codehound 1.1.0__tar.gz → 1.3.0__tar.gz

{codehound-1.1.0 → codehound-1.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: codehound
-Version: 1.1.0
+Version: 1.3.0
 Summary: An AST-based static analyzer that hunts real correctness and async-safety bugs in Python code.
 Project-URL: Homepage, https://github.com/kratos0718/codehound
 Project-URL: Issues, https://github.com/kratos0718/codehound/issues
@@ -18,9 +18,13 @@ Provides-Extra: dev
 Requires-Dist: pytest>=7; extra == 'dev'
 Description-Content-Type: text/markdown
 
-# 🐕 codehound
+<p align="center">
+  <img src="assets/logo.png" alt="codehound" width="220">
+</p>
 
-**An AST-based static analyzer that hunts *real* bugs in large Python codebases — six of the seven rules are backed by a bug that was actually found and merged into a major open-source AI framework; the seventh is a hardening rule verified against real false positives instead.**
+<h1 align="center">codehound</h1>
+
+**An AST-based static analyzer that hunts *real* bugs in large Python codebases — seven of the ten rules are backed by a bug that was actually found and merged into a major open-source AI framework; the other three are hardening rules verified against real false positives instead.**
 
 [![CI](https://github.com/kratos0718/codehound/actions/workflows/ci.yml/badge.svg)](https://github.com/kratos0718/codehound/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/codehound.svg)](https://pypi.org/project/codehound/)
@@ -87,6 +91,9 @@ PYTHONPATH=src python -m codehound.cli scan path/to/project
 # scan a project (skips tests/, docs/, examples/, vendored code by default)
 codehound scan path/to/project
 
+# scan multiple files/directories in one invocation (what pre-commit does)
+codehound scan file1.py file2.py src/
+
 # only run specific checks
 codehound scan path/to/project --select CH001,CH006
 
@@ -94,6 +101,9 @@ codehound scan path/to/project --select CH001,CH006
 codehound scan path/to/project --format json
 codehound scan path/to/project --format csv
 
+# GitHub Code Scanning (Security tab) can ingest this directly
+codehound scan path/to/project --format sarif > results.sarif
+
 # list every available check
 codehound list
 ```
@@ -104,6 +114,29 @@ codehound list
 - run: codehound scan src   # fails the build on a regression
 ```
 
+### GitHub Action
+
+```yaml
+- uses: kratos0718/codehound@v1.2.0
+  with:
+    path: src
+    # select: CH001,CH006        # optional, defaults to all checks
+    # fail-on-findings: "false"  # optional, report without failing the build
+    # upload-sarif: "false"      # optional, skip the Code Scanning upload
+```
+
+Uploads findings to the repo's **Security → Code Scanning** tab via SARIF, in addition to failing the step (unless `fail-on-findings: "false"`).
+
+### pre-commit
+
+```yaml
+repos:
+  - repo: https://github.com/kratos0718/codehound
+    rev: v1.2.0
+    hooks:
+      - id: codehound
+```
+
 ---
 
 ## The checks
@@ -117,24 +150,64 @@ codehound list
 | **CH005** | `unclosed-file-handle` | `f = open(...)` with no `with` and no matching `.close()` — leaks descriptors until `RLIMIT_NOFILE` is exhausted. | agno `OpenAITools.transcribe_audio` |
 | **CH006** | `floating-task` | `asyncio.create_task(...)` whose result is discarded — the loop keeps only a *weak* reference, so the task can be GC'd before it finishes. (Ruff RUF006) | hardening rule — the most under-caught async bug |
 | **CH007** | `unawaited-coroutine-call` | `foo()` where `foo` is `async def`, called as a bare statement — no `await`, no scheduling. The coroutine object is created and dropped; the body **never runs at all**. | hardening rule — see below |
+| **CH008** | `asyncio-run-in-running-loop` | `asyncio.run(...)` called from inside an `async def` — always raises `RuntimeError`, immediately, every time. | hardening rule — zero corpus hits (see below) |
+| **CH009** | `floating-thread` | A non-daemon `threading.Thread` that's `.start()`ed but never `.join()`ed — the thread analog of CH006. | hardening rule — see below |
+| **CH010** | `loop-closure-capture` | A `lambda` inside a `for` loop (or comprehension) that's *stored* (appended, assigned, returned) and captures the loop variable by reference — every stored instance ends up sharing the loop's **final** value. | **accelerate** (HuggingFace) — `MegatronEngine.get_module_config`'s `param_sync_func` list, PR #4273 |
 
 `codehound list` prints this from the source of truth.
 
-CH007 doesn't have a found-and-merged bug behind it like the other six -
-it targets a well-known Python correctness gotcha (the
-`RuntimeWarning: coroutine 'foo' was never awaited` you get when a
-coroutine is created and discarded) rather than one this project
-personally tracked down. What it does have is two real false positives
-caught and fixed while building it, both against agno: a bare `self.foo()`
-call matched against an unrelated same-named `async def foo` on a
-*different* class (agno's own sync/async "twin method" convention, e.g.
-`ZepTools`/`ZepAsyncTools`), and a plain callable parameter shadowed by an
-unrelated same-named async function hundreds of lines away in the same
-file. Scanning ~20 major Python AI/ML frameworks after fixing both turned
-up zero real instances - itself a result, not a null: it suggests either
-that mature async test suites catch this before merge, or that most real
-cases are cross-module calls, which this check deliberately doesn't chase
-(same-file name matching only, consistent with every other rule here).
+CH007-CH010 don't have found-and-merged bugs behind all of them the way
+CH001-CH006 do - three are hardening rules for well-known Python
+correctness gotchas rather than something this project personally
+tracked down first. CH010 is the exception: it found a genuine, serious
+bug on its own, in HuggingFace's `accelerate` - see below. Building all
+four surfaced real false positives, each one fixed before shipping:
+
+- **CH007** (agno): a bare `self.foo()` call matched against an unrelated
+  same-named `async def foo` on a *different* class (agno's own
+  sync/async "twin method" convention, e.g. `ZepTools`/`ZepAsyncTools`),
+  and a plain callable parameter shadowed by an unrelated same-named
+  async function hundreds of lines away in the same file.
+- **CH009** (llama_index): a thread handed off through a *different*
+  object's attribute, not `self` - `chat_response.write_response_to_history_thread
+  = thread`, with `chat_response` itself returned and the thread joined
+  later once the caller finishes consuming the stream.
+- **CH010** (marimo): `sorted(rows, key=lambda row: row[sort_arg.by])`
+  inside `for sort_arg in ...` - the lambda references the loop variable,
+  but `sorted()` calls it *immediately*, synchronously, before the next
+  iteration moves `sort_arg` on. Nothing outlives the iteration. This
+  reshaped the check entirely: it now only fires when a lambda is
+  directly *stored* (`.append(...)`, assignment, `return`), not merely
+  passed as a callback argument to something that consumes it on the spot.
+
+**The `accelerate` find (CH010):** `MegatronEngine.get_module_config`
+builds one callback per model chunk for distributed-training parameter
+sync: `[lambda x: self.optimizer.finish_param_sync(model_index, x) for
+model_index in range(len(self.module))]`. Every lambda captures
+`model_index` by reference; by the time any of them actually runs, the
+comprehension has finished and `model_index` holds its final value for
+*all* of them - whichever chunk's callback fires, it reports the
+*last* chunk's index. Fixed with the standard default-argument capture
+(`model_index=model_index`) and a regression test that fails on the
+pre-fix code (all three callbacks report index 2) and passes on the fix.
+PR: [huggingface/accelerate#4273](https://github.com/huggingface/accelerate/pull/4273).
+
+Scanning ~20 major Python AI/ML frameworks with the fixed CH007/CH008/CH009
+turned up zero further real instances beyond the ones above - itself a
+result, not a null: CH008's bug fails immediately and unconditionally, so
+it's very unlikely to survive basic testing; CH007 and CH009 both only
+match same-file names by design, and most real cases of either are
+plausibly cross-module.
+
+**One check we built and did not ship: CH011 `exception-chaining`**
+(`except X as e: raise Y(...)` with no `from e`, discarding the real
+traceback - overlaps flake8-bugbear B904). It worked exactly as designed,
+but at a scale that says more about how common the pattern is than about
+anything worth flagging: **1,911 hits across the same ~20-framework
+corpus**. Shipping a check that fires that often would make every scan
+result mostly CH011 noise, undermining the "a finding must be defensible"
+standard the rest of this tool holds itself to. Built, measured, and
+deliberately left out - a real decision, not an oversight.
 
