codehound 1.7.0__tar.gz → 1.9.0__tar.gz

{codehound-1.7.0 → codehound-1.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: codehound
-Version: 1.7.0
+Version: 1.9.0
 Summary: An AST-based static analyzer that hunts real correctness and async-safety bugs in Python code.
 Project-URL: Homepage, https://github.com/kratos0718/codehound
 Project-URL: Issues, https://github.com/kratos0718/codehound/issues
@@ -16,6 +16,7 @@ Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: >=3.9
 Provides-Extra: dev
 Requires-Dist: pytest>=7; extra == 'dev'
+Requires-Dist: tomli>=2; (python_version < '3.11') and extra == 'dev'
 Description-Content-Type: text/markdown
 
 <p align="center">
@@ -24,7 +25,7 @@ Description-Content-Type: text/markdown
 
 <h1 align="center">codehound</h1>
 
-**An AST-based static analyzer that hunts *real* bugs in large Python codebases — thirty-one checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
+**An AST-based static analyzer that hunts *real* bugs in large Python codebases — thirty-three checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
 
 [![CI](https://github.com/kratos0718/codehound/actions/workflows/ci.yml/badge.svg)](https://github.com/kratos0718/codehound/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/codehound.svg)](https://pypi.org/project/codehound/)
@@ -67,7 +68,13 @@ I was contributing bug fixes to large AI frameworks and noticed the same handful
 
 ## How this compares
 
-Being upfront about overlap: `codehound` is not the only tool that catches some of these patterns, and pretending otherwise wouldn't survive five minutes of someone actually checking. [Ruff](https://docs.astral.sh/ruff/)'s `RUF006` already catches a discarded `asyncio.create_task()` (CH006), `flake8-async`'s `ASYNC300` predates it. Ruff's `RUF012` already catches mutable class-level defaults (CH026), `F632` catches `is`-literal comparisons (CH025), `B006`/`UP005`/`E722` cover mutable-default-arguments/deprecated-unittest-aliases/bare-except (CH002/CH024/CH020). Pylint's `W1518` (`method-cache-max-size-none`) is close to a name-for-name match for CH011's `lru_cache`-on-instance-method leak. If you already run ruff and pylint, several of `codehound`'s checks will feel familiar.
+Being upfront about overlap: `codehound` is not the only tool that catches some of these patterns, and pretending otherwise wouldn't survive five minutes of someone actually checking. [Ruff](https://docs.astral.sh/ruff/)'s `RUF006` already catches a discarded `asyncio.create_task()` (CH006), `flake8-async`'s `ASYNC300` predates it. Ruff's `RUF012` already catches mutable class-level defaults (CH026), `F632` catches `is`-literal comparisons (CH025), `B006`/`UP005`/`E722` cover mutable-default-arguments/deprecated-unittest-aliases/bare-except (CH002/CH024/CH020). Pylint's `W1518` (`method-cache-max-size-none`) is close to a name-for-name match for CH011's `lru_cache`-on-instance-method leak. flake8-bugbear's `B012` also overlaps with CH029 (`return`/`break`/`continue` in `finally:`), though CH029 is narrower — bugbear also flags a bare `continue` inside a `finally:` loop body, which this project hasn't verified has the same swallowed-exception risk in every case. If you already run ruff and pylint, several of `codehound`'s checks will feel familiar.
+
+Three checks are explicit adaptations of a flake8-bugbear idea, kept deliberately narrower than the source rule after checking where the broader version's false-positive risk actually lands:
+
+- **CH010** extends to cover a nested `def` capturing a loop variable, the same shape bugbear's `B023` covers alongside its lambda case — the same storage-based precision guard (only fires if the function is actually stored past the iteration) applies to both.
+- **CH032** takes bugbear's `B008` idea — "a call as a default argument is suspicious" — and narrows it to a curated list of ten functions (`time.time`, `datetime.now`, `random.random`, `uuid.uuid4`, …) whose result is *never* sensibly the same across calls. B008 as written also flags `def f(x=some_factory()):`, which is frequently a deliberate compute-once memoization; that ambiguity is exactly why this project didn't just port the broader rule.
+- **CH033** takes `B005`'s "`.strip()` with a multi-character argument is misleading" and adds one precision pass B005 doesn't: skip the argument entirely when it contains no letter or digit. Scanning ~30 real frameworks turned up over a hundred multi-character `.strip()` calls, and the overwhelming majority — `.strip('\r\n')`, `.strip('[]')`, `.strip('\'"')`, box-drawing tree glyphs — were deliberate, correct uses of the character-*set* semantics, not the substring mistake the rule exists to catch. Only the argument that reads as a word or token (`data:`, `/v1`, `THREAD#`) is the real bug; a bag of punctuation isn't. Full before/after counts in [`docs/FINDINGS.md`](docs/FINDINGS.md).
 
 What actually seems to be missing elsewhere, as far as I've been able to find:
 
@@ -77,6 +84,8 @@ What actually seems to be missing elsewhere, as far as I've been able to find:
 
 And a difference in kind, not just coverage: every check here is checked against a real corpus, not just reasoned about. [`docs/FINDINGS.md`](docs/FINDINGS.md) has a running ledger of every false positive found while building each check (with the exact framework and line), and two checks that were built, measured, and **rejected outright** when the pattern turned out to be either too common to be a defensible finding (1,911 hits) or premised on something that was actually false (the first two real hits checked turned out to be correct code). I haven't found another static-analysis tool — commercial or open-source — that publishes this kind of "we built it, checked it against real code, and turned it down" ledger. Most tools that market themselves on "catches real bugs" (Greptile, Qodo, CodeRabbit) report an aggregate detection-rate benchmark, not per-rule provenance you can click through to an actual merged fix.
 
