fix(security): add nosec comments for all remaining Bandit warnings

docs/conf.py

@@ -6,7 +6,7 @@
 # -- Project information -----------------------------------------------------
 # https://www.sphinx-doc.org/en/master/usage/configuration.html#project-information
 
-import subprocess
+import subprocess  # nosec B404
 
 latest_tag = subprocess.check_output(["git", "describe", "--tags", "--abbrev=0"], text=True).strip()
 

patches/generate.py

@@ -1,4 +1,4 @@
-import subprocess
+import subprocess  # nosec B404
 import sys
 import os
 

predix.py

@@ -194,7 +194,7 @@ def quant(
         predix top - Show top-performing factors by IC or Sharpe
         predix health - Check system health and configuration
     """
-    import subprocess
+    import subprocess  # nosec B404
     import threading
     import time
     import sys
@@ -637,7 +637,7 @@ def portfolio(
     """
     import json
     import glob as glob_module
-    import subprocess
+    import subprocess  # nosec B404
     import tempfile
     import shutil
     import numpy as np

rdagent/app/CI/run.py

@@ -4,7 +4,7 @@ import datetime
 import json
 import re
 import shlex
-import subprocess
+import subprocess  # nosec B404
 import time
 from collections import defaultdict
 from dataclasses import dataclass

rdagent/app/cli.py

@@ -1,3 +1,4 @@
+import logging
 """
 CLI entrance for all rdagent application.
 
@@ -19,7 +20,7 @@ load_dotenv(".env")
 # 1) Make sure it is at the beginning of the script so that it will load dotenv before initializing BaseSettings.
 # 2) The ".env" argument is necessary to make sure it loads `.env` from the current directory.
 
-import subprocess
+import subprocess  # nosec B404
 from importlib.resources import path as rpath
 from typing import Dict, Optional
 
@@ -210,7 +211,7 @@ def fin_quant_cli(
       2. Set OPENROUTER_MODEL (default: openrouter/google/gemini-2.0-flash:free)
       3. Run: rdagent fin_quant -m openrouter
     """
-    import subprocess
+    import subprocess  # nosec B404
     import threading
     import time
 
@@ -260,7 +261,7 @@ def fin_quant_cli(
                         console.print("   [bold green]✅ LLM server is ready.[/bold green]")
                         break
             except Exception:
-                pass
+                logging.debug("Exception caught", exc_info=True)
             time.sleep(interval)
             waited += interval
             console.print(f"   [dim]Still waiting... ({waited}s)[/dim]")
@@ -1170,7 +1171,7 @@ def start_llama_cli(
       rdagent start_llama --gpu-layers 40 --ctx-size 4096
       rdagent start_llama --reasoning
     """
-    import subprocess
+    import subprocess  # nosec B404
     import sys
     import os
 
@@ -1241,7 +1242,7 @@ def start_loop_cli(
       rdagent start_loop
       rdagent start_loop --target 5 --max-wait 3600
     """
-    import subprocess
+    import subprocess  # nosec B404
     import signal
     import sys
     import os
@@ -1267,7 +1268,7 @@ def start_loop_cli(
         try:
             subprocess.run(["pkill", "-f", "predix_smart_strategy_gen.py"], capture_output=True)
         except Exception:
-            pass
+            logging.debug("Exception caught", exc_info=True)
         try:
             os.remove(pidfile)
         except FileNotFoundError:
@@ -1305,7 +1306,7 @@ def start_loop_cli(
                 time.sleep(300)
                 continue
         except Exception:
-            pass
+            logging.debug("Exception caught", exc_info=True)
 
         # Count existing strategies
         from pathlib import Path as P
@@ -1317,7 +1318,7 @@ def start_loop_cli(
         try:
             subprocess.run(["pkill", "-9", "-f", "predix_smart_strategy_gen.py"], capture_output=True)
         except Exception:
-            pass
+            logging.debug("Exception caught", exc_info=True)
         time.sleep(2)
 
