kms2229/pmcfetch

Review signals: 1 connection review.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 26 distinct locations. 8 attributed processes.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Keyword search reports how many open-access papers match before downloading: Real input produced the expected result: open-access article(s) match 'burn scar'

  Source: # [pmcfetch] 20,349 open-access article(s) match 'burn scar'

  Input: burn scar

  Expected: count line printed for the query

  Command: <guest-path> search 'burn scar'

  Observed: …open-access article(s) match 'burn scar' [pmcfetch] NCBI searched: ("burns"[MeSH Terms] OR "burns"[All Fields] OR "burn"[All Fields]) AND ("cicatrix"[MeSH Terms] OR "cicatrix"[All Fields] OR "scar"[All Fields]) AND "open access"[Filter] [pmcfetch] to download, rerun with --download N or --download all (saves to pdfs/)

• Downloads the PDFs listed in a corpus id file into an output directory: Real input produced the expected result: downloaded=1 skipped=0 failed=0 total=1

  Source: pmcfetch download --corpus ids.txt --out pdfs/

  Input: ids.txt with PMC10007932

  Expected: one article downloaded, none failed

  Command: <guest-path> download --corpus <guest-path> --out <guest-path>

  Observed: …downloaded=1 skipped=0 failed=0 total=1

Examples

• The documented test suite runs and passes: command completed successfully

  Source: README.md Tests section (## Tests)

  Input: python -m pytest tests/ -q

  Expected: all offline tests pass

  Command: <guest-path> -m pytest tests/ -q

  Observed: ........................................................................ [ 62%] ........................................... [100%]

Local or hosted: local

Install pmcfetch from the pinned source and run the README's keyword search and id-list download, producing a real PDF from PubMed Central's open-access S3 bucket.