+**Closing the "toy project" gaps, honestly.** Ruff is a single, fast binary with editor integrations, a plugin-free config file, autofix, and inline suppression - table stakes for a tool people actually adopt, not just admire. `codehound` isn't going to out-perform a Rust tool by staying pure Python, but it now has the parts of that list that don't require rewriting the whole thing: a `[tool.codehound]` block in `pyproject.toml`, `# noqa`/`# noqa: CH001` inline suppression (same syntax flake8/ruff already use, so it doesn't collide with either), `--fix` for the two checks where the rewrite is genuinely unambiguous (CH017 always, CH004 only inside `async def` - guessing wrong on the rest would be worse than not fixing them), and scanning parallelized across a process pool once there's enough files to make that worth it. Measured, not claimed: a full scan of HuggingFace's `transformers` (thousands of files) went from 57 seconds to 12 - verified byte-identical against the sequential result first, not just "seems faster."
+
 ---
 
 ## Install
@@ -85,7 +94,7 @@ And a difference in kind, not just coverage: every check here is checked against
 pip install codehound
 ```
 
-Zero dependencies — it's ~3,600 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
+Zero dependencies — it's ~4,300 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
 
 <details>
 <summary>From a clone instead (for development)</summary>
@@ -111,6 +120,9 @@ codehound scan file1.py file2.py src/
 # only run specific checks
 codehound scan path/to/project --select CH001,CH006
 
+# also skip extra directories beyond the built-in defaults
+codehound scan path/to/project --exclude migrations,generated
+
 # machine-readable output for CI dashboards
 codehound scan path/to/project --format json
 codehound scan path/to/project --format csv
@@ -118,6 +130,9 @@ codehound scan path/to/project --format csv
 # GitHub Code Scanning (Security tab) can ingest this directly
 codehound scan path/to/project --format sarif > results.sarif
 
+# rewrite the fixable findings in place, then report what's left
+codehound scan path/to/project --fix
+
 # list every available check
 codehound list
 ```
@@ -128,6 +143,32 @@ codehound list
 - run: codehound scan src   # fails the build on a regression
 ```
 
+A finding you've reviewed and want to keep suppresses the same way flake8/ruff findings do - a trailing `# noqa` (everything on that line) or `# noqa: CH001` (just that code):
+
+```python
+time.sleep(1)  # noqa: CH001 - deliberate; this branch only runs at startup, before the loop exists
+```
+
+### Config file
+
+Drop defaults into `[tool.codehound]` in `pyproject.toml` so you don't have to repeat flags on every invocation - explicit CLI flags always win over these:
+
+```toml
+[tool.codehound]
+select = ["CH001", "CH006"]   # same as --select
+exclude = ["migrations"]      # extra directories to skip, merged with the built-in defaults
+paths = ["src"]                # what `codehound scan` (no path args) scans
+```
+
+Requires Python 3.11+ to load (uses the standard-library `tomllib`) - on 3.9/3.10 the config file is silently skipped and every flag still works exactly the same via the CLI, since nothing about codehound itself depends on being able to read it.
+
+### `--fix`
+
+Only two checks ship an autofix, and deliberately so - every other check either needs a judgment call (is this "leak" actually intentional?) or an import that may or may not already be in scope, and guessing wrong there is worse than just reporting the finding:
+
+- **CH017** - `collections.<ABC>` → `collections.abc.<ABC>`, a pure rename, always safe.
+- **CH004** - `asyncio.get_event_loop()` → `asyncio.get_running_loop()`, but *only* inside an `async def`. Outside one, `get_running_loop()` raises where `get_event_loop()` wouldn't, so those calls are left as detection-only.
+
 ### GitHub Action
 
 ```yaml
@@ -146,7 +187,7 @@ Uploads findings to the repo's **Security → Code Scanning** tab via SARIF, in
 ```yaml
 repos:
   - repo: https://github.com/kratos0718/codehound
-    rev: v1.7.0
+    rev: v1.9.0
     hooks:
       - id: codehound
 ```
@@ -166,7 +207,7 @@ repos:
 | **CH007** | `unawaited-coroutine-call` | `foo()` where `foo` is `async def`, called as a bare statement — no `await`, no scheduling. The coroutine object is created and dropped; the body **never runs at all**. | hardening rule — see below |
 | **CH008** | `asyncio-run-in-running-loop` | `asyncio.run(...)` called from inside an `async def` — always raises `RuntimeError`, immediately, every time. | hardening rule — zero corpus hits (see below) |
 | **CH009** | `floating-thread` | A non-daemon `threading.Thread` that's `.start()`ed but never `.join()`ed — the thread analog of CH006. | hardening rule — see below |
-| **CH010** | `loop-closure-capture` | A `lambda` inside a `for` loop (or comprehension) that's *stored* (appended, assigned, returned) and captures the loop variable by reference — every stored instance ends up sharing the loop's **final** value. | **accelerate** (HuggingFace) — `MegatronEngine.get_module_config`'s `param_sync_func` list, PR #4273 |
+| **CH010** | `loop-closure-capture` | A `lambda` *or* nested `def` inside a `for` loop (or comprehension) that's *stored* (appended, assigned, returned) and captures the loop variable by reference — every stored instance ends up sharing the loop's **final** value. | **accelerate** (HuggingFace) — `MegatronEngine.get_module_config`'s `param_sync_func` list, PR #4273 |
 | **CH011** | `lru-cache-on-method` | `@lru_cache`/`@cache` decorating an instance method — the cache holds a strong reference to `self` forever, so every instance that ever calls the method leaks for the process lifetime. | **optuna** — `_FanovaTree`'s node-lookup methods leaked every tree built for a `get_param_importances()` call; **llama_index** — `VectaraIndex._get_corpus_key` leaked the index *and* broke its own `__del__`-based HTTP session cleanup; **litellm** — `Router._cached_get_model_group_info` leaked every `Router` even after its own documented `discard()` cleanup |
 | **CH012** | `floating-process` | A non-daemon `multiprocessing.Process` that's `.start()`ed but never `.join()`ed — the process analog of CH009. | hardening rule |
 | **CH013** | `discarded-future` | `ThreadPoolExecutor`/`ProcessPoolExecutor.submit(...)` called as a bare statement — the returned `Future` (and any exception raised inside the submitted work) is silently discarded. | hardening rule — real hits in litellm, accelerate, langchain |
@@ -188,6 +229,8 @@ repos:
 | **CH029** | `finally-swallows-exception` | `return`/`break`/`continue` in a `finally:` block silently discards any exception from the `try:` — the caller never sees it. | hardening rule — real hits in letta |
 | **CH030** | `lru-cache-on-async-function` | `@lru_cache`/`@cache` on `async def` caches the coroutine *object*, not its result — the second call with the same arguments crashes. | hardening rule |
 | **CH031** | `unclosed-pool` | `multiprocessing.Pool()` never `.close()`d/`.terminate()`d — worker processes leak for the life of the parent. | hardening rule |
+| **CH032** | `nondeterministic-default-argument` | A default argument computed from `time.time()`/`datetime.now()`/`random.random()`/`uuid.uuid4()` etc. — evaluated once at definition time, so every call using the default gets the *same* value forever. (inspired by flake8-bugbear B008, narrowed to a curated function list — see below) | hardening rule — real hit in litellm (`BudgetManager.create_budget`'s `created_at=time.time()` default) |
+| **CH033** | `strip-multichar-argument` | `.strip()`/`.lstrip()`/`.rstrip()` called with a multi-character string that contains a letter or digit — `str.strip(chars)` removes any of those *characters*, not the substring, from each end. (inspired by flake8-bugbear B005, narrowed to skip punctuation-only character sets — see below) | hardening rule — real hit in huggingface_hub (SSE parsing: `line.lstrip("data:").rstrip("/n")`, the second almost certainly meant `"\n"`) |
 
