codehound 1.8.0__tar.gz → 1.10.0__tar.gz

{codehound-1.8.0 → codehound-1.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: codehound
-Version: 1.8.0
+Version: 1.10.0
 Summary: An AST-based static analyzer that hunts real correctness and async-safety bugs in Python code.
 Project-URL: Homepage, https://github.com/kratos0718/codehound
 Project-URL: Issues, https://github.com/kratos0718/codehound/issues
@@ -25,7 +25,7 @@ Description-Content-Type: text/markdown
 
 <h1 align="center">codehound</h1>
 
-**An AST-based static analyzer that hunts *real* bugs in large Python codebases — thirty-one checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
+**An AST-based static analyzer that hunts *real* bugs in large Python codebases — thirty-six checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
 
 [![CI](https://github.com/kratos0718/codehound/actions/workflows/ci.yml/badge.svg)](https://github.com/kratos0718/codehound/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/codehound.svg)](https://pypi.org/project/codehound/)
@@ -68,7 +68,14 @@ I was contributing bug fixes to large AI frameworks and noticed the same handful
 
 ## How this compares
 
-Being upfront about overlap: `codehound` is not the only tool that catches some of these patterns, and pretending otherwise wouldn't survive five minutes of someone actually checking. [Ruff](https://docs.astral.sh/ruff/)'s `RUF006` already catches a discarded `asyncio.create_task()` (CH006), `flake8-async`'s `ASYNC300` predates it. Ruff's `RUF012` already catches mutable class-level defaults (CH026), `F632` catches `is`-literal comparisons (CH025), `B006`/`UP005`/`E722` cover mutable-default-arguments/deprecated-unittest-aliases/bare-except (CH002/CH024/CH020). Pylint's `W1518` (`method-cache-max-size-none`) is close to a name-for-name match for CH011's `lru_cache`-on-instance-method leak. If you already run ruff and pylint, several of `codehound`'s checks will feel familiar.
+Being upfront about overlap: `codehound` is not the only tool that catches some of these patterns, and pretending otherwise wouldn't survive five minutes of someone actually checking. [Ruff](https://docs.astral.sh/ruff/)'s `RUF006` already catches a discarded `asyncio.create_task()` (CH006), `flake8-async`'s `ASYNC300` predates it. Ruff's `RUF012` already catches mutable class-level defaults (CH026), `F632` catches `is`-literal comparisons (CH025), `B006`/`UP005`/`E722` cover mutable-default-arguments/deprecated-unittest-aliases/bare-except (CH002/CH024/CH020). Pylint's `W1518` (`method-cache-max-size-none`) is close to a name-for-name match for CH011's `lru_cache`-on-instance-method leak. flake8-bugbear's `B012` also overlaps with CH029 (`return`/`break`/`continue` in `finally:`), though CH029 is narrower — bugbear also flags a bare `continue` inside a `finally:` loop body, which this project hasn't verified has the same swallowed-exception risk in every case. If you already run ruff and pylint, several of `codehound`'s checks will feel familiar.
+
+Six checks are explicit adaptations of a flake8-bugbear idea. Three are kept deliberately narrower than the source rule after checking where the broader version's false-positive risk actually lands; three others (`B016`, `B029`, `B003`) are ported close to as-is because the underlying bug has no narrower/broader version to weigh — it's a fixed fact about the language, true in every version of Python 3, with no configuration or heuristic to get wrong:
+
+- **CH010** extends to cover a nested `def` capturing a loop variable, the same shape bugbear's `B023` covers alongside its lambda case — the same storage-based precision guard (only fires if the function is actually stored past the iteration) applies to both.
+- **CH032** takes bugbear's `B008` idea — "a call as a default argument is suspicious" — and narrows it to a curated list of ten functions (`time.time`, `datetime.now`, `random.random`, `uuid.uuid4`, …) whose result is *never* sensibly the same across calls. B008 as written also flags `def f(x=some_factory()):`, which is frequently a deliberate compute-once memoization; that ambiguity is exactly why this project didn't just port the broader rule.
+- **CH033** takes `B005`'s "`.strip()` with a multi-character argument is misleading" and adds one precision pass B005 doesn't: skip the argument entirely when it contains no letter or digit. Scanning ~30 real frameworks turned up over a hundred multi-character `.strip()` calls, and the overwhelming majority — `.strip('\r\n')`, `.strip('[]')`, `.strip('\'"')`, box-drawing tree glyphs — were deliberate, correct uses of the character-*set* semantics, not the substring mistake the rule exists to catch. Only the argument that reads as a word or token (`data:`, `/v1`, `THREAD#`) is the real bug; a bag of punctuation isn't. Full before/after counts in [`docs/FINDINGS.md`](docs/FINDINGS.md).
+- **CH034** (`B016`) — `raise <literal>` always raises a different, unrelated `TypeError` instead of the exception the author wrote. **CH035** (`B029`) — `except ():` can never match anything; the handler is dead code. **CH036** (`B003`) — `os.environ = {...}` rebinds the name without calling `putenv`/`unsetenv`, so the real process environment silently doesn't change. All three verified directly in a REPL before writing any AST code (`docs/FINDINGS.md` has the exact repro for each), and all three have zero false-positive risk: there's no legitimate Python where raising a literal succeeds, an empty exception tuple catches something, or reassigning `os.environ` actually syncs the environment.
 
 What actually seems to be missing elsewhere, as far as I've been able to find:
 
