chore(security): rebaseline B108 after moving /tmp fallbacks to core/paths.py

The three intentional /tmp fallback dirs (RNA_*_DIR working paths) moved from
src/tools/rna/_base.py to src/core/paths.py in 9c88c1e. Regenerate the bandit
baseline (net-zero: same 3 accepted B108 relocated, count unchanged 16) and
update the ACCEPTED-FINDINGS.md path reference. No new accepted finding class.

security/ACCEPTED-FINDINGS.md

@@ -47,7 +47,7 @@ these do not fail the build but any **new** finding does. Regenerate only via
 | Test | Count | Where | Why accepted |
 |------|-------|-------|--------------|
 | **B104** hardcoded_bind_all_interfaces | 1 | `src/managers/execution/sandbox/launchers.py:220` | The dev/test `subprocess` launcher binds `0.0.0.0` for the localhost exec-kernel; container prod does not expose it. Not reachable off-host in the deployed model. |
-| **B108** hardcoded_tmp_directory | 9 | `src/cache.py`, `src/tools/rna/_base.py`, `src/tools/bulk_rnaseq/_base.py`, `src/tools/bulk_dataset_tools.py`, `src/mcp_server/dependencies/r_dependencies.py`, `launchers.py` | `/tmp/decoupleRpy/**` working dirs. HF Spaces give each container an ephemeral private `/tmp`; these are env-overridable (`RNA_*_DIR`) working paths, not shared-host temp files. |
+| **B108** hardcoded_tmp_directory | 9 | `src/cache.py`, `src/core/paths.py`, `src/tools/bulk_rnaseq/_base.py`, `src/tools/bulk_dataset_tools.py`, `src/mcp_server/dependencies/r_dependencies.py`, `launchers.py` | `/tmp/decoupleRpy/**` working dirs. HF Spaces give each container an ephemeral private `/tmp`; these are env-overridable (`RNA_*_DIR`) working paths, not shared-host temp files. The three `rna`-family fallbacks now live in `src/core/paths.py` (shared by tools + workflows). |
 | **B310** urllib urlopen | 6 | `src/workflows/geo.py`, `src/core/data_io.py`, `src/tools/bulk_rnaseq/_base.py`, `src/tools/bulk_rnaseq/tools.py` | GEO / dataset downloads. The scheme is checked (`http/https/ftp`) before the call; URLs come from vetted manifests in `biodata-registry`, not user input. |
 
 **Inline `# nosec` suppressions** (not in the baseline; annotated at the call

security/bandit-baseline.json

@@ -1,6 +1,6 @@
 {
   "errors": [],
-  "generated_at": "2026-07-02T19:46:18Z",
+  "generated_at": "2026-07-07T15:04:13Z",
   "metrics": {
     "_totals": {
       "CONFIDENCE.HIGH": 31,
@@ -11,7 +11,7 @@
       "SEVERITY.LOW": 25,
       "SEVERITY.MEDIUM": 16,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 19364,
+      "loc": 19820,
       "nosec": 0,
       "skipped_tests": 3
     },
@@ -24,7 +24,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 430,
+      "loc": 456,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -54,6 +54,19 @@
       "nosec": 0,
       "skipped_tests": 0
     },
+    "src/core/access_control.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 92,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
     "src/core/combine.py": {
       "CONFIDENCE.HIGH": 0,
       "CONFIDENCE.LOW": 0,
@@ -102,7 +115,20 @@
       "SEVERITY.LOW": 1,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 140,
+      "loc": 139,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/core/paths.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 3,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 3,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 33,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -115,7 +141,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 35,
+      "loc": 34,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -128,7 +154,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 164,
+      "loc": 168,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -167,7 +193,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 461,
+      "loc": 482,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -180,7 +206,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 216,
+      "loc": 218,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -193,7 +219,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 169,
+      "loc": 165,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -232,7 +258,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 78,
+      "loc": 76,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -284,7 +310,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 20,
+      "loc": 22,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -310,7 +336,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 172,
+      "loc": 166,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -323,7 +349,7 @@
       "SEVERITY.LOW": 8,
       "SEVERITY.MEDIUM": 2,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 352,