 `codehound list` prints this from the source of truth.
 
@@ -438,7 +481,7 @@ codehound/
 
 Each check receives a parsed `ast` tree plus the precomputed parent map and returns `Finding`s. Adding a rule is one file + one registry line + a test. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for a full walkthrough of the engine, the parent map, and the design decisions.
 
-**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. CH016 doesn't flag a socket returned as part of a tuple/list, or passed as an argument to any call (as opposed to being the receiver of a call on itself) — real patterns found in vllm's rendezvous code. CH020 won't flag a `BaseException` handler whose bound name is actually referenced, or whose body re-raises anywhere in its own scope (not counting a nested try/except's own handler) — both real patterns found in agno. CH021 doesn't flag a relative import (`node.level != 0`) of a same-named local module, or an import already inside a `try:`/`except ImportError:` fallback — real patterns found in vllm and agno respectively. CH025 pairs each chained comparison's op with only its own adjacent operands, rather than matching a literal and an `is`/`is not` anywhere in the same chain independently — a real pattern found in litellm. CH027 and CH028 both recognize a handle stored as *any* object's attribute as a hand-off, matching CH009/CH016's precedent — real patterns found in dspy and weaviate-python-client respectively. CH028 also only trusts a bare `Timer(...)` when `from threading import Timer` was actually seen — real hits in agno were its own unrelated stopwatch class. CH029 skips a `try` whose `except` clauses never re-raise anywhere in their own scope — a real pattern in letta where the exception is deliberately logged and recorded, never propagated, so a `return` in `finally` isn't discarding anything live. All of those guards exist because of real false positives caught while building the checks (see above and [`docs/FINDINGS.md`](docs/FINDINGS.md)). The test suite asserts both "bad code is flagged" and "correct code is not."
+**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. CH016 doesn't flag a socket returned as part of a tuple/list, or passed as an argument to any call (as opposed to being the receiver of a call on itself) — real patterns found in vllm's rendezvous code. CH020 won't flag a `BaseException` handler whose bound name is actually referenced, or whose body re-raises anywhere in its own scope (not counting a nested try/except's own handler) — both real patterns found in agno. CH021 doesn't flag a relative import (`node.level != 0`) of a same-named local module, or an import already inside a `try:`/`except ImportError:` fallback — real patterns found in vllm and agno respectively. CH025 pairs each chained comparison's op with only its own adjacent operands, rather than matching a literal and an `is`/`is not` anywhere in the same chain independently — a real pattern found in litellm. CH027 and CH028 both recognize a handle stored as *any* object's attribute as a hand-off, matching CH009/CH016's precedent — real patterns found in dspy and weaviate-python-client respectively. CH028 also only trusts a bare `Timer(...)` when `from threading import Timer` was actually seen — real hits in agno were its own unrelated stopwatch class. CH029 skips a `try` whose `except` clauses never re-raise anywhere in their own scope — a real pattern in letta where the exception is deliberately logged and recorded, never propagated, so a `return` in `finally` isn't discarding anything live. CH033 skips a `.strip()` argument that's every character the same (`.strip('```')`) or made entirely of punctuation/whitespace with no letter or digit (`.strip('\r\n')`, `.strip('[]')`) — real patterns found across nearly every framework scanned, all deliberate uses of the character-*set* semantics rather than the substring mistake the check exists to catch. All of those guards exist because of real false positives caught while building the checks (see above and [`docs/FINDINGS.md`](docs/FINDINGS.md)). The test suite asserts both "bad code is flagged" and "correct code is not."
 
