codehound 1.6.0__tar.gz → 1.7.0__tar.gz

{codehound-1.6.0 → codehound-1.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: codehound
-Version: 1.6.0
+Version: 1.7.0
 Summary: An AST-based static analyzer that hunts real correctness and async-safety bugs in Python code.
 Project-URL: Homepage, https://github.com/kratos0718/codehound
 Project-URL: Issues, https://github.com/kratos0718/codehound/issues
@@ -24,7 +24,7 @@ Description-Content-Type: text/markdown
 
 <h1 align="center">codehound</h1>
 
-**An AST-based static analyzer that hunts *real* bugs in large Python codebases — twenty-eight checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
+**An AST-based static analyzer that hunts *real* bugs in large Python codebases — thirty-one checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
 
 [![CI](https://github.com/kratos0718/codehound/actions/workflows/ci.yml/badge.svg)](https://github.com/kratos0718/codehound/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/codehound.svg)](https://pypi.org/project/codehound/)
@@ -65,13 +65,27 @@ I was contributing bug fixes to large AI frameworks and noticed the same handful
 
 ---
 
+## How this compares
+
+Being upfront about overlap: `codehound` is not the only tool that catches some of these patterns, and pretending otherwise wouldn't survive five minutes of someone actually checking. [Ruff](https://docs.astral.sh/ruff/)'s `RUF006` already catches a discarded `asyncio.create_task()` (CH006), `flake8-async`'s `ASYNC300` predates it. Ruff's `RUF012` already catches mutable class-level defaults (CH026), `F632` catches `is`-literal comparisons (CH025), `B006`/`UP005`/`E722` cover mutable-default-arguments/deprecated-unittest-aliases/bare-except (CH002/CH024/CH020). Pylint's `W1518` (`method-cache-max-size-none`) is close to a name-for-name match for CH011's `lru_cache`-on-instance-method leak. If you already run ruff and pylint, several of `codehound`'s checks will feel familiar.
+
+What actually seems to be missing elsewhere, as far as I've been able to find:
+
+- **Floating threading/multiprocessing primitives.** `flake8-async`'s blocking-call rules (`ASYNC2xx`) and Ruff's `RUF006` cover `asyncio` specifically; I couldn't find any linter — Ruff, flake8-async, pylint, bandit — that flags a `threading.Thread`/`multiprocessing.Process`/`threading.Timer`/`multiprocessing.Pool` that's started but never joined, cancelled, or closed (CH009, CH012, CH028, CH031). This isn't a niche pattern; it's the exact same bug as the asyncio case, just one abstraction layer down, and nothing else checks for it.
+- **Unawaited coroutines.** Calling an `async def` function as a bare statement — no `await`, no scheduling — silently drops the whole call (CH007). Ruff has an [open, unresolved issue](https://github.com/astral-sh/ruff/issues/9833) asking for exactly this; as of writing, nothing ships it.
+- **Blocking calls to non-stdlib clients inside async functions.** `flake8-async`'s `ASYNC2xx` family only recognizes a fixed denylist (`requests`, `httpx`, `urllib3`, `subprocess`, `open`, `time.sleep`) — a synchronous call to a vector-DB client, an LLM SDK, or any other third-party library inside an `async def` isn't on anyone's list yet. CH001 is on that same denylist today; extending it to common AI/agent SDKs (the exact libraries the frameworks this tool is validated against actually use) is on the roadmap below.
+
+And a difference in kind, not just coverage: every check here is checked against a real corpus, not just reasoned about. [`docs/FINDINGS.md`](docs/FINDINGS.md) has a running ledger of every false positive found while building each check (with the exact framework and line), and two checks that were built, measured, and **rejected outright** when the pattern turned out to be either too common to be a defensible finding (1,911 hits) or premised on something that was actually false (the first two real hits checked turned out to be correct code). I haven't found another static-analysis tool — commercial or open-source — that publishes this kind of "we built it, checked it against real code, and turned it down" ledger. Most tools that market themselves on "catches real bugs" (Greptile, Qodo, CodeRabbit) report an aggregate detection-rate benchmark, not per-rule provenance you can click through to an actual merged fix.
+
+---
+
 ## Install
 
 ```bash
 pip install codehound
 ```
 
-Zero dependencies — it's ~3,200 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
+Zero dependencies — it's ~3,600 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
 
 <details>
 <summary>From a clone instead (for development)</summary>
@@ -132,7 +146,7 @@ Uploads findings to the repo's **Security → Code Scanning** tab via SARIF, in
 ```yaml
 repos:
   - repo: https://github.com/kratos0718/codehound
-    rev: v1.6.0
+    rev: v1.7.0
     hooks:
       - id: codehound
 ```
@@ -171,10 +185,13 @@ repos:
 | **CH026** | `mutable-class-attribute` | `class C: items = []` mutated via `self.items.append(...)` without ever being reassigned per instance — every instance shares and mutates the *same* list. | **vllm**, **llama_index**, **optuna**, **transformers** — see below |
 | **CH027** | `unwaited-subprocess` | `subprocess.Popen(...)` never `.wait()`ed/`.communicate()`d with, and not context-managed — risks a zombie process and a full pipe buffer deadlocking the child. | hardening rule — real hit in dspy (already handled, see below) |
 | **CH028** | `floating-timer` | `threading.Timer(...)` started but never `.cancel()`ed or handed off — nothing can stop the callback from firing later, on stale context. | hardening rule — real hits in marimo, transformers |
+| **CH029** | `finally-swallows-exception` | `return`/`break`/`continue` in a `finally:` block silently discards any exception from the `try:` — the caller never sees it. | hardening rule — real hits in letta |
+| **CH030** | `lru-cache-on-async-function` | `@lru_cache`/`@cache` on `async def` caches the coroutine *object*, not its result — the second call with the same arguments crashes. | hardening rule |
+| **CH031** | `unclosed-pool` | `multiprocessing.Pool()` never `.close()`d/`.terminate()`d — worker processes leak for the life of the parent. | hardening rule |
 
 `codehound list` prints this from the source of truth.
 
-CH007-CH028 don't have found-and-merged bugs behind all of them the way
+CH007-CH031 don't have found-and-merged bugs behind all of them the way
 CH001-CH006 do - most are hardening rules for well-known Python
 correctness gotchas rather than something this project personally
 tracked down first. CH010 and CH011 are the exceptions: both found
@@ -331,6 +348,25 @@ a real hand-off to a different object, reaped later through a separate
 `terminate_process(lm.process)` call, the same "stored as any object's
 attribute" escape CH009/CH016/CH028 already needed. Added it.
 
+**CH029 found a real bug in letta on day one, and its own precision gap
+right after.** The first corpus scan flagged `except Exception as e:
+result["error"] = str(e)` followed by `finally: return result` in
+letta's job-callback dispatcher - but that except deliberately never
+re-raises (the code comment says so directly: "callback failures should
+not affect job completion"), so nothing is actually pending to swallow
+by the time `finally` runs. Fixed by skipping a `try` whose `except`
+clauses never re-raise anywhere in their own scope - there's nothing
+live left to discard at that point. The same scan also turned up a
+*more serious*, still-real instance in two of letta's LLM streaming
+adapters: `except BaseException: <log, then re-raise a typed error>`
+immediately followed by `finally: if not stream_started: return` -
+except `stream_started` is unconditionally set `True` a few lines
+earlier with no other assignment anywhere in the function, so today
+that specific `return` is dead code, not a currently-live swallow. Read
+carefully rather than assumed, and not filed as a bug report since it
+isn't actually firing right now - but flagged as exactly the kind of
+fragile code a future refactor could silently turn into a real one.
+
 **Two checks we built and did not ship.** `exception-chaining` (`except X
 as e: raise Y(...)` with no `from e`, discarding the real traceback -
 overlaps flake8-bugbear B904) worked exactly as designed, but at a scale
@@ -394,12 +430,15 @@ codehound/
     ├── is_literal_comparison.py (CH025)
     ├── mutable_class_attribute.py (CH026)
     ├── unwaited_subprocess.py  (CH027)
-    └── floating_timer.py       (CH028)
+    ├── floating_timer.py       (CH028)
+    ├── finally_swallows_exception.py (CH029)
+    ├── lru_cache_on_async_function.py (CH030)
+    └── unclosed_pool.py        (CH031)
 ```
 
 Each check receives a parsed `ast` tree plus the precomputed parent map and returns `Finding`s. Adding a rule is one file + one registry line + a test. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for a full walkthrough of the engine, the parent map, and the design decisions.
 
-**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. CH016 doesn't flag a socket returned as part of a tuple/list, or passed as an argument to any call (as opposed to being the receiver of a call on itself) — real patterns found in vllm's rendezvous code. CH020 won't flag a `BaseException` handler whose bound name is actually referenced, or whose body re-raises anywhere in its own scope (not counting a nested try/except's own handler) — both real patterns found in agno. CH021 doesn't flag a relative import (`node.level != 0`) of a same-named local module, or an import already inside a `try:`/`except ImportError:` fallback — real patterns found in vllm and agno respectively. CH025 pairs each chained comparison's op with only its own adjacent operands, rather than matching a literal and an `is`/`is not` anywhere in the same chain independently — a real pattern found in litellm. CH027 and CH028 both recognize a handle stored as *any* object's attribute as a hand-off, matching CH009/CH016's precedent — real patterns found in dspy and weaviate-python-client respectively. CH028 also only trusts a bare `Timer(...)` when `from threading import Timer` was actually seen — real hits in agno were its own unrelated stopwatch class. All of those guards exist because of real false positives caught while building the checks (see above and [`docs/FINDINGS.md`](docs/FINDINGS.md)). The test suite asserts both "bad code is flagged" and "correct code is not."
+**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. CH016 doesn't flag a socket returned as part of a tuple/list, or passed as an argument to any call (as opposed to being the receiver of a call on itself) — real patterns found in vllm's rendezvous code. CH020 won't flag a `BaseException` handler whose bound name is actually referenced, or whose body re-raises anywhere in its own scope (not counting a nested try/except's own handler) — both real patterns found in agno. CH021 doesn't flag a relative import (`node.level != 0`) of a same-named local module, or an import already inside a `try:`/`except ImportError:` fallback — real patterns found in vllm and agno respectively. CH025 pairs each chained comparison's op with only its own adjacent operands, rather than matching a literal and an `is`/`is not` anywhere in the same chain independently — a real pattern found in litellm. CH027 and CH028 both recognize a handle stored as *any* object's attribute as a hand-off, matching CH009/CH016's precedent — real patterns found in dspy and weaviate-python-client respectively. CH028 also only trusts a bare `Timer(...)` when `from threading import Timer` was actually seen — real hits in agno were its own unrelated stopwatch class. CH029 skips a `try` whose `except` clauses never re-raise anywhere in their own scope — a real pattern in letta where the exception is deliberately logged and recorded, never propagated, so a `return` in `finally` isn't discarding anything live. All of those guards exist because of real false positives caught while building the checks (see above and [`docs/FINDINGS.md`](docs/FINDINGS.md)). The test suite asserts both "bad code is flagged" and "correct code is not."
 
 ---
 
@@ -434,8 +473,10 @@ Every check has paired tests: the buggy pattern *is* flagged, and the idiomatic
 - [x] 28 checks — removed stdlib functions, deprecated unittest aliases,
       `is`-literal comparisons, mutable class attributes, unwaited
       subprocesses, floating timers — CH023-CH028
+- [x] 31 checks — `finally:` blocks that swallow exceptions, `lru_cache`
+      on async functions, unclosed `multiprocessing.Pool` — CH029-CH031
 - [ ] Cross-module resolution for CH007/CH009 (currently same-file only)
-- [ ] Sync HTTP clients constructed inside async request handlers
+- [ ] Extend CH001 to a curated denylist of sync AI/agent SDK client calls inside async functions (vector-DB clients, LLM SDKs) — the gap flake8-async's stdlib-only denylist leaves open
 - [ ] `--fix` for the mechanical rules (CH002, CH003, CH004)
 
 ---

{codehound-1.6.0 → codehound-1.7.0}/README.md

@@ -4,7 +4,7 @@
 
 <h1 align="center">codehound</h1>
 
-**An AST-based static analyzer that hunts *real* bugs in large Python codebases — twenty-eight checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
+**An AST-based static analyzer that hunts *real* bugs in large Python codebases — thirty-one checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
 
 [![CI](https://github.com/kratos0718/codehound/actions/workflows/ci.yml/badge.svg)](https://github.com/kratos0718/codehound/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/codehound.svg)](https://pypi.org/project/codehound/)
@@ -45,13 +45,27 @@ I was contributing bug fixes to large AI frameworks and noticed the same handful
 
 ---
 
+## How this compares
+
+Being upfront about overlap: `codehound` is not the only tool that catches some of these patterns, and pretending otherwise wouldn't survive five minutes of someone actually checking. [Ruff](https://docs.astral.sh/ruff/)'s `RUF006` already catches a discarded `asyncio.create_task()` (CH006), `flake8-async`'s `ASYNC300` predates it. Ruff's `RUF012` already catches mutable class-level defaults (CH026), `F632` catches `is`-literal comparisons (CH025), `B006`/`UP005`/`E722` cover mutable-default-arguments/deprecated-unittest-aliases/bare-except (CH002/CH024/CH020). Pylint's `W1518` (`method-cache-max-size-none`) is close to a name-for-name match for CH011's `lru_cache`-on-instance-method leak. If you already run ruff and pylint, several of `codehound`'s checks will feel familiar.
+
+What actually seems to be missing elsewhere, as far as I've been able to find:
+
+- **Floating threading/multiprocessing primitives.** `flake8-async`'s blocking-call rules (`ASYNC2xx`) and Ruff's `RUF006` cover `asyncio` specifically; I couldn't find any linter — Ruff, flake8-async, pylint, bandit — that flags a `threading.Thread`/`multiprocessing.Process`/`threading.Timer`/`multiprocessing.Pool` that's started but never joined, cancelled, or closed (CH009, CH012, CH028, CH031). This isn't a niche pattern; it's the exact same bug as the asyncio case, just one abstraction layer down, and nothing else checks for it.
+- **Unawaited coroutines.** Calling an `async def` function as a bare statement — no `await`, no scheduling — silently drops the whole call (CH007). Ruff has an [open, unresolved issue](https://github.com/astral-sh/ruff/issues/9833) asking for exactly this; as of writing, nothing ships it.
+- **Blocking calls to non-stdlib clients inside async functions.** `flake8-async`'s `ASYNC2xx` family only recognizes a fixed denylist (`requests`, `httpx`, `urllib3`, `subprocess`, `open`, `time.sleep`) — a synchronous call to a vector-DB client, an LLM SDK, or any other third-party library inside an `async def` isn't on anyone's list yet. CH001 is on that same denylist today; extending it to common AI/agent SDKs (the exact libraries the frameworks this tool is validated against actually use) is on the roadmap below.
+
+And a difference in kind, not just coverage: every check here is checked against a real corpus, not just reasoned about. [`docs/FINDINGS.md`](docs/FINDINGS.md) has a running ledger of every false positive found while building each check (with the exact framework and line), and two checks that were built, measured, and **rejected outright** when the pattern turned out to be either too common to be a defensible finding (1,911 hits) or premised on something that was actually false (the first two real hits checked turned out to be correct code). I haven't found another static-analysis tool — commercial or open-source — that publishes this kind of "we built it, checked it against real code, and turned it down" ledger. Most tools that market themselves on "catches real bugs" (Greptile, Qodo, CodeRabbit) report an aggregate detection-rate benchmark, not per-rule provenance you can click through to an actual merged fix.
+
+---
+
 ## Install
 
 ```bash
 pip install codehound
 ```
 
-Zero dependencies — it's ~3,200 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
+Zero dependencies — it's ~3,600 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
 
 <details>
 <summary>From a clone instead (for development)</summary>
@@ -112,7 +126,7 @@ Uploads findings to the repo's **Security → Code Scanning** tab via SARIF, in
 ```yaml
 repos:
   - repo: https://github.com/kratos0718/codehound
-    rev: v1.6.0
+    rev: v1.7.0
     hooks:
       - id: codehound
 ```
@@ -151,10 +165,13 @@ repos:
 | **CH026** | `mutable-class-attribute` | `class C: items = []` mutated via `self.items.append(...)` without ever being reassigned per instance — every instance shares and mutates the *same* list. | **vllm**, **llama_index**, **optuna**, **transformers** — see below |
 | **CH027** | `unwaited-subprocess` | `subprocess.Popen(...)` never `.wait()`ed/`.communicate()`d with, and not context-managed — risks a zombie process and a full pipe buffer deadlocking the child. | hardening rule — real hit in dspy (already handled, see below) |
 | **CH028** | `floating-timer` | `threading.Timer(...)` started but never `.cancel()`ed or handed off — nothing can stop the callback from firing later, on stale context. | hardening rule — real hits in marimo, transformers |
+| **CH029** | `finally-swallows-exception` | `return`/`break`/`continue` in a `finally:` block silently discards any exception from the `try:` — the caller never sees it. | hardening rule — real hits in letta |
+| **CH030** | `lru-cache-on-async-function` | `@lru_cache`/`@cache` on `async def` caches the coroutine *object*, not its result — the second call with the same arguments crashes. | hardening rule |
+| **CH031** | `unclosed-pool` | `multiprocessing.Pool()` never `.close()`d/`.terminate()`d — worker processes leak for the life of the parent. | hardening rule |
 
 `codehound list` prints this from the source of truth.
 
-CH007-CH028 don't have found-and-merged bugs behind all of them the way
+CH007-CH031 don't have found-and-merged bugs behind all of them the way
 CH001-CH006 do - most are hardening rules for well-known Python
 correctness gotchas rather than something this project personally
 tracked down first. CH010 and CH011 are the exceptions: both found
@@ -311,6 +328,25 @@ a real hand-off to a different object, reaped later through a separate
 `terminate_process(lm.process)` call, the same "stored as any object's
 attribute" escape CH009/CH016/CH028 already needed. Added it.
 
+**CH029 found a real bug in letta on day one, and its own precision gap
+right after.** The first corpus scan flagged `except Exception as e:
+result["error"] = str(e)` followed by `finally: return result` in
+letta's job-callback dispatcher - but that except deliberately never
+re-raises (the code comment says so directly: "callback failures should
+not affect job completion"), so nothing is actually pending to swallow
+by the time `finally` runs. Fixed by skipping a `try` whose `except`
+clauses never re-raise anywhere in their own scope - there's nothing
+live left to discard at that point. The same scan also turned up a
+*more serious*, still-real instance in two of letta's LLM streaming
+adapters: `except BaseException: <log, then re-raise a typed error>`
+immediately followed by `finally: if not stream_started: return` -
+except `stream_started` is unconditionally set `True` a few lines
+earlier with no other assignment anywhere in the function, so today
+that specific `return` is dead code, not a currently-live swallow. Read
+carefully rather than assumed, and not filed as a bug report since it
+isn't actually firing right now - but flagged as exactly the kind of
+fragile code a future refactor could silently turn into a real one.
+
 **Two checks we built and did not ship.** `exception-chaining` (`except X
 as e: raise Y(...)` with no `from e`, discarding the real traceback -
 overlaps flake8-bugbear B904) worked exactly as designed, but at a scale
@@ -374,12 +410,15 @@ codehound/
     ├── is_literal_comparison.py (CH025)
     ├── mutable_class_attribute.py (CH026)
     ├── unwaited_subprocess.py  (CH027)
-    └── floating_timer.py       (CH028)
+    ├── floating_timer.py       (CH028)
+    ├── finally_swallows_exception.py (CH029)
+    ├── lru_cache_on_async_function.py (CH030)
+    └── unclosed_pool.py        (CH031)
 ```
 