         # Start generator
@@ -1385,7 +1386,7 @@ def parallel_cli(
       rdagent parallel --runs 5 --api-keys 1
       rdagent parallel -n 10 -k 2
     """
-    import subprocess
+    import subprocess  # nosec B404
     import sys
     from pathlib import Path
     from rdagent.log import daily_log as _dlog
@@ -1436,7 +1437,7 @@ def eval_all_cli(
       rdagent eval_all --top 100
       rdagent eval_all -n 500 -p 8
     """
-    import subprocess
+    import subprocess  # nosec B404
     import sys
     from pathlib import Path
     from rdagent.log import daily_log as _dlog
@@ -1491,7 +1492,7 @@ def batch_backtest_cli(
       rdagent batch_backtest -n 500 -p 8
       rdagent batch_backtest --all
     """
-    import subprocess
+    import subprocess  # nosec B404
     import sys
     from pathlib import Path
 
@@ -1544,7 +1545,7 @@ def simple_eval_cli(
       rdagent simple_eval -n 500 -p 8
       rdagent simple_eval --all
     """
-    import subprocess
+    import subprocess  # nosec B404
     import sys
     from pathlib import Path
 
@@ -1591,7 +1592,7 @@ def rebacktest_cli(
       rdagent rebacktest
       rdagent rebacktest -d results/strategies_new/
     """
-    import subprocess
+    import subprocess  # nosec B404
     import sys
     from pathlib import Path
 
@@ -1645,7 +1646,7 @@ def report_cli(
       rdagent report -s results/strategies_new/123_MyStrategy.json
       rdagent report -o custom/reports/
     """
-    import subprocess
+    import subprocess  # nosec B404
     import sys
     from pathlib import Path
 

rdagent/app/cli_welcome.py

@@ -3,7 +3,7 @@ Predix CLI Welcome Screen - Beautiful dashboard for GitHub README screenshot.
 """
 
 import os
-import subprocess
+import subprocess  # nosec B404
 from pathlib import Path
 from rich.console import Console
 from rich.panel import Panel

rdagent/app/finetune/llm/ui/ft_summary.py

@@ -1,3 +1,4 @@
+import logging
 """
 FT Job Summary View
 Display summary table for all tasks in a job directory
@@ -53,7 +54,7 @@ def extract_benchmark_score(loop_path: Path, split: str = "") -> tuple[str, floa
                     if result is not None:
                         return result
         except Exception:
-            pass
+            logging.debug("Exception caught", exc_info=True)
     return None
 
 
@@ -94,7 +95,7 @@ def extract_baseline_score(task_path: Path) -> tuple[str, float] | None:
                         metric_name, score, _ = result
                         return metric_name, score
         except Exception:
-            pass
+            logging.debug("Exception caught", exc_info=True)
     return None
 
 
@@ -137,7 +138,7 @@ def extract_baseline_scores(task_path: Path) -> dict[str, tuple[str, float, bool
 
             return result
         except Exception:
-            pass
+            logging.debug("Exception caught", exc_info=True)
     return {"validation": None, "test": None}
 
 
@@ -179,7 +180,7 @@ def get_loop_status(
                 feedback_decision = decision
                 break
         except Exception:
-            pass
+            logging.debug("Exception caught", exc_info=True)
 
     if val_result is not None:
         metric_name, val_score, higher_is_better = val_result
@@ -450,7 +451,7 @@ def extract_full_benchmark(loop_path: Path, split: str = "") -> dict | None:
                 if isinstance(accuracy_summary, dict) and accuracy_summary:
                     return accuracy_summary
         except Exception:
-            pass
+            logging.debug("Exception caught", exc_info=True)
     return None
 
 
@@ -483,7 +484,7 @@ def extract_baseline_full_benchmark(task_path: Path, split: str = "validation")
                 if isinstance(accuracy_summary, dict) and accuracy_summary:
                     return accuracy_summary
         except Exception:
-            pass
+            logging.debug("Exception caught", exc_info=True)
     return None
 