 ---
 
@@ -475,9 +518,21 @@ Every check has paired tests: the buggy pattern *is* flagged, and the idiomatic
       subprocesses, floating timers — CH023-CH028
 - [x] 31 checks — `finally:` blocks that swallow exceptions, `lru_cache`
       on async functions, unclosed `multiprocessing.Pool` — CH029-CH031
+- [x] Inline `# noqa` / `# noqa: CH001` suppression
+- [x] `[tool.codehound]` project config in `pyproject.toml` (`select`,
+      `exclude`, `paths` — Python 3.11+ to load, every flag still works
+      without it on 3.9/3.10)
+- [x] `--fix` — CH017 always, CH004 only inside `async def` (CH002/CH003
+      turned out to need judgment calls or import-injection this tool
+      won't guess at, so they stay detection-only; see docs/ARCHITECTURE.md)
+- [x] Parallelize scanning across files for large codebases — a full
+      HuggingFace transformers scan went from 57s to 12s (measured,
+      byte-identical output verified against the sequential run)
+- [x] 33 checks — nested-`def` loop-closure capture alongside lambdas
+      (CH010, same shape as bugbear's B023), nondeterministic default
+      arguments, multi-character `.strip()` arguments — CH032-CH033
 - [ ] Cross-module resolution for CH007/CH009 (currently same-file only)
 - [ ] Extend CH001 to a curated denylist of sync AI/agent SDK client calls inside async functions (vector-DB clients, LLM SDKs) — the gap flake8-async's stdlib-only denylist leaves open
-- [ ] `--fix` for the mechanical rules (CH002, CH003, CH004)
 
 ---
 

{codehound-1.7.0 → codehound-1.9.0}/README.md

@@ -4,7 +4,7 @@
 
 <h1 align="center">codehound</h1>
 
-**An AST-based static analyzer that hunts *real* bugs in large Python codebases — thirty-one checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
+**An AST-based static analyzer that hunts *real* bugs in large Python codebases — thirty-three checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
 
 [![CI](https://github.com/kratos0718/codehound/actions/workflows/ci.yml/badge.svg)](https://github.com/kratos0718/codehound/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/codehound.svg)](https://pypi.org/project/codehound/)
@@ -47,7 +47,13 @@ I was contributing bug fixes to large AI frameworks and noticed the same handful
 
 ## How this compares
 
-Being upfront about overlap: `codehound` is not the only tool that catches some of these patterns, and pretending otherwise wouldn't survive five minutes of someone actually checking. [Ruff](https://docs.astral.sh/ruff/)'s `RUF006` already catches a discarded `asyncio.create_task()` (CH006), `flake8-async`'s `ASYNC300` predates it. Ruff's `RUF012` already catches mutable class-level defaults (CH026), `F632` catches `is`-literal comparisons (CH025), `B006`/`UP005`/`E722` cover mutable-default-arguments/deprecated-unittest-aliases/bare-except (CH002/CH024/CH020). Pylint's `W1518` (`method-cache-max-size-none`) is close to a name-for-name match for CH011's `lru_cache`-on-instance-method leak. If you already run ruff and pylint, several of `codehound`'s checks will feel familiar.
+Being upfront about overlap: `codehound` is not the only tool that catches some of these patterns, and pretending otherwise wouldn't survive five minutes of someone actually checking. [Ruff](https://docs.astral.sh/ruff/)'s `RUF006` already catches a discarded `asyncio.create_task()` (CH006), `flake8-async`'s `ASYNC300` predates it. Ruff's `RUF012` already catches mutable class-level defaults (CH026), `F632` catches `is`-literal comparisons (CH025), `B006`/`UP005`/`E722` cover mutable-default-arguments/deprecated-unittest-aliases/bare-except (CH002/CH024/CH020). Pylint's `W1518` (`method-cache-max-size-none`) is close to a name-for-name match for CH011's `lru_cache`-on-instance-method leak. flake8-bugbear's `B012` also overlaps with CH029 (`return`/`break`/`continue` in `finally:`), though CH029 is narrower — bugbear also flags a bare `continue` inside a `finally:` loop body, which this project hasn't verified has the same swallowed-exception risk in every case. If you already run ruff and pylint, several of `codehound`'s checks will feel familiar.
+
+Three checks are explicit adaptations of a flake8-bugbear idea, kept deliberately narrower than the source rule after checking where the broader version's false-positive risk actually lands:
+
+- **CH010** extends to cover a nested `def` capturing a loop variable, the same shape bugbear's `B023` covers alongside its lambda case — the same storage-based precision guard (only fires if the function is actually stored past the iteration) applies to both.
+- **CH032** takes bugbear's `B008` idea — "a call as a default argument is suspicious" — and narrows it to a curated list of ten functions (`time.time`, `datetime.now`, `random.random`, `uuid.uuid4`, …) whose result is *never* sensibly the same across calls. B008 as written also flags `def f(x=some_factory()):`, which is frequently a deliberate compute-once memoization; that ambiguity is exactly why this project didn't just port the broader rule.
+- **CH033** takes `B005`'s "`.strip()` with a multi-character argument is misleading" and adds one precision pass B005 doesn't: skip the argument entirely when it contains no letter or digit. Scanning ~30 real frameworks turned up over a hundred multi-character `.strip()` calls, and the overwhelming majority — `.strip('\r\n')`, `.strip('[]')`, `.strip('\'"')`, box-drawing tree glyphs — were deliberate, correct uses of the character-*set* semantics, not the substring mistake the rule exists to catch. Only the argument that reads as a word or token (`data:`, `/v1`, `THREAD#`) is the real bug; a bag of punctuation isn't. Full before/after counts in [`docs/FINDINGS.md`](docs/FINDINGS.md).
 
 What actually seems to be missing elsewhere, as far as I've been able to find:
 
@@ -57,6 +63,8 @@ What actually seems to be missing elsewhere, as far as I've been able to find:
 
 And a difference in kind, not just coverage: every check here is checked against a real corpus, not just reasoned about. [`docs/FINDINGS.md`](docs/FINDINGS.md) has a running ledger of every false positive found while building each check (with the exact framework and line), and two checks that were built, measured, and **rejected outright** when the pattern turned out to be either too common to be a defensible finding (1,911 hits) or premised on something that was actually false (the first two real hits checked turned out to be correct code). I haven't found another static-analysis tool — commercial or open-source — that publishes this kind of "we built it, checked it against real code, and turned it down" ledger. Most tools that market themselves on "catches real bugs" (Greptile, Qodo, CodeRabbit) report an aggregate detection-rate benchmark, not per-rule provenance you can click through to an actual merged fix.
 