 Each check receives a parsed `ast` tree plus the precomputed parent map and returns `Finding`s. Adding a rule is one file + one registry line + a test. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for a full walkthrough of the engine, the parent map, and the design decisions.
 
-**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. CH016 doesn't flag a socket returned as part of a tuple/list, or passed as an argument to any call (as opposed to being the receiver of a call on itself) — real patterns found in vllm's rendezvous code. CH020 won't flag a `BaseException` handler whose bound name is actually referenced, or whose body re-raises anywhere in its own scope (not counting a nested try/except's own handler) — both real patterns found in agno. CH021 doesn't flag a relative import (`node.level != 0`) of a same-named local module, or an import already inside a `try:`/`except ImportError:` fallback — real patterns found in vllm and agno respectively. CH025 pairs each chained comparison's op with only its own adjacent operands, rather than matching a literal and an `is`/`is not` anywhere in the same chain independently — a real pattern found in litellm. CH027 and CH028 both recognize a handle stored as *any* object's attribute as a hand-off, matching CH009/CH016's precedent — real patterns found in dspy and weaviate-python-client respectively. CH028 also only trusts a bare `Timer(...)` when `from threading import Timer` was actually seen — real hits in agno were its own unrelated stopwatch class. All of those guards exist because of real false positives caught while building the checks (see above and [`docs/FINDINGS.md`](docs/FINDINGS.md)). The test suite asserts both "bad code is flagged" and "correct code is not."
+**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. CH016 doesn't flag a socket returned as part of a tuple/list, or passed as an argument to any call (as opposed to being the receiver of a call on itself) — real patterns found in vllm's rendezvous code. CH020 won't flag a `BaseException` handler whose bound name is actually referenced, or whose body re-raises anywhere in its own scope (not counting a nested try/except's own handler) — both real patterns found in agno. CH021 doesn't flag a relative import (`node.level != 0`) of a same-named local module, or an import already inside a `try:`/`except ImportError:` fallback — real patterns found in vllm and agno respectively. CH025 pairs each chained comparison's op with only its own adjacent operands, rather than matching a literal and an `is`/`is not` anywhere in the same chain independently — a real pattern found in litellm. CH027 and CH028 both recognize a handle stored as *any* object's attribute as a hand-off, matching CH009/CH016's precedent — real patterns found in dspy and weaviate-python-client respectively. CH028 also only trusts a bare `Timer(...)` when `from threading import Timer` was actually seen — real hits in agno were its own unrelated stopwatch class. CH029 skips a `try` whose `except` clauses never re-raise anywhere in their own scope — a real pattern in letta where the exception is deliberately logged and recorded, never propagated, so a `return` in `finally` isn't discarding anything live. All of those guards exist because of real false positives caught while building the checks (see above and [`docs/FINDINGS.md`](docs/FINDINGS.md)). The test suite asserts both "bad code is flagged" and "correct code is not."
 
 ---
 
@@ -414,8 +453,10 @@ Every check has paired tests: the buggy pattern *is* flagged, and the idiomatic
 - [x] 28 checks — removed stdlib functions, deprecated unittest aliases,
       `is`-literal comparisons, mutable class attributes, unwaited
       subprocesses, floating timers — CH023-CH028
+- [x] 31 checks — `finally:` blocks that swallow exceptions, `lru_cache`
+      on async functions, unclosed `multiprocessing.Pool` — CH029-CH031
 - [ ] Cross-module resolution for CH007/CH009 (currently same-file only)
-- [ ] Sync HTTP clients constructed inside async request handlers
+- [ ] Extend CH001 to a curated denylist of sync AI/agent SDK client calls inside async functions (vector-DB clients, LLM SDKs) — the gap flake8-async's stdlib-only denylist leaves open
 - [ ] `--fix` for the mechanical rules (CH002, CH003, CH004)
 
 ---

{codehound-1.6.0 → codehound-1.7.0}/src/codehound/__init__.py

@@ -1,9 +1,9 @@
 """codehound - an AST-based static analyzer that hunts real bugs in Python code.
 
-Twenty-eight checks. Eight are each backed by a bug that was actually
+Thirty-one checks. Eight are each backed by a bug that was actually
 found and fixed (or opened as a PR) in a popular open-source AI framework
 (agno, crewAI, mem0, llama_index, accelerate, optuna, litellm). The rest
-(CH007-CH009, CH012-CH028) are hardening rules verified against real
+(CH007-CH009, CH012-CH031) are hardening rules verified against real
 false positives across a ~29-framework validation corpus instead - see
 docs/FINDINGS.md.
 """
@@ -13,7 +13,7 @@ from __future__ import annotations
 from codehound.checks import ALL_CHECKS, get_checks
 from codehound.core import Check, Finding, scan_file, scan_path
 
-__version__ = "1.6.0"
+__version__ = "1.7.0"
 
 __all__ = [
     "ALL_CHECKS",

{codehound-1.6.0 → codehound-1.7.0}/src/codehound/checks/__init__.py

@@ -10,6 +10,7 @@ from codehound.checks.blocking_async import BlockingCallInAsync
 from codehound.checks.collections_abc_import import CollectionsAbcImport
 from codehound.checks.datetime_utcnow import DeprecatedDatetimeUtcnow
 from codehound.checks.discarded_future import DiscardedFuture
+from codehound.checks.finally_swallows_exception import FinallySwallowsException
 from codehound.checks.floating_process import FloatingProcess
 from codehound.checks.floating_task import FloatingTask
 from codehound.checks.floating_thread import FloatingThread
@@ -17,6 +18,7 @@ from codehound.checks.floating_timer import FloatingTimer
 from codehound.checks.get_event_loop import DeprecatedGetEventLoop
 from codehound.checks.is_literal_comparison import IsLiteralComparison
 from codehound.checks.loop_closure_capture import LoopClosureCapture
+from codehound.checks.lru_cache_on_async_function import LruCacheOnAsyncFunction
 from codehound.checks.lru_cache_on_method import LruCacheOnMethod
 from codehound.checks.mutable_class_attribute import MutableClassAttribute
 from codehound.checks.mutable_defaults import MutableDefaultArgument
@@ -26,6 +28,7 @@ from codehound.checks.removed_stdlib_attribute import RemovedStdlibAttribute
 from codehound.checks.removed_stdlib_module import RemovedStdlibModule
 from codehound.checks.resource_leak import UnclosedFileHandle
 from codehound.checks.unawaited_coroutine import UnawaitedCoroutineCall
+from codehound.checks.unclosed_pool import UnclosedPool
 from codehound.checks.unclosed_socket import UnclosedSocket
 from codehound.checks.unittest_deprecated_alias import UnittestDeprecatedAlias
 from codehound.checks.unprotected_lock import UnprotectedLockAcquire
@@ -61,6 +64,9 @@ ALL_CHECKS: list[type[Check]] = [
     MutableClassAttribute,
     UnwaitedSubprocess,
     FloatingTimer,
+    FinallySwallowsException,
+    LruCacheOnAsyncFunction,
+    UnclosedPool,
 ]
 
 