+      "loc": 344,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -336,7 +362,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 221,
+      "loc": 215,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -349,7 +375,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 213,
+      "loc": 228,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -375,7 +401,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 119,
+      "loc": 120,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -388,7 +414,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 45,
+      "loc": 48,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -427,7 +453,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 517,
+      "loc": 558,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -440,7 +466,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 365,
+      "loc": 376,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -453,7 +479,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 96,
+      "loc": 98,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -479,7 +505,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 45,
+      "loc": 44,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -492,7 +518,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 20,
+      "loc": 19,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -505,7 +531,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 244,
+      "loc": 259,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -544,7 +570,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 1,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 91,
+      "loc": 90,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -570,7 +596,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 128,
+      "loc": 141,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -583,7 +609,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 109,
+      "loc": 134,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -596,7 +622,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 115,
+      "loc": 116,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -609,7 +635,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 122,
+      "loc": 123,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -635,7 +661,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 110,
+      "loc": 102,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -648,7 +674,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 1,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 489,
+      "loc": 486,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -661,7 +687,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 40,
+      "loc": 54,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -674,7 +700,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 4,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 364,
+      "loc": 386,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -687,7 +713,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 1,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 483,
+      "loc": 510,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -700,7 +726,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 28,
+      "loc": 32,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -713,7 +739,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 776,
+      "loc": 904,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -726,7 +752,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 443,
+      "loc": 446,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -739,7 +765,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 429,
+      "loc": 432,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -752,7 +778,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 311,
+      "loc": 303,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -765,7 +791,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 689,
+      "loc": 674,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -811,13 +837,13 @@
     "src/tools/rna/_base.py": {
       "CONFIDENCE.HIGH": 0,
       "CONFIDENCE.LOW": 0,
-      "CONFIDENCE.MEDIUM": 3,
+      "CONFIDENCE.MEDIUM": 0,
       "CONFIDENCE.UNDEFINED": 0,
       "SEVERITY.HIGH": 0,
       "SEVERITY.LOW": 0,
-      "SEVERITY.MEDIUM": 3,
+      "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 115,
+      "loc": 101,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -830,7 +856,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 755,
+      "loc": 774,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -843,7 +869,7 @@
       "SEVERITY.LOW": 4,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 812,
+      "loc": 823,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -856,7 +882,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 498,