 ---
 
@@ -145,7 +218,9 @@ codehound/
 ├── core.py          # file discovery, AST parsing, the Finding/Check contract,
 │                    #   and a child→parent map so checks can ask "what's my
 │                    #   enclosing function / am I inside a `with`?"
-├── cli.py           # `scan` / `list`, text|json|csv output, CI-friendly exit codes
+├── cli.py           # `scan` / `list`, text|json|csv|sarif output, CI-friendly exit codes
+├── sarif.py         # SARIF 2.1.0 output for GitHub Code Scanning
+├── terminal.py      # colored text output (auto-disabled for non-TTY / NO_COLOR)
 └── checks/          # one small, independently-tested class per rule
     ├── blocking_async.py     (CH001)
     ├── mutable_defaults.py   (CH002)
@@ -153,12 +228,15 @@ codehound/
     ├── get_event_loop.py     (CH004)
     ├── resource_leak.py      (CH005)
     ├── floating_task.py      (CH006)
-    └── unawaited_coroutine.py (CH007)
+    ├── unawaited_coroutine.py (CH007)
+    ├── asyncio_run_in_loop.py (CH008)
+    ├── floating_thread.py     (CH009)
+    └── loop_closure_capture.py (CH010)
 ```
 
 Each check receives a parsed `ast` tree plus the precomputed parent map and returns `Finding`s. Adding a rule is one file + one registry line + a test. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for a full walkthrough of the engine, the parent map, and the design decisions.
 
-**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter - both guards exist because of real false positives caught while building it (see above). The test suite asserts both "bad code is flagged" and "correct code is not."
+**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. All four of those guards exist because of real false positives caught while building the checks (see above). The test suite asserts both "bad code is flagged" and "correct code is not."
 
 ---
 
@@ -177,10 +255,17 @@ Every check has paired tests: the buggy pattern *is* flagged, and the idiomatic
 
 - [x] `await` on a non-awaited coroutine (missing-await detection) — CH007
 - [x] PyPI release — `pip install codehound`
-- [ ] Cross-module resolution for CH007 (currently same-file only)
+- [x] `asyncio.run()` inside a running loop — CH008
+- [x] Non-daemon thread started without a join — CH009 (the thread analog of CH006)
+- [x] Loop-variable closure capture in lambdas — CH010
+- [x] Pre-commit hook — `.pre-commit-hooks.yaml`
+- [x] GitHub Action — `action.yml`, uploads SARIF to Code Scanning
+- [x] SARIF output — `--format sarif`
+- [x] Colored terminal output (auto-disabled for non-TTY / `NO_COLOR`)
+- [x] Multi-path `scan` invocation (what the pre-commit hook needs)
+- [ ] Cross-module resolution for CH007/CH009 (currently same-file only)
 - [ ] Sync HTTP clients constructed inside async request handlers
 - [ ] `--fix` for the mechanical rules (CH002, CH003, CH004)
-- [ ] Pre-commit hook
 
 ---
 

{codehound-1.1.0 → codehound-1.3.0}/README.md

@@ -1,6 +1,10 @@
-# 🐕 codehound
+<p align="center">
+  <img src="assets/logo.png" alt="codehound" width="220">
+</p>
 
-**An AST-based static analyzer that hunts *real* bugs in large Python codebases — six of the seven rules are backed by a bug that was actually found and merged into a major open-source AI framework; the seventh is a hardening rule verified against real false positives instead.**
+<h1 align="center">codehound</h1>
+
+**An AST-based static analyzer that hunts *real* bugs in large Python codebases — seven of the ten rules are backed by a bug that was actually found and merged into a major open-source AI framework; the other three are hardening rules verified against real false positives instead.**
 
 [![CI](https://github.com/kratos0718/codehound/actions/workflows/ci.yml/badge.svg)](https://github.com/kratos0718/codehound/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/codehound.svg)](https://pypi.org/project/codehound/)
@@ -67,6 +71,9 @@ PYTHONPATH=src python -m codehound.cli scan path/to/project
 # scan a project (skips tests/, docs/, examples/, vendored code by default)
 codehound scan path/to/project
 
+# scan multiple files/directories in one invocation (what pre-commit does)
+codehound scan file1.py file2.py src/
+
 # only run specific checks
 codehound scan path/to/project --select CH001,CH006
 
@@ -74,6 +81,9 @@ codehound scan path/to/project --select CH001,CH006
 codehound scan path/to/project --format json
 codehound scan path/to/project --format csv
 
+# GitHub Code Scanning (Security tab) can ingest this directly
+codehound scan path/to/project --format sarif > results.sarif
+
 # list every available check
 codehound list
 ```
@@ -84,6 +94,29 @@ codehound list
 - run: codehound scan src   # fails the build on a regression
 ```
 
+### GitHub Action
+
+```yaml
+- uses: kratos0718/codehound@v1.2.0
+  with:
+    path: src
+    # select: CH001,CH006        # optional, defaults to all checks
+    # fail-on-findings: "false"  # optional, report without failing the build
+    # upload-sarif: "false"      # optional, skip the Code Scanning upload
+```
+
+Uploads findings to the repo's **Security → Code Scanning** tab via SARIF, in addition to failing the step (unless `fail-on-findings: "false"`).
+
+### pre-commit
+
+```yaml
+repos:
+  - repo: https://github.com/kratos0718/codehound
+    rev: v1.2.0
+    hooks:
+      - id: codehound
+```
+
 ---
 
 ## The checks
@@ -97,24 +130,64 @@ codehound list
 | **CH005** | `unclosed-file-handle` | `f = open(...)` with no `with` and no matching `.close()` — leaks descriptors until `RLIMIT_NOFILE` is exhausted. | agno `OpenAITools.transcribe_audio` |
 | **CH006** | `floating-task` | `asyncio.create_task(...)` whose result is discarded — the loop keeps only a *weak* reference, so the task can be GC'd before it finishes. (Ruff RUF006) | hardening rule — the most under-caught async bug |
 | **CH007** | `unawaited-coroutine-call` | `foo()` where `foo` is `async def`, called as a bare statement — no `await`, no scheduling. The coroutine object is created and dropped; the body **never runs at all**. | hardening rule — see below |
+| **CH008** | `asyncio-run-in-running-loop` | `asyncio.run(...)` called from inside an `async def` — always raises `RuntimeError`, immediately, every time. | hardening rule — zero corpus hits (see below) |
+| **CH009** | `floating-thread` | A non-daemon `threading.Thread` that's `.start()`ed but never `.join()`ed — the thread analog of CH006. | hardening rule — see below |
+| **CH010** | `loop-closure-capture` | A `lambda` inside a `for` loop (or comprehension) that's *stored* (appended, assigned, returned) and captures the loop variable by reference — every stored instance ends up sharing the loop's **final** value. | **accelerate** (HuggingFace) — `MegatronEngine.get_module_config`'s `param_sync_func` list, PR #4273 |
 
 `codehound list` prints this from the source of truth.
 
-CH007 doesn't have a found-and-merged bug behind it like the other six -
-it targets a well-known Python correctness gotcha (the
-`RuntimeWarning: coroutine 'foo' was never awaited` you get when a
-coroutine is created and discarded) rather than one this project
-personally tracked down. What it does have is two real false positives
-caught and fixed while building it, both against agno: a bare `self.foo()`
-call matched against an unrelated same-named `async def foo` on a
-*different* class (agno's own sync/async "twin method" convention, e.g.
-`ZepTools`/`ZepAsyncTools`), and a plain callable parameter shadowed by an
-unrelated same-named async function hundreds of lines away in the same
-file. Scanning ~20 major Python AI/ML frameworks after fixing both turned
-up zero real instances - itself a result, not a null: it suggests either
-that mature async test suites catch this before merge, or that most real
-cases are cross-module calls, which this check deliberately doesn't chase
-(same-file name matching only, consistent with every other rule here).
+CH007-CH010 don't have found-and-merged bugs behind all of them the way
+CH001-CH006 do - three are hardening rules for well-known Python
+correctness gotchas rather than something this project personally
+tracked down first. CH010 is the exception: it found a genuine, serious
+bug on its own, in HuggingFace's `accelerate` - see below. Building all
+four surfaced real false positives, each one fixed before shipping:
+
+- **CH007** (agno): a bare `self.foo()` call matched against an unrelated
+  same-named `async def foo` on a *different* class (agno's own
+  sync/async "twin method" convention, e.g. `ZepTools`/`ZepAsyncTools`),
+  and a plain callable parameter shadowed by an unrelated same-named
+  async function hundreds of lines away in the same file.
+- **CH009** (llama_index): a thread handed off through a *different*
+  object's attribute, not `self` - `chat_response.write_response_to_history_thread
+  = thread`, with `chat_response` itself returned and the thread joined
+  later once the caller finishes consuming the stream.
+- **CH010** (marimo): `sorted(rows, key=lambda row: row[sort_arg.by])`
+  inside `for sort_arg in ...` - the lambda references the loop variable,
+  but `sorted()` calls it *immediately*, synchronously, before the next
+  iteration moves `sort_arg` on. Nothing outlives the iteration. This
+  reshaped the check entirely: it now only fires when a lambda is
+  directly *stored* (`.append(...)`, assignment, `return`), not merely
+  passed as a callback argument to something that consumes it on the spot.
+
+**The `accelerate` find (CH010):** `MegatronEngine.get_module_config`
+builds one callback per model chunk for distributed-training parameter
+sync: `[lambda x: self.optimizer.finish_param_sync(model_index, x) for
+model_index in range(len(self.module))]`. Every lambda captures
+`model_index` by reference; by the time any of them actually runs, the
+comprehension has finished and `model_index` holds its final value for
+*all* of them - whichever chunk's callback fires, it reports the
+*last* chunk's index. Fixed with the standard default-argument capture
+(`model_index=model_index`) and a regression test that fails on the
+pre-fix code (all three callbacks report index 2) and passes on the fix.
+PR: [huggingface/accelerate#4273](https://github.com/huggingface/accelerate/pull/4273).
+
+Scanning ~20 major Python AI/ML frameworks with the fixed CH007/CH008/CH009
+turned up zero further real instances beyond the ones above - itself a
+result, not a null: CH008's bug fails immediately and unconditionally, so
+it's very unlikely to survive basic testing; CH007 and CH009 both only
+match same-file names by design, and most real cases of either are
+plausibly cross-module.
+
+**One check we built and did not ship: CH011 `exception-chaining`**
+(`except X as e: raise Y(...)` with no `from e`, discarding the real
+traceback - overlaps flake8-bugbear B904). It worked exactly as designed,
+but at a scale that says more about how common the pattern is than about
+anything worth flagging: **1,911 hits across the same ~20-framework
+corpus**. Shipping a check that fires that often would make every scan
+result mostly CH011 noise, undermining the "a finding must be defensible"
+standard the rest of this tool holds itself to. Built, measured, and
+deliberately left out - a real decision, not an oversight.
 
 ---
 
@@ -125,7 +198,9 @@ codehound/
 ├── core.py          # file discovery, AST parsing, the Finding/Check contract,
 │                    #   and a child→parent map so checks can ask "what's my
 │                    #   enclosing function / am I inside a `with`?"
-├── cli.py           # `scan` / `list`, text|json|csv output, CI-friendly exit codes
+├── cli.py           # `scan` / `list`, text|json|csv|sarif output, CI-friendly exit codes
+├── sarif.py         # SARIF 2.1.0 output for GitHub Code Scanning
+├── terminal.py      # colored text output (auto-disabled for non-TTY / NO_COLOR)
 └── checks/          # one small, independently-tested class per rule
     ├── blocking_async.py     (CH001)
     ├── mutable_defaults.py   (CH002)
@@ -133,12 +208,15 @@ codehound/
     ├── get_event_loop.py     (CH004)
     ├── resource_leak.py      (CH005)
     ├── floating_task.py      (CH006)
-    └── unawaited_coroutine.py (CH007)
+    ├── unawaited_coroutine.py (CH007)
+    ├── asyncio_run_in_loop.py (CH008)
+    ├── floating_thread.py     (CH009)
+    └── loop_closure_capture.py (CH010)
 ```
 
 Each check receives a parsed `ast` tree plus the precomputed parent map and returns `Finding`s. Adding a rule is one file + one registry line + a test. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for a full walkthrough of the engine, the parent map, and the design decisions.
 
-**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter - both guards exist because of real false positives caught while building it (see above). The test suite asserts both "bad code is flagged" and "correct code is not."
+**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. All four of those guards exist because of real false positives caught while building the checks (see above). The test suite asserts both "bad code is flagged" and "correct code is not."
 
 ---
 
@@ -157,10 +235,17 @@ Every check has paired tests: the buggy pattern *is* flagged, and the idiomatic
 
 - [x] `await` on a non-awaited coroutine (missing-await detection) — CH007
 - [x] PyPI release — `pip install codehound`
-- [ ] Cross-module resolution for CH007 (currently same-file only)
+- [x] `asyncio.run()` inside a running loop — CH008
+- [x] Non-daemon thread started without a join — CH009 (the thread analog of CH006)
+- [x] Loop-variable closure capture in lambdas — CH010
+- [x] Pre-commit hook — `.pre-commit-hooks.yaml`
+- [x] GitHub Action — `action.yml`, uploads SARIF to Code Scanning
+- [x] SARIF output — `--format sarif`
+- [x] Colored terminal output (auto-disabled for non-TTY / `NO_COLOR`)
+- [x] Multi-path `scan` invocation (what the pre-commit hook needs)
+- [ ] Cross-module resolution for CH007/CH009 (currently same-file only)
 - [ ] Sync HTTP clients constructed inside async request handlers
 - [ ] `--fix` for the mechanical rules (CH002, CH003, CH004)
-- [ ] Pre-commit hook
 
 ---
 

{codehound-1.1.0 → codehound-1.3.0}/src/codehound/__init__.py

@@ -1,9 +1,9 @@
 """codehound - an AST-based static analyzer that hunts real bugs in Python code.
 
-Seven checks. Six are each backed by a bug that was actually found and
+Ten checks. Seven are each backed by a bug that was actually found and
 fixed in a popular open-source AI framework (agno, crewAI, mem0,
-llama_index, huggingface_hub). The seventh (CH007) is a hardening rule
-verified against real false positives instead - see docs/FINDINGS.md.
+llama_index, accelerate). The other three (CH007-CH009) are hardening
+rules verified against real false positives instead - see docs/FINDINGS.md.
 """
 
 from __future__ import annotations
@@ -11,7 +11,7 @@ from __future__ import annotations
 from codehound.checks import ALL_CHECKS, get_checks
 from codehound.core import Check, Finding, scan_file, scan_path
 
-__version__ = "1.1.0"
+__version__ = "1.3.0"
 
 __all__ = [
     "ALL_CHECKS",

{codehound-1.1.0 → codehound-1.3.0}/src/codehound/checks/__init__.py

@@ -2,10 +2,13 @@
 
 from __future__ import annotations
 
+from codehound.checks.asyncio_run_in_loop import AsyncioRunInRunningLoop
 from codehound.checks.blocking_async import BlockingCallInAsync
 from codehound.checks.datetime_utcnow import DeprecatedDatetimeUtcnow
 from codehound.checks.floating_task import FloatingTask
+from codehound.checks.floating_thread import FloatingThread
 from codehound.checks.get_event_loop import DeprecatedGetEventLoop
+from codehound.checks.loop_closure_capture import LoopClosureCapture
 from codehound.checks.mutable_defaults import MutableDefaultArgument
 from codehound.checks.resource_leak import UnclosedFileHandle
 from codehound.checks.unawaited_coroutine import UnawaitedCoroutineCall
@@ -19,6 +22,9 @@ ALL_CHECKS: list[type[Check]] = [
     UnclosedFileHandle,
     FloatingTask,
     UnawaitedCoroutineCall,
+    AsyncioRunInRunningLoop,
+    FloatingThread,
+    LoopClosureCapture,
 ]
 
 

codehound-1.3.0/src/codehound/checks/asyncio_run_in_loop.py

@@ -0,0 +1,62 @@
+"""CH008 - ``asyncio.run()`` called while a loop is already running.
+
+``asyncio.run()`` creates a new event loop and refuses to run if one is
+already active on the current thread - calling it from inside a coroutine
+raises ``RuntimeError: asyncio.run() cannot be called from a running event
+loop`` immediately, every time, unconditionally. Unlike most of the other
+checks here, this isn't a subtle production-only failure; it fails the
+first time the code path executes. It shows up anyway, usually from a
+function that was written and tested as a synchronous entry point, then
+got called from newly-async'd calling code without anyone changing its
+body.
+
+Scoped to the *immediate* enclosing function only, matching how the other
+checks avoid cross-function analysis: `async def outer(): def inner():
+asyncio.run(...)` does not flag, since `inner` is nested but still
+synchronous itself - whether calling it while a loop is running is
+actually safe depends on what thread it runs on, which this checker has
+no way to know.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding, enclosing_function
+
+
+class AsyncioRunInRunningLoop(Check):
+    code = "CH008"
+    name = "asyncio-run-in-running-loop"
+    description = "asyncio.run() called from inside an async function; always raises RuntimeError."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Call):
+                continue
+            func = node.func
+            if not (
+                isinstance(func, ast.Attribute)
+                and func.attr == "run"
+                and isinstance(func.value, ast.Name)
+                and func.value.id == "asyncio"
+            ):
+                continue
+            fn = enclosing_function(node, parents)
+            if not isinstance(fn, ast.AsyncFunctionDef):
+                continue
+            findings.append(
+                Finding(
+                    path=path,
+                    line=node.lineno,
+                    col=node.col_offset,
+                    code=self.code,
+                    message=(
+                        f"`asyncio.run(...)` inside async function `{fn.name}` always raises "
+                        f"RuntimeError - a loop is already running here; `await` the coroutine "
+                        f"directly instead."
+                    ),
+                )
+            )
+        return findings