codehound-1.7.0/src/codehound/checks/finally_swallows_exception.py

@@ -0,0 +1,146 @@
+"""CH029 - ``return``/``break``/``continue`` in a ``finally:`` block silently drops any pending exception.
+
+If the `try:` body raises, and the matching `finally:` block runs a
+`return`, or a `break`/`continue` that jumps to a loop outside the
+`finally` block itself, the exception is discarded entirely - not
+logged, not re-raised, nothing. Verified directly:
+
+    def f():
+        try:
+            raise ValueError("boom")
+        finally:
+            return 5
+
+`f()` returns `5`. The `ValueError` never happens as far as the caller
+can tell. This is documented CPython behavior, not a bug in Python
+itself, but it means an exception can vanish from a `finally:` block
+that looks like ordinary cleanup code, with nothing in the syntax
+calling out that it swallows errors - pylint's own `lost-exception`
+(W0150) exists for exactly this.
+
+A `break`/`continue` fully contained within a loop that itself lives
+inside the `finally:` block is a different, local loop and does not
+escape - only a `break`/`continue` whose target loop is *outside* the
+`finally:` block (an ancestor of the whole `try` statement) swallows
+the pending exception. Verified directly for both shapes.
+
+Not flagged when the `try` has at least one `except` clause and none of
+them ever re-raise: at that point every exception the `try` body could
+produce has already been fully handled by the time control reaches
+`finally`, so a `return`/`break`/`continue` there is just the
+function's normal exit for the already-handled path, not a swallow.
+Real pattern found in letta: `except Exception as e: result["error"] =
+str(e)` (logged, recorded, deliberately not re-raised, the docstring
+literally says "callback failures should not affect job completion")
+followed by `finally: return result` - nothing is pending to discard.
+A `try` with *no* `except` at all is unaffected by this guard, since
+nothing there could have absorbed anything.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding
+
+
+def _has_escaping_return(stmts: list[ast.stmt]) -> ast.Return | None:
+    def walk(node: ast.AST) -> ast.Return | None:
+        if isinstance(node, ast.Return):
+            return node
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.Lambda)):
+            return None
+        for child in ast.iter_child_nodes(node):
+            found = walk(child)
+            if found is not None:
+                return found
+        return None
+
+    for stmt in stmts:
+        found = walk(stmt)
+        if found is not None:
+            return found
+    return None
+
+
+def _owning_loop_is_outside_finally(node: ast.AST, try_node: ast.Try, parents: dict) -> bool:
+    cur: ast.AST | None = node
+    while cur is not None and cur is not try_node:
+        if isinstance(cur, (ast.For, ast.AsyncFor, ast.While)):
+            return False
+        cur = parents.get(id(cur))
+    return True
+
+
+def _find_escaping_break_or_continue(
+    stmts: list[ast.stmt], try_node: ast.Try, parents: dict
+) -> ast.stmt | None:
+    for stmt in stmts:
+        for node in ast.walk(stmt):
+            if isinstance(node, (ast.Break, ast.Continue)) and _owning_loop_is_outside_finally(
+                node, try_node, parents
+            ):
+                return node
+    return None
+
+
+def _has_raise_in_own_scope(handler: ast.ExceptHandler) -> bool:
+    """Any `raise` in the handler's own reachable body - not counting a
+    nested try/except's own handler, which is a different scope."""
+    found = False
+
+    def walk(node: ast.AST) -> None:
+        nonlocal found
+        if found:
+            return
+        for child in ast.iter_child_nodes(node):
+            if isinstance(child, ast.Raise):
+                found = True
+                return
+            if isinstance(child, ast.ExceptHandler):
+                continue
+            walk(child)
+
+    walk(handler)
+    return found
+
+
+def _fully_absorbs_exceptions(try_node: ast.Try) -> bool:
+    if not try_node.handlers:
+        return False
+    return all(not _has_raise_in_own_scope(h) for h in try_node.handlers)
+
+
+class FinallySwallowsException(Check):
+    code = "CH029"
+    name = "finally-swallows-exception"
+    description = "return/break/continue in a finally: block silently discards any exception from the try:."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Try) or not node.finalbody:
+                continue
+            if _fully_absorbs_exceptions(node):
+                continue
+            culprit: ast.stmt | None = _has_escaping_return(node.finalbody)
+            kind = "return"
+            if culprit is None:
+                culprit = _find_escaping_break_or_continue(node.finalbody, node, parents)
+                kind = "break" if isinstance(culprit, ast.Break) else "continue"
+            if culprit is None:
+                continue
+            findings.append(
+                Finding(
+                    path=path,
+                    line=culprit.lineno,
+                    col=culprit.col_offset,
+                    code=self.code,
+                    message=(
+                        f"`{kind}` in this `finally:` block silently discards any exception "
+                        f"raised in the `try:` body - the caller never sees it. Move the "
+                        f"{kind} out of `finally:`, or re-raise explicitly if that's intended."
+                    ),
+                )
+            )
+        return findings

codehound-1.7.0/src/codehound/checks/lru_cache_on_async_function.py

@@ -0,0 +1,74 @@
+"""CH030 - ``@lru_cache``/``@cache`` on an ``async def`` caches the coroutine object, not its result.
+
+`functools.lru_cache` has no idea what a coroutine is - it just
+memoizes whatever the decorated callable returns for a given set of
+arguments. Calling an `async def` function doesn't run its body at all;
+it just constructs a coroutine object. So `lru_cache` ends up caching
+*that object*, and returns the exact same one on every call with the
+same arguments - including the second, third, and every later one.
+Verified directly:
+
+    @lru_cache
+    async def fetch(x):
+        return x * 2
+
+    async def main():
+        await fetch(1)
+        await fetch(1)  # RuntimeError: cannot reuse already awaited coroutine
+
+The second `await` crashes immediately, every time, for any arguments
+that repeat - unlike CH011 (`lru_cache` leaking `self` on a *sync*
+instance method), this is a correctness bug on the very next call, not
+a slow memory leak, and it fires on module-level functions too, not
+just methods.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding
+
+_CACHE_DECORATOR_NAMES = {"lru_cache", "cache"}
+
+
+def _is_cache_decorator(node: ast.expr) -> bool:
+    target = node.func if isinstance(node, ast.Call) else node
+    if isinstance(target, ast.Name):
+        return target.id in _CACHE_DECORATOR_NAMES
+    if isinstance(target, ast.Attribute):
+        return target.attr in _CACHE_DECORATOR_NAMES
+    return False
+
+
+class LruCacheOnAsyncFunction(Check):
+    code = "CH030"
+    name = "lru-cache-on-async-function"
+    description = "@lru_cache/@cache on an async def caches the coroutine object, not its awaited result."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.AsyncFunctionDef):
+                continue
+            for dec in node.decorator_list:
+                if not _is_cache_decorator(dec):
+                    continue
+                findings.append(
+                    Finding(
+                        path=path,
+                        line=node.lineno,
+                        col=node.col_offset,
+                        code=self.code,
+                        message=(
+                            f"`{node.name}` is `async def` decorated with a cache that has no "
+                            f"idea what a coroutine is - it caches the coroutine *object*, not "
+                            f"its awaited result. The second call with the same arguments "
+                            f"raises `RuntimeError: cannot reuse already awaited coroutine`. "
+                            f"Cache the result inside the function body instead, or use a "
+                            f"cache designed for coroutines (e.g. `asyncache`'s `@cached`)."
+                        ),
+                    )
+                )
+                break
+        return findings

