codehound 1.5.0__tar.gz → 1.6.0__tar.gz

{codehound-1.5.0 → codehound-1.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: codehound
-Version: 1.5.0
+Version: 1.6.0
 Summary: An AST-based static analyzer that hunts real correctness and async-safety bugs in Python code.
 Project-URL: Homepage, https://github.com/kratos0718/codehound
 Project-URL: Issues, https://github.com/kratos0718/codehound/issues
@@ -24,7 +24,7 @@ Description-Content-Type: text/markdown
 
 <h1 align="center">codehound</h1>
 
-**An AST-based static analyzer that hunts *real* bugs in large Python codebases — twenty-two checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
+**An AST-based static analyzer that hunts *real* bugs in large Python codebases — twenty-eight checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
 
 [![CI](https://github.com/kratos0718/codehound/actions/workflows/ci.yml/badge.svg)](https://github.com/kratos0718/codehound/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/codehound.svg)](https://pypi.org/project/codehound/)
@@ -71,7 +71,7 @@ I was contributing bug fixes to large AI frameworks and noticed the same handful
 pip install codehound
 ```
 
-Zero dependencies — it's ~2,600 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
+Zero dependencies — it's ~3,200 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
 
 <details>
 <summary>From a clone instead (for development)</summary>
@@ -132,7 +132,7 @@ Uploads findings to the repo's **Security → Code Scanning** tab via SARIF, in
 ```yaml
 repos:
   - repo: https://github.com/kratos0718/codehound
-    rev: v1.5.0
+    rev: v1.6.0
     hooks:
       - id: codehound
 ```
@@ -165,10 +165,16 @@ repos:
 | **CH020** | `bare-except` | A bare `except:` (or unused `except BaseException:`) — also catches `KeyboardInterrupt`/`SystemExit`, so Ctrl-C stops working and `sys.exit()` gets silently absorbed. | hardening rule — real hits in agno, llama_index, marimo, litellm |
 | **CH021** | `removed-stdlib-module` | `import distutils` (removed 3.12) or any of the 19 PEP 594 "dead battery" modules (`cgi`, `imghdr`, `telnetlib`, `nntplib`, …, removed 3.13) — `ImportError` the moment the module loads. | hardening rule — real hit in agno (already guarded, see below) |
 | **CH022** | `removed-asyncio-coroutine-decorator` | `@asyncio.coroutine` — removed in Python 3.11 after a generator-based-coroutine bridge that predates `async def`; `AttributeError` the moment the decorator line runs. | hardening rule |
+| **CH023** | `removed-stdlib-attribute` | A specific removed function on a module that still imports fine — `time.clock()` (3.8), `platform.linux_distribution()`/`.dist()` (3.8), `cgi.escape()` (3.8), `base64.encodestring()`/`.decodestring()` (3.9). | hardening rule — real hit in scikit-learn |
+| **CH024** | `unittest-deprecated-alias` | `self.assertEquals(...)`/`self.failUnless(...)` and a dozen other legacy `unittest.TestCase` aliases — removed in Python 3.12. | hardening rule |
+| **CH025** | `is-literal-comparison` | `x is 1000` / `x is not "foo"` — `is` checks identity, not equality; relies on CPython's small-int caching / string interning, neither guaranteed. (pyflakes F632) | hardening rule — real false positive fixed in litellm's own code, see below |
+| **CH026** | `mutable-class-attribute` | `class C: items = []` mutated via `self.items.append(...)` without ever being reassigned per instance — every instance shares and mutates the *same* list. | **vllm**, **llama_index**, **optuna**, **transformers** — see below |
+| **CH027** | `unwaited-subprocess` | `subprocess.Popen(...)` never `.wait()`ed/`.communicate()`d with, and not context-managed — risks a zombie process and a full pipe buffer deadlocking the child. | hardening rule — real hit in dspy (already handled, see below) |
+| **CH028** | `floating-timer` | `threading.Timer(...)` started but never `.cancel()`ed or handed off — nothing can stop the callback from firing later, on stale context. | hardening rule — real hits in marimo, transformers |
 
 `codehound list` prints this from the source of truth.
 
-CH007-CH022 don't have found-and-merged bugs behind all of them the way
+CH007-CH028 don't have found-and-merged bugs behind all of them the way
 CH001-CH006 do - most are hardening rules for well-known Python
 correctness gotchas rather than something this project personally
 tracked down first. CH010 and CH011 are the exceptions: both found
@@ -271,6 +277,60 @@ a `try:` body whose `except` catches `ImportError` (or anything
 broader). A full corpus rescan after both fixes found zero remaining
