codehound 1.7.0__tar.gz → 1.8.0__tar.gz

codehound-1.7.0/README.md → codehound-1.8.0/PKG-INFO

@@ -1,3 +1,24 @@
+Metadata-Version: 2.5
+Name: codehound
+Version: 1.8.0
+Summary: An AST-based static analyzer that hunts real correctness and async-safety bugs in Python code.
+Project-URL: Homepage, https://github.com/kratos0718/codehound
+Project-URL: Issues, https://github.com/kratos0718/codehound/issues
+Author: Abhinav Tarigoppula
+License: MIT
+License-File: LICENSE
+Keywords: ast,asyncio,bug-finder,linter,static-analysis
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.9
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == 'dev'
+Requires-Dist: tomli>=2; (python_version < '3.11') and extra == 'dev'
+Description-Content-Type: text/markdown
+
 <p align="center">
   <img src="assets/logo.png" alt="codehound" width="220">
 </p>
@@ -57,6 +78,8 @@ What actually seems to be missing elsewhere, as far as I've been able to find:
 
 And a difference in kind, not just coverage: every check here is checked against a real corpus, not just reasoned about. [`docs/FINDINGS.md`](docs/FINDINGS.md) has a running ledger of every false positive found while building each check (with the exact framework and line), and two checks that were built, measured, and **rejected outright** when the pattern turned out to be either too common to be a defensible finding (1,911 hits) or premised on something that was actually false (the first two real hits checked turned out to be correct code). I haven't found another static-analysis tool — commercial or open-source — that publishes this kind of "we built it, checked it against real code, and turned it down" ledger. Most tools that market themselves on "catches real bugs" (Greptile, Qodo, CodeRabbit) report an aggregate detection-rate benchmark, not per-rule provenance you can click through to an actual merged fix.
 
+**Closing the "toy project" gaps, honestly.** Ruff is a single, fast binary with editor integrations, a plugin-free config file, autofix, and inline suppression - table stakes for a tool people actually adopt, not just admire. `codehound` isn't going to out-perform a Rust tool by staying pure Python, but it now has the parts of that list that don't require rewriting the whole thing: a `[tool.codehound]` block in `pyproject.toml`, `# noqa`/`# noqa: CH001` inline suppression (same syntax flake8/ruff already use, so it doesn't collide with either), `--fix` for the two checks where the rewrite is genuinely unambiguous (CH017 always, CH004 only inside `async def` - guessing wrong on the rest would be worse than not fixing them), and scanning parallelized across a process pool once there's enough files to make that worth it. Measured, not claimed: a full scan of HuggingFace's `transformers` (thousands of files) went from 57 seconds to 12 - verified byte-identical against the sequential result first, not just "seems faster."
+
 ---
 
 ## Install
@@ -65,7 +88,7 @@ And a difference in kind, not just coverage: every check here is checked against
 pip install codehound
 ```
 
-Zero dependencies — it's ~3,600 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
+Zero dependencies — it's ~4,000 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
 
 <details>
 <summary>From a clone instead (for development)</summary>
@@ -91,6 +114,9 @@ codehound scan file1.py file2.py src/
 # only run specific checks
 codehound scan path/to/project --select CH001,CH006
 
+# also skip extra directories beyond the built-in defaults
+codehound scan path/to/project --exclude migrations,generated
+
 # machine-readable output for CI dashboards
 codehound scan path/to/project --format json
 codehound scan path/to/project --format csv
@@ -98,6 +124,9 @@ codehound scan path/to/project --format csv
 # GitHub Code Scanning (Security tab) can ingest this directly
 codehound scan path/to/project --format sarif > results.sarif
 
+# rewrite the fixable findings in place, then report what's left
+codehound scan path/to/project --fix
+
 # list every available check
 codehound list
 ```
@@ -108,6 +137,32 @@ codehound list
 - run: codehound scan src   # fails the build on a regression
 ```
 
+A finding you've reviewed and want to keep suppresses the same way flake8/ruff findings do - a trailing `# noqa` (everything on that line) or `# noqa: CH001` (just that code):
+
+```python
+time.sleep(1)  # noqa: CH001 - deliberate; this branch only runs at startup, before the loop exists
+```
+
+### Config file
+
+Drop defaults into `[tool.codehound]` in `pyproject.toml` so you don't have to repeat flags on every invocation - explicit CLI flags always win over these:
+
+```toml
+[tool.codehound]
+select = ["CH001", "CH006"]   # same as --select
+exclude = ["migrations"]      # extra directories to skip, merged with the built-in defaults
+paths = ["src"]                # what `codehound scan` (no path args) scans
+```
+
+Requires Python 3.11+ to load (uses the standard-library `tomllib`) - on 3.9/3.10 the config file is silently skipped and every flag still works exactly the same via the CLI, since nothing about codehound itself depends on being able to read it.
+
+### `--fix`
+
+Only two checks ship an autofix, and deliberately so - every other check either needs a judgment call (is this "leak" actually intentional?) or an import that may or may not already be in scope, and guessing wrong there is worse than just reporting the finding:
+
+- **CH017** - `collections.<ABC>` → `collections.abc.<ABC>`, a pure rename, always safe.
+- **CH004** - `asyncio.get_event_loop()` → `asyncio.get_running_loop()`, but *only* inside an `async def`. Outside one, `get_running_loop()` raises where `get_event_loop()` wouldn't, so those calls are left as detection-only.
+
 ### GitHub Action
 
