From b0388484826ab528c65e2353b26103d770ccc8c7 Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
 <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Sun, 24 May 2026 14:35:53 +0000
Subject: [PATCH] [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci
---
 studio/backend/core/inference/tools.py        | 21 +++++++++----------
 .../backend/tests/test_sandbox_hardening.py   | 18 ++++++++--------
 2 files changed, 19 insertions(+), 20 deletions(-)

diff --git a/studio/backend/core/inference/tools.py b/studio/backend/core/inference/tools.py
index 2fe31300ec..b07893df40 100644
--- a/studio/backend/core/inference/tools.py
+++ b/studio/backend/core/inference/tools.py
@@ -1352,9 +1352,7 @@ def _check_signal_escape_patterns(code: str):
                     if alias.name == "join":
                         bare_path_join_aliases.add(alias.asname or "join")
                     elif alias.name == "expanduser":
-                        bare_path_expanduser_aliases.add(
-                            alias.asname or "expanduser"
-                        )
+                        bare_path_expanduser_aliases.add(alias.asname or "expanduser")
             elif _node.module == "shutil":
                 for alias in _node.names:
                     if alias.name in _SHUTIL_COPY_NAMES:
@@ -1364,9 +1362,7 @@ def _check_signal_escape_patterns(code: str):
             elif _node.module == "pathlib":
                 for alias in _node.names:
                     if alias.name in _PATHLIB_PATH_CLASSES_PREPASS:
-                        path_class_aliases_prepass.add(
-                            alias.asname or alias.name
-                        )
+                        path_class_aliases_prepass.add(alias.asname or alias.name)
 
     # Cheap hint set used to bias ``string_bindings`` toward the most
     # sensitive value of a name when multiple literals are assigned.
@@ -1658,9 +1654,7 @@ def _check_signal_escape_patterns(code: str):
                         "eval",
                         "exec",
                     ):
-                        eval_exec_aliases.setdefault(
-                            _target.id, _assign.value.id
-                        )
+                        eval_exec_aliases.setdefault(_target.id, _assign.value.id)
                 elif isinstance(_target, (ast.Tuple, ast.List)) and isinstance(
                     _assign.value, (ast.Tuple, ast.List)
                 ):
@@ -3218,10 +3212,15 @@ def _check_signal_escape_patterns(code: str):
                 # shutil alias. The suffix-match guards against random
                 # ``something.copy(...)`` calls on unrelated objects.
                 _attr = node.func.attr
-                _recv_chain = fq[: -(len(_attr) + 1)] if _attr in _SHUTIL_COPY_NAMES else ""
+                _recv_chain = (
+                    fq[: -(len(_attr) + 1)] if _attr in _SHUTIL_COPY_NAMES else ""
+                )
                 if _recv_chain in shutil_module_aliases and _attr in _SHUTIL_COPY_NAMES:
                     file_copy_fq = f"shutil.{_attr}"
-            elif isinstance(node.func, ast.Name) and node.func.id in bare_shutil_copy_aliases:
+            elif (
+                isinstance(node.func, ast.Name)
+                and node.func.id in bare_shutil_copy_aliases
+            ):
                 file_copy_fq = bare_shutil_copy_aliases[node.func.id]
             if file_copy_fq is not None:
                 # Use the canonical ``shutil.X`` name in the error
diff --git a/studio/backend/tests/test_sandbox_hardening.py b/studio/backend/tests/test_sandbox_hardening.py
index 927efe3e55..1f08740cc6 100644
--- a/studio/backend/tests/test_sandbox_hardening.py
+++ b/studio/backend/tests/test_sandbox_hardening.py
@@ -1801,9 +1801,9 @@ class TestR4_BraceCapOffByOne:
     def test_brace_with_n_dummies_blocked(self, n_dummies):
         dummies = ",".join(f"x{i}" for i in range(n_dummies))
         cmd = f"cat /home/u/.aws/{{{dummies},credentials}}"
-        assert _find_sensitive_paths(cmd), (
-            f"brace bomb with {n_dummies} dummies leaked: {cmd!r}"
-        )
+        assert _find_sensitive_paths(
+            cmd
+        ), f"brace bomb with {n_dummies} dummies leaked: {cmd!r}"
 
     def test_brace_bomb_within_limit_blocked(self):
         # 100 alts x 100 dummy chars per alt = comfortably under cap;
@@ -1811,9 +1811,9 @@ class TestR4_BraceCapOffByOne:
         # value names a sensitive path.
         dummies = ",".join(f"x{i}" for i in range(500))
         cmd = f"cat /home/u/.aws/{{{dummies},credentials}}"
-        assert _find_sensitive_paths(cmd), (
-            f"brace bomb (501 alts) within cap leaked: {cmd!r}"
-        )
+        assert _find_sensitive_paths(
+            cmd
+        ), f"brace bomb (501 alts) within cap leaked: {cmd!r}"
 
 
 class TestR4_ThreadSelfShellExpansion:
@@ -1831,9 +1831,9 @@ class TestR4_ThreadSelfShellExpansion:
         ],
     )
     def test_thread_self_shell_expansion_blocked(self, cmd):
-        assert _find_sensitive_paths(cmd), (
-            f"thread-self shell expansion leaked: {cmd!r}"
-        )
+        assert _find_sensitive_paths(
+            cmd
+        ), f"thread-self shell expansion leaked: {cmd!r}"
 
 
 class TestR4_EvalExecPrepass: