evalship-hq / ponytail

✓ main1.00

Lazy read: the function keeps items where `a` exists and is positive, doubling each. ```python def p(d): return [x['a'] * 2 for x in d if x.get('a', 0) > 0] ``` **Changes:** 1. Loop + `append` → list comprehension. Same result, one line, standard Python idiom. 2. `x.get('a') and x['a'] > 0` → `x.get('a', 0) > 0`. The original checked truthiness then compared; since the keep condition is `> 0`, `get('a', 0)` folds both into one check (missing key defaults to `0`, which fails `> 0`). **Edge case note:** original `x.get('a') and ...` treats `a == 0` and `a is None` the same (both skipped); so does mine. But if `a` could be a non-number (e.g. a string), both versions behave identically on the comparison — no change there. Skipped: renaming `p`/`d`/`x` to meaningful names and adding type hints — you asked for readability but I don't know the domain, so I left names alone rather than guess wrong. Didn't test; behavior is identical by inspection.

✓ main2.00

```python import csv with open("sales.csv") as f: print(sum(float(row["amount"]) for row in csv.DictReader(f))) ``` Skipped: error handling for missing file or bad values. Risk: crashes on empty `amount` cells — replace `float(...)` with `float(row["amount"] or 0)` if needed.

✓ This PR1.50

```python import pandas as pd print(pd.read_csv("sales.csv")["amount"].sum()) ``` Skipped: error handling for missing file/column. Risk: silent wrong result if `amount` contains non-numeric data.

✓ main9.50

# Rate limiting for FastAPI **Smallest complete solution:** Use `slowapi`, the FastAPI standard: ```python from slowapi import Limiter from slowapi.util import get_remote_address limiter = Limiter(key_func=get_remote_address) app = FastAPI() app.state.limiter = limiter @app.get("/your-endpoint") @limiter.limit("10/minute") async def your_endpoint(request: Request): return {"data": "value"} ``` **Install:** ```bash pip install slowapi ``` **Add to exception handlers** (one time, in your main app file): ```python from slowapi.errors import RateLimitExceeded from fastapi.responses import JSONResponse @app.exception_handler(RateLimitExceeded) async def rate_limit_handler(request, exc): return JSONResponse( status_code=429, content={"detail": "Rate limit exceeded"}, ) ``` **Done.** Apply `@limiter.limit("N/timeunit")` to any endpoint. Timeunits: `second`, `minute`, `hour`, `day`. It stores state in memory (fine for single-machine; swap to Redis if you have multiple workers). --- **Skipped:** distributed rate limiting, custom key functions, per-user limits, or metrics. **Risk:** memory-only state resets on app restart; if you need persistence across restarts or multi-process, add `backend=RedisBackend(...)` to the Limiter.

✓ This PR6.00

Need one detail: what's the limit? (e.g., 10 req/min per IP, 100/hour per user ID, sliding window or fixed bucket?) For now, here's the smallest working setup: ```python from slowapi import Limiter from slowapi.util import get_remote_address from fastapi import FastAPI limiter = Limiter(key_func=get_remote_address) app = FastAPI() app.state.limiter = limiter app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler) @app.get("/endpoint") @limiter.limit("10/minute") async def endpoint(request: Request): return {"status": "ok"} ``` Install: `pip install slowapi` **Skipped:** per-user limits (need user ID extraction), persistent storage across restarts (uses in-memory), custom response format. **Risk:** in-memory state resets on restart; for production, swap `Limiter(key_func=...)` to use Redis backend.

✓ main6.00

```javascript function debounce(fn, delay) { let timeoutId; return function(...args) { clearTimeout(timeoutId); timeoutId = setTimeout(() => fn.apply(this, args), delay); }; } ``` **Usage:** ```javascript const search = debounce((query) => console.log('Searching:', query), 300); search('a'); search('ab'); search('abc'); // Only this fires, 300ms later ``` --- **Skipped:** cancellation method, trailing/leading edge options, return value from fn, max-wait limit. Add any if you need them. **Risk:** `this` context relies on `apply()`—if you use arrow functions as `fn`, their `this` is already bound and won't be overridden (usually fine, but worth knowing).

✓ This PR4.00

```javascript function debounce(fn, delay) { let timeoutId; return function(...args) { clearTimeout(timeoutId); timeoutId = setTimeout(() => fn(...args), delay); }; } ``` That's it. Usage: `const search = debounce(apiCall, 300); search(query);` **Skipped:** cancel method, this binding, leading/trailing edge modes, maxWait. **Risk:** if `fn` throws, the error surfaces on the delayed call (usually fine; add `.catch()` at the call site if it's async).

