rubik/radon

Review signals: 110 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

OSV reports a known vulnerability in this dependency version. 9 distinct locations. 110 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Radon computes cyclomatic complexity from the command line with radon cc: Real input produced the expected result: F 98:0 mi_compute - A

  Source: radon cc sympy/solvers/solvers.py -a -nc

  Input: radon/metrics.py

  Expected: mi_compute listed with complexity rank A

  Command: <guest-path> cc radon/metrics.py -a

  Observed: F 98:0 mi_compute - A F 120:0 mi_parameters - A F 32:0 h_visit_ast - A F 25:0 h_visit - A F 145:0 mi_visit - A F 150:0 mi_rank - A 7 blocks (classes, functions, methods) analyzed. Average complexity: A (2.2857142857142856)

• Radon computes raw metrics such as LOC and SLOC: Real input produced the expected result: LOC: 245

  Source: radon raw --include-ipynb --ipynb-cells .

  Input: radon/raw.py

  Expected: raw metrics report with LOC 245

  Command: <guest-path> raw radon/raw.py

  Observed: LOC: 245 LLOC: 102 SLOC: 111 Comments: 33 Single comments: 31 Multi: 57 Blank: 46 - Comment Stats (C % L): 13% (C % S): 30% (C + M % L): 37%

Examples

• Run the documented test suite (make tests): command completed successfully

  Source: Makefile tests target

  Input: radon/tests/run.py

  Expected: all tests pass

  Command: <guest-path> radon/tests/run.py

  Observed: [ 58%] radon/tests/test_ipynb.py ..... [ 59%] radon/tests/test_other_metrics.py ...................................... [ 69%] ........................................................................ [ 86%] .. [ 87%] radon/tests/test_raw.py ................................................ [ 99%] ... [100%] ============================= 404 passed in 3.30s ==============================

• Run the README quick example form of radon cc on the package: command completed successfully

  Source: README.rst Cyclomatic Complexity Example

  Input: radon package with -a -nc

  Expected: blocks analyzed summary

  Command: <guest-path> cc radon -a -nc

  Observed: radon/raw.py F 185:0 analyze - C radon/cli/tools.py F 244:0 iter_filenames - C radon/cli/harvest.py M 276:4 RawHarvester.to_terminal - C radon/tests/test_cli_tools.py F 564:0 test_cc_to_terminal - C 4 blocks (classes, functions, methods) analyzed. Average complexity: C (12.25)

Local or hosted: local

Compute code metrics (cyclomatic complexity with radon cc, raw metrics with radon raw) from the command line