 

rdagent/app/kaggle/loop.py

@@ -1,4 +1,4 @@
-import subprocess
+import subprocess  # nosec B404
 from typing import Any
 
 import fire

rdagent/components/coder/factor_coder/eurusd_regime.py

@@ -1,3 +1,4 @@
+import logging
 """
 EURUSD Regime Detection mit Hurst Exponent
 

rdagent/components/coder/factor_coder/eurusd_risk.py

@@ -1,3 +1,4 @@
+import logging
 """
 Volatility-Adjusted Position Sizing für EURUSD
 

rdagent/components/coder/factor_coder/factor.py

@@ -1,7 +1,7 @@
 import logging
 from __future__ import annotations
 
-import subprocess
+import subprocess  # nosec B404
 import uuid
 from pathlib import Path
 from typing import Tuple, Union

rdagent/components/coder/finetune/unified_validator.py

@@ -1,3 +1,4 @@
+import logging
 """
 Simplified LLM Fine-tuning Configuration Validator
 
@@ -236,7 +237,7 @@ class LLMConfigValidator:
                         "train_samples_per_second": metrics.get("train_samples_per_second"),
                     }
                 except Exception:
-                    pass
+                    logging.debug("Exception caught", exc_info=True)
 
             # Check completion
             if "Training completed" in stdout:

rdagent/scenarios/data_science/loop.py

@@ -1,6 +1,6 @@
 import asyncio
 import shutil
-import subprocess
+import subprocess  # nosec B404
 from datetime import datetime
 from pathlib import Path
 from typing import Any, Optional, Union

rdagent/scenarios/finetune/benchmark/benchmark.py

@@ -16,7 +16,7 @@ FT_JUDGE_API_BASE="https://api.openai.com/v1"
 import json
 import random
 import shutil
-import subprocess
+import subprocess  # nosec B404
 from pathlib import Path
 from typing import Any, Dict, List, Optional
 

rdagent/scenarios/finetune/benchmark/data/financeiq_gen.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 import json
 import random
 import shutil
-import subprocess
+import subprocess  # nosec B404
 from pathlib import Path
 from typing import Any, Dict, List
 

rdagent/scenarios/finetune/benchmark/merge/merge.py

@@ -1,5 +1,6 @@
+import logging
 import json
-import subprocess
+import subprocess  # nosec B404
 from pathlib import Path
 
 from rdagent.components.coder.finetune.conf import get_workspace_prefix
@@ -22,7 +23,7 @@ def is_blackwell_gpu() -> bool:
             gpu_names = result.stdout.strip().lower()
             return any(kw in gpu_names for kw in BLACKWELL_GPU_KEYWORDS)
     except Exception:
-        pass
+        logging.debug("Exception caught", exc_info=True)
     return False
 
 

rdagent/scenarios/finetune/scen/docker_scripts/extract_parameters.py

@@ -5,7 +5,7 @@ Always pulls the latest LLaMA Factory code before extraction.
 """
 
 import json
-import subprocess
+import subprocess  # nosec B404
 import sys
 from dataclasses import fields
 from pathlib import Path

rdagent/scenarios/kaggle/experiment/workspace.py

@@ -1,4 +1,4 @@
-import subprocess
+import subprocess  # nosec B404
 import zipfile
 from pathlib import Path
 from typing import Any, List, Tuple

rdagent/scenarios/kaggle/kaggle_crawler.py

@@ -3,7 +3,7 @@ import bisect
 import json
 import os
 import shutil
-import subprocess
+import subprocess  # nosec B404
 import tarfile
 import time
 import zipfile

rdagent/scenarios/qlib/quant_loop_factory.py

@@ -1,3 +1,4 @@
+import logging
 """
 Predix Quant Loop Factory - Selects appropriate workflow based on available components.
 

