From 113e8052402a2e44975fc8bd554318b53f4839ef Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
 <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Sun, 19 Jul 2026 11:48:03 +0000
Subject: [PATCH] [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci
---
 studio/backend/core/research_runs.py          |  2 +-
 studio/backend/routes/research_runs.py        | 22 ++++++++++++++-----
 studio/backend/storage/studio_db.py           |  6 ++---
 .../tests/test_research_runs_hardening.py     | 13 ++++++-----
 4 files changed, 28 insertions(+), 15 deletions(-)

diff --git a/studio/backend/core/research_runs.py b/studio/backend/core/research_runs.py
index 918db50f04..b757d1e3b5 100644
--- a/studio/backend/core/research_runs.py
+++ b/studio/backend/core/research_runs.py
@@ -583,7 +583,7 @@ def _validate_report_sources(report: str, sources: list[dict]) -> str:
         raw = match.group(0)
         core = raw.rstrip(".,;:!?")
         if core in source_by_url:
-            return (citation(core) or core) + raw[len(core):]
+            return (citation(core) or core) + raw[len(core) :]
         return ""
 
     validated = replace_markdown_links(report)
diff --git a/studio/backend/routes/research_runs.py b/studio/backend/routes/research_runs.py
index 875d064980..4c5fd6591b 100644
--- a/studio/backend/routes/research_runs.py
+++ b/studio/backend/routes/research_runs.py
@@ -23,11 +23,24 @@ from storage.studio_db import get_chat_message, get_chat_thread, upsert_chat_mes
 
 router = APIRouter()
 _SENSITIVE_KEY_EXACT = {
-    "authorization", "password", "secret", "token", "apikey", "credential", "credentials",
+    "authorization",
+    "password",
+    "secret",
+    "token",
+    "apikey",
+    "credential",
+    "credentials",
 }
 _SENSITIVE_KEY_SUFFIXES = (
-    "apikey", "accesskey", "accesstoken", "authtoken", "bearertoken",
-    "clientsecret", "privatekey", "refreshtoken", "sessiontoken",
+    "apikey",
+    "accesskey",
+    "accesstoken",
+    "authtoken",
+    "bearertoken",
+    "clientsecret",
+    "privatekey",
+    "refreshtoken",
+    "sessiontoken",
 )
 _MAX_PLAN_STEPS = 30
 _DELTA_ONLY_EVENTS = {"reasoning.updated", "report.updated"}
@@ -140,8 +153,7 @@ def _contains_sensitive_key(value: object) -> bool:
     so credentials cannot be smuggled into a durable run via a nested dict."""
     if isinstance(value, dict):
         return any(
-            _is_sensitive_key(key) or _contains_sensitive_key(item)
-            for key, item in value.items()
+            _is_sensitive_key(key) or _contains_sensitive_key(item) for key, item in value.items()
         )
     if isinstance(value, (list, tuple)):
         return any(_contains_sensitive_key(item) for item in value)
diff --git a/studio/backend/storage/studio_db.py b/studio/backend/storage/studio_db.py
index 35e6cf6f82..9de62cb9c4 100644
--- a/studio/backend/storage/studio_db.py
+++ b/studio/backend/storage/studio_db.py
@@ -1676,9 +1676,7 @@ def _research_message_ids(conn: sqlite3.Connection, thread_id: str) -> set[str]:
     }
 
 
-def _research_message_would_change(
-    conn: sqlite3.Connection, thread_id: str, message: dict
-) -> bool:
+def _research_message_would_change(conn: sqlite3.Connection, thread_id: str, message: dict) -> bool:
     row = conn.execute(
         "SELECT parent_id, role, content_json, metadata_json "
         "FROM chat_messages WHERE thread_id = ? AND id = ?",
@@ -1688,7 +1686,7 @@ def _research_message_would_change(
         return False
 
     def canon(value: object) -> str | None:
-        return json.dumps(value, sort_keys=True) if value is not None else None
+        return json.dumps(value, sort_keys = True) if value is not None else None
 
     return (
         canon(message.get("content", [])) != canon(json.loads(row["content_json"] or "[]"))
diff --git a/studio/backend/tests/test_research_runs_hardening.py b/studio/backend/tests/test_research_runs_hardening.py
index ed7fdfe46c..3141adb6dd 100644
--- a/studio/backend/tests/test_research_runs_hardening.py
+++ b/studio/backend/tests/test_research_runs_hardening.py
@@ -90,8 +90,13 @@ def test_sanitize_config_rejects_nested_rag_scope_secret():
 
 def test_sensitive_key_matches_prefixed_and_camelcase_variants():
     for key in (
-        "apiKey", "openaiApiKey", "accessToken", "access_token",
-        "clientSecret", "refreshToken", "authorization",
+        "apiKey",
+        "openaiApiKey",
+        "accessToken",
+        "access_token",
+        "clientSecret",
+        "refreshToken",
+        "authorization",
     ):
         assert _is_sensitive_key(key), key
     # Ordinary request fields must not be flagged, so normal runs still validate.
@@ -102,9 +107,7 @@ def test_sensitive_key_matches_prefixed_and_camelcase_variants():
 def test_sanitize_query_redacts_nonpublic_ipv6_but_keeps_public():
     assert "fd00" not in _sanitize_public_query("inspect fd00::dead:beef service health")
     assert "fe80" not in _sanitize_public_query("connect to fe80::1%eth0 gateway now")
-    assert "2606:4700:4700::1111" in _sanitize_public_query(
-        "what runs on 2606:4700:4700::1111 dns"
-    )
+    assert "2606:4700:4700::1111" in _sanitize_public_query("what runs on 2606:4700:4700::1111 dns")
 
 
 def test_escape_link_destination_escapes_only_unbalanced_paren():