected
+            ],
+        ) as post:
+            react_task_started("linear", {"linear_issue_id": "issue-1"})
+            _join_sweep_thread()
+            delete_ids = [
+                call.kwargs["json"]["variables"]["id"]
+                for call in post.call_args_list
+                if "reactionDelete" in call.kwargs["json"]["query"]
+            ]
+            # The new 👀 must NOT be deleted; only the old ❌ should be.
+            assert delete_ids == ["r-old-x"]
+
 
 class TestAuthCircuitBreaker:
     """The circuit breaker in `_graphql` flips open after