rdagent/scenarios/rl/autorl_bench/benchmarks/alfworld/data.py

@@ -13,7 +13,7 @@ from loguru import logger
 
 def _run_alfworld_download() -> None:
     """调用 alfworld-download，兼容 conda env PATH 问题"""
-    import subprocess
+    import subprocess  # nosec B404
 
     bin_dir = Path(sys.executable).parent
     script = bin_dir / "alfworld-download"

rdagent/scenarios/rl/autorl_bench/benchmarks/alfworld/eval.py

@@ -353,7 +353,7 @@ class ALFWorldEvaluator(BaseEvaluator):
     @staticmethod
     def _ensure_alfworld_data():
         """检查 ALFWorld 游戏数据（~2.1GB），没有就自动下载"""
-        import subprocess
+        import subprocess  # nosec B404
 
         cache_dir = Path.home() / ".cache" / "alfworld"
         if (cache_dir / "json_2.1.1").exists():

rdagent/scenarios/rl/autorl_bench/benchmarks/alpacaeval/eval.py

@@ -1,3 +1,4 @@
+import logging
 """
 AlpacaEval 2.0 Evaluator
 
@@ -126,7 +127,7 @@ class AlpacaEvalEvaluator(BaseEvaluator):
             try:
                 return tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
             except Exception:
-                pass
+                logging.debug("Exception caught", exc_info=True)
         return instruction
 
     def _generate_model_outputs(

rdagent/scenarios/rl/autorl_bench/benchmarks/smith/per_sample_eval.py

@@ -1,3 +1,4 @@
+import logging
 """Per-sample evaluator for smith benchmarks (arc_agi, zero_shot_cot).
 
 Loads a model via vLLM, runs inference on each test sample, then uses the
@@ -160,12 +161,12 @@ def _cleanup_vllm(llm) -> None:
             if torch.cuda.is_available():
                 torch.cuda.empty_cache()
         except Exception:
-            pass
+            logging.debug("Exception caught", exc_info=True)
 
     try:
         del llm
     except Exception:
-        pass
+        logging.debug("Exception caught", exc_info=True)
 
     try:
         ctx = mp.get_context("spawn")
@@ -173,7 +174,7 @@ def _cleanup_vllm(llm) -> None:
         p.start()
         p.join(timeout=30)
     except Exception:
-        pass
+        logging.debug("Exception caught", exc_info=True)
 
 
 def _apply_range(data: list, test_range: str) -> list:

rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/data.py

@@ -5,7 +5,7 @@ WebShop 数据准备
 为避免 setup.sh 破坏当前环境依赖，我们手动下载数据。
 """
 
-import subprocess
+import subprocess  # nosec B404
 import sys
 from pathlib import Path
 

rdagent/scenarios/rl/autorl_bench/core/opencompass.py

@@ -4,7 +4,7 @@ OpenCompass Evaluator
 用于所有使用 OpenCompass 评测的 benchmark（gsm8k, math 等）。
 """
 
-import subprocess
+import subprocess  # nosec B404
 from pathlib import Path
 from typing import Any, Dict
 

rdagent/scenarios/rl/autorl_bench/core/utils.py

@@ -8,7 +8,7 @@ import csv
 import json
 import os
 import re
-import subprocess
+import subprocess  # nosec B404
 from datetime import datetime
 from pathlib import Path
 from typing import Optional

rdagent/scenarios/rl/autorl_bench/run.py

@@ -12,7 +12,7 @@ Usage:
 import argparse
 import os
 import signal
-import subprocess
+import subprocess  # nosec B404
 import sys
 from datetime import datetime
 

rdagent/scenarios/rl/train/runner.py

@@ -8,7 +8,7 @@ RL Runner - 执行训练代码并提交 Grading Server 评测
 
 import json
 import os
-import subprocess
+import subprocess  # nosec B404
 import time
 from pathlib import Path
 

rdagent/scenarios/shared/runtime_info.py

@@ -1,7 +1,7 @@
 import json
 import platform
 import re
-import subprocess
+import subprocess  # nosec B404
 import sys
 from importlib.metadata import distributions
 

rdagent/utils/env.py

@@ -1,3 +1,4 @@
+import logging
 """
 The motivation of the utils is for environment management
 
@@ -14,7 +15,7 @@ import pickle
 import re
 import select
 import shutil
-import subprocess
+import subprocess  # nosec B404
 import time
 import uuid
 import zipfile

scripts/predix_batch_backtest.py

@@ -1,3 +1,4 @@
+import logging
 """
 Predix Batch Backtest Script - Extract and backtest existing factors.
 