+      "loc": 490,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -869,7 +895,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 707,
+      "loc": 674,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -882,7 +908,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 711,
+      "loc": 687,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -947,7 +973,7 @@
       "SEVERITY.LOW": 2,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 222,
+      "loc": 237,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -960,7 +986,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 150,
+      "loc": 147,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -973,7 +999,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 183,
+      "loc": 182,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -999,7 +1025,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 210,
+      "loc": 204,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -1012,7 +1038,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 244,
+      "loc": 240,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -1025,7 +1051,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 226,
+      "loc": 229,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -1038,7 +1064,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 2,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 490,
+      "loc": 489,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -1051,7 +1077,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 277,
+      "loc": 273,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -1064,7 +1090,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 521,
+      "loc": 526,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -1077,7 +1103,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 487,
+      "loc": 499,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -1090,7 +1116,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 560,
+      "loc": 546,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -1103,7 +1129,7 @@
       "SEVERITY.LOW": 6,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 836,
+      "loc": 828,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -1116,7 +1142,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 337,
+      "loc": 401,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -1129,7 +1155,7 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 139,
+      "loc": 148,
       "nosec": 0,
       "skipped_tests": 0
     },
@@ -1142,14 +1168,14 @@
       "SEVERITY.LOW": 0,
       "SEVERITY.MEDIUM": 0,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 126,
+      "loc": 120,
       "nosec": 0,
       "skipped_tests": 0
     }
   },
   "results": [
     {
-      "code": "28 \n29 CACHE_DIR = Path(\"/tmp/decoupleRpy/cache\")\n30 \n",
+      "code": "29 \n30 CACHE_DIR = Path(\"/tmp/decoupleRpy/cache\")\n31 \n",
       "col_offset": 17,
       "end_col_offset": 41,
       "filename": "src/cache.py",
@@ -1160,16 +1186,16 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Probable insecure usage of temp file/directory.",
-      "line_number": 29,
+      "line_number": 30,
       "line_range": [
-        29
+        30
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html",
       "test_id": "B108",
       "test_name": "hardcoded_tmp_directory"
     },
     {
-      "code": "78     with tempfile.NamedTemporaryFile(suffix=suffix, delete=False) as tmp:\n79         with urllib.request.urlopen(s) as resp:\n80             while True:\n",
+      "code": "80     with tempfile.NamedTemporaryFile(suffix=suffix, delete=False) as tmp:\n81         with urllib.request.urlopen(s) as resp:\n82             while True:\n",
       "col_offset": 13,
       "end_col_offset": 38,
       "filename": "src/core/data_io.py",
@@ -1180,16 +1206,76 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.",
-      "line_number": 79,
+      "line_number": 81,
       "line_range": [
-        79
+        81
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b310-urllib-urlopen",
       "test_id": "B310",
       "test_name": "blacklist"
     },
     {
-      "code": "219             \"--host\",\n220             \"0.0.0.0\",\n221             \"--session-id\",\n222             self.session_id,\n223         ]\n224 \n225     # -- Phase-2 hardening (ADR-0007) --------------------------------------- #\n226     def _hardening(self) -> dict:\n227         \"\"\"Single source of truth for the Phase-2 lockdown, read from env once.\n228 \n",
+      "code": "38 \n39 INPUT_DIR = _resolve_dir(\"RNA_INPUT_DIR\", _DEFAULT_INPUT, Path(\"/tmp/decoupleRpy/inputs\"))\n40 OUTPUT_DIR = _resolve_dir(\"RNA_OUTPUT_DIR\", _DEFAULT_OUTPUT, Path(\"/tmp/decoupleRpy/outputs\"))\n",
