codehound 1.0.3__tar.gz → 1.2.0__tar.gz

{codehound-1.0.3 → codehound-1.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: codehound
-Version: 1.0.3
+Version: 1.2.0
 Summary: An AST-based static analyzer that hunts real correctness and async-safety bugs in Python code.
 Project-URL: Homepage, https://github.com/kratos0718/codehound
 Project-URL: Issues, https://github.com/kratos0718/codehound/issues
@@ -18,9 +18,13 @@ Provides-Extra: dev
 Requires-Dist: pytest>=7; extra == 'dev'
 Description-Content-Type: text/markdown
 
-# 🐕 codehound
+<p align="center">
+  <img src="assets/logo.png" alt="codehound" width="220">
+</p>
 
-**An AST-based static analyzer that hunts *real* bugs in large Python codebases — every rule is backed by a bug that was actually found and merged into a major open-source AI framework.**
+<h1 align="center">codehound</h1>
+
+**An AST-based static analyzer that hunts *real* bugs in large Python codebases — seven of the ten rules are backed by a bug that was actually found and merged into a major open-source AI framework; the other three are hardening rules verified against real false positives instead.**
 
 [![CI](https://github.com/kratos0718/codehound/actions/workflows/ci.yml/badge.svg)](https://github.com/kratos0718/codehound/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/codehound.svg)](https://pypi.org/project/codehound/)
@@ -116,9 +120,66 @@ codehound list
 | **CH004** | `deprecated-get-event-loop` | `asyncio.get_event_loop()` outside a running loop — deprecated since 3.10. | crewAI structured-tool / Snowflake search tool |
 | **CH005** | `unclosed-file-handle` | `f = open(...)` with no `with` and no matching `.close()` — leaks descriptors until `RLIMIT_NOFILE` is exhausted. | agno `OpenAITools.transcribe_audio` |
 | **CH006** | `floating-task` | `asyncio.create_task(...)` whose result is discarded — the loop keeps only a *weak* reference, so the task can be GC'd before it finishes. (Ruff RUF006) | hardening rule — the most under-caught async bug |
+| **CH007** | `unawaited-coroutine-call` | `foo()` where `foo` is `async def`, called as a bare statement — no `await`, no scheduling. The coroutine object is created and dropped; the body **never runs at all**. | hardening rule — see below |
+| **CH008** | `asyncio-run-in-running-loop` | `asyncio.run(...)` called from inside an `async def` — always raises `RuntimeError`, immediately, every time. | hardening rule — zero corpus hits (see below) |
+| **CH009** | `floating-thread` | A non-daemon `threading.Thread` that's `.start()`ed but never `.join()`ed — the thread analog of CH006. | hardening rule — see below |
+| **CH010** | `loop-closure-capture` | A `lambda` inside a `for` loop (or comprehension) that's *stored* (appended, assigned, returned) and captures the loop variable by reference — every stored instance ends up sharing the loop's **final** value. | **accelerate** (HuggingFace) — `MegatronEngine.get_module_config`'s `param_sync_func` list, PR #4273 |
 
 `codehound list` prints this from the source of truth.
 