 CH021 hits.
 
+**CH026 found four real, previously-unreported bugs on its first real
+scan.** All four are the exact same shape: a class-level mutable default
+(`items = []`) mutated in place via `self.items.append(...)` (or
+subscript assignment) with no per-instance reassignment anywhere, so
+every instance of the class shares and corrupts the *same* object. In
+vllm's `AXK1ForCausalLM`, `self.packed_modules_mapping["qkv_proj"] =
+[...]` patches a routing table shared by every instance of the model
+class. In llama_index's `ZapierToolSpec`, `self.spec_functions.append(...)`
+means a second tool-spec instance (a different API key, a different
+user) inherits every action name the first instance ever registered. In
+optuna's CLI `_Studies` command, `self._study_list_header.append(...)`
+does the same to a table-header list. In HuggingFace transformers'
+`CodeGenTokenizer`, `self.model_input_names.append("token_type_ids")`
+means constructing one tokenizer with `return_token_type_ids=True`
+silently changes what field every *other* `CodeGenTokenizer` instance in
+the same process expects, regardless of how it was configured - exactly
+the "spooky action at a distance" class of bug this project exists to
+catch. None have PRs yet: vllm and transformers both require AI-assisted
+PRs to carry an explicit disclosure, which this project's own policy
+doesn't do, so those two are documented here rather than filed.
+
+**CH028 hit the exact same name-collision problem CH018/CH022 already
+had a guard for, because that guard didn't get reused.** The very first
+corpus scan came back with ~30 hits, almost all in agno - which doesn't
+use `threading.Timer` at all. `from agno.utils.timer import Timer` is
+agno's own unrelated stopwatch class, called as `Timer()` with zero
+arguments (real `threading.Timer` requires `interval` and `function` and
+would raise `TypeError` immediately). Fixed by requiring `from threading
+import Timer` before trusting a bare `Timer(...)` call - the same guard
+already built for CH022's `coroutine` minutes earlier in the same
+session, just not applied here the first time. Also missed CH009's
+`daemon=True` escape entirely (found in weaviate-python-client's
+watchdog timer, `_timeout_timer.daemon = True`, a deliberate
+"outlive the caller" choice) - added both a constructor-kwarg and a
+post-construction-assignment check for it, matching CH009 exactly. Real
+hits remain in marimo (a non-daemon browser-opening timer, never
+cancelled) and transformers (a chained, never-captured checkpoint-retry
+timer).
+
+**CH025 and CH027 each found one real bug in the first scan, and one
+real gap in the check.** CH025 (is-literal-comparison) flagged litellm's
+`if "usage" in response_obj is not None:` - but for the wrong reason.
+`ast.Compare` puts every operand and every op from a chained comparison
+in one node; checking "is there a literal anywhere" and "is there an
+`is`/`is not` anywhere" independently, without pairing each op with its
+own adjacent operands, matched the string literal (paired with `in`)
+against the wrong op (`is not`, actually comparing `response_obj` to the
+allowed singleton `None`). Fixed by walking the chain as adjacent
+`(left, op, right)` triples. CH027 (unwaited-subprocess) flagged dspy's
+`process = subprocess.Popen(...)`, followed by `lm.process = process` -
+a real hand-off to a different object, reaped later through a separate
+`terminate_process(lm.process)` call, the same "stored as any object's
+attribute" escape CH009/CH016/CH028 already needed. Added it.
+
 **Two checks we built and did not ship.** `exception-chaining` (`except X
 as e: raise Y(...)` with no `from e`, discarding the real traceback -
 overlaps flake8-bugbear B904) worked exactly as designed, but at a scale
@@ -328,12 +388,18 @@ codehound/
     ├── removed_getargspec.py   (CH019)
     ├── bare_except.py          (CH020)
     ├── removed_stdlib_module.py (CH021)
-    └── asyncio_coroutine_decorator.py (CH022)
+    ├── asyncio_coroutine_decorator.py (CH022)
+    ├── removed_stdlib_attribute.py (CH023)
+    ├── unittest_deprecated_alias.py (CH024)
+    ├── is_literal_comparison.py (CH025)
+    ├── mutable_class_attribute.py (CH026)
+    ├── unwaited_subprocess.py  (CH027)
+    └── floating_timer.py       (CH028)
 ```
 
 Each check receives a parsed `ast` tree plus the precomputed parent map and returns `Finding`s. Adding a rule is one file + one registry line + a test. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for a full walkthrough of the engine, the parent map, and the design decisions.
 