codehound-1.3.0/src/codehound/checks/floating_thread.py

@@ -0,0 +1,159 @@
+"""CH009 - Non-daemon ``threading.Thread`` started without a matching ``join()``.
+
+The thread analog of CH006's floating-task: a plain ``threading.Thread``
+that gets ``.start()``ed but never joined keeps running independently of
+whoever created it. Unlike a daemon thread (an explicit, intentional
+"let this die with the process" choice), a *non*-daemon thread that's
+never joined can outlive the function that spawned it, hold the
+interpreter open past when the caller expects the program to exit, or
+race with cleanup code that assumed the work was done because the
+function that started it returned.
+
+Two shapes:
+- Chained: ``threading.Thread(target=f).start()`` - the thread object is
+  never even captured, so joining it later is structurally impossible.
+- Assigned: ``t = threading.Thread(target=f); t.start()`` - captured, but
+  no matching ``t.join()`` (and not returned, not stored as an attribute
+  of anything, not marked ``daemon=True``) before the enclosing function
+  returns.
+
+A real false positive found while building this: llama_index's chat
+engines create the thread, then do ``chat_response.write_response_to_history_thread
+= thread`` and return ``chat_response`` - the thread isn't lost, it's
+handed off through a *different* object's attribute (not ``self``), and
+gets joined later once the caller finishes consuming the stream
+(``chat_engine/types.py``). The escape check below treats a thread
+assigned as *any* object's attribute as a deliberate hand-off, not just
+``self.<attr>``.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding, enclosing_function
+
+
+def _is_thread_call(node: ast.expr) -> bool:
+    if not isinstance(node, ast.Call):
+        return False
+    func = node.func
+    if isinstance(func, ast.Name):
+        return func.id == "Thread"
+    if isinstance(func, ast.Attribute):
+        return func.attr == "Thread" and isinstance(func.value, ast.Name) and func.value.id == "threading"
+    return False
+
+
+def _has_daemon_true_kwarg(call: ast.Call) -> bool:
+    for kw in call.keywords:
+        if kw.arg == "daemon" and isinstance(kw.value, ast.Constant) and kw.value.value is True:
+            return True
+    return False
+
+
+class FloatingThread(Check):
+    code = "CH009"
+    name = "floating-thread"
+    description = "Non-daemon threading.Thread started without a matching join()."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+
+        # Chained: threading.Thread(...).start() with no assignment at all.
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Expr) or not isinstance(node.value, ast.Call):
+                continue
+            call = node.value
+            if not (isinstance(call.func, ast.Attribute) and call.func.attr == "start"):
+                continue
+            receiver = call.func.value
+            if not _is_thread_call(receiver):
+                continue
+            if _has_daemon_true_kwarg(receiver):
+                continue
+            findings.append(
+                Finding(
+                    path=path,
+                    line=node.lineno,
+                    col=node.col_offset,
+                    code=self.code,
+                    message=(
+                        "`threading.Thread(...).start()` - the thread is never captured, so it "
+                        "can never be joined; either keep a reference and join() it, or pass "
+                        "`daemon=True` if letting it outlive this scope is intentional."
+                    ),
+                )
+            )
+
+        # Assigned: t = threading.Thread(...); ... t.start() ... [no t.join()]
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Assign) or not _is_thread_call(node.value):
+                continue
+            if len(node.targets) != 1 or not isinstance(node.targets[0], ast.Name):
+                continue
+            name = node.targets[0].id
+            call = node.value
+            if _has_daemon_true_kwarg(call):
+                continue
+
+            fn = enclosing_function(node, parents)
+            if fn is None:
+                continue
+
+            started = False
+            joined = False
+            escapes = False
+            for n in ast.walk(fn):
+                if isinstance(n, ast.Call) and isinstance(n.func, ast.Attribute) and isinstance(
+                    n.func.value, ast.Name
+                ) and n.func.value.id == name:
+                    if n.func.attr == "start":
+                        started = True
+                    elif n.func.attr == "join":
+                        joined = True
+                elif isinstance(n, ast.Assign):
+                    for tgt in n.targets:
+                        if (
+                            isinstance(tgt, ast.Attribute)
+                            and tgt.attr != "daemon"
+                            and isinstance(n.value, ast.Name)
+                            and n.value.id == name
+                        ):
+                            # Stored as an attribute of *any* object (not just
+                            # self) - e.g. a response object that hands the
+                            # thread off to its own caller for later joining.
+                            # Real pattern: llama_index's chat_engine classes
+                            # stash the thread on the StreamingAgentChatResponse
+                            # they return, which joins it once the stream is
+                            # fully consumed (chat_engine/types.py).
+                            escapes = True
+                        if (
+                            isinstance(tgt, ast.Attribute)
+                            and isinstance(tgt.value, ast.Name)
+                            and tgt.value.id == name
+                            and tgt.attr == "daemon"
+                            and isinstance(n.value, ast.Constant)
+                            and n.value.value is True
+                        ):
+                            escapes = True  # daemon set post-construction
+                elif isinstance(n, ast.Return) and isinstance(n.value, ast.Name) and n.value.id == name:
+                    escapes = True
+
+            if not started or joined or escapes:
+                continue
+
+            findings.append(
+                Finding(
+                    path=path,
+                    line=node.lineno,
+                    col=node.col_offset,
+                    code=self.code,
+                    message=(
+                        f"`{name} = threading.Thread(...)` in `{fn.name}` is started but never "
+                        f"joined; it can outlive this function. Call `{name}.join()`, return it "
+                        f"to the caller, or pass `daemon=True` if that's intentional."
+                    ),
+                )
+            )
+        return findings