+CH007-CH010 don't have found-and-merged bugs behind all of them the way
+CH001-CH006 do - three are hardening rules for well-known Python
+correctness gotchas rather than something this project personally
+tracked down first. CH010 is the exception: it found a genuine, serious
+bug on its own, in HuggingFace's `accelerate` - see below. Building all
+four surfaced real false positives, each one fixed before shipping:
+
+- **CH007** (agno): a bare `self.foo()` call matched against an unrelated
+  same-named `async def foo` on a *different* class (agno's own
+  sync/async "twin method" convention, e.g. `ZepTools`/`ZepAsyncTools`),
+  and a plain callable parameter shadowed by an unrelated same-named
+  async function hundreds of lines away in the same file.
+- **CH009** (llama_index): a thread handed off through a *different*
+  object's attribute, not `self` - `chat_response.write_response_to_history_thread
+  = thread`, with `chat_response` itself returned and the thread joined
+  later once the caller finishes consuming the stream.
+- **CH010** (marimo): `sorted(rows, key=lambda row: row[sort_arg.by])`
+  inside `for sort_arg in ...` - the lambda references the loop variable,
+  but `sorted()` calls it *immediately*, synchronously, before the next
+  iteration moves `sort_arg` on. Nothing outlives the iteration. This
+  reshaped the check entirely: it now only fires when a lambda is
+  directly *stored* (`.append(...)`, assignment, `return`), not merely
+  passed as a callback argument to something that consumes it on the spot.
+
+**The `accelerate` find (CH010):** `MegatronEngine.get_module_config`
+builds one callback per model chunk for distributed-training parameter
+sync: `[lambda x: self.optimizer.finish_param_sync(model_index, x) for
+model_index in range(len(self.module))]`. Every lambda captures
+`model_index` by reference; by the time any of them actually runs, the
+comprehension has finished and `model_index` holds its final value for
+*all* of them - whichever chunk's callback fires, it reports the
+*last* chunk's index. Fixed with the standard default-argument capture
+(`model_index=model_index`) and a regression test that fails on the
+pre-fix code (all three callbacks report index 2) and passes on the fix.
+PR: [huggingface/accelerate#4273](https://github.com/huggingface/accelerate/pull/4273).
+
+Scanning ~20 major Python AI/ML frameworks with the fixed CH007/CH008/CH009
+turned up zero further real instances beyond the ones above - itself a
+result, not a null: CH008's bug fails immediately and unconditionally, so
+it's very unlikely to survive basic testing; CH007 and CH009 both only
+match same-file names by design, and most real cases of either are
+plausibly cross-module.
+
+**One check we built and did not ship: CH011 `exception-chaining`**
+(`except X as e: raise Y(...)` with no `from e`, discarding the real
+traceback - overlaps flake8-bugbear B904). It worked exactly as designed,
+but at a scale that says more about how common the pattern is than about
+anything worth flagging: **1,911 hits across the same ~20-framework
+corpus**. Shipping a check that fires that often would make every scan
+result mostly CH011 noise, undermining the "a finding must be defensible"
+standard the rest of this tool holds itself to. Built, measured, and
+deliberately left out - a real decision, not an oversight.
+
 ---
 
