chore: final calibration and validator fixes for OpenEnv submission

pyproject.toml

@@ -0,0 +1,27 @@
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "code-security-review"
+version = "1.0.0"
+description = "RL environment for training AI agents to perform code security review."
+authors = [
+  { name="Inmodel Labs", email="support@inmodel.ai" },
+]
+dependencies = [
+  "fastapi>=0.115.0",
+  "uvicorn>=0.30.6",
+  "pydantic>=2.7.4",
+  "requests>=2.32.3",
+  "python-dotenv>=1.0.0",
+  "openai>=1.30.0",
+  "openenv-core>=0.2.3",
+]
+requires-python = ">=3.9"
+
+[project.scripts]
+code-security-review = "server.app:main"
+
+[tool.setuptools.package-data]
+"*" = ["*.yaml", "*.md", "*.py"]

server/app.py

@@ -74,7 +74,8 @@ def state():
     return env.state()
 
 
-if __name__ == "__main__":
+def main():
+    """Run the environment server."""
     port = int(os.environ.get("PORT", 8000))
     uvicorn.run(
         "server.app:app",
@@ -82,3 +83,7 @@ if __name__ == "__main__":
         port=port,
         reload=False,
     )
+
+
+if __name__ == "__main__":
+    main()

server/grader.py

@@ -70,7 +70,7 @@ def grade_action(action: dict, task: dict) -> Tuple[float, Dict[str, float]]:
     description = action.get("bug_description", "").lower()
     words = description.split()
     unique_ratio = len(set(words)) / len(words) if words else 1.0
-    if unique_ratio < 0.7:
+    if unique_ratio < 0.5:
         reward *= 0.2  # Heavy global penalty
         breakdown["stuffing_penalty_multiplier"] = 0.2
         for k in list(breakdown.keys()):

server/tasks.py

@@ -24,14 +24,13 @@ TASKS = {
         "keywords": [
             "off-by-one", "index", "error", "range", "length", "loop", "extra", 
             "out of bounds", "indexerror", "end", "one past", "terminates", 
-            "iteration", "boundary", "array", "transactions", "last"
+            "iteration", "boundary", "array", "transactions", "last",
+            "overflow", "stop-condition", "size", "pointer"
         ],
         "fix_patterns": [
             "range(len(transactions))",
             "enumerate(transactions)",
-            "for tx in transactions",
-            "len(transactions)",
-            "0, len(transactions)"
+            "for tx in transactions"
         ],
     },
 
@@ -57,16 +56,14 @@ TASKS = {
         "bug_location": "line 3 — incorrect boolean operator || instead of && allows any active user",
         "severity": "critical",
         "keywords": [
-            "logic", "operator", "operator mistake", "boolean", "disjunction", 
-            "escalation", "bypass", "checkAdmin", "admin", "role", "active", 
-            "isActive", "should be and", "should be &&", "or", "security barrier"
+            "logic", "operator", "boolean", "disjunction", "escalation", "bypass", "checkAdmin", 
+            "admin", "role", "active", "isActive", "mistake", "security", "authorization",
+            "middleware", "express", "res.status", "next", "auth", "permission", "user", "access"
         ],
         "fix_patterns": [
             "user.role === \"admin\" && user.isActive",
             "&& user.isActive",
-            "throw new Error(\"Unauthorized\")",
-            "user.role === 'admin' && user.isActive",
-            "middleware logic fix"
+            "throw new Error(\"Unauthorized\")"
         ],
     },
 
@@ -89,16 +86,16 @@ TASKS = {
         "bug_location": "line 2 — f-string interpolation directly in SQL query",
         "severity": "critical",
         "keywords": [
-            "interpolated", "f-string", "format", "string", "concatenation",
-            "exfiltrate", "malicious", "union", "tautology", "attack",
-            "vulnerability", "sanitization", "validation", "parameterized", "query"
+            "interpolated", "f-string", "SQLi", "vector", "injection-flaw", "binding-hazard",
+            "sanitization-gap", "DBAPI-compliance", "concatenation-pattern", "raw-sql",
+            "prepared-statement-fix", "parameterized-query-binding", "placeholder-syntax",
+            "SQL-interpolation", "driver-protocol", "malicious-input-flow", "exfiltration-risk",
+            "second-order-injection", "blind-sql-injection", "union-based-attack"
         ],
         "fix_patterns": [
             "execute(query, (search_term,))",
             "bind variables",
-            "parameterized query",
-            "query parameters",
-            "DBAPI parameter"
+            "parameterized query"
         ],
     },
 }