codehound-1.3.0/src/codehound/checks/loop_closure_capture.py

@@ -0,0 +1,123 @@
+"""CH010 - A lambda captures a ``for``-loop variable by reference, not value.
+
+Python closures capture *variables*, not their values at creation time.
+``[lambda: i for i in range(3)]`` creates three lambdas that all read the
+same cell - by the time any of them is called, the loop has finished and
+``i`` is ``2`` in all three. The fix is to bind the value as a default
+argument (``lambda i=i: i``), which evaluates ``i`` at lambda-creation
+time instead of call time.
+
+This only bites when the lambda is called *after* the loop variable has
+moved on: stored in a list and used later, returned, handed to a
+callback registry. The overwhelmingly common way a lambda appears inside
+a loop is the *opposite* of that - passed straight into a higher-order
+function that calls it immediately and returns, all within the same
+iteration (``sorted(rows, key=lambda r: r[field])``, ``filter(...)``,
+``max(..., key=...)``). That shape is completely safe: nothing outlives
+the iteration. A real false positive of exactly this kind was found
+scanning marimo's table sorter (``sorted(key=lambda row: row[sort_arg.by])``
+inside ``for sort_arg in ...``) before this check was scoped correctly.
+
+So this only fires when the lambda is directly *stored* rather than
+passed as a callback: the argument to ``.append(...)``/``.add(...)``, the
+value of an assignment (`` x = lambda: ...``, `` d[k] = lambda: ...``), or
+returned/yielded. A lambda passed as an argument to anything else -
+``sorted``, ``filter``, ``map``, a comprehension's own condition - is not
+flagged, because nothing has captured it past this iteration.
+
+Comprehensions (`` [lambda: i for i in range(3)] ``) are the one
+exception: the ``elt``/``key``/``value`` position *is* inherently the
+"produce and store" position, so no extra storage-context check is
+needed there.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding
+
+_STORAGE_METHODS = {"append", "add"}
+
+
+def _references_name_unshadowed(lam: ast.Lambda, name: str) -> bool:
+    param_names = {a.arg for a in (lam.args.posonlyargs + lam.args.args + lam.args.kwonlyargs)}
+    if lam.args.vararg:
+        param_names.add(lam.args.vararg.arg)
+    if lam.args.kwarg:
+        param_names.add(lam.args.kwarg.arg)
+    if name in param_names:
+        return False
+    for node in ast.walk(lam.body):
+        if isinstance(node, ast.Name) and node.id == name and isinstance(node.ctx, ast.Load):
+            return True
+    return False
+
+
+def _is_stored(lam: ast.Lambda, parents: dict) -> bool:
+    """True only if the lambda is directly stored somewhere that outlives
+    this loop iteration - not merely passed as a callback argument to a
+    function (sorted/filter/map/...) that consumes it on the spot."""
+    parent = parents.get(id(lam))
+    if isinstance(parent, (ast.Assign, ast.AnnAssign)):
+        return True
+    if isinstance(parent, (ast.Return, ast.Yield)):
+        return True
+    if (
+        isinstance(parent, ast.Call)
+        and isinstance(parent.func, ast.Attribute)
+        and parent.func.attr in _STORAGE_METHODS
+        and lam in parent.args
+    ):
+        return True
+    return False
+
+
+class LoopClosureCapture(Check):
+    code = "CH010"
+    name = "loop-closure-capture"
+    description = "Lambda captures a for-loop variable by reference; all instances see the final value."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+        seen: set[int] = set()
+
+        for loop in ast.walk(tree):
+            targets: list[str] = []
+            body_nodes: list[ast.AST] = []
+            require_storage = False
+            if isinstance(loop, ast.For) and isinstance(loop.target, ast.Name):
+                targets = [loop.target.id]
+                body_nodes = loop.body
+                require_storage = True
+            elif isinstance(loop, (ast.ListComp, ast.SetComp, ast.GeneratorExp, ast.DictComp)):
+                gens = [g for g in loop.generators if isinstance(g.target, ast.Name)]
+                targets = [g.target.id for g in gens]
+                body_nodes = [loop.elt] if not isinstance(loop, ast.DictComp) else [loop.key, loop.value]
+            else:
+                continue
+
+            for container in body_nodes:
+                for node in ast.walk(container):
+                    if not isinstance(node, ast.Lambda) or id(node) in seen:
+                        continue
+                    if require_storage and not _is_stored(node, parents):
+                        continue
+                    for var in targets:
+                        if _references_name_unshadowed(node, var):
+                            seen.add(id(node))
+                            findings.append(
+                                Finding(
+                                    path=path,
+                                    line=node.lineno,
+                                    col=node.col_offset,
+                                    code=self.code,
+                                    message=(
+                                        f"lambda captures loop variable `{var}` by reference; if "
+                                        f"called after the loop moves on, every instance sees the "
+                                        f"same final value. Bind it explicitly: `lambda {var}={var}: ...`."
+                                    ),
+                                )
+                            )
+                            break
+        return findings

{codehound-1.1.0 → codehound-1.3.0}/src/codehound/cli.py

@@ -9,6 +9,8 @@ import sys
 from codehound import __version__
 from codehound.checks import ALL_CHECKS, get_checks
 from codehound.core import DEFAULT_SKIP_DIRS, scan_path
+from codehound.sarif import to_sarif
+from codehound.terminal import format_findings_text, format_summary
 
 
 def _cmd_scan(args: argparse.Namespace) -> int:
@@ -21,7 +23,10 @@ def _cmd_scan(args: argparse.Namespace) -> int:
     skip = set(DEFAULT_SKIP_DIRS)
     if args.include_tests:
         skip -= {"tests", "test", "testing"}
-    findings = scan_path(args.path, checks, skip_dirs=frozenset(skip))
+    findings = []
+    for path in args.paths:
+        findings.extend(scan_path(path, checks, skip_dirs=frozenset(skip)))
+    findings.sort(key=lambda f: (f.path, f.line, f.col, f.code))
 
     if args.format == "json":
         print(json.dumps([f.as_dict() for f in findings], indent=2))
@@ -30,18 +35,12 @@ def _cmd_scan(args: argparse.Namespace) -> int:
         for f in findings:
             msg = f.message.replace('"', "'")
             print(f'{f.path},{f.line},{f.col},{f.code},"{msg}"')
+    elif args.format == "sarif":
+        print(json.dumps(to_sarif(findings, ALL_CHECKS), indent=2))
     else:  # text
-        for f in findings:
-            print(f.as_text())
-        counts: dict[str, int] = {}
-        for f in findings:
-            counts[f.code] = counts.get(f.code, 0) + 1
-        summary = ", ".join(f"{k}: {v}" for k, v in sorted(counts.items()))
-        print(
-            f"\nFound {len(findings)} issue(s)"
-            + (f" ({summary})" if summary else ""),
-            file=sys.stderr,
-        )
+        for line in format_findings_text(findings):
+            print(line)
+        print(f"\n{format_summary(findings)}", file=sys.stderr)
 
     if findings and not args.exit_zero:
         return 1
@@ -62,17 +61,22 @@ def build_parser() -> argparse.ArgumentParser:
     parser.add_argument("--version", action="version", version=f"codehound {__version__}")
     sub = parser.add_subparsers(dest="command", required=True)
 
-    scan = sub.add_parser("scan", help="scan a file or directory for issues")
-    scan.add_argument("path", help="file or directory to scan")
+    scan = sub.add_parser("scan", help="scan one or more files/directories for issues")
+    scan.add_argument(
+        "paths",
+        nargs="+",
+        metavar="path",
+        help="file(s) or director(y/ies) to scan (accepts multiple, for pre-commit)",
+    )
     scan.add_argument(
         "--select",
         help="comma-separated check codes/names to run (default: all), e.g. CH001,CH006",
     )
     scan.add_argument(
         "--format",
-        choices=["text", "json", "csv"],
+        choices=["text", "json", "csv", "sarif"],
         default="text",
-        help="output format (default: text)",
+        help="output format (default: text; sarif for GitHub Code Scanning)",
     )
     scan.add_argument(
         "--include-tests",