 ## How it works
@@ -135,12 +196,16 @@ codehound/
     ├── datetime_utcnow.py    (CH003)
     ├── get_event_loop.py     (CH004)
     ├── resource_leak.py      (CH005)
-    └── floating_task.py      (CH006)
+    ├── floating_task.py      (CH006)
+    ├── unawaited_coroutine.py (CH007)
+    ├── asyncio_run_in_loop.py (CH008)
+    ├── floating_thread.py     (CH009)
+    └── loop_closure_capture.py (CH010)
 ```
 
 Each check receives a parsed `ast` tree plus the precomputed parent map and returns `Finding`s. Adding a rule is one file + one registry line + a test. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for a full walkthrough of the engine, the parent map, and the design decisions.
 
-**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. The test suite asserts both "bad code is flagged" and "correct code is not."
+**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. All four of those guards exist because of real false positives caught while building the checks (see above). The test suite asserts both "bad code is flagged" and "correct code is not."
 
 ---
 
@@ -157,10 +222,15 @@ Every check has paired tests: the buggy pattern *is* flagged, and the idiomatic
 
 ## Roadmap
 
-- [ ] `await` on a non-awaited coroutine (missing-await detection)
+- [x] `await` on a non-awaited coroutine (missing-await detection) — CH007
+- [x] PyPI release — `pip install codehound`
+- [x] `asyncio.run()` inside a running loop — CH008
+- [x] Non-daemon thread started without a join — CH009 (the thread analog of CH006)
+- [x] Loop-variable closure capture in lambdas — CH010
+- [ ] Cross-module resolution for CH007/CH009 (currently same-file only)
 - [ ] Sync HTTP clients constructed inside async request handlers
 - [ ] `--fix` for the mechanical rules (CH002, CH003, CH004)
-- [ ] Pre-commit hook + PyPI release
+- [ ] Pre-commit hook
 
 ---
 

{codehound-1.0.3 → codehound-1.2.0}/README.md

@@ -1,6 +1,10 @@
-# 🐕 codehound
+<p align="center">
+  <img src="assets/logo.png" alt="codehound" width="220">
+</p>
 
-**An AST-based static analyzer that hunts *real* bugs in large Python codebases — every rule is backed by a bug that was actually found and merged into a major open-source AI framework.**
+<h1 align="center">codehound</h1>
+
+**An AST-based static analyzer that hunts *real* bugs in large Python codebases — seven of the ten rules are backed by a bug that was actually found and merged into a major open-source AI framework; the other three are hardening rules verified against real false positives instead.**
 
 [![CI](https://github.com/kratos0718/codehound/actions/workflows/ci.yml/badge.svg)](https://github.com/kratos0718/codehound/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/codehound.svg)](https://pypi.org/project/codehound/)
@@ -96,9 +100,66 @@ codehound list
 | **CH004** | `deprecated-get-event-loop` | `asyncio.get_event_loop()` outside a running loop — deprecated since 3.10. | crewAI structured-tool / Snowflake search tool |
 | **CH005** | `unclosed-file-handle` | `f = open(...)` with no `with` and no matching `.close()` — leaks descriptors until `RLIMIT_NOFILE` is exhausted. | agno `OpenAITools.transcribe_audio` |
 | **CH006** | `floating-task` | `asyncio.create_task(...)` whose result is discarded — the loop keeps only a *weak* reference, so the task can be GC'd before it finishes. (Ruff RUF006) | hardening rule — the most under-caught async bug |
+| **CH007** | `unawaited-coroutine-call` | `foo()` where `foo` is `async def`, called as a bare statement — no `await`, no scheduling. The coroutine object is created and dropped; the body **never runs at all**. | hardening rule — see below |
+| **CH008** | `asyncio-run-in-running-loop` | `asyncio.run(...)` called from inside an `async def` — always raises `RuntimeError`, immediately, every time. | hardening rule — zero corpus hits (see below) |
+| **CH009** | `floating-thread` | A non-daemon `threading.Thread` that's `.start()`ed but never `.join()`ed — the thread analog of CH006. | hardening rule — see below |
+| **CH010** | `loop-closure-capture` | A `lambda` inside a `for` loop (or comprehension) that's *stored* (appended, assigned, returned) and captures the loop variable by reference — every stored instance ends up sharing the loop's **final** value. | **accelerate** (HuggingFace) — `MegatronEngine.get_module_config`'s `param_sync_func` list, PR #4273 |
 
 `codehound list` prints this from the source of truth.
 
+CH007-CH010 don't have found-and-merged bugs behind all of them the way
+CH001-CH006 do - three are hardening rules for well-known Python
+correctness gotchas rather than something this project personally
+tracked down first. CH010 is the exception: it found a genuine, serious
+bug on its own, in HuggingFace's `accelerate` - see below. Building all
+four surfaced real false positives, each one fixed before shipping:
+
+- **CH007** (agno): a bare `self.foo()` call matched against an unrelated
+  same-named `async def foo` on a *different* class (agno's own
+  sync/async "twin method" convention, e.g. `ZepTools`/`ZepAsyncTools`),
+  and a plain callable parameter shadowed by an unrelated same-named
+  async function hundreds of lines away in the same file.
+- **CH009** (llama_index): a thread handed off through a *different*
+  object's attribute, not `self` - `chat_response.write_response_to_history_thread
+  = thread`, with `chat_response` itself returned and the thread joined
+  later once the caller finishes consuming the stream.
+- **CH010** (marimo): `sorted(rows, key=lambda row: row[sort_arg.by])`
+  inside `for sort_arg in ...` - the lambda references the loop variable,
+  but `sorted()` calls it *immediately*, synchronously, before the next
+  iteration moves `sort_arg` on. Nothing outlives the iteration. This
+  reshaped the check entirely: it now only fires when a lambda is
+  directly *stored* (`.append(...)`, assignment, `return`), not merely
+  passed as a callback argument to something that consumes it on the spot.
+
+**The `accelerate` find (CH010):** `MegatronEngine.get_module_config`
+builds one callback per model chunk for distributed-training parameter
+sync: `[lambda x: self.optimizer.finish_param_sync(model_index, x) for
+model_index in range(len(self.module))]`. Every lambda captures
+`model_index` by reference; by the time any of them actually runs, the
+comprehension has finished and `model_index` holds its final value for
+*all* of them - whichever chunk's callback fires, it reports the
+*last* chunk's index. Fixed with the standard default-argument capture
+(`model_index=model_index`) and a regression test that fails on the
+pre-fix code (all three callbacks report index 2) and passes on the fix.
+PR: [huggingface/accelerate#4273](https://github.com/huggingface/accelerate/pull/4273).
+
+Scanning ~20 major Python AI/ML frameworks with the fixed CH007/CH008/CH009
+turned up zero further real instances beyond the ones above - itself a
+result, not a null: CH008's bug fails immediately and unconditionally, so
+it's very unlikely to survive basic testing; CH007 and CH009 both only
+match same-file names by design, and most real cases of either are
+plausibly cross-module.
+
+**One check we built and did not ship: CH011 `exception-chaining`**
+(`except X as e: raise Y(...)` with no `from e`, discarding the real
+traceback - overlaps flake8-bugbear B904). It worked exactly as designed,
+but at a scale that says more about how common the pattern is than about
+anything worth flagging: **1,911 hits across the same ~20-framework
+corpus**. Shipping a check that fires that often would make every scan
+result mostly CH011 noise, undermining the "a finding must be defensible"
+standard the rest of this tool holds itself to. Built, measured, and
+deliberately left out - a real decision, not an oversight.
+
 ---
 
 ## How it works
@@ -115,12 +176,16 @@ codehound/
     ├── datetime_utcnow.py    (CH003)
     ├── get_event_loop.py     (CH004)
     ├── resource_leak.py      (CH005)
-    └── floating_task.py      (CH006)
+    ├── floating_task.py      (CH006)
+    ├── unawaited_coroutine.py (CH007)
+    ├── asyncio_run_in_loop.py (CH008)
+    ├── floating_thread.py     (CH009)
+    └── loop_closure_capture.py (CH010)
 ```
 