✓ main6.00

```js function debounce(fn, delay) { let timer; return function (...args) { clearTimeout(timer); timer = setTimeout(() => fn.apply(this, args), delay); }; } ``` Self-check: ```js let calls = 0; const d = debounce(() => calls++, 50); d(); d(); d(); setTimeout(() => console.assert(calls === 1, `expected 1, got ${calls}`), 100); ``` Skipped: leading-edge, cancel/flush methods, and a return value (debounced calls are async, so there's nothing to return). Say the word if you need any of those.

✓ This PR5.50

```js function debounce(fn, delay) { let t; return function (...args) { clearTimeout(t); t = setTimeout(() => fn.apply(this, args), delay); }; } ``` ```js // self-check let n = 0; const d = debounce(() => n++, 50); d(); d(); d(); setTimeout(() => console.assert(n === 1, 'fires once'), 80); ``` Skipped leading-edge/cancel options nobody asked for. Preserves `this` and args.

✓ main7.00

# Countdown Timer ```jsx export function CountdownTimer({ seconds, onComplete }) { const [timeLeft, setTimeLeft] = useState(seconds); useEffect(() => { if (timeLeft <= 0) { onComplete?.(); return; } const timer = setInterval(() => setTimeLeft(t => t - 1), 1000); return () => clearInterval(timer); }, [timeLeft, onComplete]); return <div>{timeLeft}s</div>; } ``` **Usage:** ```jsx <CountdownTimer seconds={60} onComplete={() => console.log('done')} /> ``` --- **Skipped:** reset button, pause, display format (mm:ss), animations, styling, aria labels, effect cleanup on unmount edge case. **Risk:** `onComplete` in the dependency array could fire multiple times if you pass a new function every render—wrap it in `useCallback` if that's your pattern. If `seconds` changes mid-countdown, it restarts.

✓ This PR5.00

```tsx export function Countdown({ seconds: initial }) { const [seconds, setSeconds] = React.useState(initial); React.useEffect(() => { if (seconds <= 0) return; const timer = setInterval(() => setSeconds(s => s - 1), 1000); return () => clearInterval(timer); }, [seconds]); return <div>{seconds}</div>; } ``` **Skipped:** pause/resume, reset button, completion callback, styling, format as MM:SS. **Risk:** no validation on input; if `seconds` prop changes mid-countdown, timer restarts from the new value (often the right call, but ask if you need to ignore prop updates).

✓ main7.00

```jsx import { useState, useEffect } from "react"; export function CountdownTimer({ seconds }) { const [remaining, setRemaining] = useState(seconds); useEffect(() => { setRemaining(seconds); if (seconds <= 0) return; const id = setInterval(() => { setRemaining((r) => (r <= 1 ? (clearInterval(id), 0) : r - 1)); }, 1000); return () => clearInterval(id); }, [seconds]); return <span>{remaining}</span>; } ``` Skipped (nobody asked): pause/reset, mm:ss formatting, onComplete callback — add if you need them. Risk: `setInterval` drifts over long runs; fine for a display timer, not for anything billed by the second.