@@ -88,7 +95,7 @@ And a difference in kind, not just coverage: every check here is checked against
 pip install codehound
 ```
 
-Zero dependencies — it's ~4,000 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
+Zero dependencies — it's ~4,450 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
 
 <details>
 <summary>From a clone instead (for development)</summary>
@@ -181,7 +188,7 @@ Uploads findings to the repo's **Security → Code Scanning** tab via SARIF, in
 ```yaml
 repos:
   - repo: https://github.com/kratos0718/codehound
-    rev: v1.8.0
+    rev: v1.10.0
     hooks:
       - id: codehound
 ```
@@ -201,7 +208,7 @@ repos:
 | **CH007** | `unawaited-coroutine-call` | `foo()` where `foo` is `async def`, called as a bare statement — no `await`, no scheduling. The coroutine object is created and dropped; the body **never runs at all**. | hardening rule — see below |
 | **CH008** | `asyncio-run-in-running-loop` | `asyncio.run(...)` called from inside an `async def` — always raises `RuntimeError`, immediately, every time. | hardening rule — zero corpus hits (see below) |
 | **CH009** | `floating-thread` | A non-daemon `threading.Thread` that's `.start()`ed but never `.join()`ed — the thread analog of CH006. | hardening rule — see below |
-| **CH010** | `loop-closure-capture` | A `lambda` inside a `for` loop (or comprehension) that's *stored* (appended, assigned, returned) and captures the loop variable by reference — every stored instance ends up sharing the loop's **final** value. | **accelerate** (HuggingFace) — `MegatronEngine.get_module_config`'s `param_sync_func` list, PR #4273 |
+| **CH010** | `loop-closure-capture` | A `lambda` *or* nested `def` inside a `for` loop (or comprehension) that's *stored* (appended, assigned, returned) and captures the loop variable by reference — every stored instance ends up sharing the loop's **final** value. | **accelerate** (HuggingFace) — `MegatronEngine.get_module_config`'s `param_sync_func` list, PR #4273 |
 | **CH011** | `lru-cache-on-method` | `@lru_cache`/`@cache` decorating an instance method — the cache holds a strong reference to `self` forever, so every instance that ever calls the method leaks for the process lifetime. | **optuna** — `_FanovaTree`'s node-lookup methods leaked every tree built for a `get_param_importances()` call; **llama_index** — `VectaraIndex._get_corpus_key` leaked the index *and* broke its own `__del__`-based HTTP session cleanup; **litellm** — `Router._cached_get_model_group_info` leaked every `Router` even after its own documented `discard()` cleanup |
 | **CH012** | `floating-process` | A non-daemon `multiprocessing.Process` that's `.start()`ed but never `.join()`ed — the process analog of CH009. | hardening rule |
 | **CH013** | `discarded-future` | `ThreadPoolExecutor`/`ProcessPoolExecutor.submit(...)` called as a bare statement — the returned `Future` (and any exception raised inside the submitted work) is silently discarded. | hardening rule — real hits in litellm, accelerate, langchain |
@@ -223,6 +230,11 @@ repos:
 | **CH029** | `finally-swallows-exception` | `return`/`break`/`continue` in a `finally:` block silently discards any exception from the `try:` — the caller never sees it. | hardening rule — real hits in letta |
 | **CH030** | `lru-cache-on-async-function` | `@lru_cache`/`@cache` on `async def` caches the coroutine *object*, not its result — the second call with the same arguments crashes. | hardening rule |
 | **CH031** | `unclosed-pool` | `multiprocessing.Pool()` never `.close()`d/`.terminate()`d — worker processes leak for the life of the parent. | hardening rule |
+| **CH032** | `nondeterministic-default-argument` | A default argument computed from `time.time()`/`datetime.now()`/`random.random()`/`uuid.uuid4()` etc. — evaluated once at definition time, so every call using the default gets the *same* value forever. (inspired by flake8-bugbear B008, narrowed to a curated function list — see below) | hardening rule — real hit in litellm (`BudgetManager.create_budget`'s `created_at=time.time()` default) |
+| **CH033** | `strip-multichar-argument` | `.strip()`/`.lstrip()`/`.rstrip()` called with a multi-character string that contains a letter or digit — `str.strip(chars)` removes any of those *characters*, not the substring, from each end. (inspired by flake8-bugbear B005, narrowed to skip punctuation-only character sets — see below) | hardening rule — real hit in huggingface_hub (SSE parsing: `line.lstrip("data:").rstrip("/n")`, the second almost certainly meant `"\n"`) |
+| **CH034** | `raise-literal` | `raise "some error"` / `raise None` / `raise (1, 2)` — raising anything that isn't an exception instance always fails with a *different*, unrelated `TypeError` at the exact moment something has already gone wrong. (flake8-bugbear B016) | hardening rule — real hit in llama_index (an `ImportError` fallback that raises a bare string instead) |
+| **CH035** | `empty-except-tuple` | `except ():` — an empty tuple matches nothing, so the handler can never run; every exception still propagates past it. (flake8-bugbear B029) | hardening rule — zero corpus hits (see below) |
+| **CH036** | `environ-reassignment` | `os.environ = {...}` rebinds the name but doesn't call `putenv`/`unsetenv` — the real process environment (what child processes and C-level `getenv` see) stays unchanged. (flake8-bugbear B003) | hardening rule — real hit in HuggingFace `datasets` (a multiprocessing restore that silently doesn't reach spawned worker processes) |
 
 `codehound list` prints this from the source of truth.
 
@@ -473,7 +485,7 @@ codehound/
 
 Each check receives a parsed `ast` tree plus the precomputed parent map and returns `Finding`s. Adding a rule is one file + one registry line + a test. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for a full walkthrough of the engine, the parent map, and the design decisions.
 
-**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. CH016 doesn't flag a socket returned as part of a tuple/list, or passed as an argument to any call (as opposed to being the receiver of a call on itself) — real patterns found in vllm's rendezvous code. CH020 won't flag a `BaseException` handler whose bound name is actually referenced, or whose body re-raises anywhere in its own scope (not counting a nested try/except's own handler) — both real patterns found in agno. CH021 doesn't flag a relative import (`node.level != 0`) of a same-named local module, or an import already inside a `try:`/`except ImportError:` fallback — real patterns found in vllm and agno respectively. CH025 pairs each chained comparison's op with only its own adjacent operands, rather than matching a literal and an `is`/`is not` anywhere in the same chain independently — a real pattern found in litellm. CH027 and CH028 both recognize a handle stored as *any* object's attribute as a hand-off, matching CH009/CH016's precedent — real patterns found in dspy and weaviate-python-client respectively. CH028 also only trusts a bare `Timer(...)` when `from threading import Timer` was actually seen — real hits in agno were its own unrelated stopwatch class. CH029 skips a `try` whose `except` clauses never re-raise anywhere in their own scope — a real pattern in letta where the exception is deliberately logged and recorded, never propagated, so a `return` in `finally` isn't discarding anything live. All of those guards exist because of real false positives caught while building the checks (see above and [`docs/FINDINGS.md`](docs/FINDINGS.md)). The test suite asserts both "bad code is flagged" and "correct code is not."
+**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. CH016 doesn't flag a socket returned as part of a tuple/list, or passed as an argument to any call (as opposed to being the receiver of a call on itself) — real patterns found in vllm's rendezvous code. CH020 won't flag a `BaseException` handler whose bound name is actually referenced, or whose body re-raises anywhere in its own scope (not counting a nested try/except's own handler) — both real patterns found in agno. CH021 doesn't flag a relative import (`node.level != 0`) of a same-named local module, or an import already inside a `try:`/`except ImportError:` fallback — real patterns found in vllm and agno respectively. CH025 pairs each chained comparison's op with only its own adjacent operands, rather than matching a literal and an `is`/`is not` anywhere in the same chain independently — a real pattern found in litellm. CH027 and CH028 both recognize a handle stored as *any* object's attribute as a hand-off, matching CH009/CH016's precedent — real patterns found in dspy and weaviate-python-client respectively. CH028 also only trusts a bare `Timer(...)` when `from threading import Timer` was actually seen — real hits in agno were its own unrelated stopwatch class. CH029 skips a `try` whose `except` clauses never re-raise anywhere in their own scope — a real pattern in letta where the exception is deliberately logged and recorded, never propagated, so a `return` in `finally` isn't discarding anything live. CH033 skips a `.strip()` argument that's every character the same (`.strip('```')`) or made entirely of punctuation/whitespace with no letter or digit (`.strip('\r\n')`, `.strip('[]')`) — real patterns found across nearly every framework scanned, all deliberate uses of the character-*set* semantics rather than the substring mistake the check exists to catch. All of those guards exist because of real false positives caught while building the checks (see above and [`docs/FINDINGS.md`](docs/FINDINGS.md)). The test suite asserts both "bad code is flagged" and "correct code is not."
 
 ---
 
@@ -517,11 +529,17 @@ Every check has paired tests: the buggy pattern *is* flagged, and the idiomatic
 - [x] `--fix` — CH017 always, CH004 only inside `async def` (CH002/CH003
       turned out to need judgment calls or import-injection this tool
       won't guess at, so they stay detection-only; see docs/ARCHITECTURE.md)
-- [ ] Cross-module resolution for CH007/CH009 (currently same-file only)
-- [ ] Extend CH001 to a curated denylist of sync AI/agent SDK client calls inside async functions (vector-DB clients, LLM SDKs) — the gap flake8-async's stdlib-only denylist leaves open
 - [x] Parallelize scanning across files for large codebases — a full
       HuggingFace transformers scan went from 57s to 12s (measured,
       byte-identical output verified against the sequential run)
+- [x] 33 checks — nested-`def` loop-closure capture alongside lambdas
+      (CH010, same shape as bugbear's B023), nondeterministic default
+      arguments, multi-character `.strip()` arguments — CH032-CH033
+- [x] 36 checks — raising a literal instead of an exception, an empty
+      `except ()` tuple that can never match, direct `os.environ`
+      reassignment that doesn't sync the real environment — CH034-CH036
+- [ ] Cross-module resolution for CH007/CH009 (currently same-file only)
+- [ ] Extend CH001 to a curated denylist of sync AI/agent SDK client calls inside async functions (vector-DB clients, LLM SDKs) — the gap flake8-async's stdlib-only denylist leaves open
 
 ---
 

{codehound-1.8.0 → codehound-1.10.0}/README.md

@@ -4,7 +4,7 @@
 
 <h1 align="center">codehound</h1>
 
-**An AST-based static analyzer that hunts *real* bugs in large Python codebases — thirty-one checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
+**An AST-based static analyzer that hunts *real* bugs in large Python codebases — thirty-six checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
 
 [![CI](https://github.com/kratos0718/codehound/actions/workflows/ci.yml/badge.svg)](https://github.com/kratos0718/codehound/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/codehound.svg)](https://pypi.org/project/codehound/)
@@ -47,7 +47,14 @@ I was contributing bug fixes to large AI frameworks and noticed the same handful
 
 ## How this compares
 
-Being upfront about overlap: `codehound` is not the only tool that catches some of these patterns, and pretending otherwise wouldn't survive five minutes of someone actually checking. [Ruff](https://docs.astral.sh/ruff/)'s `RUF006` already catches a discarded `asyncio.create_task()` (CH006), `flake8-async`'s `ASYNC300` predates it. Ruff's `RUF012` already catches mutable class-level defaults (CH026), `F632` catches `is`-literal comparisons (CH025), `B006`/`UP005`/`E722` cover mutable-default-arguments/deprecated-unittest-aliases/bare-except (CH002/CH024/CH020). Pylint's `W1518` (`method-cache-max-size-none`) is close to a name-for-name match for CH011's `lru_cache`-on-instance-method leak. If you already run ruff and pylint, several of `codehound`'s checks will feel familiar.
+Being upfront about overlap: `codehound` is not the only tool that catches some of these patterns, and pretending otherwise wouldn't survive five minutes of someone actually checking. [Ruff](https://docs.astral.sh/ruff/)'s `RUF006` already catches a discarded `asyncio.create_task()` (CH006), `flake8-async`'s `ASYNC300` predates it. Ruff's `RUF012` already catches mutable class-level defaults (CH026), `F632` catches `is`-literal comparisons (CH025), `B006`/`UP005`/`E722` cover mutable-default-arguments/deprecated-unittest-aliases/bare-except (CH002/CH024/CH020). Pylint's `W1518` (`method-cache-max-size-none`) is close to a name-for-name match for CH011's `lru_cache`-on-instance-method leak. flake8-bugbear's `B012` also overlaps with CH029 (`return`/`break`/`continue` in `finally:`), though CH029 is narrower — bugbear also flags a bare `continue` inside a `finally:` loop body, which this project hasn't verified has the same swallowed-exception risk in every case. If you already run ruff and pylint, several of `codehound`'s checks will feel familiar.
+
+Six checks are explicit adaptations of a flake8-bugbear idea. Three are kept deliberately narrower than the source rule after checking where the broader version's false-positive risk actually lands; three others (`B016`, `B029`, `B003`) are ported close to as-is because the underlying bug has no narrower/broader version to weigh — it's a fixed fact about the language, true in every version of Python 3, with no configuration or heuristic to get wrong:
+
+- **CH010** extends to cover a nested `def` capturing a loop variable, the same shape bugbear's `B023` covers alongside its lambda case — the same storage-based precision guard (only fires if the function is actually stored past the iteration) applies to both.
+- **CH032** takes bugbear's `B008` idea — "a call as a default argument is suspicious" — and narrows it to a curated list of ten functions (`time.time`, `datetime.now`, `random.random`, `uuid.uuid4`, …) whose result is *never* sensibly the same across calls. B008 as written also flags `def f(x=some_factory()):`, which is frequently a deliberate compute-once memoization; that ambiguity is exactly why this project didn't just port the broader rule.
+- **CH033** takes `B005`'s "`.strip()` with a multi-character argument is misleading" and adds one precision pass B005 doesn't: skip the argument entirely when it contains no letter or digit. Scanning ~30 real frameworks turned up over a hundred multi-character `.strip()` calls, and the overwhelming majority — `.strip('\r\n')`, `.strip('[]')`, `.strip('\'"')`, box-drawing tree glyphs — were deliberate, correct uses of the character-*set* semantics, not the substring mistake the rule exists to catch. Only the argument that reads as a word or token (`data:`, `/v1`, `THREAD#`) is the real bug; a bag of punctuation isn't. Full before/after counts in [`docs/FINDINGS.md`](docs/FINDINGS.md).
+- **CH034** (`B016`) — `raise <literal>` always raises a different, unrelated `TypeError` instead of the exception the author wrote. **CH035** (`B029`) — `except ():` can never match anything; the handler is dead code. **CH036** (`B003`) — `os.environ = {...}` rebinds the name without calling `putenv`/`unsetenv`, so the real process environment silently doesn't change. All three verified directly in a REPL before writing any AST code (`docs/FINDINGS.md` has the exact repro for each), and all three have zero false-positive risk: there's no legitimate Python where raising a literal succeeds, an empty exception tuple catches something, or reassigning `os.environ` actually syncs the environment.
 
 What actually seems to be missing elsewhere, as far as I've been able to find:
 
@@ -67,7 +74,7 @@ And a difference in kind, not just coverage: every check here is checked against
 pip install codehound
 ```
 
-Zero dependencies — it's ~4,000 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
+Zero dependencies — it's ~4,450 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
 
 <details>
 <summary>From a clone instead (for development)</summary>
@@ -160,7 +167,7 @@ Uploads findings to the repo's **Security → Code Scanning** tab via SARIF, in
 ```yaml
 repos:
   - repo: https://github.com/kratos0718/codehound
-    rev: v1.8.0
+    rev: v1.10.0
     hooks:
       - id: codehound
 ```
@@ -180,7 +187,7 @@ repos:
 | **CH007** | `unawaited-coroutine-call` | `foo()` where `foo` is `async def`, called as a bare statement — no `await`, no scheduling. The coroutine object is created and dropped; the body **never runs at all**. | hardening rule — see below |
 | **CH008** | `asyncio-run-in-running-loop` | `asyncio.run(...)` called from inside an `async def` — always raises `RuntimeError`, immediately, every time. | hardening rule — zero corpus hits (see below) |
 | **CH009** | `floating-thread` | A non-daemon `threading.Thread` that's `.start()`ed but never `.join()`ed — the thread analog of CH006. | hardening rule — see below |
-| **CH010** | `loop-closure-capture` | A `lambda` inside a `for` loop (or comprehension) that's *stored* (appended, assigned, returned) and captures the loop variable by reference — every stored instance ends up sharing the loop's **final** value. | **accelerate** (HuggingFace) — `MegatronEngine.get_module_config`'s `param_sync_func` list, PR #4273 |
+| **CH010** | `loop-closure-capture` | A `lambda` *or* nested `def` inside a `for` loop (or comprehension) that's *stored* (appended, assigned, returned) and captures the loop variable by reference — every stored instance ends up sharing the loop's **final** value. | **accelerate** (HuggingFace) — `MegatronEngine.get_module_config`'s `param_sync_func` list, PR #4273 |
 | **CH011** | `lru-cache-on-method` | `@lru_cache`/`@cache` decorating an instance method — the cache holds a strong reference to `self` forever, so every instance that ever calls the method leaks for the process lifetime. | **optuna** — `_FanovaTree`'s node-lookup methods leaked every tree built for a `get_param_importances()` call; **llama_index** — `VectaraIndex._get_corpus_key` leaked the index *and* broke its own `__del__`-based HTTP session cleanup; **litellm** — `Router._cached_get_model_group_info` leaked every `Router` even after its own documented `discard()` cleanup |
 | **CH012** | `floating-process` | A non-daemon `multiprocessing.Process` that's `.start()`ed but never `.join()`ed — the process analog of CH009. | hardening rule |
 | **CH013** | `discarded-future` | `ThreadPoolExecutor`/`ProcessPoolExecutor.submit(...)` called as a bare statement — the returned `Future` (and any exception raised inside the submitted work) is silently discarded. | hardening rule — real hits in litellm, accelerate, langchain |
@@ -202,6 +209,11 @@ repos:
 | **CH029** | `finally-swallows-exception` | `return`/`break`/`continue` in a `finally:` block silently discards any exception from the `try:` — the caller never sees it. | hardening rule — real hits in letta |
 | **CH030** | `lru-cache-on-async-function` | `@lru_cache`/`@cache` on `async def` caches the coroutine *object*, not its result — the second call with the same arguments crashes. | hardening rule |
 | **CH031** | `unclosed-pool` | `multiprocessing.Pool()` never `.close()`d/`.terminate()`d — worker processes leak for the life of the parent. | hardening rule |
+| **CH032** | `nondeterministic-default-argument` | A default argument computed from `time.time()`/`datetime.now()`/`random.random()`/`uuid.uuid4()` etc. — evaluated once at definition time, so every call using the default gets the *same* value forever. (inspired by flake8-bugbear B008, narrowed to a curated function list — see below) | hardening rule — real hit in litellm (`BudgetManager.create_budget`'s `created_at=time.time()` default) |
+| **CH033** | `strip-multichar-argument` | `.strip()`/`.lstrip()`/`.rstrip()` called with a multi-character string that contains a letter or digit — `str.strip(chars)` removes any of those *characters*, not the substring, from each end. (inspired by flake8-bugbear B005, narrowed to skip punctuation-only character sets — see below) | hardening rule — real hit in huggingface_hub (SSE parsing: `line.lstrip("data:").rstrip("/n")`, the second almost certainly meant `"\n"`) |
+| **CH034** | `raise-literal` | `raise "some error"` / `raise None` / `raise (1, 2)` — raising anything that isn't an exception instance always fails with a *different*, unrelated `TypeError` at the exact moment something has already gone wrong. (flake8-bugbear B016) | hardening rule — real hit in llama_index (an `ImportError` fallback that raises a bare string instead) |
+| **CH035** | `empty-except-tuple` | `except ():` — an empty tuple matches nothing, so the handler can never run; every exception still propagates past it. (flake8-bugbear B029) | hardening rule — zero corpus hits (see below) |
+| **CH036** | `environ-reassignment` | `os.environ = {...}` rebinds the name but doesn't call `putenv`/`unsetenv` — the real process environment (what child processes and C-level `getenv` see) stays unchanged. (flake8-bugbear B003) | hardening rule — real hit in HuggingFace `datasets` (a multiprocessing restore that silently doesn't reach spawned worker processes) |
 