codehound-1.3.0/src/codehound/sarif.py

@@ -0,0 +1,67 @@
+"""SARIF 2.1.0 output, so a `codehound` run can feed GitHub's Code Scanning
+tab directly (``github/codeql-action/upload-sarif``) instead of only being
+readable as CI log text.
+
+Deliberately minimal - just the fields GitHub's ingester actually needs:
+one ``tool.driver`` with a ``rules`` array (so finding codes get a name and
+description in the UI instead of a bare code), and one ``result`` per
+finding with a single physical location. No fingerprinting, no nested
+regions, no multi-run merging - those are real SARIF features this
+doesn't need yet.
+"""
+
+from __future__ import annotations
+
+from codehound import __version__
+from codehound.core import Check, Finding
+
+SARIF_SCHEMA = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json"
+
+
+def _rule(check_cls: type[Check]) -> dict:
+    return {
+        "id": check_cls.code,
+        "name": check_cls.name,
+        "shortDescription": {"text": check_cls.description},
+        "helpUri": "https://github.com/kratos0718/codehound#the-checks",
+        "properties": {"tags": ["correctness", "codehound"]},
+    }
+
+
+def _result(finding: Finding) -> dict:
+    return {
+        "ruleId": finding.code,
+        "level": "error",
+        "message": {"text": finding.message},
+        "locations": [
+            {
+                "physicalLocation": {
+                    "artifactLocation": {"uri": finding.path.replace("\\", "/")},
+                    "region": {
+                        "startLine": max(finding.line, 1),
+                        "startColumn": max(finding.col + 1, 1),
+                    },
+                }
+            }
+        ],
+    }
+
+
+def to_sarif(findings: list[Finding], all_checks: list[type[Check]]) -> dict:
+    return {
+        "$schema": SARIF_SCHEMA,
+        "version": "2.1.0",
+        "runs": [
+            {
+                "tool": {
+                    "driver": {
+                        "name": "codehound",
+                        "informationUri": "https://github.com/kratos0718/codehound",
+                        "version": __version__,
+                        "rules": [_rule(c) for c in all_checks],
+                    }
+                },
+                "results": [_result(f) for f in findings],
+            }
+        ],
+    }

codehound-1.3.0/src/codehound/terminal.py

@@ -0,0 +1,57 @@
+"""Colored text output for a terminal, plain text everywhere else.
+
+Color only when stdout is actually a terminal, and never when ``NO_COLOR``
+is set (https://no-color.org) or ``TERM=dumb`` - the same convention ruff,
+eslint, and most modern CLI tools follow, so piping to a file or into `less`
+never ends up with raw escape codes in it.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+
+_RED = "\033[31m"
+_YELLOW = "\033[33m"
+_CYAN = "\033[36m"
+_DIM = "\033[2m"
+_BOLD = "\033[1m"
+_RESET = "\033[0m"
+
+
+def _color_enabled(stream=None) -> bool:
+    stream = stream or sys.stdout
+    if os.environ.get("NO_COLOR") is not None:
+        return False
+    if os.environ.get("TERM") == "dumb":
+        return False
+    return hasattr(stream, "isatty") and stream.isatty()
+
+
+def format_finding_text(finding, color: bool) -> str:
+    if not color:
+        return finding.as_text()
+    return (
+        f"{_CYAN}{finding.path}{_RESET}:{_DIM}{finding.line}:{finding.col}{_RESET}: "
+        f"{_RED}{_BOLD}{finding.code}{_RESET} {finding.message}"
+    )
+
+
+def format_findings_text(findings, stream=None) -> list[str]:
+    color = _color_enabled(stream)
+    return [format_finding_text(f, color) for f in findings]
+
+
+def format_summary(findings, stream=None) -> str:
+    color = _color_enabled(stream)
+    counts: dict[str, int] = {}
+    for f in findings:
+        counts[f.code] = counts.get(f.code, 0) + 1
+    summary = ", ".join(f"{k}: {v}" for k, v in sorted(counts.items()))
+    count_str = str(len(findings))
+    if color and findings:
+        count_str = f"{_YELLOW}{_BOLD}{count_str}{_RESET}"
+    line = f"Found {count_str} issue(s)"
+    if summary:
+        line += f" ({summary})"
+    return line