cd <guest-path> && ls -la && git status 2>&1 | head -3; cat README.md 2>/dev/null | head -150; python3 --version
cd <guest-path> && tail -c 400 README.md; echo ---; ls -la .coldpass examples tests docs; echo ---; cat pyproject.toml | head -60; echo; ls /inputs 2>&1; which pip3 pip; python3 -m pip --version
mkdir -p <guest-path> && python3 -m venv <guest-path> 2>&1 | tail -3; ls <guest-path> 2>&1 | head
cd /tmp && <guest-path> install --upgrade pip -q 2>&1 | tail -2; <guest-path> install <guest-path> 2>&1 | tail -5; <guest-path> --help 2>&1 | head -40
cd /tmp && timeout 120 <guest-path> search "burn scar" < /dev/null; echo "rc=$?"
mkdir -p <guest-path> <guest-path> && printf 'PMC10007932\n' > <guest-path> && cd <guest-path> && timeout 300 <guest-path> download --corpus <guest-path> --out <guest-path> < /dev/null; echo "rc=$?"; ls -la <guest-path> 2>&1
cd <guest-path> && find . -type f -exec ls -la {} \; && find . -type f -name '*.pdf' -exec head -c 8 {} \; ; echo; ls <guest-path> ; ls <guest-path> 2>/dev/null
cd <guest-path> && <guest-path> install -q 'pytest>=8.0' 2>&1 | tail -2; <guest-path> -m pytest tests -q -p no:cacheprovider 2>&1 | tail -8; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && grep -n -F -e "# [pmcfetch] 20,349 open-access article(s) match 'burn scar'" -e "pmcfetch download --corpus ids.txt --out pdfs/" -e "Exit code is \`1\` when any article failed" README.md; cp <guest-path> .coldpass/ids.txt && cat .coldpass/ids.txt
cd <guest-path> && cat > claims.json <<'EOF'
[
  {"kind":"claim","claim":"Keyword search reports how many open-access papers match before downloading","source":"# [pmcfetch] 20,349 open-access article(s) match 'burn scar'","input":"burn scar","expected":"count line printed for the query","probe_kind":"cli","argv":["<guest-path>","search","burn scar"],"expected_text":"open-access article(s) match 'burn scar'","cwd":"<guest-path>"},
  {"kind":"claim","claim":"Downloads the PDFs listed in a corpus id file into an output directory","source":"pmcfetch download --corpus ids.txt --out pdfs/","input":"ids.txt with PMC10007932","expected":"one article downloaded, none failed","probe_kind":"cli","argv":["<guest-path>","download","--corpus","<guest-path>","--out","<guest-path>"],"output_directory":"<guest-path>","expected_text":"downloaded=1 skipped=0 failed=0 total=1","cwd":"<guest-path>"}
]
EOF
cat > probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","download","--corpus","<guest-path>","--out","<guest-path>"],"cwd":"<guest-path>","output_directory":"<guest-path>","expected_text":"downloaded=1 skipped=0 failed=0 total=1"}
EOF
python3 -I -c 'import json;[json.load(open(f)) for f in ["claims.json","probe.json"]];print("json ok")'
cd <guest-path> && <guest-path> tests -p no:cacheprovider 2>&1 | tail -3; echo "rc=${PIPESTATUS[0]}"; grep -rn -i "pytest\|cron\|schedul\|--once\|--now\|webhook" pyproject.toml README.md .github 2>/dev/null | head; ls .github/workflows
cd <guest-path> && sed -n 205,216p README.md; echo ---; grep -n "^##" README.md; grep -rln -i "while true\|sleep\|--once\|--now\|cron" src | head
cd <guest-path> && grep -n -i "while true\|sleep\|--once\|--now\|cron\|schedule\|webhook" src/pmcfetch/cli.py src/pmcfetch/ratelimit.py | head -20; echo ---; grep -n -F "\`\`\`bash" README.md | head -2 >/dev/null; grep -n -F "pip install -e '.[dev]'" README.md
cd <guest-path> && sed -n 300,325p src/pmcfetch/cli.py
cd <guest-path> && cat > examples.json <<'EOF'
[
  {"kind":"example","claim":"The documented test suite runs and passes","source":"README.md Tests section (## Tests)","input":"python -m pytest tests/ -q","expected":"all offline tests pass","argv":["<guest-path>","-m","pytest","tests/","-q"],"cwd":"<guest-path>","env":{},"expected_text":"115 passed"}
]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README.md (no cron, schedule, daemon, webhook, --once or --now feature documented), pyproject.toml scripts (only pmcfetch.cli:main), and src/pmcfetch/cli.py. The only loop found is the interactive 'How many to download?' prompt in _ask_amount, which is user input retry, not a scheduled or repeating product cycle. The .github/workflows/publish.yml file is CI, not a product cycle."}
EOF
python3 -I -c 'import json;[json.load(open(f)) for f in ["examples.json","cycles.json"]];print("json ok")'; ls -la <guest-path>
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo "rc=${PIPESTATUS[0]}"
rm -rf <guest-path> && cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install pmcfetch from the pinned source and run the README's keyword search and id-list download, producing a real PDF from PubMed Central's open-access S3 bucket.","operation_scope":"Python 3.12.3 (README requires 3.10+) in a venv at <guest-path>; network access to NCBI E-utilities and the AWS S3 bucket pmc-oa-opendata; stdlib-only product. Source pinned at https://github.com/kms2229/pmcfetch @ 5a95f5979ffc2c521f8062a2cc6d0dc149546c12 (workspace supplied pre-populated; no git metadata was initialized).","steps":["python3 -m venv <guest-path>","<guest-path> install <guest-path>  (README says 'pip install pmcfetch'; installed the pinned local source instead, which reported pmcfetch-0.2.1)","<guest-path> --help","<guest-path> search \"burn scar\"  (returned 20,349 open-access matches)","printf PMC10007932 > ids.txt; <guest-path> download --corpus ids.txt --out pdfs/  (downloaded=1 failed=0; output is %PDF-1.4, 542332 bytes)","<guest-path> -m pytest tests/ -q  (README ## Tests; 115 passed)"],"deviations":["Installed from the pinned local source with pip install <workspace path> rather than PyPI 'pip install pmcfetch', so the tested code matches the pin.","pip install created build artifacts (src/pmcfetch.egg-info, __pycache__) inside the workspace; no product source was edited.","Checker path: /inputs/coldpass-preflight.py does not exist in this VM, so <guest-path> was used with --validate --replay (valid=true, replay PASS).","Tests were run with the README's 'python -m pytest tests/ -q' (venv python) because the pytest entrypoint was not separately documented.","Replay of the search count depends on live NCBI results; claims match on the stable phrase, not the count.","Cycles: none detected; the only loop is an interactive input prompt."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for the tested operations. Optional: the README's pip install pmcfetch line should be kept in sync with the published PyPI release."}
EOF
python3 -I -c 'import json;json.load(open("report.json"));print("report ok")'; ls -la <guest-path> <guest-path>