 ```yaml
@@ -126,7 +181,7 @@ Uploads findings to the repo's **Security → Code Scanning** tab via SARIF, in
 ```yaml
 repos:
   - repo: https://github.com/kratos0718/codehound
-    rev: v1.7.0
+    rev: v1.8.0
     hooks:
       - id: codehound
 ```
@@ -455,9 +510,18 @@ Every check has paired tests: the buggy pattern *is* flagged, and the idiomatic
       subprocesses, floating timers — CH023-CH028
 - [x] 31 checks — `finally:` blocks that swallow exceptions, `lru_cache`
       on async functions, unclosed `multiprocessing.Pool` — CH029-CH031
+- [x] Inline `# noqa` / `# noqa: CH001` suppression
+- [x] `[tool.codehound]` project config in `pyproject.toml` (`select`,
+      `exclude`, `paths` — Python 3.11+ to load, every flag still works
+      without it on 3.9/3.10)
+- [x] `--fix` — CH017 always, CH004 only inside `async def` (CH002/CH003
+      turned out to need judgment calls or import-injection this tool
+      won't guess at, so they stay detection-only; see docs/ARCHITECTURE.md)
 - [ ] Cross-module resolution for CH007/CH009 (currently same-file only)
 - [ ] Extend CH001 to a curated denylist of sync AI/agent SDK client calls inside async functions (vector-DB clients, LLM SDKs) — the gap flake8-async's stdlib-only denylist leaves open
-- [ ] `--fix` for the mechanical rules (CH002, CH003, CH004)
+- [x] Parallelize scanning across files for large codebases — a full
+      HuggingFace transformers scan went from 57s to 12s (measured,
+      byte-identical output verified against the sequential run)
 
 ---
 

codehound-1.7.0/PKG-INFO → codehound-1.8.0/README.md

@@ -1,23 +1,3 @@
-Metadata-Version: 2.5
-Name: codehound
-Version: 1.7.0
-Summary: An AST-based static analyzer that hunts real correctness and async-safety bugs in Python code.
-Project-URL: Homepage, https://github.com/kratos0718/codehound
-Project-URL: Issues, https://github.com/kratos0718/codehound/issues
-Author: Abhinav Tarigoppula
-License: MIT
-License-File: LICENSE
-Keywords: ast,asyncio,bug-finder,linter,static-analysis
-Classifier: Development Status :: 4 - Beta
-Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Programming Language :: Python :: 3
-Classifier: Topic :: Software Development :: Quality Assurance
-Requires-Python: >=3.9
-Provides-Extra: dev
-Requires-Dist: pytest>=7; extra == 'dev'
-Description-Content-Type: text/markdown
-
 <p align="center">
   <img src="assets/logo.png" alt="codehound" width="220">
 </p>
@@ -77,6 +57,8 @@ What actually seems to be missing elsewhere, as far as I've been able to find:
 