-**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. CH016 doesn't flag a socket returned as part of a tuple/list, or passed as an argument to any call (as opposed to being the receiver of a call on itself) — real patterns found in vllm's rendezvous code. CH020 won't flag a `BaseException` handler whose bound name is actually referenced, or whose body re-raises anywhere in its own scope (not counting a nested try/except's own handler) — both real patterns found in agno. CH021 doesn't flag a relative import (`node.level != 0`) of a same-named local module, or an import already inside a `try:`/`except ImportError:` fallback — real patterns found in vllm and agno respectively. All of those guards exist because of real false positives caught while building the checks (see above and [`docs/FINDINGS.md`](docs/FINDINGS.md)). The test suite asserts both "bad code is flagged" and "correct code is not."
+**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. CH016 doesn't flag a socket returned as part of a tuple/list, or passed as an argument to any call (as opposed to being the receiver of a call on itself) — real patterns found in vllm's rendezvous code. CH020 won't flag a `BaseException` handler whose bound name is actually referenced, or whose body re-raises anywhere in its own scope (not counting a nested try/except's own handler) — both real patterns found in agno. CH021 doesn't flag a relative import (`node.level != 0`) of a same-named local module, or an import already inside a `try:`/`except ImportError:` fallback — real patterns found in vllm and agno respectively. CH025 pairs each chained comparison's op with only its own adjacent operands, rather than matching a literal and an `is`/`is not` anywhere in the same chain independently — a real pattern found in litellm. CH027 and CH028 both recognize a handle stored as *any* object's attribute as a hand-off, matching CH009/CH016's precedent — real patterns found in dspy and weaviate-python-client respectively. CH028 also only trusts a bare `Timer(...)` when `from threading import Timer` was actually seen — real hits in agno were its own unrelated stopwatch class. All of those guards exist because of real false positives caught while building the checks (see above and [`docs/FINDINGS.md`](docs/FINDINGS.md)). The test suite asserts both "bad code is flagged" and "correct code is not."
 
 ---
 
@@ -365,6 +431,9 @@ Every check has paired tests: the buggy pattern *is* flagged, and the idiomatic
       sockets, removed-in-3.9/3.10/3.11 stdlib APIs, bare `except:` — CH011-CH020
 - [x] 22 checks — removed stdlib modules (`distutils`, PEP 594 "dead
       batteries"), removed `@asyncio.coroutine` decorator — CH021-CH022
+- [x] 28 checks — removed stdlib functions, deprecated unittest aliases,
+      `is`-literal comparisons, mutable class attributes, unwaited
+      subprocesses, floating timers — CH023-CH028
 - [ ] Cross-module resolution for CH007/CH009 (currently same-file only)
 - [ ] Sync HTTP clients constructed inside async request handlers
 - [ ] `--fix` for the mechanical rules (CH002, CH003, CH004)

{codehound-1.5.0 → codehound-1.6.0}/README.md

@@ -4,7 +4,7 @@
 
 <h1 align="center">codehound</h1>
 
-**An AST-based static analyzer that hunts *real* bugs in large Python codebases — twenty-two checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
+**An AST-based static analyzer that hunts *real* bugs in large Python codebases — twenty-eight checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
 