 `codehound list` prints this from the source of truth.
 
@@ -452,7 +464,7 @@ codehound/
 
 Each check receives a parsed `ast` tree plus the precomputed parent map and returns `Finding`s. Adding a rule is one file + one registry line + a test. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for a full walkthrough of the engine, the parent map, and the design decisions.
 
-**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. CH016 doesn't flag a socket returned as part of a tuple/list, or passed as an argument to any call (as opposed to being the receiver of a call on itself) — real patterns found in vllm's rendezvous code. CH020 won't flag a `BaseException` handler whose bound name is actually referenced, or whose body re-raises anywhere in its own scope (not counting a nested try/except's own handler) — both real patterns found in agno. CH021 doesn't flag a relative import (`node.level != 0`) of a same-named local module, or an import already inside a `try:`/`except ImportError:` fallback — real patterns found in vllm and agno respectively. CH025 pairs each chained comparison's op with only its own adjacent operands, rather than matching a literal and an `is`/`is not` anywhere in the same chain independently — a real pattern found in litellm. CH027 and CH028 both recognize a handle stored as *any* object's attribute as a hand-off, matching CH009/CH016's precedent — real patterns found in dspy and weaviate-python-client respectively. CH028 also only trusts a bare `Timer(...)` when `from threading import Timer` was actually seen — real hits in agno were its own unrelated stopwatch class. CH029 skips a `try` whose `except` clauses never re-raise anywhere in their own scope — a real pattern in letta where the exception is deliberately logged and recorded, never propagated, so a `return` in `finally` isn't discarding anything live. All of those guards exist because of real false positives caught while building the checks (see above and [`docs/FINDINGS.md`](docs/FINDINGS.md)). The test suite asserts both "bad code is flagged" and "correct code is not."
+**False-positive discipline is a feature.** CH005 won't flag a handle that's `return`ed (the caller owns it) or explicitly `.close()`d. CH006 won't flag `TaskGroup.create_task` (the group holds the reference). CH001 only fires when the *enclosing* function is `async`. CH007 scopes `self.foo()` matches to async methods on the *same* class as the call site, and bare `foo()` matches to module-level async functions that aren't shadowed by a same-named parameter. CH009 doesn't flag a thread handed off as *any* object's attribute, not just `self`. CH010 only fires when a lambda is directly stored (appended, assigned, returned), not merely passed as a callback argument that gets consumed on the spot. CH016 doesn't flag a socket returned as part of a tuple/list, or passed as an argument to any call (as opposed to being the receiver of a call on itself) — real patterns found in vllm's rendezvous code. CH020 won't flag a `BaseException` handler whose bound name is actually referenced, or whose body re-raises anywhere in its own scope (not counting a nested try/except's own handler) — both real patterns found in agno. CH021 doesn't flag a relative import (`node.level != 0`) of a same-named local module, or an import already inside a `try:`/`except ImportError:` fallback — real patterns found in vllm and agno respectively. CH025 pairs each chained comparison's op with only its own adjacent operands, rather than matching a literal and an `is`/`is not` anywhere in the same chain independently — a real pattern found in litellm. CH027 and CH028 both recognize a handle stored as *any* object's attribute as a hand-off, matching CH009/CH016's precedent — real patterns found in dspy and weaviate-python-client respectively. CH028 also only trusts a bare `Timer(...)` when `from threading import Timer` was actually seen — real hits in agno were its own unrelated stopwatch class. CH029 skips a `try` whose `except` clauses never re-raise anywhere in their own scope — a real pattern in letta where the exception is deliberately logged and recorded, never propagated, so a `return` in `finally` isn't discarding anything live. CH033 skips a `.strip()` argument that's every character the same (`.strip('```')`) or made entirely of punctuation/whitespace with no letter or digit (`.strip('\r\n')`, `.strip('[]')`) — real patterns found across nearly every framework scanned, all deliberate uses of the character-*set* semantics rather than the substring mistake the check exists to catch. All of those guards exist because of real false positives caught while building the checks (see above and [`docs/FINDINGS.md`](docs/FINDINGS.md)). The test suite asserts both "bad code is flagged" and "correct code is not."
 
 ---
 
@@ -496,11 +508,17 @@ Every check has paired tests: the buggy pattern *is* flagged, and the idiomatic
 - [x] `--fix` — CH017 always, CH004 only inside `async def` (CH002/CH003
       turned out to need judgment calls or import-injection this tool
       won't guess at, so they stay detection-only; see docs/ARCHITECTURE.md)
-- [ ] Cross-module resolution for CH007/CH009 (currently same-file only)
-- [ ] Extend CH001 to a curated denylist of sync AI/agent SDK client calls inside async functions (vector-DB clients, LLM SDKs) — the gap flake8-async's stdlib-only denylist leaves open
 - [x] Parallelize scanning across files for large codebases — a full
       HuggingFace transformers scan went from 57s to 12s (measured,
       byte-identical output verified against the sequential run)
+- [x] 33 checks — nested-`def` loop-closure capture alongside lambdas
+      (CH010, same shape as bugbear's B023), nondeterministic default
+      arguments, multi-character `.strip()` arguments — CH032-CH033
+- [x] 36 checks — raising a literal instead of an exception, an empty
+      `except ()` tuple that can never match, direct `os.environ`
+      reassignment that doesn't sync the real environment — CH034-CH036
+- [ ] Cross-module resolution for CH007/CH009 (currently same-file only)
+- [ ] Extend CH001 to a curated denylist of sync AI/agent SDK client calls inside async functions (vector-DB clients, LLM SDKs) — the gap flake8-async's stdlib-only denylist leaves open
 
 ---
 

{codehound-1.8.0 → codehound-1.10.0}/src/codehound/__init__.py

@@ -1,9 +1,9 @@
 """codehound - an AST-based static analyzer that hunts real bugs in Python code.
 