 And a difference in kind, not just coverage: every check here is checked against a real corpus, not just reasoned about. [`docs/FINDINGS.md`](docs/FINDINGS.md) has a running ledger of every false positive found while building each check (with the exact framework and line), and two checks that were built, measured, and **rejected outright** when the pattern turned out to be either too common to be a defensible finding (1,911 hits) or premised on something that was actually false (the first two real hits checked turned out to be correct code). I haven't found another static-analysis tool — commercial or open-source — that publishes this kind of "we built it, checked it against real code, and turned it down" ledger. Most tools that market themselves on "catches real bugs" (Greptile, Qodo, CodeRabbit) report an aggregate detection-rate benchmark, not per-rule provenance you can click through to an actual merged fix.
 
+**Closing the "toy project" gaps, honestly.** Ruff is a single, fast binary with editor integrations, a plugin-free config file, autofix, and inline suppression - table stakes for a tool people actually adopt, not just admire. `codehound` isn't going to out-perform a Rust tool by staying pure Python, but it now has the parts of that list that don't require rewriting the whole thing: a `[tool.codehound]` block in `pyproject.toml`, `# noqa`/`# noqa: CH001` inline suppression (same syntax flake8/ruff already use, so it doesn't collide with either), `--fix` for the two checks where the rewrite is genuinely unambiguous (CH017 always, CH004 only inside `async def` - guessing wrong on the rest would be worse than not fixing them), and scanning parallelized across a process pool once there's enough files to make that worth it. Measured, not claimed: a full scan of HuggingFace's `transformers` (thousands of files) went from 57 seconds to 12 - verified byte-identical against the sequential result first, not just "seems faster."
+
 ---
 
 ## Install
@@ -85,7 +67,7 @@ And a difference in kind, not just coverage: every check here is checked against
 pip install codehound
 ```
 
-Zero dependencies — it's ~3,600 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
+Zero dependencies — it's ~4,000 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
 
 <details>
 <summary>From a clone instead (for development)</summary>
@@ -111,6 +93,9 @@ codehound scan file1.py file2.py src/
 # only run specific checks
 codehound scan path/to/project --select CH001,CH006
 
+# also skip extra directories beyond the built-in defaults
+codehound scan path/to/project --exclude migrations,generated
+
 # machine-readable output for CI dashboards
 codehound scan path/to/project --format json
 codehound scan path/to/project --format csv
@@ -118,6 +103,9 @@ codehound scan path/to/project --format csv
 # GitHub Code Scanning (Security tab) can ingest this directly
 codehound scan path/to/project --format sarif > results.sarif
 
+# rewrite the fixable findings in place, then report what's left
+codehound scan path/to/project --fix
+
 # list every available check
 codehound list
 ```
@@ -128,6 +116,32 @@ codehound list
 - run: codehound scan src   # fails the build on a regression
 ```
 
+A finding you've reviewed and want to keep suppresses the same way flake8/ruff findings do - a trailing `# noqa` (everything on that line) or `# noqa: CH001` (just that code):
+
+```python
+time.sleep(1)  # noqa: CH001 - deliberate; this branch only runs at startup, before the loop exists
+```
+
+### Config file
+
+Drop defaults into `[tool.codehound]` in `pyproject.toml` so you don't have to repeat flags on every invocation - explicit CLI flags always win over these:
+
+```toml
+[tool.codehound]
+select = ["CH001", "CH006"]   # same as --select
+exclude = ["migrations"]      # extra directories to skip, merged with the built-in defaults
+paths = ["src"]                # what `codehound scan` (no path args) scans
+```
+
+Requires Python 3.11+ to load (uses the standard-library `tomllib`) - on 3.9/3.10 the config file is silently skipped and every flag still works exactly the same via the CLI, since nothing about codehound itself depends on being able to read it.
+
+### `--fix`
+
+Only two checks ship an autofix, and deliberately so - every other check either needs a judgment call (is this "leak" actually intentional?) or an import that may or may not already be in scope, and guessing wrong there is worse than just reporting the finding:
+
+- **CH017** - `collections.<ABC>` → `collections.abc.<ABC>`, a pure rename, always safe.
+- **CH004** - `asyncio.get_event_loop()` → `asyncio.get_running_loop()`, but *only* inside an `async def`. Outside one, `get_running_loop()` raises where `get_event_loop()` wouldn't, so those calls are left as detection-only.
+
 ### GitHub Action
 