 [![CI](https://github.com/kratos0718/codehound/actions/workflows/ci.yml/badge.svg)](https://github.com/kratos0718/codehound/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/codehound.svg)](https://pypi.org/project/codehound/)
@@ -51,7 +51,7 @@ I was contributing bug fixes to large AI frameworks and noticed the same handful
 pip install codehound
 ```
 
-Zero dependencies — it's ~2,600 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
+Zero dependencies — it's ~3,200 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
 
 <details>
 <summary>From a clone instead (for development)</summary>
@@ -112,7 +112,7 @@ Uploads findings to the repo's **Security → Code Scanning** tab via SARIF, in
 ```yaml
 repos:
   - repo: https://github.com/kratos0718/codehound
-    rev: v1.5.0
+    rev: v1.6.0
     hooks:
       - id: codehound
 ```
@@ -145,10 +145,16 @@ repos:
 | **CH020** | `bare-except` | A bare `except:` (or unused `except BaseException:`) — also catches `KeyboardInterrupt`/`SystemExit`, so Ctrl-C stops working and `sys.exit()` gets silently absorbed. | hardening rule — real hits in agno, llama_index, marimo, litellm |
 | **CH021** | `removed-stdlib-module` | `import distutils` (removed 3.12) or any of the 19 PEP 594 "dead battery" modules (`cgi`, `imghdr`, `telnetlib`, `nntplib`, …, removed 3.13) — `ImportError` the moment the module loads. | hardening rule — real hit in agno (already guarded, see below) |
 | **CH022** | `removed-asyncio-coroutine-decorator` | `@asyncio.coroutine` — removed in Python 3.11 after a generator-based-coroutine bridge that predates `async def`; `AttributeError` the moment the decorator line runs. | hardening rule |
+| **CH023** | `removed-stdlib-attribute` | A specific removed function on a module that still imports fine — `time.clock()` (3.8), `platform.linux_distribution()`/`.dist()` (3.8), `cgi.escape()` (3.8), `base64.encodestring()`/`.decodestring()` (3.9). | hardening rule — real hit in scikit-learn |
+| **CH024** | `unittest-deprecated-alias` | `self.assertEquals(...)`/`self.failUnless(...)` and a dozen other legacy `unittest.TestCase` aliases — removed in Python 3.12. | hardening rule |
+| **CH025** | `is-literal-comparison` | `x is 1000` / `x is not "foo"` — `is` checks identity, not equality; relies on CPython's small-int caching / string interning, neither guaranteed. (pyflakes F632) | hardening rule — real false positive fixed in litellm's own code, see below |
+| **CH026** | `mutable-class-attribute` | `class C: items = []` mutated via `self.items.append(...)` without ever being reassigned per instance — every instance shares and mutates the *same* list. | **vllm**, **llama_index**, **optuna**, **transformers** — see below |
+| **CH027** | `unwaited-subprocess` | `subprocess.Popen(...)` never `.wait()`ed/`.communicate()`d with, and not context-managed — risks a zombie process and a full pipe buffer deadlocking the child. | hardening rule — real hit in dspy (already handled, see below) |
+| **CH028** | `floating-timer` | `threading.Timer(...)` started but never `.cancel()`ed or handed off — nothing can stop the callback from firing later, on stale context. | hardening rule — real hits in marimo, transformers |
 
 `codehound list` prints this from the source of truth.
 
-CH007-CH022 don't have found-and-merged bugs behind all of them the way
+CH007-CH028 don't have found-and-merged bugs behind all of them the way
 CH001-CH006 do - most are hardening rules for well-known Python
 correctness gotchas rather than something this project personally
 tracked down first. CH010 and CH011 are the exceptions: both found
@@ -251,6 +257,60 @@ a `try:` body whose `except` catches `ImportError` (or anything
 broader). A full corpus rescan after both fixes found zero remaining
 CH021 hits.
 
+**CH026 found four real, previously-unreported bugs on its first real
+scan.** All four are the exact same shape: a class-level mutable default
+(`items = []`) mutated in place via `self.items.append(...)` (or
+subscript assignment) with no per-instance reassignment anywhere, so
+every instance of the class shares and corrupts the *same* object. In
+vllm's `AXK1ForCausalLM`, `self.packed_modules_mapping["qkv_proj"] =
+[...]` patches a routing table shared by every instance of the model
+class. In llama_index's `ZapierToolSpec`, `self.spec_functions.append(...)`
+means a second tool-spec instance (a different API key, a different
+user) inherits every action name the first instance ever registered. In
+optuna's CLI `_Studies` command, `self._study_list_header.append(...)`
+does the same to a table-header list. In HuggingFace transformers'
+`CodeGenTokenizer`, `self.model_input_names.append("token_type_ids")`
+means constructing one tokenizer with `return_token_type_ids=True`
+silently changes what field every *other* `CodeGenTokenizer` instance in
+the same process expects, regardless of how it was configured - exactly
+the "spooky action at a distance" class of bug this project exists to
+catch. None have PRs yet: vllm and transformers both require AI-assisted
+PRs to carry an explicit disclosure, which this project's own policy
+doesn't do, so those two are documented here rather than filed.
+
+**CH028 hit the exact same name-collision problem CH018/CH022 already
+had a guard for, because that guard didn't get reused.** The very first
+corpus scan came back with ~30 hits, almost all in agno - which doesn't
+use `threading.Timer` at all. `from agno.utils.timer import Timer` is
+agno's own unrelated stopwatch class, called as `Timer()` with zero
+arguments (real `threading.Timer` requires `interval` and `function` and
+would raise `TypeError` immediately). Fixed by requiring `from threading
+import Timer` before trusting a bare `Timer(...)` call - the same guard
+already built for CH022's `coroutine` minutes earlier in the same
+session, just not applied here the first time. Also missed CH009's
+`daemon=True` escape entirely (found in weaviate-python-client's
+watchdog timer, `_timeout_timer.daemon = True`, a deliberate
+"outlive the caller" choice) - added both a constructor-kwarg and a
+post-construction-assignment check for it, matching CH009 exactly. Real
+hits remain in marimo (a non-daemon browser-opening timer, never
+cancelled) and transformers (a chained, never-captured checkpoint-retry
+timer).
+
+**CH025 and CH027 each found one real bug in the first scan, and one
+real gap in the check.** CH025 (is-literal-comparison) flagged litellm's
+`if "usage" in response_obj is not None:` - but for the wrong reason.
+`ast.Compare` puts every operand and every op from a chained comparison
+in one node; checking "is there a literal anywhere" and "is there an
+`is`/`is not` anywhere" independently, without pairing each op with its
+own adjacent operands, matched the string literal (paired with `in`)
+against the wrong op (`is not`, actually comparing `response_obj` to the
+allowed singleton `None`). Fixed by walking the chain as adjacent
+`(left, op, right)` triples. CH027 (unwaited-subprocess) flagged dspy's
+`process = subprocess.Popen(...)`, followed by `lm.process = process` -
+a real hand-off to a different object, reaped later through a separate
+`terminate_process(lm.process)` call, the same "stored as any object's
+attribute" escape CH009/CH016/CH028 already needed. Added it.
+
 **Two checks we built and did not ship.** `exception-chaining` (`except X
 as e: raise Y(...)` with no `from e`, discarding the real traceback -
 overlaps flake8-bugbear B904) worked exactly as designed, but at a scale
@@ -308,12 +368,18 @@ codehound/
     ├── removed_getargspec.py   (CH019)
     ├── bare_except.py          (CH020)
     ├── removed_stdlib_module.py (CH021)
-    └── asyncio_coroutine_decorator.py (CH022)
+    ├── asyncio_coroutine_decorator.py (CH022)
+    ├── removed_stdlib_attribute.py (CH023)
+    ├── unittest_deprecated_alias.py (CH024)
+    ├── is_literal_comparison.py (CH025)
+    ├── mutable_class_attribute.py (CH026)
+    ├── unwaited_subprocess.py  (CH027)
+    └── floating_timer.py       (CH028)
 ```
 