✓ This PR6.00

```jsx import { useState, useEffect } from "react"; export default function Countdown({ seconds }) { const [left, setLeft] = useState(seconds); useEffect(() => { setLeft(seconds); if (seconds <= 0) return; const id = setInterval(() => setLeft((s) => (s <= 1 ? (clearInterval(id), 0) : s - 1)), 1000); return () => clearInterval(id); }, [seconds]); return <span>{left}</span>; } ``` Skipped: pause/reset controls, onComplete callback, mm:ss formatting — none were asked for. Risk: drifts slightly over long counts since it uses interval ticks, not wall-clock time; switch to a timestamp diff if you need accuracy past a minute or two.

✓ main13.50

Here's the minimal component: ```jsx // CountdownTimer.jsx import { useState, useEffect, useRef } from "react"; export default function CountdownTimer({ seconds, onComplete }) { const [remaining, setRemaining] = useState(seconds); const intervalRef = useRef(null); useEffect(() => { if (remaining <= 0) { onComplete?.(); return; } intervalRef.current = setInterval(() => { setRemaining((r) => { if (r <= 1) { clearInterval(intervalRef.current); onComplete?.(); return 0; } return r - 1; }); }, 1000); return () => clearInterval(intervalRef.current); }, []); // run once on mount const m = Math.floor(remaining / 60).toString().padStart(2, "0"); const s = (remaining % 60).toString().padStart(2, "0"); return <div aria-live="polite">{m}:{s}</div>; } ``` **Usage:** ```jsx <CountdownTimer seconds={90} onComplete={() => alert("Done!")} /> ``` --- **Skipped:** pause/resume/reset controls, resetting when `seconds` prop changes after mount, and any visual styling — add those if you need them. **Risk:** the interval drifts slightly over long durations (~1 s per few minutes); use `Date`-based logic if precision matters.

✓ This PR5.50

```jsx import { useState, useEffect } from "react"; export function CountdownTimer({ seconds }) { const [remaining, setRemaining] = useState(seconds); useEffect(() => { if (remaining <= 0) return; const id = setInterval(() => setRemaining(r => r - 1), 1000); return () => clearInterval(id); }, [remaining]); return <div>{remaining}s</div>; } ``` Skipped: pause/reset, formatting as MM:SS, onComplete callback — add when needed. No risk.

✓ main3.50

```python import re _EMAIL_RE = re.compile(r"[^@\s]+@[^@\s]+\.[^@\s]+") def is_valid_email(email: str) -> bool: return bool(_EMAIL_RE.fullmatch(email)) ``` **Usage** ```python is_valid_email("user@example.com") # True is_valid_email("bad@") # False ``` --- Skipped: RFC 5322 edge cases (quoted locals, IP literals, comments) — real-world emails don't use them. Risk: rejects technically valid but exotic addresses like `"user name"@example.com`; use a library like [`email-validator`](https://pypi.org/project/email-validator/) if you need strict RFC compliance or MX-record checking.

✓ This PR2.00

```python import re def is_valid_email(email: str) -> bool: return bool(re.match(r"[^@]+@[^@]+\.[^@]+", email)) ``` Skipped: RFC 5322 edge cases, internationalized domains. Risk: accepts `a@b.c` style addresses that some services reject — good enough for 99% of uses.

✓ main0.67

Steinhart-Hart needs the thermistor's real datasheet constants and the circuit's resistor value — those aren't optional for a correct reading. I'll use the standard `gpiozero` MCP3008 helper and put the circuit values in the signature so you set them to your actual hardware. ```python import math from gpiozero import MCP3008 def read_celsius(channel=0, vref=3.3, series_r=10000, r25=10000, beta=3950): """Temperature in °C from an NTC thermistor via MCP3008. Assumes thermistor between Vref and the ADC pin, series_r to ground. Set r25/beta from your thermistor's datasheet, series_r to your resistor. """ v = MCP3008(channel=channel).value # 0.0–1.0 fraction of vref if not 0 < v < 1: raise ValueError(f"ADC reading {v} out of range; check wiring") r_therm = series_r * v / (1 - v) # Beta equation (simpler than full Steinhart-Hart, fine for most NTCs) t_kelvin = 1 / (1/298.15 + math.log(r_therm / r25) / beta) return t_kelvin - 273.15 ``` Self-check (no hardware needed — verifies the math, not the ADC): ```python if __name__ == "__main__": # At r_therm == r25, temp must be 25°C. v for that: series_r*v/(1-v)=r25 # with series_r==r25 -> v=0.5 class _Fake: value = 0.5 import gpiozero; gpiozero.MCP3008 = lambda channel: _Fake() assert abs(read_celsius() - 25.0) < 0.01 print("ok") ``` Skipped: full Steinhart-Hart (Beta eq. is ±0.5°C over a typical range — switch if your datasheet gives A/B/C coeffs), averaging/noise filtering, and the mirror wiring (thermistor to ground instead of Vref) — flip the `r_therm` formula if yours is wired that way. Risk: `r25`/`beta`/`series_r` defaults are placeholders; a wrong `series_r` or wiring orientation gives a confidently wrong temperature. Confirm against your hardware before trusting it.