 ```yaml
@@ -146,7 +160,7 @@ Uploads findings to the repo's **Security → Code Scanning** tab via SARIF, in
 ```yaml
 repos:
   - repo: https://github.com/kratos0718/codehound
-    rev: v1.7.0
+    rev: v1.8.0
     hooks:
       - id: codehound
 ```
@@ -475,9 +489,18 @@ Every check has paired tests: the buggy pattern *is* flagged, and the idiomatic
       subprocesses, floating timers — CH023-CH028
 - [x] 31 checks — `finally:` blocks that swallow exceptions, `lru_cache`
       on async functions, unclosed `multiprocessing.Pool` — CH029-CH031
+- [x] Inline `# noqa` / `# noqa: CH001` suppression
+- [x] `[tool.codehound]` project config in `pyproject.toml` (`select`,
+      `exclude`, `paths` — Python 3.11+ to load, every flag still works
+      without it on 3.9/3.10)
+- [x] `--fix` — CH017 always, CH004 only inside `async def` (CH002/CH003
+      turned out to need judgment calls or import-injection this tool
+      won't guess at, so they stay detection-only; see docs/ARCHITECTURE.md)
 - [ ] Cross-module resolution for CH007/CH009 (currently same-file only)
 - [ ] Extend CH001 to a curated denylist of sync AI/agent SDK client calls inside async functions (vector-DB clients, LLM SDKs) — the gap flake8-async's stdlib-only denylist leaves open
-- [ ] `--fix` for the mechanical rules (CH002, CH003, CH004)
+- [x] Parallelize scanning across files for large codebases — a full
+      HuggingFace transformers scan went from 57s to 12s (measured,
+      byte-identical output verified against the sequential run)
 
 ---
 

{codehound-1.7.0 → codehound-1.8.0}/pyproject.toml

@@ -28,7 +28,7 @@ Issues = "https://github.com/kratos0718/codehound/issues"
 codehound = "codehound.cli:main"
 
 [project.optional-dependencies]
-dev = ["pytest>=7"]
+dev = ["pytest>=7", "tomli>=2; python_version < '3.11'"]
 
 [tool.hatch.version]
 path = "src/codehound/__init__.py"

{codehound-1.7.0 → codehound-1.8.0}/src/codehound/__init__.py

@@ -6,14 +6,20 @@ found and fixed (or opened as a PR) in a popular open-source AI framework
 (CH007-CH009, CH012-CH031) are hardening rules verified against real
 false positives across a ~29-framework validation corpus instead - see
 docs/FINDINGS.md.
+
+Also has the parts of a production-grade linter that don't require
+rewriting the whole thing in Rust: inline `# noqa` suppression,
+`[tool.codehound]` project config, `--fix` for the checks where the
+rewrite is genuinely unambiguous, and scanning parallelized across a
+process pool for large codebases.
 """
 
 from __future__ import annotations
 
 from codehound.checks import ALL_CHECKS, get_checks
-from codehound.core import Check, Finding, scan_file, scan_path
+from codehound.core import Check, Finding, scan_file, scan_files, scan_path
 
-__version__ = "1.7.0"
+__version__ = "1.8.0"
 
 __all__ = [
     "ALL_CHECKS",
@@ -21,6 +27,7 @@ __all__ = [
     "Check",
     "Finding",
     "scan_file",
+    "scan_files",
     "scan_path",
     "__version__",
 ]