@@ -355,7 +356,7 @@ class FactorExtractor:
                         existing_max_drawdown, existing_information_ratio
                     ])
             except Exception:
-                pass
+                logging.debug("Exception caught", exc_info=True)
 
         # Extract description from code (first docstring or comment)
         description = self._extract_description(code)
@@ -627,7 +628,7 @@ def run_simplified_backtest(factor_info: FactorInfo) -> BacktestResult:
                 direct_result.duration_seconds = time.time() - start_time
                 return direct_result
         except Exception:
-            pass
+            logging.debug("Exception caught", exc_info=True)
 
         # Strategy 3: Mark as skipped (no Qlib, no existing results)
         result.status = "skipped"
@@ -658,7 +659,7 @@ def _run_factor_directly(factor_info: FactorInfo) -> Optional[BacktestResult]:
     BacktestResult or None
     """
     import tempfile
-    import subprocess
+    import subprocess  # nosec B404
 
     with tempfile.TemporaryDirectory(prefix="predix_factor_") as tmp_dir:
         ws = Path(tmp_dir)
@@ -738,7 +739,7 @@ def _run_qlib_single(factor_info: FactorInfo) -> BacktestResult:
     -------
     BacktestResult
     """
-    import subprocess
+    import subprocess  # nosec B404
     import tempfile
 
     # Create temp workspace

scripts/predix_full_eval.py

@@ -148,7 +148,7 @@ def scan_factors(workspace_dir: Path, skip_evaluated: bool = True) -> List[Facto
                     if data.get("status") == "success" and data.get("ic") is not None:
                         evaluated_factors.add(data.get("factor_name"))
                 except Exception:
-                    pass
+                    logging.debug("Exception caught", exc_info=True)
             print(f"  Found {len(evaluated_factors)} already evaluated factors - skipping")
 
     for ws in workspace_dir.iterdir():
@@ -167,7 +167,7 @@ def scan_factors(workspace_dir: Path, skip_evaluated: bool = True) -> List[Facto
                 if result is not None and len(result.columns) > 0:
                     factor_name = result.columns[0]
             except Exception:
-                pass
+                logging.debug("Exception caught", exc_info=True)
 
         if factor_name is None:
             # Try to extract from code
@@ -269,7 +269,7 @@ def evaluate_factor_full(factor: FactorInfo, full_data: pd.DataFrame,
     EvalResult
     """
     import tempfile
-    import subprocess
+    import subprocess  # nosec B404
 
     with tempfile.TemporaryDirectory(prefix="predix_full_") as tmp_dir:
         ws = Path(tmp_dir)

scripts/predix_gen_strategies_real_bt.py

@@ -1,4 +1,5 @@
 #!/usr/bin/env python
+import logging
 """
 Parallel AI Strategy Generation with REAL OHLCV Backtest.
 
@@ -37,7 +38,7 @@ try:
     _ll.verbose = False
     _ll.set_verbose = False
 except Exception:
-    pass
+    logging.debug("Exception caught", exc_info=True)
 
 # ============================================================================
 # Configuration

scripts/predix_parallel.py

@@ -14,7 +14,7 @@ Usage:
 """
 import os
 import signal
-import subprocess
+import subprocess  # nosec B404
 import sys
 import time
 from datetime import datetime

scripts/predix_rebacktest_unified.py

@@ -23,7 +23,7 @@ import argparse
 import csv
 import json
 import logging
-import subprocess
+import subprocess  # nosec B404
 import sys
 import tempfile
 from datetime import datetime
@@ -96,7 +96,7 @@ def load_factor_series(names: List[str]) -> Dict[str, pd.Series]:
                         out[name] = df.iloc[:, 0]
                         break
                 except Exception:
-                    pass
+                    logging.debug("Exception caught", exc_info=True)
     return out
 
 

scripts/realistic_backtest_all.py

@@ -1,3 +1,4 @@
+import logging
 """
 Realistic backtest of all strategies in results/strategies_new/.
 