cd <guest-path> && ls -la && git status 2>&1 | head -3; python3 --version; id -u; cat README.md | head -150
cd <guest-path> && cat README.rst; ls .coldpass; cat pyproject.toml | head -30
ls -la <guest-path>; cd /tmp && python3 -m venv <guest-path> 2>&1 | tail -3; <guest-path> install -q <guest-path> 2>&1 | tail -5; <guest-path> --version
mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
def classify(n):
    if n < 0:
        return "neg"
    elif n == 0:
        return "zero"
    for i in range(n):
        if i % 2 == 0 and i > 3:
            print(i)
    return "pos"
EOF
cd <guest-path> && <guest-path> cc example.py -a; echo rc=$?; <guest-path> raw example.py; echo rc=$?; <guest-path> mi example.py -s; echo rc=$?
cd <guest-path> && cat Makefile; cat tox.ini; ls radon; ls radon/tests 2>/dev/null | head; grep -rn "schedul\|cron\|--once\|webhook" --include=*.py --include=*.rst radon docs README.rst | head -5
cd <guest-path> && cat test_requirements.txt && <guest-path> install -q -r test_requirements.txt 2>&1 | tail -3; echo rc=$?
cd <guest-path> && <guest-path> radon/tests/run.py > <guest-path> 2>&1; echo rc=$?; tail -5 <guest-path>
cd <guest-path> && R=<guest-path> && cat > claims.json <<EOF
[
{"kind":"claim","claim":"Radon computes cyclomatic complexity from the command line with radon cc","source":"radon cc sympy/solvers/solvers.py -a -nc","input":"<guest-path>","expected":"classify function listed with complexity rank B and average B","probe_kind":"cli","argv":["$R","cc","<guest-path>","-a"],"expected_text":"F 1:0 classify - B","cwd":"<guest-path>"},
{"kind":"claim","claim":"Radon computes raw metrics such as LOC and SLOC","source":"radon raw --include-ipynb --ipynb-cells .","input":"<guest-path>","expected":"raw metrics report with LOC 9","probe_kind":"cli","argv":["$R","raw","<guest-path>"],"expected_text":"LOC: 9","cwd":"<guest-path>"}
]
EOF
sed -i "s#\$R#$R#g" claims.json && cat > probe.json <<EOF
{"kind":"cli","argv":["$R","cc","<guest-path>","-a"],"cwd":"<guest-path>","expected_text":"F 1:0 classify - B"}
EOF
cat claims.json probe.json
cd <guest-path> && P=<guest-path> && R=<guest-path> && cat > examples.json <<EOF
[
{"kind":"example","claim":"Run the documented test suite (make tests)","source":"Makefile tests target","input":"radon/tests/run.py","expected":"all tests pass","argv":["$P","radon/tests/run.py"],"cwd":"<guest-path>","expected_text":"404 passed"},
{"kind":"example","claim":"Run the README quick example form of radon cc on the package","source":"README.rst Cyclomatic Complexity Example","input":"radon package with -a -nc","expected":"blocks analyzed summary","argv":["$R","cc","radon","-a","-nc"],"cwd":"<guest-path>","expected_text":"blocks (classes, functions, methods) analyzed"}
]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected (radon/cli.py, README.rst, setup.py, pyproject.toml): radon is a one-shot CLI that computes metrics and exits; it has no scheduler, cron, loop, webhook or --once/--now trigger.","checks":[]}
EOF
cd <guest-path> && <guest-path> cc radon -a -nc | tail -2; <guest-path> cc radon -a -nc >/dev/null; echo rc=$?
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Compute code metrics (cyclomatic complexity with radon cc, raw metrics with radon raw) from the command line","operation_scope":"Python 3.12 guest VM; pip install of the pinned checkout into a venv at <guest-path>; no browser or credentials needed","steps":["python3 -m venv <guest-path>","<guest-path> install <guest-path>","<guest-path> install -r test_requirements.txt","<guest-path> --version","<guest-path> cc example.py -a","<guest-path> raw example.py","python radon/tests/run.py (404 passed)"],"deviations":["README gives 'pip install radon'; installed the pinned checkout instead, from <guest-path>, to test the pinned commit.","Ran the tests with the venv python at <guest-path> rather than a bare python, because the Makefile's bare 'python' is not guaranteed to be the venv interpreter.","README names the file README.rst; the Makefile and checker default look for README.md, so claim quotes are taken from README.rst."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for the tested operations."}
EOF
python3 -c "import json;json.load(open('report.json'));print('ok')"; cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -40
cd <guest-path> && python3 - <<'EOF'
import json
p='claims.json'
c=json.load(open(p))
for x in c: x['source_file']='README.rst'
json.dump(c,open(p,'w'),indent=1)
e=json.load(open('examples.json'))
for x in e: x['source_file']='README.rst'
json.dump(e,open('examples.json','w'),indent=1)
EOF
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -40
grep -n "partial evidence" -B12 <guest-path> | head -60
grep -n "def agent_written" -A25 <guest-path> | head -50
cd <guest-path> && R=<guest-path>; $R cc radon/metrics.py -a; $R raw radon/raw.py | head -3
cd <guest-path> && python3 - <<'EOF'
import json
R='<guest-path>'
c=json.load(open('claims.json'))
c[0]['input']='radon/metrics.py'; c[0]['argv']=[R,'cc','radon/metrics.py','-a']; c[0]['expected_text']='F 98:0 mi_compute - A'; c[0]['expected']='mi_compute listed with complexity rank A'
c[1]['input']='radon/raw.py'; c[1]['argv']=[R,'raw','radon/raw.py']; c[1]['expected_text']='LOC: 245'; c[1]['expected']='raw metrics report with LOC 245'
json.dump(c,open('claims.json','w'),indent=1)
p={"kind":"cli","argv":[R,'cc','radon/metrics.py','-a'],"cwd":"<guest-path>","expected_text":"F 98:0 mi_compute - A"}
json.dump(p,open('probe.json','w'),indent=1)
e=json.load(open('examples.json'))
json.dump(e,open('examples.json','w'),indent=1)
EOF
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -40
cd <guest-path> && python3 - <<'EOF'
import json
r=json.load(open('report.json'))
r['deviations'].append("Checker rejected probes whose input .py file lived outside the checkout (flagged as agent-written), so the final probe, claims and examples use the repo's own radon/metrics.py and radon/raw.py as inputs.")
r['deviations'].append("Final validation: check.py --validate --replay returned valid=true, replay PASS (1 probe, 2 README claims, 2 examples, 1 cycle check with detected=false).")
json.dump(r,open('report.json','w'),indent=1)
EOF
python3 -c "import json;json.load(open('<guest-path>'));print('ok')"; ls <guest-path>