codehound 1.9.0__tar.gz → 1.10.0__tar.gz

{codehound-1.9.0 → codehound-1.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: codehound
-Version: 1.9.0
+Version: 1.10.0
 Summary: An AST-based static analyzer that hunts real correctness and async-safety bugs in Python code.
 Project-URL: Homepage, https://github.com/kratos0718/codehound
 Project-URL: Issues, https://github.com/kratos0718/codehound/issues
@@ -25,7 +25,7 @@ Description-Content-Type: text/markdown
 
 <h1 align="center">codehound</h1>
 
-**An AST-based static analyzer that hunts *real* bugs in large Python codebases — thirty-three checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
+**An AST-based static analyzer that hunts *real* bugs in large Python codebases — thirty-six checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
 
 [![CI](https://github.com/kratos0718/codehound/actions/workflows/ci.yml/badge.svg)](https://github.com/kratos0718/codehound/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/codehound.svg)](https://pypi.org/project/codehound/)
@@ -70,11 +70,12 @@ I was contributing bug fixes to large AI frameworks and noticed the same handful
 
 Being upfront about overlap: `codehound` is not the only tool that catches some of these patterns, and pretending otherwise wouldn't survive five minutes of someone actually checking. [Ruff](https://docs.astral.sh/ruff/)'s `RUF006` already catches a discarded `asyncio.create_task()` (CH006), `flake8-async`'s `ASYNC300` predates it. Ruff's `RUF012` already catches mutable class-level defaults (CH026), `F632` catches `is`-literal comparisons (CH025), `B006`/`UP005`/`E722` cover mutable-default-arguments/deprecated-unittest-aliases/bare-except (CH002/CH024/CH020). Pylint's `W1518` (`method-cache-max-size-none`) is close to a name-for-name match for CH011's `lru_cache`-on-instance-method leak. flake8-bugbear's `B012` also overlaps with CH029 (`return`/`break`/`continue` in `finally:`), though CH029 is narrower — bugbear also flags a bare `continue` inside a `finally:` loop body, which this project hasn't verified has the same swallowed-exception risk in every case. If you already run ruff and pylint, several of `codehound`'s checks will feel familiar.
 
-Three checks are explicit adaptations of a flake8-bugbear idea, kept deliberately narrower than the source rule after checking where the broader version's false-positive risk actually lands:
+Six checks are explicit adaptations of a flake8-bugbear idea. Three are kept deliberately narrower than the source rule after checking where the broader version's false-positive risk actually lands; three others (`B016`, `B029`, `B003`) are ported close to as-is because the underlying bug has no narrower/broader version to weigh — it's a fixed fact about the language, true in every version of Python 3, with no configuration or heuristic to get wrong:
 
 - **CH010** extends to cover a nested `def` capturing a loop variable, the same shape bugbear's `B023` covers alongside its lambda case — the same storage-based precision guard (only fires if the function is actually stored past the iteration) applies to both.
 - **CH032** takes bugbear's `B008` idea — "a call as a default argument is suspicious" — and narrows it to a curated list of ten functions (`time.time`, `datetime.now`, `random.random`, `uuid.uuid4`, …) whose result is *never* sensibly the same across calls. B008 as written also flags `def f(x=some_factory()):`, which is frequently a deliberate compute-once memoization; that ambiguity is exactly why this project didn't just port the broader rule.
 - **CH033** takes `B005`'s "`.strip()` with a multi-character argument is misleading" and adds one precision pass B005 doesn't: skip the argument entirely when it contains no letter or digit. Scanning ~30 real frameworks turned up over a hundred multi-character `.strip()` calls, and the overwhelming majority — `.strip('\r\n')`, `.strip('[]')`, `.strip('\'"')`, box-drawing tree glyphs — were deliberate, correct uses of the character-*set* semantics, not the substring mistake the rule exists to catch. Only the argument that reads as a word or token (`data:`, `/v1`, `THREAD#`) is the real bug; a bag of punctuation isn't. Full before/after counts in [`docs/FINDINGS.md`](docs/FINDINGS.md).
+- **CH034** (`B016`) — `raise <literal>` always raises a different, unrelated `TypeError` instead of the exception the author wrote. **CH035** (`B029`) — `except ():` can never match anything; the handler is dead code. **CH036** (`B003`) — `os.environ = {...}` rebinds the name without calling `putenv`/`unsetenv`, so the real process environment silently doesn't change. All three verified directly in a REPL before writing any AST code (`docs/FINDINGS.md` has the exact repro for each), and all three have zero false-positive risk: there's no legitimate Python where raising a literal succeeds, an empty exception tuple catches something, or reassigning `os.environ` actually syncs the environment.
 