-Thirty-one checks. Eight are each backed by a bug that was actually
+Thirty-six checks. Eight are each backed by a bug that was actually
 found and fixed (or opened as a PR) in a popular open-source AI framework
 (agno, crewAI, mem0, llama_index, accelerate, optuna, litellm). The rest
-(CH007-CH009, CH012-CH031) are hardening rules verified against real
+(CH007-CH009, CH012-CH036) are hardening rules verified against real
 false positives across a ~29-framework validation corpus instead - see
 docs/FINDINGS.md.
 
@@ -19,7 +19,7 @@ from __future__ import annotations
 from codehound.checks import ALL_CHECKS, get_checks
 from codehound.core import Check, Finding, scan_file, scan_files, scan_path
 
-__version__ = "1.8.0"
+__version__ = "1.10.0"
 
 __all__ = [
     "ALL_CHECKS",

{codehound-1.8.0 → codehound-1.10.0}/src/codehound/checks/__init__.py

@@ -10,6 +10,8 @@ from codehound.checks.blocking_async import BlockingCallInAsync
 from codehound.checks.collections_abc_import import CollectionsAbcImport
 from codehound.checks.datetime_utcnow import DeprecatedDatetimeUtcnow
 from codehound.checks.discarded_future import DiscardedFuture
+from codehound.checks.empty_except_tuple import EmptyExceptTuple
+from codehound.checks.environ_reassignment import EnvironReassignment
 from codehound.checks.finally_swallows_exception import FinallySwallowsException
 from codehound.checks.floating_process import FloatingProcess
 from codehound.checks.floating_task import FloatingTask
@@ -22,11 +24,14 @@ from codehound.checks.lru_cache_on_async_function import LruCacheOnAsyncFunction
 from codehound.checks.lru_cache_on_method import LruCacheOnMethod
 from codehound.checks.mutable_class_attribute import MutableClassAttribute
 from codehound.checks.mutable_defaults import MutableDefaultArgument
+from codehound.checks.nondeterministic_default import NondeterministicDefault
+from codehound.checks.raise_literal import RaiseLiteral
 from codehound.checks.removed_asyncio_task_methods import RemovedAsyncioTaskMethods
 from codehound.checks.removed_getargspec import RemovedGetargspec
 from codehound.checks.removed_stdlib_attribute import RemovedStdlibAttribute
 from codehound.checks.removed_stdlib_module import RemovedStdlibModule
 from codehound.checks.resource_leak import UnclosedFileHandle
+from codehound.checks.strip_multichar import StripMultichar
 from codehound.checks.unawaited_coroutine import UnawaitedCoroutineCall
 from codehound.checks.unclosed_pool import UnclosedPool
 from codehound.checks.unclosed_socket import UnclosedSocket
@@ -67,6 +72,11 @@ ALL_CHECKS: list[type[Check]] = [
     FinallySwallowsException,
     LruCacheOnAsyncFunction,
     UnclosedPool,
+    NondeterministicDefault,
+    StripMultichar,
+    RaiseLiteral,
+    EmptyExceptTuple,
+    EnvironReassignment,
 ]
 
 

codehound-1.10.0/src/codehound/checks/empty_except_tuple.py

@@ -0,0 +1,57 @@
+"""CH035 - ``except ():`` catches nothing at all.
+
+`isinstance(exc, ())` is always `False` - an empty tuple has nothing
+to match against - so `except ():` is a handler that can *never* run.
+Verified directly:
+
+    try:
+        raise ValueError("boom")
+    except ():
+        print("caught")   # never printed
+    # ValueError propagates past the handler, as if it wasn't there
+
+This is flake8-bugbear's B029. It's easy to write by accident - a
+`(SomeError,)` tuple that gets refactored down to nothing (a variable
+that used to hold exception types now holds an empty list/tuple,
+or an `except (E1, E2):` where both names got deleted during a merge)
+silently turns into dead code with no error, no warning, and a handler
+that reads as if it's protecting something it no longer protects.
+
+Zero configuration, zero false-positive risk: an empty tuple can never
+match any exception, so there's no reading of `except ():` where it's
+doing useful work.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding
+
+
+class EmptyExceptTuple(Check):
+    code = "CH035"
+    name = "empty-except-tuple"
+    description = "except () catches nothing - an empty exception tuple can never match, so the handler is dead code."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.ExceptHandler):
+                continue
+            if not (isinstance(node.type, ast.Tuple) and len(node.type.elts) == 0):
+                continue
+            findings.append(
+                Finding(
+                    path=path,
+                    line=node.lineno,
+                    col=node.col_offset,
+                    code=self.code,
+                    message=(
+                        "`except ():` can never match any exception - an empty tuple has "
+                        "nothing to catch, so this handler is dead code and every exception "
+                        "still propagates past it."
+                    ),
+                )
+            )
+        return findings

codehound-1.10.0/src/codehound/checks/environ_reassignment.py

@@ -0,0 +1,69 @@
+"""CH036 - assigning directly to ``os.environ`` doesn't sync the real environment.
+
+`os.environ` isn't a plain dict - it's a special mapping (`os._Environ`)
+that calls `os.putenv`/`os.unsetenv` under the hood so the process's
+*actual* environment (the C-level `environ`, the thing child processes
+inherit) stays in sync with what Python sees. `os.environ = {...}`
+doesn't call any of that - it just rebinds the module attribute to a
+plain dict, leaving the real environment untouched. Verified directly:
+
+    os.environ['TOKEN'] = 'secret'
+    os.environ = {}
+    subprocess.run([...])  # child process still sees TOKEN='secret'
+    os.getenv('TOKEN')     # None - Python's own view says it's gone
+
+Python's own view and the operating system's view now disagree, and
+whichever one a test or a child process happens to read from decides
+whether the "clear" actually took effect. This is flake8-bugbear's
+B003, and it's exactly the kind of gotcha that looks like the obviously
+correct way to reset environment state - `os.environ = old_snapshot`
+inside a test's cleanup/`finally:` block is the single most common
+place this shows up, precisely because it looks like a restore and
+silently isn't one.
+
+Only flags a direct assignment to the `os.environ` attribute -
+`os.environ.clear()`, `os.environ.update(...)`, `os.environ.pop(...)`,
+and `del os.environ[...]` all go through the real mapping and are all
+correct, unflagged uses.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding
+
+
+def _is_os_environ_attribute(node: ast.expr) -> bool:
+    return isinstance(node, ast.Attribute) and node.attr == "environ" and isinstance(node.value, ast.Name) and node.value.id == "os"
+
+
+class EnvironReassignment(Check):
+    code = "CH036"
+    name = "environ-reassignment"
+    description = "os.environ = ... rebinds the name but doesn't sync the real process environment; use .clear()/.update() instead."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Assign):
+                continue
+            for target in node.targets:
+                if not _is_os_environ_attribute(target):
+                    continue
+                findings.append(
+                    Finding(
+                        path=path,
+                        line=node.lineno,
+                        col=node.col_offset,
+                        code=self.code,
+                        message=(
+                            "assigning directly to `os.environ` rebinds the name but doesn't "
+                            "call putenv/unsetenv - the real process environment (what child "
+                            "processes and `os.getenv` from C libraries see) stays unchanged. "
+                            "Use `os.environ.clear()` and/or `.update(...)` instead."
+                        ),
+                    )
+                )
+                break
+        return findings