+**Closing the "toy project" gaps, honestly.** Ruff is a single, fast binary with editor integrations, a plugin-free config file, autofix, and inline suppression - table stakes for a tool people actually adopt, not just admire. `codehound` isn't going to out-perform a Rust tool by staying pure Python, but it now has the parts of that list that don't require rewriting the whole thing: a `[tool.codehound]` block in `pyproject.toml`, `# noqa`/`# noqa: CH001` inline suppression (same syntax flake8/ruff already use, so it doesn't collide with either), `--fix` for the two checks where the rewrite is genuinely unambiguous (CH017 always, CH004 only inside `async def` - guessing wrong on the rest would be worse than not fixing them), and scanning parallelized across a process pool once there's enough files to make that worth it. Measured, not claimed: a full scan of HuggingFace's `transformers` (thousands of files) went from 57 seconds to 12 - verified byte-identical against the sequential result first, not just "seems faster."
+
 ---
 
 ## Install
@@ -65,7 +73,7 @@ And a difference in kind, not just coverage: every check here is checked against
 pip install codehound
 ```
 
-Zero dependencies — it's ~3,600 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
+Zero dependencies — it's ~4,300 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
 
 <details>
 <summary>From a clone instead (for development)</summary>
@@ -91,6 +99,9 @@ codehound scan file1.py file2.py src/
 # only run specific checks
 codehound scan path/to/project --select CH001,CH006
 
+# also skip extra directories beyond the built-in defaults
+codehound scan path/to/project --exclude migrations,generated
+
 # machine-readable output for CI dashboards
 codehound scan path/to/project --format json
 codehound scan path/to/project --format csv
@@ -98,6 +109,9 @@ codehound scan path/to/project --format csv
 # GitHub Code Scanning (Security tab) can ingest this directly
 codehound scan path/to/project --format sarif > results.sarif
 
+# rewrite the fixable findings in place, then report what's left
+codehound scan path/to/project --fix
+
 # list every available check
 codehound list
 ```
@@ -108,6 +122,32 @@ codehound list
 - run: codehound scan src   # fails the build on a regression
 ```
 
+A finding you've reviewed and want to keep suppresses the same way flake8/ruff findings do - a trailing `# noqa` (everything on that line) or `# noqa: CH001` (just that code):
+
+```python
+time.sleep(1)  # noqa: CH001 - deliberate; this branch only runs at startup, before the loop exists
+```
+
+### Config file
+
+Drop defaults into `[tool.codehound]` in `pyproject.toml` so you don't have to repeat flags on every invocation - explicit CLI flags always win over these:
+
+```toml
+[tool.codehound]
+select = ["CH001", "CH006"]   # same as --select
+exclude = ["migrations"]      # extra directories to skip, merged with the built-in defaults
+paths = ["src"]                # what `codehound scan` (no path args) scans
+```
+
+Requires Python 3.11+ to load (uses the standard-library `tomllib`) - on 3.9/3.10 the config file is silently skipped and every flag still works exactly the same via the CLI, since nothing about codehound itself depends on being able to read it.
+
+### `--fix`
+
+Only two checks ship an autofix, and deliberately so - every other check either needs a judgment call (is this "leak" actually intentional?) or an import that may or may not already be in scope, and guessing wrong there is worse than just reporting the finding:
+
+- **CH017** - `collections.<ABC>` → `collections.abc.<ABC>`, a pure rename, always safe.
+- **CH004** - `asyncio.get_event_loop()` → `asyncio.get_running_loop()`, but *only* inside an `async def`. Outside one, `get_running_loop()` raises where `get_event_loop()` wouldn't, so those calls are left as detection-only.
+
 ### GitHub Action
 
 ```yaml
@@ -126,7 +166,7 @@ Uploads findings to the repo's **Security → Code Scanning** tab via SARIF, in
 ```yaml
 repos:
   - repo: https://github.com/kratos0718/codehound
-    rev: v1.7.0
+    rev: v1.9.0
     hooks:
       - id: codehound
 ```
@@ -146,7 +186,7 @@ repos:
 | **CH007** | `unawaited-coroutine-call` | `foo()` where `foo` is `async def`, called as a bare statement — no `await`, no scheduling. The coroutine object is created and dropped; the body **never runs at all**. | hardening rule — see below |
 | **CH008** | `asyncio-run-in-running-loop` | `asyncio.run(...)` called from inside an `async def` — always raises `RuntimeError`, immediately, every time. | hardening rule — zero corpus hits (see below) |
 | **CH009** | `floating-thread` | A non-daemon `threading.Thread` that's `.start()`ed but never `.join()`ed — the thread analog of CH006. | hardening rule — see below |
-| **CH010** | `loop-closure-capture` | A `lambda` inside a `for` loop (or comprehension) that's *stored* (appended, assigned, returned) and captures the loop variable by reference — every stored instance ends up sharing the loop's **final** value. | **accelerate** (HuggingFace) — `MegatronEngine.get_module_config`'s `param_sync_func` list, PR #4273 |
+| **CH010** | `loop-closure-capture` | A `lambda` *or* nested `def` inside a `for` loop (or comprehension) that's *stored* (appended, assigned, returned) and captures the loop variable by reference — every stored instance ends up sharing the loop's **final** value. | **accelerate** (HuggingFace) — `MegatronEngine.get_module_config`'s `param_sync_func` list, PR #4273 |
 | **CH011** | `lru-cache-on-method` | `@lru_cache`/`@cache` decorating an instance method — the cache holds a strong reference to `self` forever, so every instance that ever calls the method leaks for the process lifetime. | **optuna** — `_FanovaTree`'s node-lookup methods leaked every tree built for a `get_param_importances()` call; **llama_index** — `VectaraIndex._get_corpus_key` leaked the index *and* broke its own `__del__`-based HTTP session cleanup; **litellm** — `Router._cached_get_model_group_info` leaked every `Router` even after its own documented `discard()` cleanup |
 | **CH012** | `floating-process` | A non-daemon `multiprocessing.Process` that's `.start()`ed but never `.join()`ed — the process analog of CH009. | hardening rule |
 | **CH013** | `discarded-future` | `ThreadPoolExecutor`/`ProcessPoolExecutor.submit(...)` called as a bare statement — the returned `Future` (and any exception raised inside the submitted work) is silently discarded. | hardening rule — real hits in litellm, accelerate, langchain |
@@ -168,6 +208,8 @@ repos:
 | **CH029** | `finally-swallows-exception` | `return`/`break`/`continue` in a `finally:` block silently discards any exception from the `try:` — the caller never sees it. | hardening rule — real hits in letta |
 | **CH030** | `lru-cache-on-async-function` | `@lru_cache`/`@cache` on `async def` caches the coroutine *object*, not its result — the second call with the same arguments crashes. | hardening rule |
 | **CH031** | `unclosed-pool` | `multiprocessing.Pool()` never `.close()`d/`.terminate()`d — worker processes leak for the life of the parent. | hardening rule |
+| **CH032** | `nondeterministic-default-argument` | A default argument computed from `time.time()`/`datetime.now()`/`random.random()`/`uuid.uuid4()` etc. — evaluated once at definition time, so every call using the default gets the *same* value forever. (inspired by flake8-bugbear B008, narrowed to a curated function list — see below) | hardening rule — real hit in litellm (`BudgetManager.create_budget`'s `created_at=time.time()` default) |
+| **CH033** | `strip-multichar-argument` | `.strip()`/`.lstrip()`/`.rstrip()` called with a multi-character string that contains a letter or digit — `str.strip(chars)` removes any of those *characters*, not the substring, from each end. (inspired by flake8-bugbear B005, narrowed to skip punctuation-only character sets — see below) | hardening rule — real hit in huggingface_hub (SSE parsing: `line.lstrip("data:").rstrip("/n")`, the second almost certainly meant `"\n"`) |
 