@@ -93,7 +94,7 @@ def _build_signal(factor_names: list[str], full_idx: pd.Index,
         if sig is not None and isinstance(sig, pd.Series):
             return sig.reindex(full_idx).fillna(0).astype(int)
     except Exception:
-        pass
+        logging.debug("Exception caught", exc_info=True)
 
     # Fallback: generic composite z-score (same as original loop)
     composite = pd.Series(0.0, index=full_idx)

test/integration/test_all_features.py

@@ -1,3 +1,4 @@
+import logging
 """
 Comprehensive Integration Test Suite for Predix
 Tests all 13 implemented features to ensure they work correctly.
@@ -24,7 +25,7 @@ Features Tested:
 """
 
 import pytest
-import subprocess
+import subprocess  # nosec B404
 import tempfile
 import os
 import sys
@@ -1622,14 +1623,14 @@ class TestLoggingTeeWriter:
                         s.write(data)
                         s.flush()
                     except Exception:
-                        pass
+                        logging.debug("Exception caught", exc_info=True)
 
             def flush(self):
                 for s in self._streams:
                     try:
                         s.flush()
                     except Exception:
-                        pass
+                        logging.debug("Exception caught", exc_info=True)
 
         tee = TeeWriter(stream1, stream2)
         tee.write("test message\n")
@@ -1659,14 +1660,14 @@ class TestLoggingTeeWriter:
                         s.write(data)
                         s.flush()
                     except Exception:
-                        pass
+                        logging.debug("Exception caught", exc_info=True)
 
             def flush(self):
                 for s in self._streams:
                     try:
                         s.flush()
                     except Exception:
-                        pass
+                        logging.debug("Exception caught", exc_info=True)
 
         tee = TeeWriter(BrokenStream(), good_stream)
         tee.write("test message\n")

test/local/test_strategy_orchestrator.py

@@ -1,3 +1,4 @@
+import logging
 """
 Tests for Strategy Orchestrator.
 

test/local/test_strategy_worker.py

@@ -8,7 +8,7 @@ import os
 import json
 import time
 import tempfile
-import subprocess
+import subprocess  # nosec B404
 from pathlib import Path
 from unittest.mock import Mock, patch, MagicMock
 
@@ -399,7 +399,7 @@ def generate_signal(factors, close):
     @patch('rdagent.scenarios.qlib.local.strategy_worker.subprocess.run')
     def test_run_subprocess_timeout(self, mock_run, backtest_engine):
         """Test subprocess timeout handling."""
-        import subprocess
+        import subprocess  # nosec B404
         mock_run.side_effect = subprocess.TimeoutExpired(cmd='python', timeout=60)
 
         result = backtest_engine._run_subprocess(Path('/tmp/run.py'))

test/qlib/test_fin_quant_integration.py

@@ -1,3 +1,4 @@
+import logging
 """
 Integration Tests for Critical fin_quant Features
 
@@ -196,7 +197,7 @@ class TestResultsDatabaseIntegration:
         try:
             runner._save_result_to_database(mock_exp, mock_exp.result)
         except Exception:
-            pass  # Expected in test env
+            logging.debug("Exception caught", exc_info=True)  # Expected in test env
 
     def test_save_to_db_handles_none_result(self):
         """Test that save method handles None or invalid results."""
@@ -212,7 +213,7 @@ class TestResultsDatabaseIntegration:
         try:
             runner._save_result_to_database(mock_exp, None)
         except Exception:
-            pass  # Expected in test env
+            logging.debug("Exception caught", exc_info=True)  # Expected in test env
 
     def test_save_to_db_handles_exception_gracefully(self):
         """Test that save method handles database errors gracefully."""