{codehound-1.8.0 → codehound-1.10.0}/src/codehound/checks/loop_closure_capture.py

@@ -29,6 +29,14 @@ Comprehensions (`` [lambda: i for i in range(3)] ``) are the one
 exception: the ``elt``/``key``/``value`` position *is* inherently the
 "produce and store" position, so no extra storage-context check is
 needed there.
+
+Same bug, same fix, different syntax: a nested ``def`` inside a ``for``
+loop captures the loop variable exactly the same way a lambda does -
+flake8-bugbear's B023 covers both shapes under one rule, and this check
+now does too. ``def`` is a statement, not an expression, so "is it
+stored" means something different: the function's *name* has to show up
+later in a storage position (appended, assigned, returned), not the
+``def`` itself.
 """
 
 from __future__ import annotations
@@ -54,6 +62,53 @@ def _references_name_unshadowed(lam: ast.Lambda, name: str) -> bool:
     return False
 
 
+def _references_name_in_body(funcdef: ast.FunctionDef | ast.AsyncFunctionDef, name: str) -> bool:
+    """Like ``_references_name_unshadowed`` but for a ``def``'s own
+    parameters and statement body rather than a lambda's params and
+    single expression - a same-named parameter shadows the outer loop
+    variable exactly like it would for a lambda."""
+    args = funcdef.args
+    param_names = {a.arg for a in (args.posonlyargs + args.args + args.kwonlyargs)}
+    if args.vararg:
+        param_names.add(args.vararg.arg)
+    if args.kwarg:
+        param_names.add(args.kwarg.arg)
+    if name in param_names:
+        return False
+    for stmt in funcdef.body:
+        for node in ast.walk(stmt):
+            if isinstance(node, ast.Name) and node.id == name and isinstance(node.ctx, ast.Load):
+                return True
+    return False
+
+
+def _name_is_stored(name: str, loop_body: list[ast.stmt], parents: dict) -> bool:
+    """True if `name` (a nested def's own name) is later used in a
+    storage position anywhere in the loop body: assigned, returned/
+    yielded, or passed to `.append()`/`.add()` - same storage shapes
+    `_is_stored` recognizes for a lambda, just checked via the Name
+    reference's parent instead of the def statement's own parent, since
+    a `def` can't be the direct value of an assignment the way a lambda
+    expression can."""
+    for stmt in loop_body:
+        for node in ast.walk(stmt):
+            if not (isinstance(node, ast.Name) and node.id == name and isinstance(node.ctx, ast.Load)):
+                continue
+            parent = parents.get(id(node))
+            if isinstance(parent, (ast.Assign, ast.AnnAssign)) and parent.value is node:
+                return True
+            if isinstance(parent, (ast.Return, ast.Yield)) and parent.value is node:
+                return True
+            if (
+                isinstance(parent, ast.Call)
+                and isinstance(parent.func, ast.Attribute)
+                and parent.func.attr in _STORAGE_METHODS
+                and node in parent.args
+            ):
+                return True
+    return False
+
+
 def _is_stored(lam: ast.Lambda, parents: dict) -> bool:
     """True only if the lambda is directly stored somewhere that outlives
     this loop iteration - not merely passed as a callback argument to a
@@ -120,4 +175,35 @@ class LoopClosureCapture(Check):
                                 )
                             )
                             break
+
+            # Same bug, `def` instead of `lambda`: a nested function
+            # defined directly in a `for` loop's body, capturing the loop
+            # variable, whose *name* (not the def itself) is later stored
+            # somewhere that outlives this iteration.
+            if isinstance(loop, ast.For) and isinstance(loop.target, ast.Name):
+                var = loop.target.id
+                for stmt in loop.body:
+                    if not isinstance(stmt, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                        continue
+                    if id(stmt) in seen:
+                        continue
+                    if not _references_name_in_body(stmt, var):
+                        continue
+                    if not _name_is_stored(stmt.name, loop.body, parents):
+                        continue
+                    seen.add(id(stmt))
+                    findings.append(
+                        Finding(
+                            path=path,
+                            line=stmt.lineno,
+                            col=stmt.col_offset,
+                            code=self.code,
+                            message=(
+                                f"`{stmt.name}` captures loop variable `{var}` by reference; if "
+                                f"called after the loop moves on, every instance sees the same "
+                                f"final value. Bind it explicitly with a default argument, e.g. "
+                                f"`def {stmt.name}({var}={var}):`."
+                            ),
+                        )
+                    )
         return findings

codehound-1.10.0/src/codehound/checks/nondeterministic_default.py

@@ -0,0 +1,99 @@
+"""CH032 - a default argument computed from a call to a non-deterministic function.
+
+A default value is evaluated exactly *once*, when the function is
+defined, not on every call - the same fact CH002 is about, but this is
+a distinct shape: a call to something like `time.time()` or
+`datetime.now()` isn't mutable, so CH002's "shared mutable object" check
+doesn't fire, and it's syntactically identical to a perfectly reasonable
+default like `def f(x=DEFAULT_TIMEOUT):`. What makes it a bug is that
+the *value itself* depends on when it's called, and every default
+argument only ever captures the value from function-definition time.
+Verified directly:
+
+    def f(x=time.time()):
+        return x
+
+    a = f()
+    time.sleep(0.05)
+    b = f()
+    a == b  # True - both calls return the exact same timestamp
+
+Deliberately narrow, unlike a general "any call as a default is
+suspicious" rule (flake8-bugbear's B008, which also flags things like
+`def f(x=some_factory()):` that may well be an intentional
+compute-once memoization): this only flags a curated set of functions
+where "the same value every call" can never be what the author wanted -
+the current time, a random number, a new UUID. A generic factory call
+as a default might be deliberate; a cached `time.time()` never is.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding
+
+# (module, attribute) pairs whose result changes every call and would
+# never sensibly be memoized as a shared default.
+_NONDETERMINISTIC_CALLS: dict[tuple[str, str], str] = {
+    ("time", "time"): "time.time()",
+    ("time", "monotonic"): "time.monotonic()",
+    ("time", "perf_counter"): "time.perf_counter()",
+    ("datetime", "now"): "datetime.now()",
+    ("datetime", "utcnow"): "datetime.utcnow()",
+    ("date", "today"): "date.today()",
+    ("random", "random"): "random.random()",
+    ("random", "randint"): "random.randint()",
+    ("random", "choice"): "random.choice()",
+    ("uuid", "uuid4"): "uuid.uuid4()",
+}
+
+
+def _nondeterministic_call_name(node: ast.expr) -> str | None:
+    if not isinstance(node, ast.Call):
+        return None
+    func = node.func
+    if isinstance(func, ast.Attribute) and isinstance(func.value, ast.Name):
+        return _NONDETERMINISTIC_CALLS.get((func.value.id, func.attr))
+    return None
+
+
+def _iter_defaults(args: ast.arguments):
+    positional = args.posonlyargs + args.args
+    for arg, default in zip(reversed(positional), reversed(args.defaults)):
+        yield arg, default
+    for arg, default in zip(args.kwonlyargs, args.kw_defaults):
+        if default is not None:
+            yield arg, default
+
+
+class NondeterministicDefault(Check):
+    code = "CH032"
+    name = "nondeterministic-default-argument"
+    description = "Default argument calls a function (time/random/uuid) whose result changes every call."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.Lambda)):
+                continue
+            for arg, default in _iter_defaults(node.args):
+                call_text = _nondeterministic_call_name(default)
+                if call_text is None:
+                    continue
+                name = getattr(node, "name", "<lambda>")
+                findings.append(
+                    Finding(
+                        path=path,
+                        line=default.lineno,
+                        col=default.col_offset,
+                        code=self.code,
+                        message=(
+                            f"default value for `{arg.arg}` in `{name}` calls `{call_text}` - "
+                            f"evaluated once, at definition time, not on every call. Every "
+                            f"invocation using the default gets the exact same value. Use "
+                            f"`{arg.arg}=None` and compute it inside the function body instead."
+                        ),
+                    )
+                )
+        return findings