 `codehound list` prints this from the source of truth.
 
@@ -418,7 +460,7 @@ codehound/
 
 Each check receives a parsed `ast` tree plus the precomputed parent map and returns `Finding`s. Adding a rule is one file + one registry line + a test. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for a full walkthrough of the engine, the parent map, and the design decisions.
 
-**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. CH016 doesn't flag a socket returned as part of a tuple/list, or passed as an argument to any call (as opposed to being the receiver of a call on itself) — real patterns found in vllm's rendezvous code. CH020 won't flag a `BaseException` handler whose bound name is actually referenced, or whose body re-raises anywhere in its own scope (not counting a nested try/except's own handler) — both real patterns found in agno. CH021 doesn't flag a relative import (`node.level != 0`) of a same-named local module, or an import already inside a `try:`/`except ImportError:` fallback — real patterns found in vllm and agno respectively. CH025 pairs each chained comparison's op with only its own adjacent operands, rather than matching a literal and an `is`/`is not` anywhere in the same chain independently — a real pattern found in litellm. CH027 and CH028 both recognize a handle stored as *any* object's attribute as a hand-off, matching CH009/CH016's precedent — real patterns found in dspy and weaviate-python-client respectively. CH028 also only trusts a bare `Timer(...)` when `from threading import Timer` was actually seen — real hits in agno were its own unrelated stopwatch class. CH029 skips a `try` whose `except` clauses never re-raise anywhere in their own scope — a real pattern in letta where the exception is deliberately logged and recorded, never propagated, so a `return` in `finally` isn't discarding anything live. All of those guards exist because of real false positives caught while building the checks (see above and [`docs/FINDINGS.md`](docs/FINDINGS.md)). The test suite asserts both "bad code is flagged" and "correct code is not."
+**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. CH016 doesn't flag a socket returned as part of a tuple/list, or passed as an argument to any call (as opposed to being the receiver of a call on itself) — real patterns found in vllm's rendezvous code. CH020 won't flag a `BaseException` handler whose bound name is actually referenced, or whose body re-raises anywhere in its own scope (not counting a nested try/except's own handler) — both real patterns found in agno. CH021 doesn't flag a relative import (`node.level != 0`) of a same-named local module, or an import already inside a `try:`/`except ImportError:` fallback — real patterns found in vllm and agno respectively. CH025 pairs each chained comparison's op with only its own adjacent operands, rather than matching a literal and an `is`/`is not` anywhere in the same chain independently — a real pattern found in litellm. CH027 and CH028 both recognize a handle stored as *any* object's attribute as a hand-off, matching CH009/CH016's precedent — real patterns found in dspy and weaviate-python-client respectively. CH028 also only trusts a bare `Timer(...)` when `from threading import Timer` was actually seen — real hits in agno were its own unrelated stopwatch class. CH029 skips a `try` whose `except` clauses never re-raise anywhere in their own scope — a real pattern in letta where the exception is deliberately logged and recorded, never propagated, so a `return` in `finally` isn't discarding anything live. CH033 skips a `.strip()` argument that's every character the same (`.strip('```')`) or made entirely of punctuation/whitespace with no letter or digit (`.strip('\r\n')`, `.strip('[]')`) — real patterns found across nearly every framework scanned, all deliberate uses of the character-*set* semantics rather than the substring mistake the check exists to catch. All of those guards exist because of real false positives caught while building the checks (see above and [`docs/FINDINGS.md`](docs/FINDINGS.md)). The test suite asserts both "bad code is flagged" and "correct code is not."
 