codehound-1.7.0/src/codehound/checks/unclosed_pool.py

@@ -0,0 +1,142 @@
+"""CH031 - ``multiprocessing.Pool()`` never closed or terminated.
+
+A `Pool` starts its worker processes at construction time. Until
+`.close()` (graceful, finishes queued work first) or `.terminate()`
+(immediate) is called - and normally `.join()` after `.close()` to
+reap them - those worker processes keep running, each holding its own
+copy of the parent's memory, for as long as the parent process lives.
+Same resource-leak shape as CH027's `subprocess.Popen`, CH009's
+`threading.Thread`, and CH012's `multiprocessing.Process`, just for a
+whole pool of them at once, and Python's own docs recommend the
+context-manager form specifically to avoid this.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding, enclosing_function, inside_with_statement
+
+_RELEASES = {"close", "terminate"}
+
+
+def _is_pool_call(node: ast.expr) -> bool:
+    if not isinstance(node, ast.Call):
+        return False
+    func = node.func
+    if isinstance(func, ast.Attribute):
+        return func.attr == "Pool" and isinstance(func.value, ast.Name) and func.value.id in (
+            "multiprocessing",
+            "mp",
+        )
+    if isinstance(func, ast.Name):
+        return func.id == "Pool"
+    return False
+
+
+def _name_targets(target: ast.expr) -> list[str]:
+    if isinstance(target, ast.Name):
+        return [target.id]
+    if isinstance(target, (ast.Tuple, ast.List)):
+        out: list[str] = []
+        for elt in target.elts:
+            out.extend(_name_targets(elt))
+        return out
+    return []
+
+
+def _return_targets(value: ast.expr | None) -> list[str]:
+    if value is None:
+        return []
+    if isinstance(value, ast.Name):
+        return [value.id]
+    if isinstance(value, (ast.Tuple, ast.List)):
+        out: list[str] = []
+        for elt in value.elts:
+            out.extend(_return_targets(elt))
+        return out
+    return []
+
+
+def _has_release_call(scope: ast.AST, name: str) -> bool:
+    for node in ast.walk(scope):
+        if (
+            isinstance(node, ast.Call)
+            and isinstance(node.func, ast.Attribute)
+            and node.func.attr in _RELEASES
+            and isinstance(node.func.value, ast.Name)
+            and node.func.value.id == name
+        ):
+            return True
+    return False
+
+
+def _is_passed_as_argument(scope: ast.AST, name: str) -> bool:
+    for node in ast.walk(scope):
+        if not isinstance(node, ast.Call):
+            continue
+        for arg in node.args:
+            if isinstance(arg, ast.Name) and arg.id == name:
+                return True
+        for kw in node.keywords:
+            if isinstance(kw.value, ast.Name) and kw.value.id == name:
+                return True
+    return False
+
+
+def _is_stored_as_attribute(scope: ast.AST, name: str) -> bool:
+    for node in ast.walk(scope):
+        if not isinstance(node, ast.Assign):
+            continue
+        if isinstance(node.value, ast.Name) and node.value.id == name:
+            if any(isinstance(tgt, ast.Attribute) for tgt in node.targets):
+                return True
+    return False
+
+
+class UnclosedPool(Check):
+    code = "CH031"
+    name = "unclosed-pool"
+    description = "multiprocessing.Pool() never closed or terminated; worker processes leak."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Assign) or not _is_pool_call(node.value):
+                continue
+            if inside_with_statement(node, parents):
+                continue
+            names: list[str] = []
+            for tgt in node.targets:
+                names.extend(_name_targets(tgt))
+            if not names:
+                continue
+            fn = enclosing_function(node, parents)
+            if fn is None:
+                continue
+            returned_names = {
+                n for r in ast.walk(fn) if isinstance(r, ast.Return) for n in _return_targets(r.value)
+            }
+            for name in names:
+                if (
+                    name in returned_names
+                    or _has_release_call(fn, name)
+                    or _is_passed_as_argument(fn, name)
+                    or _is_stored_as_attribute(fn, name)
+                ):
+                    continue
+                findings.append(
+                    Finding(
+                        path=path,
+                        line=node.lineno,
+                        col=node.col_offset,
+                        code=self.code,
+                        message=(
+                            f"`{name} = multiprocessing.Pool(...)` in `{fn.name}` is never "
+                            f"closed or terminated; its worker processes keep running for the "
+                            f"life of the parent. Call `{name}.close()`/`.join()` (or "
+                            f"`.terminate()`), or use `with multiprocessing.Pool(...) as {name}:`."
+                        ),
+                    )
+                )
+        return findings

{codehound-1.6.0 → codehound-1.7.0}/tests/test_checks.py

@@ -1474,3 +1474,236 @@ def test_ch028_ignores_daemon_set_post_construction():
     )
     assert _run(code, ["CH028"]) == []
 
