- Path injection (B614): centralized safe_resolve_path in core/utils.py,
refactored 6 UI modules to use it with safe_root validation
- B701: added explicit autoescape=select_autoescape() to Jinja2
Environment() calls in 3 files
- B101: replaced assert statements with proper if/raise patterns in
12+ files (partial)
- B112: added logger.warning() to bare except:continue blocks in
5 files
- ds_trace.py: resolve() user-provided save path and use Path.name for filenames
to prevent directory traversal in the local workspace save UI
- rl/finetune UI data_loaders: nosec B614 where paths are already validated
against safe_root via realpath() before use
- Temp paths (/tmp/sample, /tmp/full, /tmp/mock/*, /tmp/predix_loop.pid,
/tmp/autorl_output): nosec B108 — fixed Docker volume mount points or
single-process admin files, not user-writable attack surface
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
B608: Bandit flags any f-string containing "select" as potential SQL
injection. All four cases (app.py, ds_trace.py, llm_st.py, merge.py)
are Streamlit UI labels or log messages — not database queries.
B701: Jinja2 autoescape=False warnings in coder.py and utils.py are
false positives — these render Python code and plain-text templates,
not HTML. Enabling autoescape would corrupt the rendered code.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Switch log rotation from midnight-only ("00:00") to size-based:
per-command logs: 50 MB, all.log: 100 MB (with gz compression)
- Shorten retention from 30/60 days to 7 days
- Cap llm_calls.jsonl entries to 500 chars per field to prevent
GB-scale files from long-running loops
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add log_llm_call() to daily_log.py that appends every LLM interaction
(system prompt, user prompt, response, duration_ms) as a JSON object to
logs/YYYY-MM-DD/llm_calls.jsonl. Call it from both chat completion paths
in base.py so all LLM activity — factor generation, strategy generation,
feedback, proposals — is captured in a human-readable, grep/jq-friendly
format alongside the existing binary pickle logs.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* update rdagent cmd
* fix log error message
* use multiProcessing.Process instead of subprocess.Popen
* add traces to gitignore
* add user interactor in RDLoop (finance scenarios)
* add interactor (feedback, hypothesis) for quant scens
* fix the test_end in qlib conf
* add features init config, general instruction to qlib scenarios
* set base features for based exp
* fix bug when combine factors
* move traces folder to git_ignore_folder
* fix bug in features init
* fix quant interact bug
* fix logger warning error
* bug fixes
* modify rdagent logger, now it can set file output
* adjust cli functions and fix logger bug
* fix server port transport problem
* update server_ui in cli
* add web code
* fix CI problem
* black fix
* update web ui README
* update README
* update readme
* feat: add interactor classes and user interaction handling for experiments
* update code
* use fragment retry mechanism instead of rerun()
* fix a bug
* integrate user instructions into proposal and coder
* fix CI
* fix CI
* feat: add approval option for user instructions submission
* feat: enhance user instructions handling in Task and DSExperiment classes
* fix CI
* add user instructions into hypothesis rewrite
* add interface to command line
---------
Co-authored-by: Bowen Xian <xianbowen@outlook.com>
* show a workspace path string for easier copy, only percent existing columns when percent summary dataframe
* catch summary exception
* fix a bug
* fix ci
* update data science docs part1
* update data science docs part2
* update data science docs part3
* update data science docs part4
* update data science docs part5
* format with isort
* update data science docs part6
* add check environment scripts
* format with isort
* format with isort
* merge env_check to health_check
* format with isort
* format with black
* optimize code
* use boolean cli options
* replace fire with typer
* replace fire with typer
* optimizing parameter and variable naming
TPTBusiness