fix(cli): accept --thinking flag silently in csa review

Cargo.toml

@@ -3,7 +3,7 @@ members = ["crates/*"]
 resolver = "2"
 
 [workspace.package]
-version = "0.1.153"
+version = "0.1.154"
 edition = "2024"
 rust-version = "1.88"
 license = "Apache-2.0"

crates/cli-sub-agent/src/cli_review.rs

@@ -50,6 +50,11 @@ pub struct ReviewArgs {
     #[arg(short, long)]
     pub model: Option<String>,
 
+    /// Thinking budget (accepted for CLI compatibility but not used by review;
+    /// thinking level is controlled via tier configuration)
+    #[arg(long)]
+    pub thinking: Option<String>,
+
     /// Review uncommitted changes (git diff HEAD)
     #[arg(long)]
     pub diff: bool,

crates/cli-sub-agent/src/review_cmd.rs

@@ -231,7 +231,7 @@ pub(crate) async fn handle_review(args: ReviewArgs, current_depth: u32) -> Resul
     // Resolve thinking: CLI > config review.thinking > tier model_spec thinking.
     // Tier thinking is embedded in model_spec and applied via build_and_validate_executor.
     let review_thinking = resolve_review_thinking(
-        None, // review CLI has no --thinking flag yet
+        args.thinking.as_deref(),
         config
             .as_ref()
             .and_then(|c| c.review.as_ref())

crates/cli-sub-agent/src/review_cmd_tests.rs

@@ -338,6 +338,7 @@ fn derive_scope_uncommitted() {
         sa_mode: None,
         session: None,
         model: None,
+        thinking: None,
         diff: true,
         branch: None,
         commit: None,
@@ -374,6 +375,7 @@ fn derive_scope_commit() {
         sa_mode: None,
         session: None,
         model: None,
+        thinking: None,
         diff: false,
         branch: None,
         commit: Some("abc123".to_string()),
@@ -410,6 +412,7 @@ fn derive_scope_range() {
         sa_mode: None,
         session: None,
         model: None,
+        thinking: None,
         diff: false,
         branch: None,
         commit: None,
@@ -446,6 +449,7 @@ fn derive_scope_files() {
         sa_mode: None,
         session: None,
         model: None,
+        thinking: None,
         diff: false,
         branch: None,
         commit: None,
@@ -482,6 +486,7 @@ fn derive_scope_default_branch() {
         sa_mode: None,
         session: None,
         model: None,
+        thinking: None,
         diff: false,
         branch: Some("develop".to_string()),
         commit: None,

crates/cli-sub-agent/src/review_cmd_tests_tail.rs

@@ -1,6 +1,21 @@
 use super::*;
 use csa_config::ProjectProfile;
 
+// --- --thinking silent acceptance tests ---
+
+#[test]
+fn thinking_flag_accepted_silently() {
+    let args = parse_review_args(&["csa", "review", "--thinking", "xhigh", "--diff"]);
+    assert_eq!(args.thinking.as_deref(), Some("xhigh"));
+    assert!(args.diff);
+}
+
+#[test]
+fn thinking_flag_optional() {
+    let args = parse_review_args(&["csa", "review", "--diff"]);
+    assert!(args.thinking.is_none());
+}
+
 // --- verify_review_skill_available tests ---
 
 #[test]

deny.toml

@@ -7,7 +7,14 @@ ignore = [
     # Transitive from agent-teams -> cc-sdk -> reqwest.
     # rustls-pemfile is archived; no non-breaking safe upgrade is available yet.
     "RUSTSEC-2025-0134",
-    # (removed: RUSTSEC-2024-0384 resolved by dependency upgrades)
+    # Transitive from agent-teams -> cc-sdk -> reqwest -> hyper-rustls -> rustls -> aws-lc-rs.
+    # X.509 Name Constraints Bypass — no direct upgrade path (deep transitive).
+    "RUSTSEC-2026-0044",
+    # Transitive from same chain. CRL Distribution Point Scope Check Logic Error.
+    "RUSTSEC-2026-0048",
+    # Transitive from cc-sdk -> reqwest -> rustls. CRL revocation check bug.
+    # Safe default (UnknownStatusPolicy::Deny) mitigates impact.
+    "RUSTSEC-2026-0049",
 ]
 
 [licenses]

weave.lock

@@ -1,9 +1,9 @@
 package = []
 
 [versions]
-csa = "0.1.151"
+csa = "0.1.152"
 last_migrated_at = "2026-03-08T12:08:01.820964091Z"
-weave = "0.1.151"
+weave = "0.1.152"
 
 [migrations]
 applied = [