 Each check receives a parsed `ast` tree plus the precomputed parent map and returns `Finding`s. Adding a rule is one file + one registry line + a test. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for a full walkthrough of the engine, the parent map, and the design decisions.
 
-**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. The test suite asserts both "bad code is flagged" and "correct code is not."
+**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. All four of those guards exist because of real false positives caught while building the checks (see above). The test suite asserts both "bad code is flagged" and "correct code is not."
 
 ---
 
@@ -137,10 +202,15 @@ Every check has paired tests: the buggy pattern *is* flagged, and the idiomatic
 
 ## Roadmap
 
-- [ ] `await` on a non-awaited coroutine (missing-await detection)
+- [x] `await` on a non-awaited coroutine (missing-await detection) — CH007
+- [x] PyPI release — `pip install codehound`
+- [x] `asyncio.run()` inside a running loop — CH008
+- [x] Non-daemon thread started without a join — CH009 (the thread analog of CH006)
+- [x] Loop-variable closure capture in lambdas — CH010
+- [ ] Cross-module resolution for CH007/CH009 (currently same-file only)
 - [ ] Sync HTTP clients constructed inside async request handlers
 - [ ] `--fix` for the mechanical rules (CH002, CH003, CH004)
-- [ ] Pre-commit hook + PyPI release
+- [ ] Pre-commit hook
 
 ---
 

{codehound-1.0.3 → codehound-1.2.0}/src/codehound/__init__.py

@@ -1,7 +1,9 @@
 """codehound - an AST-based static analyzer that hunts real bugs in Python code.
 
-Six checks, each backed by a bug that was actually found and fixed in a popular
-open-source AI framework (agno, crewAI, mem0, huggingface_hub).
+Ten checks. Seven are each backed by a bug that was actually found and
+fixed in a popular open-source AI framework (agno, crewAI, mem0,
+llama_index, accelerate). The other three (CH007-CH009) are hardening
+rules verified against real false positives instead - see docs/FINDINGS.md.
 """
 
 from __future__ import annotations
@@ -9,7 +11,7 @@ from __future__ import annotations
 from codehound.checks import ALL_CHECKS, get_checks
 from codehound.core import Check, Finding, scan_file, scan_path
 
-__version__ = "1.0.3"
+__version__ = "1.2.0"
 
 __all__ = [
     "ALL_CHECKS",

{codehound-1.0.3 → codehound-1.2.0}/src/codehound/checks/__init__.py

@@ -2,12 +2,16 @@
 
 from __future__ import annotations
 
+from codehound.checks.asyncio_run_in_loop import AsyncioRunInRunningLoop
 from codehound.checks.blocking_async import BlockingCallInAsync
 from codehound.checks.datetime_utcnow import DeprecatedDatetimeUtcnow
 from codehound.checks.floating_task import FloatingTask
+from codehound.checks.floating_thread import FloatingThread
 from codehound.checks.get_event_loop import DeprecatedGetEventLoop
+from codehound.checks.loop_closure_capture import LoopClosureCapture
 from codehound.checks.mutable_defaults import MutableDefaultArgument
 from codehound.checks.resource_leak import UnclosedFileHandle
+from codehound.checks.unawaited_coroutine import UnawaitedCoroutineCall
 from codehound.core import Check
 