 Each check receives a parsed `ast` tree plus the precomputed parent map and returns `Finding`s. Adding a rule is one file + one registry line + a test. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for a full walkthrough of the engine, the parent map, and the design decisions.
 
-**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. CH016 doesn't flag a socket returned as part of a tuple/list, or passed as an argument to any call (as opposed to being the receiver of a call on itself) — real patterns found in vllm's rendezvous code. CH020 won't flag a `BaseException` handler whose bound name is actually referenced, or whose body re-raises anywhere in its own scope (not counting a nested try/except's own handler) — both real patterns found in agno. CH021 doesn't flag a relative import (`node.level != 0`) of a same-named local module, or an import already inside a `try:`/`except ImportError:` fallback — real patterns found in vllm and agno respectively. All of those guards exist because of real false positives caught while building the checks (see above and [`docs/FINDINGS.md`](docs/FINDINGS.md)). The test suite asserts both "bad code is flagged" and "correct code is not."
+**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. CH016 doesn't flag a socket returned as part of a tuple/list, or passed as an argument to any call (as opposed to being the receiver of a call on itself) — real patterns found in vllm's rendezvous code. CH020 won't flag a `BaseException` handler whose bound name is actually referenced, or whose body re-raises anywhere in its own scope (not counting a nested try/except's own handler) — both real patterns found in agno. CH021 doesn't flag a relative import (`node.level != 0`) of a same-named local module, or an import already inside a `try:`/`except ImportError:` fallback — real patterns found in vllm and agno respectively. CH025 pairs each chained comparison's op with only its own adjacent operands, rather than matching a literal and an `is`/`is not` anywhere in the same chain independently — a real pattern found in litellm. CH027 and CH028 both recognize a handle stored as *any* object's attribute as a hand-off, matching CH009/CH016's precedent — real patterns found in dspy and weaviate-python-client respectively. CH028 also only trusts a bare `Timer(...)` when `from threading import Timer` was actually seen — real hits in agno were its own unrelated stopwatch class. All of those guards exist because of real false positives caught while building the checks (see above and [`docs/FINDINGS.md`](docs/FINDINGS.md)). The test suite asserts both "bad code is flagged" and "correct code is not."
 