+      "col_offset": 63,
+      "end_col_offset": 88,
+      "filename": "src/core/paths.py",
+      "issue_confidence": "MEDIUM",
+      "issue_cwe": {
+        "id": 377,
+        "link": "https://cwe.mitre.org/data/definitions/377.html"
+      },
+      "issue_severity": "MEDIUM",
+      "issue_text": "Probable insecure usage of temp file/directory.",
+      "line_number": 39,
+      "line_range": [
+        39
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html",
+      "test_id": "B108",
+      "test_name": "hardcoded_tmp_directory"
+    },
+    {
+      "code": "39 INPUT_DIR = _resolve_dir(\"RNA_INPUT_DIR\", _DEFAULT_INPUT, Path(\"/tmp/decoupleRpy/inputs\"))\n40 OUTPUT_DIR = _resolve_dir(\"RNA_OUTPUT_DIR\", _DEFAULT_OUTPUT, Path(\"/tmp/decoupleRpy/outputs\"))\n41 GEO_CACHE_DIR = _resolve_dir(\n",
+      "col_offset": 66,
+      "end_col_offset": 92,
+      "filename": "src/core/paths.py",
+      "issue_confidence": "MEDIUM",
+      "issue_cwe": {
+        "id": 377,
+        "link": "https://cwe.mitre.org/data/definitions/377.html"
+      },
+      "issue_severity": "MEDIUM",
+      "issue_text": "Probable insecure usage of temp file/directory.",
+      "line_number": 40,
+      "line_range": [
+        40
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html",
+      "test_id": "B108",
+      "test_name": "hardcoded_tmp_directory"
+    },
+    {
+      "code": "41 GEO_CACHE_DIR = _resolve_dir(\n42     \"RNA_GEO_CACHE_DIR\", _DEFAULT_GEO_CACHE, Path(\"/tmp/decoupleRpy/geo_cache\")\n43 )\n",
+      "col_offset": 50,
+      "end_col_offset": 78,
+      "filename": "src/core/paths.py",
+      "issue_confidence": "MEDIUM",
+      "issue_cwe": {
+        "id": 377,
+        "link": "https://cwe.mitre.org/data/definitions/377.html"
+      },
+      "issue_severity": "MEDIUM",
+      "issue_text": "Probable insecure usage of temp file/directory.",
+      "line_number": 42,
+      "line_range": [
+        42
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html",
+      "test_id": "B108",
+      "test_name": "hardcoded_tmp_directory"
+    },
+    {
+      "code": "213             \"--host\",\n214             \"0.0.0.0\",\n215             \"--session-id\",\n216             self.session_id,\n217         ]\n218 \n219     # -- Phase-2 hardening (ADR-0007) --------------------------------------- #\n220     def _hardening(self) -> dict:\n221         \"\"\"Single source of truth for the Phase-2 lockdown, read from env once.\n222 \n",
       "col_offset": 12,
       "end_col_offset": 21,
       "filename": "src/managers/execution/sandbox/launchers.py",
@@ -1200,23 +1286,23 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Possible binding to all interfaces.",
-      "line_number": 220,
+      "line_number": 214,
       "line_range": [
+        210,
+        211,
+        212,
+        213,
+        214,
+        215,
         216,
-        217,
-        218,
-        219,
-        220,
-        221,
-        222,
-        223
+        217
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b104_hardcoded_bind_all_interfaces.html",
       "test_id": "B104",
       "test_name": "hardcoded_bind_all_interfaces"
     },
     {
-      "code": "261         return {\n262             \"/tmp\": f\"rw,size={tmpfs_size},mode=1777\",\n263             _SANDBOX_HOME: (\n264                 f\"rw,size={tmpfs_size},mode=0700,\"\n265                 f\"uid={_SANDBOX_UID},gid={_SANDBOX_UID}\"\n266             ),\n267         }\n268 \n269     def _hardening_flags(self) -> List[str]:\n",
+      "code": "255         return {\n256             \"/tmp\": f\"rw,size={tmpfs_size},mode=1777\",\n257             _SANDBOX_HOME: (\n258                 f\"rw,size={tmpfs_size},mode=0700,uid={_SANDBOX_UID},gid={_SANDBOX_UID}\"\n259             ),\n260         }\n261 \n262     def _hardening_flags(self) -> list[str]:\n",
       "col_offset": 12,
       "end_col_offset": 18,
       "filename": "src/managers/execution/sandbox/launchers.py",
@@ -1227,22 +1313,21 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Probable insecure usage of temp file/directory.",
-      "line_number": 262,
+      "line_number": 256,
       "line_range": [
-        261,
-        262,
-        263,
-        264,
-        265,
-        266,
-        267
+        255,
+        256,
+        257,
+        258,
+        259,
+        260
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html",
       "test_id": "B108",
       "test_name": "hardcoded_tmp_directory"
     },
     {
-      "code": "18 \n19 _R_READY_FLAG = \"/tmp/decoupleRpy/r_deps_installed\"\n20 \n",
