style(safety): apply yapf to satisfy CI formatting check

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Violet2314

tests/tool_safety/test_review_p0_p1.py

@@ -147,6 +147,7 @@ def test_safe_git_status_still_allowed():
 
 
 def test_scanner_error_is_high_fail_closed():
+
     class BoomRule(SafetyRule):
         rule_id = "BOOM_TEST"
         rule_name = "boom"

tests/tool_safety/test_rules.py

@@ -44,13 +44,13 @@ def test_dangerous_files_bash_rm_gnu_long_options():
     """
     rule = DangerousFilesRule()
     for cmd in (
-        "rm --recursive /",
-        "rm --force /",
-        "rm --recursive --force /",
-        "rm --force --recursive /",
-        "rm --recursive -f /",
-        "rm -r --force /",
-        "rm --recursive=yes /",
+            "rm --recursive /",
+            "rm --force /",
+            "rm --recursive --force /",
+            "rm --force --recursive /",
+            "rm --recursive -f /",
+            "rm -r --force /",
+            "rm --recursive=yes /",
     ):
         findings = rule.check(ScanInput(script=cmd, language="bash"), _policy())
         assert any("R001" in f.rule_id for f in findings), f"failed to flag: {cmd!r}"

trpc_agent_sdk/safety/_rules.py

@@ -113,8 +113,7 @@ def _finding(
 # Commands that mutate filesystem content when aimed at a system directory.
 _SYSTEM_DIR_MUTATORS = re.compile(
     r"(?i)(?:^|[\s;|&])(?:rm|cp|mv|install|ln|tee|sed|dd|chmod|chown|chgrp|truncate|"
-    r"install|rsync|tar|unzip|gzip|bzip2|xz)\b|>|>>",
-)
+    r"install|rsync|tar|unzip|gzip|bzip2|xz)\b|>|>>", )
 
 _SYSTEM_DIRS = [
     "/etc",
@@ -938,6 +937,7 @@ def _is_process_call(lname: str) -> bool:
         return True
     return False
 
+
 _PRIVILEGE_CMDS = {"sudo", "su", "doas", "pkexec", "runuser"}
 _INJECTION_BUILTINS = {"eval", "exec", "compile", "builtins.eval", "builtins.exec"}
 _DECODE_EXEC_BASH = re.compile(
@@ -998,15 +998,14 @@ def _check_python(self, scan_input: ScanInput, policy: PolicyConfig) -> list[Saf
                 attr_raw = get_string_literal(node.args[1]) if len(node.args) > 1 else None
                 attr = attr_raw.lower() if isinstance(attr_raw, str) else None
                 # Match any process API attr, including exec*/spawn* families.
-                if obj in {"os", "subprocess", "pty"} and attr and (
-                        attr in {
-                            "system",
-                            "popen",
-                            "exec",
-                            "run",
-                            "call",
-                            "spawn",
-                        } or attr.startswith("exec") or attr.startswith("spawn")):
+                if obj in {"os", "subprocess", "pty"} and attr and (attr in {
+                        "system",
+                        "popen",
+                        "exec",
+                        "run",
+                        "call",
+                        "spawn",
+                } or attr.startswith("exec") or attr.startswith("spawn")):
                     findings.append(
                         self._finding(
                             f"getattr({obj}, {attr_raw!r})",

trpc_agent_sdk/safety/_scanner.py

@@ -117,10 +117,7 @@ def scan(self, scan_input: ScanInput) -> SafetyReport:
         # cannot slip through as ALLOW.
         if language == "python":
             script = scan_input.script or ""
-            needs_bash = (
-                parse_python_ast(script) is None
-                or has_shell_command_lines(script)
-            )
+            needs_bash = (parse_python_ast(script) is None or has_shell_command_lines(script))
             if needs_bash:
                 bash_input = ScanInput(
                     script=script,

trpc_agent_sdk/safety/_wrapper.py

@@ -211,8 +211,7 @@ async def execute_code(self, invocation_context, input_data):
             if report is not None:
                 audit.log(report, intercepted=should_block)
             if should_block and report is not None:
-                label = ("TOOL_SAFETY_DENY"
-                         if report.decision == Decision.DENY else "TOOL_SAFETY_NEEDS_REVIEW")
+                label = ("TOOL_SAFETY_DENY" if report.decision == Decision.DENY else "TOOL_SAFETY_NEEDS_REVIEW")
                 return _deny_code_result(report.rule_ids, label=label)
             return await inner.execute_code(invocation_context, input_data)