 ---
 
@@ -345,6 +411,9 @@ Every check has paired tests: the buggy pattern *is* flagged, and the idiomatic
       sockets, removed-in-3.9/3.10/3.11 stdlib APIs, bare `except:` — CH011-CH020
 - [x] 22 checks — removed stdlib modules (`distutils`, PEP 594 "dead
       batteries"), removed `@asyncio.coroutine` decorator — CH021-CH022
+- [x] 28 checks — removed stdlib functions, deprecated unittest aliases,
+      `is`-literal comparisons, mutable class attributes, unwaited
+      subprocesses, floating timers — CH023-CH028
 - [ ] Cross-module resolution for CH007/CH009 (currently same-file only)
 - [ ] Sync HTTP clients constructed inside async request handlers
 - [ ] `--fix` for the mechanical rules (CH002, CH003, CH004)

{codehound-1.5.0 → codehound-1.6.0}/src/codehound/__init__.py

@@ -1,9 +1,9 @@
 """codehound - an AST-based static analyzer that hunts real bugs in Python code.
 
-Twenty-two checks. Eight are each backed by a bug that was actually found
-and fixed (or opened as a PR) in a popular open-source AI framework
+Twenty-eight checks. Eight are each backed by a bug that was actually
+found and fixed (or opened as a PR) in a popular open-source AI framework
 (agno, crewAI, mem0, llama_index, accelerate, optuna, litellm). The rest
-(CH007-CH009, CH012-CH022) are hardening rules verified against real
+(CH007-CH009, CH012-CH028) are hardening rules verified against real
 false positives across a ~29-framework validation corpus instead - see
 docs/FINDINGS.md.
 """
@@ -13,7 +13,7 @@ from __future__ import annotations
 from codehound.checks import ALL_CHECKS, get_checks
 from codehound.core import Check, Finding, scan_file, scan_path
 
-__version__ = "1.5.0"
+__version__ = "1.6.0"
 
 __all__ = [
     "ALL_CHECKS",

{codehound-1.5.0 → codehound-1.6.0}/src/codehound/checks/__init__.py

@@ -13,17 +13,23 @@ from codehound.checks.discarded_future import DiscardedFuture
 from codehound.checks.floating_process import FloatingProcess
 from codehound.checks.floating_task import FloatingTask
 from codehound.checks.floating_thread import FloatingThread
+from codehound.checks.floating_timer import FloatingTimer
 from codehound.checks.get_event_loop import DeprecatedGetEventLoop
+from codehound.checks.is_literal_comparison import IsLiteralComparison
 from codehound.checks.loop_closure_capture import LoopClosureCapture
 from codehound.checks.lru_cache_on_method import LruCacheOnMethod
+from codehound.checks.mutable_class_attribute import MutableClassAttribute
 from codehound.checks.mutable_defaults import MutableDefaultArgument
 from codehound.checks.removed_asyncio_task_methods import RemovedAsyncioTaskMethods
 from codehound.checks.removed_getargspec import RemovedGetargspec
+from codehound.checks.removed_stdlib_attribute import RemovedStdlibAttribute
 from codehound.checks.removed_stdlib_module import RemovedStdlibModule
 from codehound.checks.resource_leak import UnclosedFileHandle
 from codehound.checks.unawaited_coroutine import UnawaitedCoroutineCall
 from codehound.checks.unclosed_socket import UnclosedSocket
+from codehound.checks.unittest_deprecated_alias import UnittestDeprecatedAlias
 from codehound.checks.unprotected_lock import UnprotectedLockAcquire
+from codehound.checks.unwaited_subprocess import UnwaitedSubprocess
 from codehound.core import Check
 
 ALL_CHECKS: list[type[Check]] = [
@@ -49,6 +55,12 @@ ALL_CHECKS: list[type[Check]] = [
     BareExcept,
     RemovedStdlibModule,
     AsyncioCoroutineDecorator,
+    RemovedStdlibAttribute,
+    UnittestDeprecatedAlias,
+    IsLiteralComparison,
+    MutableClassAttribute,
+    UnwaitedSubprocess,
+    FloatingTimer,
 ]
 