codehound-1.10.0/src/codehound/checks/raise_literal.py

@@ -0,0 +1,62 @@
+"""CH034 - ``raise`` with a literal instead of an exception instance.
+
+`raise` accepts a `BaseException` instance or class - nothing else.
+A string, number, or container literal isn't either, so it always
+raises a *different* exception than the one the author wrote. Verified
+directly, every shape:
+
+    raise "some error"   # TypeError: exceptions must derive from BaseException
+    raise None            # same TypeError
+    raise f"boom {x}"     # same - still a str at runtime
+    raise (1, 2)          # same, for a tuple literal
+    raise {"error": x}    # same, for a dict literal
+
+This is flake8-bugbear's B016, and it earns a place here for the same
+reason CH025 (`is`-literal-comparison) does: the code that triggers it
+reads like a deliberate, reasonable choice - `raise "config missing"`
+looks like someone chose a plain string over defining a custom
+exception class - and the failure mode is a second, unrelated
+`TypeError` at the exact moment something has already gone wrong, which
+is a uniquely bad time to discover a typo.
+
+Zero configuration, zero false-positive risk: this isn't a style
+opinion or a narrowed heuristic like CH032/CH033 - `raise <literal>`
+has exactly one possible outcome in every version of Python 3, so there
+is no "usually fine, occasionally not" case to guard against.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding
+
+_LITERAL_NODE_TYPES = (ast.Constant, ast.JoinedStr, ast.List, ast.Dict, ast.Set, ast.Tuple)
+
+
+class RaiseLiteral(Check):
+    code = "CH034"
+    name = "raise-literal"
+    description = "raise with a literal (str/int/list/dict/...) instead of an exception instance always raises TypeError."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Raise) or node.exc is None:
+                continue
+            if not isinstance(node.exc, _LITERAL_NODE_TYPES):
+                continue
+            findings.append(
+                Finding(
+                    path=path,
+                    line=node.lineno,
+                    col=node.col_offset,
+                    code=self.code,
+                    message=(
+                        "raising a literal instead of an exception instance always fails with "
+                        "`TypeError: exceptions must derive from BaseException` - wrap it in an "
+                        "exception, e.g. `raise ValueError(...)`."
+                    ),
+                )
+            )
+        return findings

codehound-1.10.0/src/codehound/checks/strip_multichar.py

@@ -0,0 +1,88 @@
+"""CH033 - ``.strip()``/``.lstrip()``/``.rstrip()`` called with a multi-character string.
+
+`str.strip(chars)` doesn't remove a substring - `chars` is a *set* of
+characters, stripped one at a time from each end for as long as the
+next character matches something in the set. Verified directly, in the
+shape this actually bites people in:
+
+    "report.txt".strip(".txt")   # 'repor'  - not 'report'
+    "test.txt".strip(".txt")     # 'es'     - not 'test'
+
+Both look like "strip the `.txt` suffix," and both are wrong: the
+trailing `t` in "report" and the leading `t` in "test" are themselves in
+the character set `{'.', 't', 'x'}`, so they get eaten too. This is
+flake8-bugbear's B005, included here because it's exactly the kind of
+subtle, easy-to-write, hard-to-notice correctness bug this project
+exists to catch - the code runs, returns a string, and looks plausible
+at a glance.
+
+Scanning ~30 real frameworks turned up over a hundred multi-character
+`.strip()` calls, and the overwhelming majority were deliberate,
+correct uses of the character-*set* semantics: `.strip('\r\n')` to
+absorb either line-ending convention, `.strip('[]')`/`.strip('()')` to
+peel matching brackets, `.strip('\'"')` to drop either quote style,
+`.lstrip('│ ├└─')` to strip box-drawing tree glyphs.
+None of those are "misread as a substring" mistakes - a reader who
+sees a bag of punctuation or whitespace correctly reads it as a set.
+The real mistakes only showed up when the argument contained a letter
+or digit: `.lstrip('data:')` (the SSE "data: " prefix), `.strip('/v1')`
+(an API version suffix), `.strip('THREAD#')`/`.strip('STEP#')` (DynamoDB
+key prefixes), `.rstrip('/n')` (almost certainly a typo for `'\n'`) -
+those really do read like someone meant a prefix or suffix and reached
+for the wrong method.
+
+So this only flags a multi-character argument that contains at least
+one letter or digit, and isn't just the same character repeated
+(`.strip('```')` strips one character, backtick, no matter how many
+times it appears in the argument - no charset/substring ambiguity to
+get wrong either).
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding
+
+_STRIP_METHODS = {"strip", "lstrip", "rstrip"}
+
+
+class StripMultichar(Check):
+    code = "CH033"
+    name = "strip-multichar-argument"
+    description = "str.strip()/.lstrip()/.rstrip() with a multi-character argument strips a character set, not a substring."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+        for node in ast.walk(tree):
+            if not (
+                isinstance(node, ast.Call)
+                and isinstance(node.func, ast.Attribute)
+                and node.func.attr in _STRIP_METHODS
+                and len(node.args) == 1
+                and not node.keywords
+            ):
+                continue
+            arg = node.args[0]
+            if not (isinstance(arg, ast.Constant) and isinstance(arg.value, str) and len(arg.value) > 1):
+                continue
+            chars = arg.value
+            if len(set(chars)) == 1:
+                continue
+            if not any(c.isalnum() for c in chars):
+                continue
+            findings.append(
+                Finding(
+                    path=path,
+                    line=node.lineno,
+                    col=node.col_offset,
+                    code=self.code,
+                    message=(
+                        f"`.{node.func.attr}({arg.value!r})` strips any of these characters "
+                        f"from each end, not the substring `{arg.value!r}` - "
+                        f"`{arg.value[0]!r}{arg.value[-1]!r}` and every character in between are "
+                        f"each removed independently for as long as they keep matching."
+                    ),
+                )
+            )
+        return findings

{codehound-1.8.0 → codehound-1.10.0}/tests/test_checks.py

@@ -468,6 +468,71 @@ def test_ch010_still_flags_lambda_appended_even_when_named_like_a_key_fn():
     assert len(findings) == 1
 
 
+def test_ch010_flags_nested_def_capturing_loop_variable():
+    # Same bug as the lambda case, `def` instead - flake8-bugbear's B023
+    # covers this shape too.
+    code = (
+        "callbacks = []\n"
+        "for i in range(3):\n"
+        "    def handler():\n"
+        "        return i\n"
+        "    callbacks.append(handler)\n"
+    )
+    findings = _run(code, ["CH010"])
+    assert len(findings) == 1
+    assert findings[0].code == "CH010"
+
+
+def test_ch010_flags_nested_def_returned():
+    code = (
+        "def make_handlers():\n"
+        "    handlers = []\n"
+        "    for i in range(3):\n"
+        "        def handler():\n"
+        "            return i\n"
+        "        handlers.append(handler)\n"
+        "    return handlers\n"
+    )
+    findings = _run(code, ["CH010"])
+    assert len(findings) == 1
+
+
+def test_ch010_ignores_nested_def_shadowed_by_own_parameter():
+    # def's own parameter `i` shadows the outer loop variable - the same
+    # guard the lambda case already has for lambda i=i: i.
+    code = (
+        "callbacks = []\n"
+        "for i in range(3):\n"
+        "    def handler(i):\n"
+        "        return i\n"
+        "    callbacks.append(handler)\n"
+    )
+    assert _run(code, ["CH010"]) == []
+
+
+def test_ch010_ignores_nested_def_not_referencing_loop_var():
+    code = (
+        "callbacks = []\n"
+        "for i in range(3):\n"
+        "    def handler():\n"
+        "        return 42\n"
+        "    callbacks.append(handler)\n"
+    )
+    assert _run(code, ["CH010"]) == []
+
+
+def test_ch010_ignores_nested_def_never_stored():
+    # Defined and called immediately within the same iteration - nothing
+    # outlives the loop, same idea as the immediately-invoked lambda case.
+    code = (
+        "for i in range(3):\n"
+        "    def handler():\n"
+        "        return i\n"
+        "    print(handler())\n"
+    )
+    assert _run(code, ["CH010"]) == []
+
+
 # --- CH011 lru-cache-on-method ------------------------------------------------------
 