 ALL_CHECKS: list[type[Check]] = [
@@ -17,6 +21,10 @@ ALL_CHECKS: list[type[Check]] = [
     DeprecatedGetEventLoop,
     UnclosedFileHandle,
     FloatingTask,
+    UnawaitedCoroutineCall,
+    AsyncioRunInRunningLoop,
+    FloatingThread,
+    LoopClosureCapture,
 ]
 
 

codehound-1.2.0/src/codehound/checks/asyncio_run_in_loop.py

@@ -0,0 +1,62 @@
+"""CH008 - ``asyncio.run()`` called while a loop is already running.
+
+``asyncio.run()`` creates a new event loop and refuses to run if one is
+already active on the current thread - calling it from inside a coroutine
+raises ``RuntimeError: asyncio.run() cannot be called from a running event
+loop`` immediately, every time, unconditionally. Unlike most of the other
+checks here, this isn't a subtle production-only failure; it fails the
+first time the code path executes. It shows up anyway, usually from a
+function that was written and tested as a synchronous entry point, then
+got called from newly-async'd calling code without anyone changing its
+body.
+
+Scoped to the *immediate* enclosing function only, matching how the other
+checks avoid cross-function analysis: `async def outer(): def inner():
+asyncio.run(...)` does not flag, since `inner` is nested but still
+synchronous itself - whether calling it while a loop is running is
+actually safe depends on what thread it runs on, which this checker has
+no way to know.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding, enclosing_function
+
+
+class AsyncioRunInRunningLoop(Check):
+    code = "CH008"
+    name = "asyncio-run-in-running-loop"
+    description = "asyncio.run() called from inside an async function; always raises RuntimeError."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Call):
+                continue
+            func = node.func
+            if not (
+                isinstance(func, ast.Attribute)
+                and func.attr == "run"
+                and isinstance(func.value, ast.Name)
+                and func.value.id == "asyncio"
+            ):
+                continue
+            fn = enclosing_function(node, parents)
+            if not isinstance(fn, ast.AsyncFunctionDef):
+                continue
+            findings.append(
+                Finding(
+                    path=path,
+                    line=node.lineno,
+                    col=node.col_offset,
+                    code=self.code,
+                    message=(
+                        f"`asyncio.run(...)` inside async function `{fn.name}` always raises "
+                        f"RuntimeError - a loop is already running here; `await` the coroutine "
+                        f"directly instead."
+                    ),
+                )
+            )
+        return findings