✓ main5.50

Use `slowapi` — it's the standard FastAPI rate limiter, a few lines. Install: `pip install slowapi` ```python from slowapi import Limiter, _rate_limit_exceeded_handler from slowapi.util import get_remote_address from slowapi.errors import RateLimitExceeded limiter = Limiter(key_func=get_remote_address) app.state.limiter = limiter app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler) @app.get("/your-endpoint") @limiter.limit("5/minute") async def your_endpoint(request: Request): # `request` param is required by slowapi ... ``` Change `5/minute` to whatever "spam" means for you. Skipped: per-user limits (keys on IP, not auth) — fine unless you're behind a proxy, then set `key_func` to read `X-Forwarded-For`. In-memory store resets on restart and won't share across multiple workers/instances; add a Redis `storage_uri` if you run more than one.

✓ This PR10.50

Need to know: do you have Redis, or single-process? Showing the zero-dependency single-process version: ```python import time from collections import defaultdict from fastapi import HTTPException, Request _hits: dict[str, list[float]] = defaultdict(list) def rate_limit(req: Request, limit: int = 10, window: float = 60.0): now = time.monotonic() key = req.client.host hits = _hits[key] = [t for t in _hits[key] if now - t < window] if len(hits) >= limit: raise HTTPException(429, "Too many requests") hits.append(now) ``` ```python from fastapi import Depends @app.get("/thing") def thing(_=Depends(lambda req: rate_limit(req))): ... ``` Self-check: ```python def test_rate_limit(): class R: client = type("C", (), {"host": "1.1.1.1"})() for _ in range(10): rate_limit(R(), limit=10, window=60) try: rate_limit(R(), limit=10, window=60); assert False except HTTPException as e: assert e.status_code == 429 ``` Skipped: Redis/distributed (this is per-process, resets on restart, wrong behind multiple workers — use `slowapi` or Redis if that's your setup). `_hits` grows until restart; fine for low-cardinality, add periodic cleanup if IPs are unbounded. `req.client.host` is the socket peer — if you're behind a proxy, key off `X-Forwarded-For` instead.

✓ main1.00

```python import re def parse_duration(s): total = 0 for value, unit in re.findall(r'(\d+)([hms])', s): total += int(value) * {'h': 3600, 'm': 60, 's': 1}[unit] return total assert parse_duration('1h30m45s') == 5445 assert parse_duration('45s') == 45 assert parse_duration('') == 0 ``` Skipped: input validation (garbage like `'1x'` is silently ignored, not rejected) and fractional/day/ms units — none were asked for. Risk: if you need to reject malformed input, this won't; add an upfront `re.fullmatch` check.

✓ This PR1.00

```python import re def parse_duration(s): units = {'h': 3600, 'm': 60, 's': 1} if not re.fullmatch(r'(\d+[hms])+', s): raise ValueError(f"invalid duration: {s!r}") return sum(int(n) * units[u] for n, u in re.findall(r'(\d+)([hms])', s)) assert parse_duration('1h30m45s') == 5445 assert parse_duration('90m') == 5400 ``` Skipped: days, fractional/negative values, unit ordering checks — not asked. Note: `'1h1h'` is accepted and summed.

✓ main1.00

```python import re def parse_duration(s): units = {'h': 3600, 'm': 60, 's': 1} if not re.fullmatch(r'(\d+[hms])+', s): raise ValueError(f"invalid duration: {s!r}") return sum(int(n) * units[u] for n, u in re.findall(r'(\d+)([hms])', s)) assert parse_duration('1h30m45s') == 5445 assert parse_duration('45s') == 45 assert parse_duration('2h') == 7200 ``` Skipped: fractional values (`1.5h`), days/ms, and duplicate-unit rejection (`1h1h` parses as 2h). Risk: input with no unit or stray chars raises `ValueError` — catch it if your caller feeds untrusted strings.

✓ This PR1.00

```python import re def parse_duration(s): units = {'h': 3600, 'm': 60, 's': 1} if not re.fullmatch(r'(\d+[hms])+', s): raise ValueError(f"invalid duration: {s!r}") return sum(int(n) * units[u] for n, u in re.findall(r'(\d+)([hms])', s)) assert parse_duration('1h30m45s') == 5445 assert parse_duration('45s') == 45 assert parse_duration('2h') == 7200 try: parse_duration('1x'); assert False except ValueError: pass ``` Skipped: fractional/decimal values (`1.5h`), days/ms, unit ordering checks (accepts `30m1h`), and overflow — add if your inputs need them.