 ---
 
@@ -455,9 +497,21 @@ Every check has paired tests: the buggy pattern *is* flagged, and the idiomatic
       subprocesses, floating timers — CH023-CH028
 - [x] 31 checks — `finally:` blocks that swallow exceptions, `lru_cache`
       on async functions, unclosed `multiprocessing.Pool` — CH029-CH031
+- [x] Inline `# noqa` / `# noqa: CH001` suppression
+- [x] `[tool.codehound]` project config in `pyproject.toml` (`select`,
+      `exclude`, `paths` — Python 3.11+ to load, every flag still works
+      without it on 3.9/3.10)
+- [x] `--fix` — CH017 always, CH004 only inside `async def` (CH002/CH003
+      turned out to need judgment calls or import-injection this tool
+      won't guess at, so they stay detection-only; see docs/ARCHITECTURE.md)
+- [x] Parallelize scanning across files for large codebases — a full
+      HuggingFace transformers scan went from 57s to 12s (measured,
+      byte-identical output verified against the sequential run)
+- [x] 33 checks — nested-`def` loop-closure capture alongside lambdas
+      (CH010, same shape as bugbear's B023), nondeterministic default
+      arguments, multi-character `.strip()` arguments — CH032-CH033
 - [ ] Cross-module resolution for CH007/CH009 (currently same-file only)
 - [ ] Extend CH001 to a curated denylist of sync AI/agent SDK client calls inside async functions (vector-DB clients, LLM SDKs) — the gap flake8-async's stdlib-only denylist leaves open
-- [ ] `--fix` for the mechanical rules (CH002, CH003, CH004)
 
 ---
 

{codehound-1.7.0 → codehound-1.9.0}/pyproject.toml

@@ -28,7 +28,7 @@ Issues = "https://github.com/kratos0718/codehound/issues"
 codehound = "codehound.cli:main"
 
 [project.optional-dependencies]
-dev = ["pytest>=7"]
+dev = ["pytest>=7", "tomli>=2; python_version < '3.11'"]
 
 [tool.hatch.version]
 path = "src/codehound/__init__.py"

codehound-1.9.0/src/codehound/__init__.py

@@ -0,0 +1,33 @@
+"""codehound - an AST-based static analyzer that hunts real bugs in Python code.
+
+Thirty-three checks. Eight are each backed by a bug that was actually
+found and fixed (or opened as a PR) in a popular open-source AI framework
+(agno, crewAI, mem0, llama_index, accelerate, optuna, litellm). The rest
+(CH007-CH009, CH012-CH033) are hardening rules verified against real
+false positives across a ~29-framework validation corpus instead - see
+docs/FINDINGS.md.
+
+Also has the parts of a production-grade linter that don't require
+rewriting the whole thing in Rust: inline `# noqa` suppression,
+`[tool.codehound]` project config, `--fix` for the checks where the
+rewrite is genuinely unambiguous, and scanning parallelized across a
+process pool for large codebases.
+"""
+
+from __future__ import annotations
+
+from codehound.checks import ALL_CHECKS, get_checks
+from codehound.core import Check, Finding, scan_file, scan_files, scan_path
+
+__version__ = "1.9.0"
+
+__all__ = [
+    "ALL_CHECKS",
+    "get_checks",
+    "Check",
+    "Finding",
+    "scan_file",
+    "scan_files",
+    "scan_path",
+    "__version__",
+]

{codehound-1.7.0 → codehound-1.9.0}/src/codehound/checks/__init__.py

@@ -22,11 +22,13 @@ from codehound.checks.lru_cache_on_async_function import LruCacheOnAsyncFunction
 from codehound.checks.lru_cache_on_method import LruCacheOnMethod
 from codehound.checks.mutable_class_attribute import MutableClassAttribute
 from codehound.checks.mutable_defaults import MutableDefaultArgument
+from codehound.checks.nondeterministic_default import NondeterministicDefault
 from codehound.checks.removed_asyncio_task_methods import RemovedAsyncioTaskMethods
 from codehound.checks.removed_getargspec import RemovedGetargspec
 from codehound.checks.removed_stdlib_attribute import RemovedStdlibAttribute
 from codehound.checks.removed_stdlib_module import RemovedStdlibModule
 from codehound.checks.resource_leak import UnclosedFileHandle
+from codehound.checks.strip_multichar import StripMultichar
 from codehound.checks.unawaited_coroutine import UnawaitedCoroutineCall
 from codehound.checks.unclosed_pool import UnclosedPool
 from codehound.checks.unclosed_socket import UnclosedSocket
@@ -67,6 +69,8 @@ ALL_CHECKS: list[type[Check]] = [
     FinallySwallowsException,
     LruCacheOnAsyncFunction,
     UnclosedPool,
+    NondeterministicDefault,
+    StripMultichar,
 ]
 
 

{codehound-1.7.0 → codehound-1.9.0}/src/codehound/checks/loop_closure_capture.py

@@ -29,6 +29,14 @@ Comprehensions (`` [lambda: i for i in range(3)] ``) are the one
 exception: the ``elt``/``key``/``value`` position *is* inherently the
 "produce and store" position, so no extra storage-context check is
 needed there.
+
+Same bug, same fix, different syntax: a nested ``def`` inside a ``for``
+loop captures the loop variable exactly the same way a lambda does -
+flake8-bugbear's B023 covers both shapes under one rule, and this check
+now does too. ``def`` is a statement, not an expression, so "is it
+stored" means something different: the function's *name* has to show up
+later in a storage position (appended, assigned, returned), not the
+``def`` itself.
 """
 
 from __future__ import annotations
@@ -54,6 +62,53 @@ def _references_name_unshadowed(lam: ast.Lambda, name: str) -> bool:
     return False
 