codehound-1.8.0/src/codehound/cli.py

@@ -0,0 +1,169 @@
+"""Command-line interface: ``codehound scan <path>``."""
+
+from __future__ import annotations
+
+import argparse
+import ast
+import json
+import sys
+
+from codehound import __version__
+from codehound.checks import ALL_CHECKS, get_checks
+from codehound.config import load_config
+from codehound.core import DEFAULT_SKIP_DIRS, build_parents, iter_python_files, scan_files
+from codehound.fixes import fix_source
+from codehound.sarif import to_sarif
+from codehound.terminal import format_findings_text, format_summary
+
+
+def _apply_fixes(paths: list[str], skip_dirs: frozenset) -> tuple[int, int]:
+    """Rewrite every fixable finding in place. Returns ``(files_changed, edit_count)``."""
+    files_changed = 0
+    total_edits = 0
+    for root in paths:
+        for path in iter_python_files(root, skip_dirs):
+            try:
+                with open(path, encoding="utf-8") as fh:
+                    source = fh.read()
+            except (OSError, UnicodeDecodeError):
+                continue
+            try:
+                tree = ast.parse(source, filename=path)
+            except SyntaxError:
+                continue
+            parents = build_parents(tree)
+            new_source, count = fix_source(source, tree, parents)
+            if count:
+                with open(path, "w", encoding="utf-8") as fh:
+                    fh.write(new_source)
+                files_changed += 1
+                total_edits += count
+    return files_changed, total_edits
+
+
+def _cmd_scan(args: argparse.Namespace) -> int:
+    config = load_config()
+
+    select_arg = args.select or (",".join(config.select) if config.select else None)
+    selected = [s.strip() for s in select_arg.split(",")] if select_arg else None
+    checks = get_checks(selected)
+    if not checks:
+        print(f"No checks matched: {select_arg}", file=sys.stderr)
+        return 2
+
+    paths = args.paths or config.paths or ["."]
+
+    skip = set(DEFAULT_SKIP_DIRS)
+    if args.include_tests:
+        skip -= {"tests", "test", "testing"}
+    skip |= set(config.exclude)
+    if args.exclude:
+        skip |= {e.strip() for e in args.exclude.split(",") if e.strip()}
+
+    if args.fix:
+        files_changed, edit_count = _apply_fixes(paths, frozenset(skip))
+        if edit_count:
+            print(f"Fixed {edit_count} issue(s) in {files_changed} file(s).", file=sys.stderr)
+
+    all_files: list[str] = []
+    for path in paths:
+        all_files.extend(iter_python_files(path, frozenset(skip)))
+    findings = scan_files(all_files, checks)
+
+    if args.format == "json":
+        print(json.dumps([f.as_dict() for f in findings], indent=2))
+    elif args.format == "csv":
+        print("path,line,col,code,message")
+        for f in findings:
+            msg = f.message.replace('"', "'")
+            print(f'{f.path},{f.line},{f.col},{f.code},"{msg}"')
+    elif args.format == "sarif":
+        print(json.dumps(to_sarif(findings, ALL_CHECKS), indent=2))
+    else:  # text
+        for line in format_findings_text(findings):
+            print(line)
+        print(f"\n{format_summary(findings)}", file=sys.stderr)
+
+    if findings and not args.exit_zero:
+        return 1
+    return 0
+
+
+def _cmd_list(_args: argparse.Namespace) -> int:
+    for cls in ALL_CHECKS:
+        print(f"{cls.code}  {cls.name}\n      {cls.description}")
+    return 0
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="codehound",
+        description="AST-based static analyzer that hunts real bugs in Python code.",
+    )
+    parser.add_argument("--version", action="version", version=f"codehound {__version__}")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    scan = sub.add_parser("scan", help="scan one or more files/directories for issues")
+    scan.add_argument(
+        "paths",
+        nargs="*",
+        metavar="path",
+        help=(
+            "file(s) or director(y/ies) to scan (accepts multiple, for pre-commit). "
+            "Defaults to `paths` in pyproject.toml's [tool.codehound], then `.`"
+        ),
+    )
+    scan.add_argument(
+        "--select",
+        help=(
+            "comma-separated check codes/names to run (default: `select` in "
+            "pyproject.toml's [tool.codehound], else all), e.g. CH001,CH006"
+        ),
+    )
+    scan.add_argument(
+        "--exclude",
+        help=(
+            "comma-separated extra directory names to skip, merged with the "
+            "built-in defaults and pyproject.toml's [tool.codehound] `exclude`"
+        ),
+    )
+    scan.add_argument(
+        "--format",
+        choices=["text", "json", "csv", "sarif"],
+        default="text",
+        help="output format (default: text; sarif for GitHub Code Scanning)",
+    )
+    scan.add_argument(
+        "--include-tests",
+        action="store_true",
+        help="also scan tests/ directories (skipped by default)",
+    )
+    scan.add_argument(
+        "--exit-zero",
+        action="store_true",
+        help="always exit 0, even when issues are found",
+    )
+    scan.add_argument(
+        "--fix",
+        action="store_true",
+        help=(
+            "rewrite fixable findings in place before reporting (currently CH017, "
+            "and CH004 only inside async functions - see docs/ARCHITECTURE.md)"
+        ),
+    )
+    scan.set_defaults(func=_cmd_scan)
+
+    listp = sub.add_parser("list", help="list available checks")
+    listp.set_defaults(func=_cmd_list)
+
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = build_parser()
+    args = parser.parse_args(argv)
+    return args.func(args)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