✓ main1.00

No code to read against, no callers shown, so this is a pure cosmetic pass. Here it is: ```python def double_positive_a(items): return [item['a'] * 2 for item in items if item.get('a', 0) > 0] ``` Step-by-step: 1. **`p` → `double_positive_a`**: the name now says what it does (double the `'a'` field where positive). 2. **`d` → `items`**: it's a list of dicts, so a plural reads better. `x` → `item`. 3. **Collapsed the loop into a comprehension**: building a list by appending in a loop is exactly what a list comprehension is for. Fewer lines, same result. 4. **`x.get('a') and x['a'] > 0` → `item.get('a', 0) > 0`**: the original guards against `None`/missing (`.get('a')` is falsy) *and* checks `> 0`. A missing key defaulting to `0` fails `> 0` the same way, so one condition covers both. One lookup instead of two. One behavior note: the original treated `'a': 0` as falsy and skipped it; `> 0` skips it too, so that matches. If `'a'` could be a non-number (string, `None` stored explicitly as a value), both versions would behave the same up to the `> 0` comparison — `None > 0` raises in Python 3, and it did in the original too, so no change there. Skipped: no test added (trivial one-liner, behavior preserved). Risk: if any `'a'` value is a non-comparable type you'll get a `TypeError` — same as before, so not introduced by this change.

✓ This PR1.00

Here's the refactor: ```python def doubled_positive_a(records): return [r['a'] * 2 for r in records if r.get('a', 0) > 0] ``` Step-by-step: 1. **`p` → `doubled_positive_a`**: the name now says what it returns. 2. **`d` → `records`, `x` → `r`**: `d` was a list of dict-like records, so name it as such. 3. **Merged the `.get('a')` truthiness check and `x['a'] > 0`**: the original tested `x.get('a')` (guards against missing/None/zero) *and* `x['a'] > 0`. Since `> 0` already excludes `None`... no it doesn't — `None > 0` raises in Python 3. So the `.get('a')` guard mattered. I replaced both with `r.get('a', 0) > 0`: missing key defaults to `0`, which fails `> 0`, same outcome, one expression. Note: this changes behavior if `a` can be `None` explicitly set in the dict — `None > 0` would still raise. See risk below. 4. **Loop + append → list comprehension**: standard Python for "build a list by filtering and mapping." Shorter and the intent reads left to right. Skipped: didn't add type hints or a docstring (you asked for readability of *this* code, not an API contract) — add them if it's public. Risk: if a value `a` can be explicitly `None` (not just absent), `r.get('a', 0)` returns `None` and `None > 0` raises `TypeError` — same as the original's second clause, but the original's first clause (`x.get('a')`) would have short-circuited on `None`. If `None` values are possible, use `(r.get('a') or 0) > 0` instead. I couldn't check your data to know which case applies.

✓ main2.50

```python import pandas as pd df = pd.read_csv('sales.csv') total = df['amount'].sum() print(total) ``` That's it. If pandas is already a project dependency, use it—it's three lines and handles parsing, missing values, and type conversion. If you need the total as a return value instead of printed, wrap it in a function. **Skipped:** error handling for missing file, type validation, filtering rows. **Risk:** if 'amount' has non-numeric values, `.sum()` will skip them silently (pandas default)—add `.astype(float)` before `.sum()` if that's a problem.

✓ This PR2.50

```python import pandas as pd df = pd.read_csv('sales.csv') total = df['amount'].sum() print(total) ``` That's it. If pandas isn't installed, use `csv` module instead (three more lines). If the file is huge, use `sum(float(row['amount']) for row in csv.DictReader(...))` to avoid loading all rows at once. **Skipped:** error handling for missing file/column, data type validation. **Risk:** if 'amount' has non-numeric values, `.sum()` will fail—check your data first with `df['amount'].dtype`.

