rmetcalf9/ManagerPythonClient

Review signals: 6 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

OSV reports a known vulnerability in this dependency version. requests 6 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The README documents building the distribution with uv build: Real input produced the expected result: Successfully built dist/managerpythonclient-0.0.31-py3-none-any.whl

  Source: Build the distribution with:

  Input: uv build

  Expected: uv reports a built wheel for managerpythonclient

  Command: uv build

  Observed: Successfully built dist/managerpythonclient-0.0.31-py3-none-any.whl

Examples

• Documented test command from README Development section: command completed successfully

  Source: README.md Development: Run the tests with

  Input: uv run --with pytest pytest

  Expected: test suite passes

  Command: uv run --with pytest pytest

  Observed: ============================= test session starts ============================== platform linux -- Python 3.12.3, pytest-9.2.0, pluggy-1.7.0 rootdir: <guest-path> configfile: pyproject.toml testpaths: tests collected 1 item tests/test_library.py . [100%] ============================== 1 passed in 0.46s ===============================

• Documented test script (test.sh) runs the same suite: command completed successfully

  Source: test.sh

  Input: bash test.sh

  Expected: test suite passes

  Command: bash test.sh

  Observed: ============================= test session starts ============================== platform linux -- Python 3.12.3, pytest-9.2.0, pluggy-1.7.0 rootdir: <guest-path> configfile: pyproject.toml testpaths: tests collected 1 item tests/test_library.py . [100%] ============================== 1 passed in 0.45s ===============================

Local or hosted: local

Install toolchain, run the documented test suite, and build the Python distribution (uv build) for ManagerPythonClient 0.0.31

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; python3 --version; cat README.md 2>/dev/null | head -150
cd <guest-path> && cat pyproject.toml test.sh release.sh; find src tests .github .coldpass -type f | head -50; ls -la .coldpass
cd <guest-path> && cat .github/workflows/ci.yml; echo ---; head -c 3000 tests/test_library.py; echo; wc -l tests/test_library.py; which uv node npm; uv --version 2>&1
cd <guest-path> && timeout 600 uv run --with pytest pytest 2>&1 | tail -30; echo EXIT=${PIPESTATUS[0]}
cd <guest-path> && timeout 600 uv build 2>&1 | tail -8; echo EXIT=${PIPESTATUS[0]}; ls dist; cat src/ManagerPythonClient/__init__.py | head -60
ls -la <guest-path> /inputs/ 2>&1; grep -n "python_api\|expected_file\|stdout\|stderr" <guest-path> | head -60
sed -n 1076,1135p <guest-path> | cut -c1-400
cd <guest-path> && cat > .coldpass/claims.json <<'EOF'
[
  {"kind":"claim","claim":"The README documents running the test suite with uv and pytest","source":"Run the tests with:","input":"uv run --with pytest pytest","expected":"pytest reports the test passing","probe_kind":"cli","argv":["uv","run","--with","pytest","pytest"],"expected_text":"1 passed","cwd":"<guest-path>"},
  {"kind":"claim","claim":"The README documents building the distribution with uv build","source":"Build the distribution with:","input":"uv build","expected":"uv reports a built wheel for managerpythonclient","probe_kind":"cli","argv":["uv","build"],"expected_text":"Successfully built dist/managerpythonclient-0.0.31-py3-none-any.whl","cwd":"<guest-path>"}
]
EOF
python3 -m json.tool .coldpass/claims.json >/dev/null && echo OK
cd <guest-path> && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["uv","build"],"cwd":"<guest-path>","expected_text":"Successfully built dist/managerpythonclient-0.0.31-py3-none-any.whl"}
EOF
cat > .coldpass/examples.json <<'EOF'
[
  {"kind":"example","claim":"Documented test command from README Development section","source":"README.md Development: Run the tests with","input":"uv run --with pytest pytest","expected":"test suite passes","argv":["uv","run","--with","pytest","pytest"],"cwd":"<guest-path>","env":{},"expected_text":"1 passed"},
  {"kind":"example","claim":"Documented test script (test.sh) runs the same suite","source":"test.sh","input":"bash test.sh","expected":"test suite passes","argv":["bash","test.sh"],"cwd":"<guest-path>","env":{},"expected_text":"1 passed"}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README.md, pyproject.toml, test.sh, release.sh, .github/workflows/ci.yml and src/ManagerPythonClient. The package is a Python library with no cron, loop, scheduler, webhook, --once or --now entrypoint; the only workflow is manual workflow_dispatch CI and a release script."}
EOF
for f in probe claims examples cycles; do python3 -m json.tool .coldpass/$f.json >/dev/null && echo $f OK; done
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -c 5000; echo EXIT=${PIPESTATUS[0]}
cd <guest-path> && cat > .coldpass/claims.json <<'EOF'
[
  {"kind":"claim","claim":"The README documents building the distribution with uv build","source":"Build the distribution with:","input":"uv build","expected":"uv reports a built wheel for managerpythonclient","probe_kind":"cli","argv":["uv","build"],"expected_text":"Successfully built dist/managerpythonclient-0.0.31-py3-none-any.whl","cwd":"<guest-path>"}
]
EOF
python3 -m json.tool .coldpass/claims.json >/dev/null && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | python3 -c 'import sys,json; d=json.loads(sys.stdin.read()); print(d.get("valid"), d.get("problems")); print(d["replay"]["status"], d["replay"].get("details",{}).get("working"))' ; echo EXIT=${PIPESTATUS[1]}
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install toolchain, run the documented test suite, and build the Python distribution (uv build) for ManagerPythonClient 0.0.31","operation_scope":"Linux guest, Python 3.12.3 (project requires >=3.11), uv 0.13.5 at /usr/local/bin/uv. No Manager API server, network service, browser or credentials are needed for these operations.","steps":["uv run --with pytest pytest (README.md Development: Run the tests with)","uv build (README.md Development: Build the distribution with)","bash test.sh (test.sh, runs uv run --with pytest pytest)"],"deviations":["README has no runtime entrypoint; ManagerPythonClient is a library, so the probe is the documented uv build, not a library call. The only zero-backend library function, hello_world(), is not documented in the README and python_api would run under the checker's system interpreter, so it was not used.","The README test command (pytest over tests/test_library.py, one test of hello_world) was kept as a documented example only; the checker rejects a unit suite as a product-operation claim, so no claim was recorded for it.","uv created .venv and dist/ inside the workspace during the documented commands.","No cycles: the package has no cron, loop, scheduler, webhook, --once or --now entrypoint."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for the operations checked. For stronger runtime evidence, the Manager API client methods (ManagerClient, ManagerClientV4) would need a reachable Manager server, which the README does not document."}
EOF
python3 -m json.tool .coldpass/report.json >/dev/null && echo OK; ls -la .coldpass
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | python3 -c 'import sys,json; d=json.loads(sys.stdin.read()); print(d.get("valid"), d.get("problems")); print(d["replay"]["status"])'