+      "code": "17 \n18 _R_READY_FLAG = \"/tmp/decoupleRpy/r_deps_installed\"\n19 \n",
       "col_offset": 16,
       "end_col_offset": 51,
       "filename": "src/mcp_server/dependencies/r_dependencies.py",
@@ -1253,16 +1338,16 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Probable insecure usage of temp file/directory.",
-      "line_number": 19,
+      "line_number": 18,
       "line_range": [
-        19
+        18
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html",
       "test_id": "B108",
       "test_name": "hardcoded_tmp_directory"
     },
     {
-      "code": "56     except PermissionError:\n57         fallback = Path(\"/tmp/decoupleRpy/outputs\")\n58         fallback.mkdir(parents=True, exist_ok=True)\n",
+      "code": "57     except PermissionError:\n58         fallback = Path(\"/tmp/decoupleRpy/outputs\")\n59         fallback.mkdir(parents=True, exist_ok=True)\n",
       "col_offset": 24,
       "end_col_offset": 50,
       "filename": "src/tools/bulk_dataset_tools.py",
@@ -1273,16 +1358,16 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Probable insecure usage of temp file/directory.",
-      "line_number": 57,
+      "line_number": 58,
       "line_range": [
-        57
+        58
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html",
       "test_id": "B108",
       "test_name": "hardcoded_tmp_directory"
     },
     {
-      "code": "31     except PermissionError:\n32         fallback = Path(\"/tmp/decoupleRpy/outputs\")\n33         fallback.mkdir(parents=True, exist_ok=True)\n",
+      "code": "32     except PermissionError:\n33         fallback = Path(\"/tmp/decoupleRpy/outputs\")\n34         fallback.mkdir(parents=True, exist_ok=True)\n",
       "col_offset": 24,
       "end_col_offset": 50,
       "filename": "src/tools/bulk_rnaseq/_base.py",
@@ -1293,16 +1378,16 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Probable insecure usage of temp file/directory.",
-      "line_number": 32,
+      "line_number": 33,
       "line_range": [
-        32
+        33
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html",
       "test_id": "B108",
       "test_name": "hardcoded_tmp_directory"
     },
     {
-      "code": "254     )\n255     with urllib.request.urlopen(req, timeout=60) as resp:\n256         result = json.loads(resp.read())\n",
+      "code": "277     )\n278     with urllib.request.urlopen(req, timeout=60) as resp:\n279         result = json.loads(resp.read())\n",
       "col_offset": 9,
       "end_col_offset": 48,
       "filename": "src/tools/bulk_rnaseq/_base.py",
@@ -1313,16 +1398,16 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.",
-      "line_number": 255,
+      "line_number": 278,
       "line_range": [
-        255
+        278
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b310-urllib-urlopen",
       "test_id": "B310",
       "test_name": "blacklist"
     },
     {
-      "code": "309     tmp = tempfile.NamedTemporaryFile(\n310         suffix=\".tar.gz\", delete=False, dir=\"/tmp\", prefix=\"gdc_star_\"\n311     )\n",
+      "code": "332     tmp = tempfile.NamedTemporaryFile(\n333         suffix=\".tar.gz\", delete=False, dir=\"/tmp\", prefix=\"gdc_star_\"\n334     )\n",
       "col_offset": 44,
       "end_col_offset": 50,
       "filename": "src/tools/bulk_rnaseq/_base.py",
@@ -1333,16 +1418,16 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Probable insecure usage of temp file/directory.",
-      "line_number": 310,
+      "line_number": 333,
       "line_range": [
-        310
+        333
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html",
       "test_id": "B108",
       "test_name": "hardcoded_tmp_directory"
     },
     {
-      "code": "313         print(f\"[gdc] Downloading {len(file_ids)} files as tar.gz \u2026\")\n314         with urllib.request.urlopen(req, timeout=600) as resp:\n315             downloaded = 0\n",
+      "code": "336         print(f\"[gdc] Downloading {len(file_ids)} files as tar.gz \u2026\")\n337         with urllib.request.urlopen(req, timeout=600) as resp:\n338             downloaded = 0\n",
       "col_offset": 13,
       "end_col_offset": 53,
       "filename": "src/tools/bulk_rnaseq/_base.py",
@@ -1353,16 +1438,16 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.",
-      "line_number": 314,
+      "line_number": 337,
       "line_range": [
-        314
+        337
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b310-urllib-urlopen",
       "test_id": "B310",
       "test_name": "blacklist"
     },
     {
-      "code": "110             if url_or_path.startswith((\"http://\", \"https://\", \"ftp://\")):\n111                 with urllib.request.urlopen(url_or_path) as resp:\n112                     while True:\n",