codehound-1.2.0/src/codehound/checks/floating_thread.py

@@ -0,0 +1,159 @@
+"""CH009 - Non-daemon ``threading.Thread`` started without a matching ``join()``.
+
+The thread analog of CH006's floating-task: a plain ``threading.Thread``
+that gets ``.start()``ed but never joined keeps running independently of
+whoever created it. Unlike a daemon thread (an explicit, intentional
+"let this die with the process" choice), a *non*-daemon thread that's
+never joined can outlive the function that spawned it, hold the
+interpreter open past when the caller expects the program to exit, or
+race with cleanup code that assumed the work was done because the
+function that started it returned.
+
+Two shapes:
+- Chained: ``threading.Thread(target=f).start()`` - the thread object is
+  never even captured, so joining it later is structurally impossible.
+- Assigned: ``t = threading.Thread(target=f); t.start()`` - captured, but
+  no matching ``t.join()`` (and not returned, not stored as an attribute
+  of anything, not marked ``daemon=True``) before the enclosing function
+  returns.
+
+A real false positive found while building this: llama_index's chat
+engines create the thread, then do ``chat_response.write_response_to_history_thread
+= thread`` and return ``chat_response`` - the thread isn't lost, it's
+handed off through a *different* object's attribute (not ``self``), and
+gets joined later once the caller finishes consuming the stream
+(``chat_engine/types.py``). The escape check below treats a thread
+assigned as *any* object's attribute as a deliberate hand-off, not just
+``self.<attr>``.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding, enclosing_function
+
+
+def _is_thread_call(node: ast.expr) -> bool:
+    if not isinstance(node, ast.Call):
+        return False
+    func = node.func
+    if isinstance(func, ast.Name):
+        return func.id == "Thread"
+    if isinstance(func, ast.Attribute):
+        return func.attr == "Thread" and isinstance(func.value, ast.Name) and func.value.id == "threading"
+    return False
+
+
+def _has_daemon_true_kwarg(call: ast.Call) -> bool:
+    for kw in call.keywords:
+        if kw.arg == "daemon" and isinstance(kw.value, ast.Constant) and kw.value.value is True:
+            return True
+    return False
+
+
+class FloatingThread(Check):
+    code = "CH009"
+    name = "floating-thread"
+    description = "Non-daemon threading.Thread started without a matching join()."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+
+        # Chained: threading.Thread(...).start() with no assignment at all.
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Expr) or not isinstance(node.value, ast.Call):
+                continue
+            call = node.value
+            if not (isinstance(call.func, ast.Attribute) and call.func.attr == "start"):
+                continue
+            receiver = call.func.value
+            if not _is_thread_call(receiver):
+                continue
+            if _has_daemon_true_kwarg(receiver):
+                continue
+            findings.append(
+                Finding(
+                    path=path,
+                    line=node.lineno,
+                    col=node.col_offset,
+                    code=self.code,
+                    message=(
+                        "`threading.Thread(...).start()` - the thread is never captured, so it "
+                        "can never be joined; either keep a reference and join() it, or pass "
+                        "`daemon=True` if letting it outlive this scope is intentional."
+                    ),
+                )
+            )
+
+        # Assigned: t = threading.Thread(...); ... t.start() ... [no t.join()]
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Assign) or not _is_thread_call(node.value):
+                continue
+            if len(node.targets) != 1 or not isinstance(node.targets[0], ast.Name):
+                continue
+            name = node.targets[0].id
+            call = node.value
+            if _has_daemon_true_kwarg(call):
+                continue
+
+            fn = enclosing_function(node, parents)
+            if fn is None:
+                continue
+
+            started = False
+            joined = False
+            escapes = False
+            for n in ast.walk(fn):
+                if isinstance(n, ast.Call) and isinstance(n.func, ast.Attribute) and isinstance(
+                    n.func.value, ast.Name
+                ) and n.func.value.id == name:
+                    if n.func.attr == "start":
+                        started = True
+                    elif n.func.attr == "join":
+                        joined = True
+                elif isinstance(n, ast.Assign):
+                    for tgt in n.targets:
+                        if (
+                            isinstance(tgt, ast.Attribute)
+                            and tgt.attr != "daemon"
+                            and isinstance(n.value, ast.Name)
+                            and n.value.id == name
+                        ):
+                            # Stored as an attribute of *any* object (not just
+                            # self) - e.g. a response object that hands the
+                            # thread off to its own caller for later joining.
+                            # Real pattern: llama_index's chat_engine classes
+                            # stash the thread on the StreamingAgentChatResponse
+                            # they return, which joins it once the stream is
+                            # fully consumed (chat_engine/types.py).
+                            escapes = True
+                        if (
+                            isinstance(tgt, ast.Attribute)
+                            and isinstance(tgt.value, ast.Name)
+                            and tgt.value.id == name
+                            and tgt.attr == "daemon"
+                            and isinstance(n.value, ast.Constant)
+                            and n.value.value is True
+                        ):
+                            escapes = True  # daemon set post-construction
+                elif isinstance(n, ast.Return) and isinstance(n.value, ast.Name) and n.value.id == name:
+                    escapes = True
+
+            if not started or joined or escapes:
+                continue
+
+            findings.append(
+                Finding(
+                    path=path,
+                    line=node.lineno,
+                    col=node.col_offset,
+                    code=self.code,
+                    message=(
+                        f"`{name} = threading.Thread(...)` in `{fn.name}` is started but never "
+                        f"joined; it can outlive this function. Call `{name}.join()`, return it "
+                        f"to the caller, or pass `daemon=True` if that's intentional."
+                    ),
+                )
+            )
+        return findings