 

codehound-1.6.0/src/codehound/checks/floating_timer.py

@@ -0,0 +1,169 @@
+"""CH028 - ``threading.Timer`` started without keeping a way to cancel it.
+
+A `Timer` schedules its callback to run *later*, on its own thread, once
+the interval elapses. Unlike a plain `Thread` doing work right now, the
+risk with an un-captured or un-cancelled `Timer` isn't just "outlives the
+function" - it's that nothing can stop the callback from firing after
+the context it was meant to act on is already gone: a retry timer that
+fires after the operation it would retry has already completed, a
+debounce timer that resets state on an object that was already torn
+down. `.cancel()` before that happens is the only way to prevent it; if
+nothing ever keeps a reference capable of calling it, the callback is
+guaranteed to run no matter what changes in the meantime.
+
+Same two shapes as CH009's floating-thread:
+- Chained: ``threading.Timer(30, cb).start()`` - never captured, so
+  cancelling it later is structurally impossible.
+- Assigned: ``t = threading.Timer(30, cb); t.start()`` - captured, but no
+  matching ``t.cancel()`` before the enclosing function returns, and not
+  handed off (returned, stored as any object's attribute), and not
+  marked ``daemon=True`` (a deliberate "let this outlive the caller"
+  choice, the same escape CH009 recognizes).
+
+A bare ``Timer(...)`` is only trusted to mean `threading.Timer` if the
+file actually imported it via `from threading import Timer` - the same
+name-collision guard CH018/CH022 use. A real false positive found while
+building this: agno defines its own unrelated stopwatch-style `Timer`
+class (`from agno.utils.timer import Timer`, called as `Timer()` with no
+arguments at all - `threading.Timer` requires `interval` and `function`
+and would raise `TypeError` immediately if it were really that class),
+and every one of its ~30 corpus hits was this same collision.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding, enclosing_function
+
+
+def _imports_timer_from_threading(tree: ast.AST) -> bool:
+    for node in ast.walk(tree):
+        if isinstance(node, ast.ImportFrom) and node.module == "threading":
+            if any(alias.name == "Timer" for alias in node.names):
+                return True
+    return False
+
+
+def _is_timer_call(node: ast.expr, trust_bare_name: bool) -> bool:
+    if not isinstance(node, ast.Call):
+        return False
+    func = node.func
+    if isinstance(func, ast.Attribute):
+        return func.attr == "Timer" and isinstance(func.value, ast.Name) and func.value.id == "threading"
+    if isinstance(func, ast.Name):
+        return trust_bare_name and func.id == "Timer"
+    return False
+
+
+def _has_daemon_true_kwarg(call: ast.Call) -> bool:
+    for kw in call.keywords:
+        if kw.arg == "daemon" and isinstance(kw.value, ast.Constant) and kw.value.value is True:
+            return True
+    return False
+
+
+class FloatingTimer(Check):
+    code = "CH028"
+    name = "floating-timer"
+    description = "threading.Timer started without keeping a way to cancel() it."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+        trust_bare_name = _imports_timer_from_threading(tree)
+
+        # Chained: threading.Timer(...).start() with no assignment at all.
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Expr) or not isinstance(node.value, ast.Call):
+                continue
+            call = node.value
+            if not (isinstance(call.func, ast.Attribute) and call.func.attr == "start"):
+                continue
+            receiver = call.func.value
+            if not _is_timer_call(receiver, trust_bare_name):
+                continue
+            if isinstance(receiver, ast.Call) and _has_daemon_true_kwarg(receiver):
+                continue
+            findings.append(
+                Finding(
+                    path=path,
+                    line=node.lineno,
+                    col=node.col_offset,
+                    code=self.code,
+                    message=(
+                        "`threading.Timer(...).start()` - the timer is never captured, so it can "
+                        "never be cancelled; keep a reference so it can be cancel()ed if the "
+                        "context it would act on goes away before it fires."
+                    ),
+                )
+            )
+
+        # Assigned: t = threading.Timer(...); ... t.start() ... [no t.cancel()]
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Assign) or not _is_timer_call(node.value, trust_bare_name):
+                continue
+            if len(node.targets) != 1 or not isinstance(node.targets[0], ast.Name):
+                continue
+            name = node.targets[0].id
+            if _has_daemon_true_kwarg(node.value):
+                continue
+
+            fn = enclosing_function(node, parents)
+            if fn is None:
+                continue
+
+            started = False
+            cancelled = False
+            escapes = False
+            for n in ast.walk(fn):
+                if (
+                    isinstance(n, ast.Call)
+                    and isinstance(n.func, ast.Attribute)
+                    and isinstance(n.func.value, ast.Name)
+                    and n.func.value.id == name
+                ):
+                    if n.func.attr == "start":
+                        started = True
+                    elif n.func.attr == "cancel":
+                        cancelled = True
+                elif isinstance(n, ast.Assign):
+                    for tgt in n.targets:
+                        if (
+                            isinstance(tgt, ast.Attribute)
+                            and tgt.attr != "daemon"
+                            and isinstance(n.value, ast.Name)
+                            and n.value.id == name
+                        ):
+                            # Handed off as any object's attribute - the
+                            # receiver can cancel it later.
+                            escapes = True
+                        if (
+                            isinstance(tgt, ast.Attribute)
+                            and isinstance(tgt.value, ast.Name)
+                            and tgt.value.id == name
+                            and tgt.attr == "daemon"
+                            and isinstance(n.value, ast.Constant)
+                            and n.value.value is True
+                        ):
+                            escapes = True  # daemon set post-construction
+                elif isinstance(n, ast.Return) and isinstance(n.value, ast.Name) and n.value.id == name:
+                    escapes = True
+
+            if not started or cancelled or escapes:
+                continue
+
+            findings.append(
+                Finding(
+                    path=path,
+                    line=node.lineno,
+                    col=node.col_offset,
+                    code=self.code,
+                    message=(
+                        f"`{name} = threading.Timer(...)` in `{fn.name}` is started but never "
+                        f"cancelled or handed off; nothing can stop it from firing later. Call "
+                        f"`{name}.cancel()` when it's no longer needed, return/store it so the "
+                        f"caller can, or pass `daemon=True` if that's intentional."
+                    ),
+                )
+            )
+        return findings