 
@@ -1707,3 +1772,214 @@ def test_ch031_ignores_pool_stored_as_attribute():
     )
     assert _run(code, ["CH031"]) == []
 
+
+# --- CH032 nondeterministic-default-argument --------------------------------------------
+
+
+def test_ch032_flags_time_time_default():
+    code = "import time\ndef f(x=time.time()):\n    return x\n"
+    findings = _run(code, ["CH032"])
+    assert len(findings) == 1
+    assert findings[0].code == "CH032"
+
+
+def test_ch032_flags_datetime_now_default():
+    code = "from datetime import datetime\ndef f(x=datetime.now()):\n    return x\n"
+    findings = _run(code, ["CH032"])
+    assert len(findings) == 1
+
+
+def test_ch032_flags_random_default_on_lambda():
+    code = "import random\nf = lambda x=random.random(): x\n"
+    findings = _run(code, ["CH032"])
+    assert len(findings) == 1
+
+
+def test_ch032_flags_uuid4_keyword_only_default():
+    code = "import uuid\ndef f(*, id=uuid.uuid4()):\n    return id\n"
+    findings = _run(code, ["CH032"])
+    assert len(findings) == 1
+
+
+def test_ch032_ignores_none_default():
+    code = "def f(x=None):\n    return x\n"
+    assert _run(code, ["CH032"]) == []
+
+
+def test_ch032_ignores_literal_default():
+    code = "def f(x=10):\n    return x\n"
+    assert _run(code, ["CH032"]) == []
+
+
+def test_ch032_ignores_unrelated_call_default():
+    code = "def f(x=get_default_timeout()):\n    return x\n"
+    assert _run(code, ["CH032"]) == []
+
+
+def test_ch032_ignores_module_constant_default():
+    code = "import time\ndef f(x=time.sleep):\n    return x\n"
+    assert _run(code, ["CH032"]) == []
+
+
+# --- CH033 strip-multichar-argument ------------------------------------------------------
+
+
+def test_ch033_flags_strip_with_multichar_string():
+    code = "'report.txt'.strip('.txt')\n"
+    findings = _run(code, ["CH033"])
+    assert len(findings) == 1
+    assert findings[0].code == "CH033"
+
+
+def test_ch033_flags_lstrip_with_multichar_string():
+    code = "'v1.2.3'.lstrip('v.')\n"
+    findings = _run(code, ["CH033"])
+    assert len(findings) == 1
+
+
+def test_ch033_flags_rstrip_with_multichar_string():
+    code = "'name.txt'.rstrip('.txt')\n"
+    findings = _run(code, ["CH033"])
+    assert len(findings) == 1
+
+
+def test_ch033_ignores_single_char_argument():
+    code = "'name,'.strip(',')\n"
+    assert _run(code, ["CH033"]) == []
+
+
+def test_ch033_ignores_strip_with_no_argument():
+    code = "'  name  '.strip()\n"
+    assert _run(code, ["CH033"]) == []
+
+
+def test_ch033_ignores_non_string_variable_argument():
+    code = "chars = build_chars()\n'name'.strip(chars)\n"
+    assert _run(code, ["CH033"]) == []
+
+
+def test_ch033_ignores_repeated_single_character():
+    code = "'```sql```'.strip('```')\n"
+    assert _run(code, ["CH033"]) == []
+
+
+def test_ch033_ignores_bracket_or_quote_character_set():
+    code = "'[1,2,3]'.strip('[]')\nline.rstrip('\\r\\n')\ns.strip('\\'\"')\n"
+    assert _run(code, ["CH033"]) == []
+
+
+def test_ch033_flags_argument_with_letters_even_with_punctuation():
+    code = "url.strip('/v1')\n"
+    findings = _run(code, ["CH033"])
+    assert len(findings) == 1
+
+
+# --- CH034 raise-literal -----------------------------------------------------------------
+
+
+def test_ch034_flags_raise_string_literal():
+    code = "raise 'some error'\n"
+    findings = _run(code, ["CH034"])
+    assert len(findings) == 1
+    assert findings[0].code == "CH034"
+
+
+def test_ch034_flags_raise_fstring():
+    code = "x = 1\nraise f'boom {x}'\n"
+    findings = _run(code, ["CH034"])
+    assert len(findings) == 1
+
+
+def test_ch034_flags_raise_none():
+    code = "raise None\n"
+    findings = _run(code, ["CH034"])
+    assert len(findings) == 1
+
+
+def test_ch034_flags_raise_tuple_literal():
+    code = "raise (1, 2)\n"
+    findings = _run(code, ["CH034"])
+    assert len(findings) == 1
+
+
+def test_ch034_flags_raise_dict_literal():
+    code = "raise {'error': 'bad'}\n"
+    findings = _run(code, ["CH034"])
+    assert len(findings) == 1
+
+
+def test_ch034_ignores_raise_exception_instance():
+    code = "raise ValueError('bad input')\n"
+    assert _run(code, ["CH034"]) == []
+
+
+def test_ch034_ignores_bare_reraise():
+    code = "try:\n    pass\nexcept Exception:\n    raise\n"
+    assert _run(code, ["CH034"]) == []
+
+
+def test_ch034_ignores_raise_from_variable():
+    code = "def f(exc):\n    raise exc\n"
+    assert _run(code, ["CH034"]) == []
+
+
+# --- CH035 empty-except-tuple -------------------------------------------------------------
+
+
+def test_ch035_flags_empty_except_tuple():
+    code = "try:\n    pass\nexcept ():\n    pass\n"
+    findings = _run(code, ["CH035"])
+    assert len(findings) == 1
+    assert findings[0].code == "CH035"
+
+
+def test_ch035_ignores_single_exception_type():
+    code = "try:\n    pass\nexcept ValueError:\n    pass\n"
+    assert _run(code, ["CH035"]) == []
+
+
+def test_ch035_ignores_nonempty_exception_tuple():
+    code = "try:\n    pass\nexcept (ValueError, TypeError):\n    pass\n"
+    assert _run(code, ["CH035"]) == []
+
+
+def test_ch035_ignores_bare_except():
+    code = "try:\n    pass\nexcept:\n    pass\n"
+    assert _run(code, ["CH035"]) == []
+
+
+# --- CH036 environ-reassignment -----------------------------------------------------------
+
+
+def test_ch036_flags_direct_environ_reassignment():
+    code = "import os\nos.environ = {}\n"
+    findings = _run(code, ["CH036"])
+    assert len(findings) == 1
+    assert findings[0].code == "CH036"
+
+
+def test_ch036_flags_environ_reassignment_from_snapshot():
+    code = "import os\nsaved = os.environ.copy()\nos.environ = saved\n"
+    findings = _run(code, ["CH036"])
+    assert len(findings) == 1
+
+
+def test_ch036_ignores_environ_item_assignment():
+    code = "import os\nos.environ['KEY'] = 'value'\n"
+    assert _run(code, ["CH036"]) == []
+
+
+def test_ch036_ignores_environ_clear():
+    code = "import os\nos.environ.clear()\n"
+    assert _run(code, ["CH036"]) == []
+
+
+def test_ch036_ignores_environ_update():
+    code = "import os\nos.environ.update({'KEY': 'value'})\n"
+    assert _run(code, ["CH036"]) == []
+
+
+def test_ch036_ignores_unrelated_attribute_named_environ():
+    code = "config.environ = {}\n"
+    assert _run(code, ["CH036"]) == []
+