+
+# --- CH029 finally-swallows-exception --------------------------------------------------
+
+
+def test_ch029_flags_return_in_finally():
+    code = "def f():\n    try:\n        raise ValueError()\n    finally:\n        return 5\n"
+    findings = _run(code, ["CH029"])
+    assert len(findings) == 1
+    assert findings[0].code == "CH029"
+
+
+def test_ch029_flags_break_escaping_finally():
+    code = (
+        "def f():\n"
+        "    for i in range(3):\n"
+        "        try:\n"
+        "            raise ValueError()\n"
+        "        finally:\n"
+        "            break\n"
+    )
+    findings = _run(code, ["CH029"])
+    assert len(findings) == 1
+
+
+def test_ch029_flags_continue_escaping_finally():
+    code = (
+        "def f():\n"
+        "    for i in range(3):\n"
+        "        try:\n"
+        "            raise ValueError()\n"
+        "        finally:\n"
+        "            continue\n"
+    )
+    findings = _run(code, ["CH029"])
+    assert len(findings) == 1
+
+
+def test_ch029_ignores_break_local_to_a_loop_inside_finally():
+    # A break inside a loop that itself lives entirely within the
+    # finally block is local to that loop and does not escape - the
+    # pending exception still propagates correctly.
+    code = (
+        "def f():\n"
+        "    try:\n"
+        "        raise ValueError()\n"
+        "    finally:\n"
+        "        for i in range(1):\n"
+        "            break\n"
+    )
+    assert _run(code, ["CH029"]) == []
+
+
+def test_ch029_ignores_normal_finally_cleanup():
+    code = (
+        "def f():\n"
+        "    try:\n"
+        "        risky()\n"
+        "    finally:\n"
+        "        cleanup()\n"
+    )
+    assert _run(code, ["CH029"]) == []
+
+
+def test_ch029_ignores_return_in_try_body():
+    code = "def f():\n    try:\n        return 1\n    finally:\n        cleanup()\n"
+    assert _run(code, ["CH029"]) == []
+
+
+def test_ch029_ignores_return_in_nested_function_inside_finally():
+    code = (
+        "def f():\n"
+        "    try:\n"
+        "        raise ValueError()\n"
+        "    finally:\n"
+        "        def helper():\n"
+        "            return 1\n"
+        "        helper()\n"
+    )
+    assert _run(code, ["CH029"]) == []
+
+
+def test_ch029_ignores_return_when_except_fully_absorbs_and_never_reraises():
+    # Real pattern found in letta: except Exception logs and records the
+    # error into a result dict, deliberately never re-raises (docstring:
+    # "callback failures should not affect job completion") - by the
+    # time finally runs, nothing is pending to swallow.
+    code = (
+        "def f():\n"
+        "    result = {}\n"
+        "    try:\n"
+        "        risky()\n"
+        "    except Exception as e:\n"
+        "        result['error'] = str(e)\n"
+        "    finally:\n"
+        "        return result\n"
+    )
+    assert _run(code, ["CH029"]) == []
+
+
+def test_ch029_still_flags_return_when_except_reraises():
+    # Real pattern found in letta: the except handler logs, then
+    # re-raises (or raises a wrapped error) - the finally's return still
+    # discards that live, in-flight exception.
+    code = (
+        "def f():\n"
+        "    try:\n"
+        "        risky()\n"
+        "    except Exception as e:\n"
+        "        log(e)\n"
+        "        raise\n"
+        "    finally:\n"
+        "        return None\n"
+    )
+    findings = _run(code, ["CH029"])
+    assert len(findings) == 1
+
+
+def test_ch029_still_flags_return_when_no_except_at_all():
+    code = "def f():\n    try:\n        raise ValueError()\n    finally:\n        return 5\n"
+    findings = _run(code, ["CH029"])
+    assert len(findings) == 1
+
+
+def test_ch029_still_flags_when_one_of_several_handlers_reraises():
+    code = (
+        "def f():\n"
+        "    try:\n"
+        "        risky()\n"
+        "    except ValueError:\n"
+        "        pass\n"
+        "    except TypeError:\n"
+        "        raise\n"
+        "    finally:\n"
+        "        return None\n"
+    )
+    findings = _run(code, ["CH029"])
+    assert len(findings) == 1
+
+
+# --- CH030 lru-cache-on-async-function --------------------------------------------------
+
+
+def test_ch030_flags_lru_cache_on_module_level_async_function():
+    code = "from functools import lru_cache\n@lru_cache\nasync def fetch(x):\n    return x\n"
+    findings = _run(code, ["CH030"])
+    assert len(findings) == 1
+    assert findings[0].code == "CH030"
+
+
+def test_ch030_flags_cache_decorator_call_form_on_async_method():
+    code = (
+        "import functools\n"
+        "class C:\n"
+        "    @functools.lru_cache(maxsize=128)\n"
+        "    async def fetch(self, x):\n"
+        "        return x\n"
+    )
+    findings = _run(code, ["CH030"])
+    assert len(findings) == 1
+
+
+def test_ch030_ignores_lru_cache_on_sync_function():
+    code = "from functools import lru_cache\n@lru_cache\ndef compute(x):\n    return x\n"
+    assert _run(code, ["CH030"]) == []
+
+
+def test_ch030_ignores_uncached_async_function():
+    code = "async def fetch(x):\n    return x\n"
+    assert _run(code, ["CH030"]) == []
+
+
+# --- CH031 unclosed-pool -----------------------------------------------------------------
+
+
+def test_ch031_flags_pool_never_closed():
+    code = (
+        "import multiprocessing\n"
+        "def run():\n"
+        "    pool = multiprocessing.Pool(4)\n"
+        "    pool.map(f, items)\n"
+    )
+    findings = _run(code, ["CH031"])
+    assert len(findings) == 1
+    assert findings[0].code == "CH031"
+
+
+def test_ch031_ignores_pool_with_context_manager():
+    code = (
+        "import multiprocessing\n"
+        "def run():\n"
+        "    with multiprocessing.Pool(4) as pool:\n"
+        "        pool.map(f, items)\n"
+    )
+    assert _run(code, ["CH031"]) == []
+
+
+def test_ch031_ignores_pool_with_close_call():
+    code = (
+        "import multiprocessing\n"
+        "def run():\n"
+        "    pool = multiprocessing.Pool(4)\n"
+        "    pool.map(f, items)\n"
+        "    pool.close()\n"
+        "    pool.join()\n"
+    )
+    assert _run(code, ["CH031"]) == []
+
+
+def test_ch031_ignores_pool_with_terminate_call():
+    code = (
+        "import multiprocessing\n"
+        "def run():\n"
+        "    pool = multiprocessing.Pool(4)\n"
+        "    pool.map(f, items)\n"
+        "    pool.terminate()\n"
+    )
+    assert _run(code, ["CH031"]) == []
+
+
+def test_ch031_ignores_pool_returned_to_caller():
+    code = "import multiprocessing\ndef run():\n    pool = multiprocessing.Pool(4)\n    return pool\n"
+    assert _run(code, ["CH031"]) == []
+
+
+def test_ch031_ignores_pool_stored_as_attribute():
+    code = (
+        "import multiprocessing\n"
+        "def run(obj):\n"
+        "    pool = multiprocessing.Pool(4)\n"
+        "    obj.pool = pool\n"
+    )
+    assert _run(code, ["CH031"]) == []
+