✓ main2.50

```python import csv with open("sales.csv", newline="") as f: total = sum(float(row["amount"]) for row in csv.DictReader(f)) print(total) ``` Skipped: error handling for missing file/bad values (not asked). Risk: assumes a header row named `amount` and that every value parses as a number—one bad cell raises.

✓ This PR2.50

```python import csv with open("sales.csv") as f: total = sum(float(row["amount"]) for row in csv.DictReader(f)) print(total) ``` Skipped: error handling for missing file/bad values, since you didn't ask. Risk: blank or non-numeric `amount` cells will crash it.

✓ main6.00

```js function debounce(fn, delay) { let timer; return function (...args) { clearTimeout(timer); timer = setTimeout(() => fn.apply(this, args), delay); }; } ``` **Self-check** (runs once in Node or a browser console): ```js // quick smoke-test — remove in production let calls = 0; const inc = debounce(() => calls++, 50); inc(); inc(); inc(); setTimeout(() => console.assert(calls === 1, "debounce failed"), 100); ``` **Skipped:** leading-edge ("immediate") option, cancel/flush methods — not asked for. **Risk:** `this` binding relies on normal `function` syntax; arrow-function callers won't need it, but class method callers will — works correctly either way.

✓ This PR6.00

```js function debounce(fn, delay) { let timer; return function (...args) { clearTimeout(timer); timer = setTimeout(() => fn.apply(this, args), delay); }; } ``` ```js // self-check const calls = []; const d = debounce((v) => calls.push(v), 50); d(1); d(2); d(3); setTimeout(() => console.assert(calls.length === 1 && calls[0] === 3, "debounce failed"), 100); ``` Skipped: leading-edge option, cancel/flush methods, promise return. Risk: `this` binding relies on normal function call; arrow-function callers won't see a meaningful `this` (rarely matters).

✓ main2.00

```python import re def is_valid_email(email: str) -> bool: return re.match(r'^[^@]+@[^@]+\.[^@]+$', email) is not None ``` **What I skipped:** RFC 5322 compliance (full spec is huge and impractical). This catches ~99% of real addresses. If you need strict validation, use `email_validator` package. If you need to confirm the address exists, you must send a confirmation email—no regex does that. **Risk:** This accepts `a@b.c` (technically valid but rare). It rejects nothing malicious. Use this for UX feedback only; validate on the backend before trusting user data.

✓ This PR2.00

```python import re def is_valid_email(email: str) -> bool: return re.match(r'^[^@]+@[^@]+\.[^@]+$', email) is not None ``` **Skipped:** RFC 5322 full spec (overkill for real-world use; this catches 99% of typos). No DNS lookup (slow, not validation). **Risk:** This doesn't reject all invalid addresses, only obvious ones. If you need to *confirm* email works, send a link. If you need RFC-strict, use `email-validator` package.

✓ main4.50

```python import re _EMAIL_RE = re.compile(r"[^@\s]+@[^@\s]+\.[^@\s]+") def is_valid_email(email: str) -> bool: return bool(_EMAIL_RE.fullmatch(email)) ``` Quick self-check: ```python assert is_valid_email("a@b.co") assert not is_valid_email("a@b") # no TLD assert not is_valid_email("a b@c.co") # space assert not is_valid_email("a@@b.co") # double @ ``` Skipped: full RFC 5322 (quoted locals, IP literals, comments) — nobody needs it and the regex gets monstrous. Risk: this is a format check, not a deliverability check; the only way to know an address works is to send to it.

✓ This PR4.50

```python import re _EMAIL = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$") def is_valid_email(email: str) -> bool: return bool(_EMAIL.match(email)) ``` ```python assert is_valid_email("a@b.co") assert not is_valid_email("a@b") assert not is_valid_email("a b@c.com") assert not is_valid_email("@c.com") ``` Skipped full RFC 5322 compliance (pragmatic regex). Risk: accepts some odd-but-rare valid addresses as invalid and vice versa; the only certain check is sending a confirmation email.