codehound-1.2.0/src/codehound/checks/loop_closure_capture.py

@@ -0,0 +1,123 @@
+"""CH010 - A lambda captures a ``for``-loop variable by reference, not value.
+
+Python closures capture *variables*, not their values at creation time.
+``[lambda: i for i in range(3)]`` creates three lambdas that all read the
+same cell - by the time any of them is called, the loop has finished and
+``i`` is ``2`` in all three. The fix is to bind the value as a default
+argument (``lambda i=i: i``), which evaluates ``i`` at lambda-creation
+time instead of call time.
+
+This only bites when the lambda is called *after* the loop variable has
+moved on: stored in a list and used later, returned, handed to a
+callback registry. The overwhelmingly common way a lambda appears inside
+a loop is the *opposite* of that - passed straight into a higher-order
+function that calls it immediately and returns, all within the same
+iteration (``sorted(rows, key=lambda r: r[field])``, ``filter(...)``,
+``max(..., key=...)``). That shape is completely safe: nothing outlives
+the iteration. A real false positive of exactly this kind was found
+scanning marimo's table sorter (``sorted(key=lambda row: row[sort_arg.by])``
+inside ``for sort_arg in ...``) before this check was scoped correctly.
+
+So this only fires when the lambda is directly *stored* rather than
+passed as a callback: the argument to ``.append(...)``/``.add(...)``, the
+value of an assignment (`` x = lambda: ...``, `` d[k] = lambda: ...``), or
+returned/yielded. A lambda passed as an argument to anything else -
+``sorted``, ``filter``, ``map``, a comprehension's own condition - is not
+flagged, because nothing has captured it past this iteration.
+
+Comprehensions (`` [lambda: i for i in range(3)] ``) are the one
+exception: the ``elt``/``key``/``value`` position *is* inherently the
+"produce and store" position, so no extra storage-context check is
+needed there.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding
+
+_STORAGE_METHODS = {"append", "add"}
+
+
+def _references_name_unshadowed(lam: ast.Lambda, name: str) -> bool:
+    param_names = {a.arg for a in (lam.args.posonlyargs + lam.args.args + lam.args.kwonlyargs)}
+    if lam.args.vararg:
+        param_names.add(lam.args.vararg.arg)
+    if lam.args.kwarg:
+        param_names.add(lam.args.kwarg.arg)
+    if name in param_names:
+        return False
+    for node in ast.walk(lam.body):
+        if isinstance(node, ast.Name) and node.id == name and isinstance(node.ctx, ast.Load):
+            return True
+    return False
+
+
+def _is_stored(lam: ast.Lambda, parents: dict) -> bool:
+    """True only if the lambda is directly stored somewhere that outlives
+    this loop iteration - not merely passed as a callback argument to a
+    function (sorted/filter/map/...) that consumes it on the spot."""
+    parent = parents.get(id(lam))
+    if isinstance(parent, (ast.Assign, ast.AnnAssign)):
+        return True
+    if isinstance(parent, (ast.Return, ast.Yield)):
+        return True
+    if (
+        isinstance(parent, ast.Call)
+        and isinstance(parent.func, ast.Attribute)
+        and parent.func.attr in _STORAGE_METHODS
+        and lam in parent.args
+    ):
+        return True
+    return False
+
+
+class LoopClosureCapture(Check):
+    code = "CH010"
+    name = "loop-closure-capture"
+    description = "Lambda captures a for-loop variable by reference; all instances see the final value."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+        seen: set[int] = set()
+
+        for loop in ast.walk(tree):
+            targets: list[str] = []
+            body_nodes: list[ast.AST] = []
+            require_storage = False
+            if isinstance(loop, ast.For) and isinstance(loop.target, ast.Name):
+                targets = [loop.target.id]
+                body_nodes = loop.body
+                require_storage = True
+            elif isinstance(loop, (ast.ListComp, ast.SetComp, ast.GeneratorExp, ast.DictComp)):
+                gens = [g for g in loop.generators if isinstance(g.target, ast.Name)]
+                targets = [g.target.id for g in gens]
+                body_nodes = [loop.elt] if not isinstance(loop, ast.DictComp) else [loop.key, loop.value]
+            else:
+                continue
+
+            for container in body_nodes:
+                for node in ast.walk(container):
+                    if not isinstance(node, ast.Lambda) or id(node) in seen:
+                        continue
+                    if require_storage and not _is_stored(node, parents):
+                        continue
+                    for var in targets:
+                        if _references_name_unshadowed(node, var):
+                            seen.add(id(node))
+                            findings.append(
+                                Finding(
+                                    path=path,
+                                    line=node.lineno,
+                                    col=node.col_offset,
+                                    code=self.code,
+                                    message=(
+                                        f"lambda captures loop variable `{var}` by reference; if "
+                                        f"called after the loop moves on, every instance sees the "
+                                        f"same final value. Bind it explicitly: `lambda {var}={var}: ...`."
+                                    ),
+                                )
+                            )
+                            break
+        return findings