codehound-1.8.0/src/codehound/config.py

@@ -0,0 +1,85 @@
+"""Project config: ``[tool.codehound]`` in ``pyproject.toml``.
+
+Loaded with the standard-library ``tomllib`` (Python 3.11+), falling back
+to the ``tomli`` backport *only if it happens to already be installed*
+(it's listed in the ``dev`` extras so the test suite can exercise config
+loading on 3.9/3.10 too) - never a required install. If neither is
+available, config loading is silently skipped rather than failing: the
+CLI still works identically with explicit flags either way, so a missing
+TOML parser never blocks a scan, it only means the config-file
+convenience isn't available on that Python. This keeps the
+zero-runtime-dependency guarantee: nothing here is ever a hard
+requirement to run `codehound scan`.
+
+Recognized keys, all optional:
+
+    [tool.codehound]
+    select = ["CH001", "CH006"]   # same as --select
+    exclude = ["migrations"]      # extra directory names to skip, merged
+                                   # with the built-in DEFAULT_SKIP_DIRS
+    paths = ["src"]               # default paths when none given on the CLI
+
+Explicit CLI flags always take precedence over the config file - the
+config only fills in what wasn't passed on the command line.
+"""
+
+from __future__ import annotations
+
+import os
+
+try:
+    import tomllib
+except ImportError:  # Python < 3.11
+    try:
+        import tomli as tomllib  # type: ignore[import-not-found,no-redef]
+    except ImportError:
+        tomllib = None  # type: ignore[assignment]
+
+
+class CodehoundConfig:
+    def __init__(
+        self,
+        select: list[str] | None = None,
+        exclude: list[str] | None = None,
+        paths: list[str] | None = None,
+    ) -> None:
+        self.select = select
+        self.exclude = exclude or []
+        self.paths = paths
+
+
+_EMPTY = CodehoundConfig()
+
+
+def load_config(start_dir: str = ".") -> CodehoundConfig:
+    """Read ``[tool.codehound]`` from ``pyproject.toml`` in ``start_dir``.
+
+    Returns an empty config (every field ``None``/``[]``) if the file
+    doesn't exist, has no ``[tool.codehound]`` table, or ``tomllib`` isn't
+    available on this Python version - never raises for any of those.
+    """
+    if tomllib is None:
+        return _EMPTY
+
+    pyproject_path = os.path.join(start_dir, "pyproject.toml")
+    if not os.path.isfile(pyproject_path):
+        return _EMPTY
+
+    try:
+        with open(pyproject_path, "rb") as fh:
+            data = tomllib.load(fh)
+    except (OSError, tomllib.TOMLDecodeError):
+        return _EMPTY
+
+    table = data.get("tool", {}).get("codehound", {})
+    if not isinstance(table, dict):
+        return _EMPTY
+
+    select = table.get("select")
+    exclude = table.get("exclude")
+    paths = table.get("paths")
+    return CodehoundConfig(
+        select=list(select) if isinstance(select, list) else None,
+        exclude=list(exclude) if isinstance(exclude, list) else None,
+        paths=list(paths) if isinstance(paths, list) else None,
+    )

{codehound-1.7.0 → codehound-1.8.0}/src/codehound/core.py

@@ -9,9 +9,16 @@ from __future__ import annotations
 
 import ast
 import os
+import re
+from concurrent.futures import ProcessPoolExecutor
 from dataclasses import dataclass
 from typing import Iterator
 