 
+def _references_name_in_body(funcdef: ast.FunctionDef | ast.AsyncFunctionDef, name: str) -> bool:
+    """Like ``_references_name_unshadowed`` but for a ``def``'s own
+    parameters and statement body rather than a lambda's params and
+    single expression - a same-named parameter shadows the outer loop
+    variable exactly like it would for a lambda."""
+    args = funcdef.args
+    param_names = {a.arg for a in (args.posonlyargs + args.args + args.kwonlyargs)}
+    if args.vararg:
+        param_names.add(args.vararg.arg)
+    if args.kwarg:
+        param_names.add(args.kwarg.arg)
+    if name in param_names:
+        return False
+    for stmt in funcdef.body:
+        for node in ast.walk(stmt):
+            if isinstance(node, ast.Name) and node.id == name and isinstance(node.ctx, ast.Load):
+                return True
+    return False
+
+
+def _name_is_stored(name: str, loop_body: list[ast.stmt], parents: dict) -> bool:
+    """True if `name` (a nested def's own name) is later used in a
+    storage position anywhere in the loop body: assigned, returned/
+    yielded, or passed to `.append()`/`.add()` - same storage shapes
+    `_is_stored` recognizes for a lambda, just checked via the Name
+    reference's parent instead of the def statement's own parent, since
+    a `def` can't be the direct value of an assignment the way a lambda
+    expression can."""
+    for stmt in loop_body:
+        for node in ast.walk(stmt):
+            if not (isinstance(node, ast.Name) and node.id == name and isinstance(node.ctx, ast.Load)):
+                continue
+            parent = parents.get(id(node))
+            if isinstance(parent, (ast.Assign, ast.AnnAssign)) and parent.value is node:
+                return True
+            if isinstance(parent, (ast.Return, ast.Yield)) and parent.value is node:
+                return True
+            if (
+                isinstance(parent, ast.Call)
+                and isinstance(parent.func, ast.Attribute)
+                and parent.func.attr in _STORAGE_METHODS
+                and node in parent.args
+            ):
+                return True
+    return False
+
+
 def _is_stored(lam: ast.Lambda, parents: dict) -> bool:
     """True only if the lambda is directly stored somewhere that outlives
     this loop iteration - not merely passed as a callback argument to a
@@ -120,4 +175,35 @@ class LoopClosureCapture(Check):
                                 )
                             )
                             break
+
+            # Same bug, `def` instead of `lambda`: a nested function
+            # defined directly in a `for` loop's body, capturing the loop
+            # variable, whose *name* (not the def itself) is later stored
+            # somewhere that outlives this iteration.
+            if isinstance(loop, ast.For) and isinstance(loop.target, ast.Name):
+                var = loop.target.id
+                for stmt in loop.body:
+                    if not isinstance(stmt, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                        continue
+                    if id(stmt) in seen:
+                        continue
+                    if not _references_name_in_body(stmt, var):
+                        continue
+                    if not _name_is_stored(stmt.name, loop.body, parents):
+                        continue
+                    seen.add(id(stmt))
+                    findings.append(
+                        Finding(
+                            path=path,
+                            line=stmt.lineno,
+                            col=stmt.col_offset,
+                            code=self.code,
+                            message=(
+                                f"`{stmt.name}` captures loop variable `{var}` by reference; if "
+                                f"called after the loop moves on, every instance sees the same "
+                                f"final value. Bind it explicitly with a default argument, e.g. "
+                                f"`def {stmt.name}({var}={var}):`."
+                            ),
+                        )
+                    )
         return findings

codehound-1.9.0/src/codehound/checks/nondeterministic_default.py

@@ -0,0 +1,99 @@
+"""CH032 - a default argument computed from a call to a non-deterministic function.
+
+A default value is evaluated exactly *once*, when the function is
+defined, not on every call - the same fact CH002 is about, but this is
+a distinct shape: a call to something like `time.time()` or
+`datetime.now()` isn't mutable, so CH002's "shared mutable object" check
+doesn't fire, and it's syntactically identical to a perfectly reasonable
+default like `def f(x=DEFAULT_TIMEOUT):`. What makes it a bug is that
+the *value itself* depends on when it's called, and every default
+argument only ever captures the value from function-definition time.
+Verified directly:
+
+    def f(x=time.time()):
+        return x
+
+    a = f()
+    time.sleep(0.05)
+    b = f()
+    a == b  # True - both calls return the exact same timestamp
+
+Deliberately narrow, unlike a general "any call as a default is
+suspicious" rule (flake8-bugbear's B008, which also flags things like
+`def f(x=some_factory()):` that may well be an intentional
+compute-once memoization): this only flags a curated set of functions
+where "the same value every call" can never be what the author wanted -
+the current time, a random number, a new UUID. A generic factory call
+as a default might be deliberate; a cached `time.time()` never is.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding
+
+# (module, attribute) pairs whose result changes every call and would
+# never sensibly be memoized as a shared default.
+_NONDETERMINISTIC_CALLS: dict[tuple[str, str], str] = {
+    ("time", "time"): "time.time()",
+    ("time", "monotonic"): "time.monotonic()",
+    ("time", "perf_counter"): "time.perf_counter()",
+    ("datetime", "now"): "datetime.now()",
+    ("datetime", "utcnow"): "datetime.utcnow()",
+    ("date", "today"): "date.today()",
+    ("random", "random"): "random.random()",
+    ("random", "randint"): "random.randint()",
+    ("random", "choice"): "random.choice()",
+    ("uuid", "uuid4"): "uuid.uuid4()",
+}
+
+
+def _nondeterministic_call_name(node: ast.expr) -> str | None:
+    if not isinstance(node, ast.Call):
+        return None
+    func = node.func
+    if isinstance(func, ast.Attribute) and isinstance(func.value, ast.Name):
+        return _NONDETERMINISTIC_CALLS.get((func.value.id, func.attr))
+    return None
+
+
+def _iter_defaults(args: ast.arguments):
+    positional = args.posonlyargs + args.args
+    for arg, default in zip(reversed(positional), reversed(args.defaults)):
+        yield arg, default
+    for arg, default in zip(args.kwonlyargs, args.kw_defaults):
+        if default is not None:
+            yield arg, default
+
+
+class NondeterministicDefault(Check):
+    code = "CH032"
+    name = "nondeterministic-default-argument"
+    description = "Default argument calls a function (time/random/uuid) whose result changes every call."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.Lambda)):
+                continue
+            for arg, default in _iter_defaults(node.args):
+                call_text = _nondeterministic_call_name(default)
+                if call_text is None:
+                    continue
+                name = getattr(node, "name", "<lambda>")
+                findings.append(
+                    Finding(
+                        path=path,
+                        line=default.lineno,
+                        col=default.col_offset,
+                        code=self.code,
+                        message=(
+                            f"default value for `{arg.arg}` in `{name}` calls `{call_text}` - "
+                            f"evaluated once, at definition time, not on every call. Every "
+                            f"invocation using the default gets the exact same value. Use "
+                            f"`{arg.arg}=None` and compute it inside the function body instead."
+                        ),
+                    )
+                )
+        return findings