codehound-1.6.0/src/codehound/checks/is_literal_comparison.py

@@ -0,0 +1,80 @@
+"""CH025 - ``is``/``is not`` comparing against a str/bytes/int/float literal.
+
+`is` checks object *identity*, not equality - `x is 5` only happens to
+work because CPython caches small integers (-5 to 256) and sometimes
+interns short string literals, neither of which is a language guarantee.
+`x is 1000` can be `False` even when `x == 1000` is `True`, and whether a
+given string literal gets interned depends on the compiler and the
+string's exact contents. Code that "works" this way is one PyPy run, one
+larger number, or one differently-compiled string away from silently
+returning the wrong answer - this is pyflakes' own F632, included here
+because a bug this easy to introduce by typo (`is` for `==`) and this
+quiet when it happens to pass by accident earns a place in a tool whose
+whole premise is "subtle correctness bugs," not just style.
+
+`is None` / `is True` / `is False` / `is ...` are the actual idiomatic
+uses of `is` and are never flagged.
+
+A chained comparison (`a in b is not None`) has every operand and every
+op in one `ast.Compare` node, but they aren't a free-for-all - each op
+only applies to the two operands adjacent to it. `"usage" in response_obj
+is not None` is `("usage" in response_obj) and (response_obj is not
+None)`: the string literal is the left side of `in`, not of `is not`,
+which is actually comparing `response_obj` against the *allowed*
+singleton `None`. Real false positive found in litellm: checking "is
+there a literal anywhere in the chain" and "is there an Is/IsNot op
+anywhere in the chain" independently, without pairing each op with its
+own adjacent operands, matched this for the wrong reason. Fixed by
+walking the chain as adjacent (left, op, right) triples.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding
+
+_ALLOWED_SINGLETONS = (None, True, False, Ellipsis)
+
+
+def _is_flagged_literal(node: ast.expr) -> bool:
+    if not isinstance(node, ast.Constant):
+        return False
+    value = node.value
+    if any(value is s for s in _ALLOWED_SINGLETONS):
+        return False
+    return isinstance(value, (str, bytes, int, float, complex))
+
+
+class IsLiteralComparison(Check):
+    code = "CH025"
+    name = "is-literal-comparison"
+    description = "`is`/`is not` compares identity, not equality; use ==/!= for str/bytes/int/float literals."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Compare):
+                continue
+            operands = [node.left, *node.comparators]
+            for left, op, right in zip(operands, node.ops, operands[1:]):
+                if not isinstance(op, (ast.Is, ast.IsNot)):
+                    continue
+                if not (_is_flagged_literal(left) or _is_flagged_literal(right)):
+                    continue
+                op_text = "is not" if isinstance(op, ast.IsNot) else "is"
+                findings.append(
+                    Finding(
+                        path=path,
+                        line=node.lineno,
+                        col=node.col_offset,
+                        code=self.code,
+                        message=(
+                            f"`{op_text}` compares identity, not equality - comparing against a "
+                            f"literal here relies on CPython implementation details (small-int "
+                            f"caching, string interning) that aren't guaranteed; use "
+                            f"`{'!=' if op_text == 'is not' else '=='}` instead."
+                        ),
+                    )
+                )
+        return findings