+# Below this many files, a process pool's startup cost isn't worth it -
+# sequential scanning wins on small inputs (a handful of files, which is
+# also exactly pre-commit's typical invocation shape).
+_MIN_FILES_FOR_PARALLEL = 16
+
 
 # Directories we never want to descend into. Third-party and generated code is
 # not ours to fix, and test/example dirs deliberately contain "bad" patterns.
@@ -181,6 +188,44 @@ def attr_call_parts(node: ast.AST):
     return None, attr
 
 
+# --- Inline suppression (# noqa) --------------------------------------------------
+
+_NOQA_RE = re.compile(r"#\s*noqa\b(?::\s*(?P<codes>[A-Za-z0-9_, ]+))?", re.IGNORECASE)
+
+
+def _parse_noqa_lines(source: str) -> dict[int, set[str] | None]:
+    """Map 1-indexed line number -> suppressed codes, or ``None`` for a bare
+    ``# noqa`` that suppresses every finding on that line.
+
+    Same convention flake8/ruff use: a trailing ``# noqa`` (optionally
+    ``# noqa: CH001,CH002``) on the offending physical line. This is a
+    text-level scan, not an AST one - a real ``# noqa`` inside a string
+    literal would false-suppress, but that's the same trade-off every
+    other tool using this convention already makes, and matching their
+    exact syntax means a codebase can suppress codehound and flake8/ruff
+    findings side by side on the same line.
+    """
+    suppressed: dict[int, set[str] | None] = {}
+    for lineno, line in enumerate(source.splitlines(), start=1):
+        match = _NOQA_RE.search(line)
+        if match is None:
+            continue
+        codes_text = match.group("codes")
+        if codes_text is None:
+            suppressed[lineno] = None
+        else:
+            codes = {c.strip().upper() for c in re.split(r"[,\s]+", codes_text) if c.strip()}
+            suppressed[lineno] = codes
+    return suppressed
+
+
+def _is_suppressed(finding: Finding, noqa_lines: dict[int, set[str] | None]) -> bool:
+    if finding.line not in noqa_lines:
+        return False
+    codes = noqa_lines[finding.line]
+    return codes is None or finding.code.upper() in codes
+
+
 # --- File discovery and orchestration ---------------------------------------------
 
 
@@ -210,16 +255,48 @@ def scan_file(path: str, checks: list[Check]) -> list[Finding]:
     findings: list[Finding] = []
     for check in checks:
         findings.extend(check.run(tree, parents, path))
+    noqa_lines = _parse_noqa_lines(source)
+    if noqa_lines:
+        findings = [f for f in findings if not _is_suppressed(f, noqa_lines)]
     return findings
 
 
-def scan_path(
-    root: str,
+def _scan_file_worker(args: tuple[str, list[Check]]) -> list[Finding]:
+    path, checks = args
+    return scan_file(path, checks)
+
+
+def scan_files(
+    paths: list[str],
     checks: list[Check],
-    skip_dirs: frozenset = DEFAULT_SKIP_DIRS,
+    workers: int | None = None,
 ) -> list[Finding]:
+    """Scan an already-expanded list of file paths (no directory walking),
+    in parallel across a process pool once there are enough files to make
+    that worthwhile - one call, one pool, regardless of how many separate
+    root paths a CLI invocation was given.
+    """
+    if not paths:
+        return []
+    if workers is None:
+        workers = os.cpu_count() or 1
+
     findings: list[Finding] = []
-    for path in iter_python_files(root, skip_dirs):
-        findings.extend(scan_file(path, checks))
+    if workers <= 1 or len(paths) < _MIN_FILES_FOR_PARALLEL:
+        for path in paths:
+            findings.extend(scan_file(path, checks))
+    else:
+        with ProcessPoolExecutor(max_workers=workers) as executor:
+            for result in executor.map(_scan_file_worker, [(p, checks) for p in paths]):
+                findings.extend(result)
     findings.sort(key=lambda f: (f.path, f.line, f.col, f.code))
     return findings
+
+
+def scan_path(
+    root: str,
+    checks: list[Check],
+    skip_dirs: frozenset = DEFAULT_SKIP_DIRS,
+    workers: int | None = None,
+) -> list[Finding]:
+    return scan_files(list(iter_python_files(root, skip_dirs)), checks, workers=workers)