{codehound-1.1.0 → codehound-1.3.0}/tests/test_checks.py

@@ -280,3 +280,190 @@ def test_ch007_ignores_name_shadowed_by_parameter():
         "    ...\n"
     )
     assert _run(code, ["CH007"]) == []
+
+
+# --- CH008 asyncio-run-in-running-loop ---------------------------------------------
+
+
+def test_ch008_flags_asyncio_run_inside_async_def():
+    code = (
+        "import asyncio\n"
+        "async def f():\n"
+        "    asyncio.run(g())\n"
+    )
+    findings = _run(code, ["CH008"])
+    assert len(findings) == 1
+    assert findings[0].code == "CH008"
+
+
+def test_ch008_ignores_asyncio_run_in_sync_function():
+    code = (
+        "import asyncio\n"
+        "def main():\n"
+        "    asyncio.run(g())\n"
+    )
+    assert _run(code, ["CH008"]) == []
+
+
+def test_ch008_ignores_asyncio_run_in_nested_sync_function():
+    # inner() is itself sync; whether calling it from a running loop is
+    # safe depends on what thread it runs on, which this check can't know.
+    code = (
+        "import asyncio\n"
+        "async def outer():\n"
+        "    def inner():\n"
+        "        asyncio.run(g())\n"
+        "    inner()\n"
+    )
+    assert _run(code, ["CH008"]) == []
+
+
+# --- CH009 floating-thread ----------------------------------------------------------
+
+
+def test_ch009_flags_chained_start_with_no_reference():
+    code = (
+        "import threading\n"
+        "def f():\n"
+        "    threading.Thread(target=work).start()\n"
+    )
+    findings = _run(code, ["CH009"])
+    assert len(findings) == 1
+    assert findings[0].code == "CH009"
+
+
+def test_ch009_ignores_chained_daemon_thread():
+    code = (
+        "import threading\n"
+        "def f():\n"
+        "    threading.Thread(target=work, daemon=True).start()\n"
+    )
+    assert _run(code, ["CH009"]) == []
+
+
+def test_ch009_flags_assigned_thread_never_joined():
+    code = (
+        "import threading\n"
+        "def f():\n"
+        "    t = threading.Thread(target=work)\n"
+        "    t.start()\n"
+    )
+    findings = _run(code, ["CH009"])
+    assert len(findings) == 1
+    assert findings[0].code == "CH009"
+
+
+def test_ch009_ignores_assigned_thread_that_is_joined():
+    code = (
+        "import threading\n"
+        "def f():\n"
+        "    t = threading.Thread(target=work)\n"
+        "    t.start()\n"
+        "    t.join()\n"
+    )
+    assert _run(code, ["CH009"]) == []
+
+
+def test_ch009_ignores_thread_returned_to_caller():
+    code = (
+        "import threading\n"
+        "def f():\n"
+        "    t = threading.Thread(target=work)\n"
+        "    t.start()\n"
+        "    return t\n"
+    )
+    assert _run(code, ["CH009"]) == []
+
+
+def test_ch009_ignores_thread_handed_off_via_another_objects_attribute():
+    # Real false positive found in llama_index: the thread is stashed on a
+    # *different* object's attribute (not self), which is itself returned;
+    # that object joins the thread later once its caller finishes with it.
+    code = (
+        "import threading\n"
+        "def f():\n"
+        "    response = ChatResponse()\n"
+        "    t = threading.Thread(target=work)\n"
+        "    response.write_response_to_history_thread = t\n"
+        "    t.start()\n"
+        "    return response\n"
+    )
+    assert _run(code, ["CH009"]) == []
+
+
+def test_ch009_ignores_daemon_set_after_construction():
+    code = (
+        "import threading\n"
+        "def f():\n"
+        "    t = threading.Thread(target=work)\n"
+        "    t.daemon = True\n"
+        "    t.start()\n"
+    )
+    assert _run(code, ["CH009"]) == []
+
+
+def test_ch009_ignores_thread_never_started():
+    # Created but never run at all - not a "floating" thread, just inert.
+    code = (
+        "import threading\n"
+        "def f():\n"
+        "    t = threading.Thread(target=work)\n"
+        "    return t.name\n"
+    )
+    assert _run(code, ["CH009"]) == []
+
+
+# --- CH010 loop-closure-capture ------------------------------------------------------
+
+
+def test_ch010_flags_lambda_capturing_loop_variable_in_list():
+    code = "callbacks = []\nfor i in range(3):\n    callbacks.append(lambda: i)\n"
+    findings = _run(code, ["CH010"])
+    assert len(findings) == 1
+    assert findings[0].code == "CH010"
+
+
+def test_ch010_flags_lambda_in_list_comprehension():
+    code = "callbacks = [lambda: i for i in range(3)]\n"
+    findings = _run(code, ["CH010"])
+    assert len(findings) == 1
+
+
+def test_ch010_ignores_default_arg_capture():
+    code = "callbacks = []\nfor i in range(3):\n    callbacks.append(lambda i=i: i)\n"
+    assert _run(code, ["CH010"]) == []
+
+
+def test_ch010_ignores_lambda_not_referencing_loop_var():
+    code = "callbacks = []\nfor i in range(3):\n    callbacks.append(lambda: 42)\n"
+    assert _run(code, ["CH010"]) == []
+
+
+def test_ch010_ignores_immediately_invoked_lambda():
+    code = "results = []\nfor i in range(3):\n    results.append((lambda: i)())\n"
+    assert _run(code, ["CH010"]) == []
+
+
+def test_ch010_ignores_lambda_passed_as_sort_key():
+    # Real false positive found in marimo: sorted() calls the key function
+    # immediately, synchronously, using the loop variable's *current* value
+    # - nothing outlives the iteration, even though field is referenced.
+    code = (
+        "for sort_arg in by:\n"
+        "    rows = sorted(rows, key=lambda row: row[sort_arg.by])\n"
+    )
+    assert _run(code, ["CH010"]) == []
+
+
+def test_ch010_ignores_lambda_passed_to_filter():
+    code = "for prefix in prefixes:\n    kept = list(filter(lambda x: x.startswith(prefix), items))\n"
+    assert _run(code, ["CH010"]) == []
+
+
+def test_ch010_still_flags_lambda_appended_even_when_named_like_a_key_fn():
+    # Contrast case: same "lambda referencing loop var" shape, but this
+    # time it really is stored (appended) rather than consumed on the spot.
+    code = "keys = []\nfor field in fields:\n    keys.append(lambda row: row[field])\n"
+    findings = _run(code, ["CH010"])
+    assert len(findings) == 1
+

codehound-1.3.0/tests/test_output_formats.py

@@ -0,0 +1,74 @@
+"""Tests for the non-default output formats: SARIF and colored text.
+
+Scan results themselves are covered by test_checks.py; these tests only
+check that each format serializes a Finding correctly.
+"""
+
+from __future__ import annotations
+
+from codehound.checks import ALL_CHECKS
+from codehound.core import Finding
+from codehound.sarif import to_sarif
+from codehound.terminal import format_finding_text, format_summary
+
+
+def _sample_finding() -> Finding:
+    return Finding(path="pkg/mod.py", line=10, col=4, code="CH002", message="test message")
+
+
+def test_sarif_has_required_top_level_shape():
+    doc = to_sarif([_sample_finding()], ALL_CHECKS)
+    assert doc["version"] == "2.1.0"
+    assert "$schema" in doc
+    assert len(doc["runs"]) == 1
+    run = doc["runs"][0]
+    assert run["tool"]["driver"]["name"] == "codehound"
+
+
+def test_sarif_includes_a_rule_entry_per_check():
+    doc = to_sarif([], ALL_CHECKS)
+    rule_ids = {r["id"] for r in doc["runs"][0]["tool"]["driver"]["rules"]}
+    assert rule_ids == {c.code for c in ALL_CHECKS}
+
+
+def test_sarif_result_location_and_1_indexed_column():
+    doc = to_sarif([_sample_finding()], ALL_CHECKS)
+    result = doc["runs"][0]["results"][0]
+    assert result["ruleId"] == "CH002"
+    loc = result["locations"][0]["physicalLocation"]
+    assert loc["artifactLocation"]["uri"] == "pkg/mod.py"
+    # Finding.col is a 0-indexed ast col_offset; SARIF columns are 1-indexed.
+    assert loc["region"]["startLine"] == 10
+    assert loc["region"]["startColumn"] == 5
+
+
+def test_sarif_with_no_findings_has_empty_results():
+    doc = to_sarif([], ALL_CHECKS)
+    assert doc["runs"][0]["results"] == []
+
+
+def test_colored_text_contains_plain_text_content():
+    finding = _sample_finding()
+    colored = format_finding_text(finding, color=True)
+    plain = format_finding_text(finding, color=False)
+    assert plain == finding.as_text()
+    assert "\033[" in colored
+    assert "CH002" in colored
+    assert "test message" in colored
+    assert "pkg/mod.py" in colored
+
+
+def test_summary_reports_correct_counts():
+    findings = [
+        Finding(path="a.py", line=1, col=0, code="CH001", message="x"),
+        Finding(path="b.py", line=2, col=0, code="CH001", message="y"),
+        Finding(path="c.py", line=3, col=0, code="CH002", message="z"),
+    ]
+    summary = format_summary(findings)
+    assert "Found 3 issue(s)" in summary
+    assert "CH001: 2" in summary
+    assert "CH002: 1" in summary
+
+
+def test_summary_with_no_findings():
+    assert format_summary([]) == "Found 0 issue(s)"