+      "code": "127             if url_or_path.startswith((\"http://\", \"https://\", \"ftp://\")):\n128                 with urllib.request.urlopen(url_or_path) as resp:\n129                     while True:\n",
       "col_offset": 21,
       "end_col_offset": 56,
       "filename": "src/tools/bulk_rnaseq/tools.py",
@@ -1373,76 +1458,16 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.",
-      "line_number": 111,
+      "line_number": 128,
       "line_range": [
-        111
+        128
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b310-urllib-urlopen",
       "test_id": "B310",
       "test_name": "blacklist"
     },
     {
-      "code": "48 \n49 INPUT_DIR = _resolve_dir(\"RNA_INPUT_DIR\", _DEFAULT_INPUT, Path(\"/tmp/decoupleRpy/inputs\"))\n50 OUTPUT_DIR = _resolve_dir(\"RNA_OUTPUT_DIR\", _DEFAULT_OUTPUT, Path(\"/tmp/decoupleRpy/outputs\"))\n",
-      "col_offset": 63,
-      "end_col_offset": 88,
-      "filename": "src/tools/rna/_base.py",
-      "issue_confidence": "MEDIUM",
-      "issue_cwe": {
-        "id": 377,
-        "link": "https://cwe.mitre.org/data/definitions/377.html"
-      },
-      "issue_severity": "MEDIUM",
-      "issue_text": "Probable insecure usage of temp file/directory.",
-      "line_number": 49,
-      "line_range": [
-        49
-      ],
-      "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html",
-      "test_id": "B108",
-      "test_name": "hardcoded_tmp_directory"
-    },
-    {
-      "code": "49 INPUT_DIR = _resolve_dir(\"RNA_INPUT_DIR\", _DEFAULT_INPUT, Path(\"/tmp/decoupleRpy/inputs\"))\n50 OUTPUT_DIR = _resolve_dir(\"RNA_OUTPUT_DIR\", _DEFAULT_OUTPUT, Path(\"/tmp/decoupleRpy/outputs\"))\n51 GEO_CACHE_DIR = _resolve_dir(\"RNA_GEO_CACHE_DIR\", _DEFAULT_GEO_CACHE, Path(\"/tmp/decoupleRpy/geo_cache\"))\n",
-      "col_offset": 66,
-      "end_col_offset": 92,
-      "filename": "src/tools/rna/_base.py",
-      "issue_confidence": "MEDIUM",
-      "issue_cwe": {
-        "id": 377,
-        "link": "https://cwe.mitre.org/data/definitions/377.html"
-      },
-      "issue_severity": "MEDIUM",
-      "issue_text": "Probable insecure usage of temp file/directory.",
-      "line_number": 50,
-      "line_range": [
-        50
-      ],
-      "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html",
-      "test_id": "B108",
-      "test_name": "hardcoded_tmp_directory"
-    },
-    {
-      "code": "50 OUTPUT_DIR = _resolve_dir(\"RNA_OUTPUT_DIR\", _DEFAULT_OUTPUT, Path(\"/tmp/decoupleRpy/outputs\"))\n51 GEO_CACHE_DIR = _resolve_dir(\"RNA_GEO_CACHE_DIR\", _DEFAULT_GEO_CACHE, Path(\"/tmp/decoupleRpy/geo_cache\"))\n52 \n",
-      "col_offset": 75,
-      "end_col_offset": 103,
-      "filename": "src/tools/rna/_base.py",
-      "issue_confidence": "MEDIUM",
-      "issue_cwe": {
-        "id": 377,
-        "link": "https://cwe.mitre.org/data/definitions/377.html"
-      },
-      "issue_severity": "MEDIUM",
-      "issue_text": "Probable insecure usage of temp file/directory.",
-      "line_number": 51,
-      "line_range": [
-        51
-      ],
-      "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html",
-      "test_id": "B108",
-      "test_name": "hardcoded_tmp_directory"
-    },
-    {
-      "code": "129     if url_or_path.startswith((\"http://\", \"https://\", \"ftp://\")):\n130         with urllib.request.urlopen(url_or_path) as resp:\n131             raw = resp.read()\n",
+      "code": "134     if url_or_path.startswith((\"http://\", \"https://\", \"ftp://\")):\n135         with urllib.request.urlopen(url_or_path) as resp:\n136             raw = resp.read()\n",
       "col_offset": 13,
       "end_col_offset": 48,
       "filename": "src/workflows/geo.py",
@@ -1453,16 +1478,16 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.",
-      "line_number": 130,
+      "line_number": 135,
       "line_range": [
-        130
+        135
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b310-urllib-urlopen",
       "test_id": "B310",
       "test_name": "blacklist"
     },
     {
-      "code": "311 \n312     with _ur.urlopen(resolved) as resp:\n313         raw = resp.read()\n",
+      "code": "310 \n311     with _ur.urlopen(resolved) as resp:\n312         raw = resp.read()\n",
       "col_offset": 9,
       "end_col_offset": 30,
       "filename": "src/workflows/geo.py",
@@ -1473,13 +1498,13 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.",
-      "line_number": 312,
+      "line_number": 311,
       "line_range": [
-        312
+        311
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b310-urllib-urlopen",
       "test_id": "B310",
       "test_name": "blacklist"
     }
   ]
-}
+}