 What actually seems to be missing elsewhere, as far as I've been able to find:
 
@@ -94,7 +95,7 @@ And a difference in kind, not just coverage: every check here is checked against
 pip install codehound
 ```
 
-Zero dependencies — it's ~4,300 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
+Zero dependencies — it's ~4,450 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
 
 <details>
 <summary>From a clone instead (for development)</summary>
@@ -187,7 +188,7 @@ Uploads findings to the repo's **Security → Code Scanning** tab via SARIF, in
 ```yaml
 repos:
   - repo: https://github.com/kratos0718/codehound
-    rev: v1.9.0
+    rev: v1.10.0
     hooks:
       - id: codehound
 ```
@@ -231,6 +232,9 @@ repos:
 | **CH031** | `unclosed-pool` | `multiprocessing.Pool()` never `.close()`d/`.terminate()`d — worker processes leak for the life of the parent. | hardening rule |
 | **CH032** | `nondeterministic-default-argument` | A default argument computed from `time.time()`/`datetime.now()`/`random.random()`/`uuid.uuid4()` etc. — evaluated once at definition time, so every call using the default gets the *same* value forever. (inspired by flake8-bugbear B008, narrowed to a curated function list — see below) | hardening rule — real hit in litellm (`BudgetManager.create_budget`'s `created_at=time.time()` default) |
 | **CH033** | `strip-multichar-argument` | `.strip()`/`.lstrip()`/`.rstrip()` called with a multi-character string that contains a letter or digit — `str.strip(chars)` removes any of those *characters*, not the substring, from each end. (inspired by flake8-bugbear B005, narrowed to skip punctuation-only character sets — see below) | hardening rule — real hit in huggingface_hub (SSE parsing: `line.lstrip("data:").rstrip("/n")`, the second almost certainly meant `"\n"`) |
+| **CH034** | `raise-literal` | `raise "some error"` / `raise None` / `raise (1, 2)` — raising anything that isn't an exception instance always fails with a *different*, unrelated `TypeError` at the exact moment something has already gone wrong. (flake8-bugbear B016) | hardening rule — real hit in llama_index (an `ImportError` fallback that raises a bare string instead) |
+| **CH035** | `empty-except-tuple` | `except ():` — an empty tuple matches nothing, so the handler can never run; every exception still propagates past it. (flake8-bugbear B029) | hardening rule — zero corpus hits (see below) |
+| **CH036** | `environ-reassignment` | `os.environ = {...}` rebinds the name but doesn't call `putenv`/`unsetenv` — the real process environment (what child processes and C-level `getenv` see) stays unchanged. (flake8-bugbear B003) | hardening rule — real hit in HuggingFace `datasets` (a multiprocessing restore that silently doesn't reach spawned worker processes) |
 
 `codehound list` prints this from the source of truth.
 
@@ -531,6 +535,9 @@ Every check has paired tests: the buggy pattern *is* flagged, and the idiomatic
 - [x] 33 checks — nested-`def` loop-closure capture alongside lambdas
       (CH010, same shape as bugbear's B023), nondeterministic default
       arguments, multi-character `.strip()` arguments — CH032-CH033
+- [x] 36 checks — raising a literal instead of an exception, an empty
+      `except ()` tuple that can never match, direct `os.environ`
+      reassignment that doesn't sync the real environment — CH034-CH036
 - [ ] Cross-module resolution for CH007/CH009 (currently same-file only)
 - [ ] Extend CH001 to a curated denylist of sync AI/agent SDK client calls inside async functions (vector-DB clients, LLM SDKs) — the gap flake8-async's stdlib-only denylist leaves open
 

{codehound-1.9.0 → codehound-1.10.0}/README.md

@@ -4,7 +4,7 @@
 
 <h1 align="center">codehound</h1>
 
-**An AST-based static analyzer that hunts *real* bugs in large Python codebases — thirty-three checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
+**An AST-based static analyzer that hunts *real* bugs in large Python codebases — thirty-six checks, eight backed by a bug that was actually found and merged (or opened as a PR) into a major open-source AI framework, the rest hardening rules verified against real false positives across a ~29-framework validation corpus instead of just reasoned about.**
 
 [![CI](https://github.com/kratos0718/codehound/actions/workflows/ci.yml/badge.svg)](https://github.com/kratos0718/codehound/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/codehound.svg)](https://pypi.org/project/codehound/)
@@ -49,11 +49,12 @@ I was contributing bug fixes to large AI frameworks and noticed the same handful
 
 Being upfront about overlap: `codehound` is not the only tool that catches some of these patterns, and pretending otherwise wouldn't survive five minutes of someone actually checking. [Ruff](https://docs.astral.sh/ruff/)'s `RUF006` already catches a discarded `asyncio.create_task()` (CH006), `flake8-async`'s `ASYNC300` predates it. Ruff's `RUF012` already catches mutable class-level defaults (CH026), `F632` catches `is`-literal comparisons (CH025), `B006`/`UP005`/`E722` cover mutable-default-arguments/deprecated-unittest-aliases/bare-except (CH002/CH024/CH020). Pylint's `W1518` (`method-cache-max-size-none`) is close to a name-for-name match for CH011's `lru_cache`-on-instance-method leak. flake8-bugbear's `B012` also overlaps with CH029 (`return`/`break`/`continue` in `finally:`), though CH029 is narrower — bugbear also flags a bare `continue` inside a `finally:` loop body, which this project hasn't verified has the same swallowed-exception risk in every case. If you already run ruff and pylint, several of `codehound`'s checks will feel familiar.
 
-Three checks are explicit adaptations of a flake8-bugbear idea, kept deliberately narrower than the source rule after checking where the broader version's false-positive risk actually lands:
+Six checks are explicit adaptations of a flake8-bugbear idea. Three are kept deliberately narrower than the source rule after checking where the broader version's false-positive risk actually lands; three others (`B016`, `B029`, `B003`) are ported close to as-is because the underlying bug has no narrower/broader version to weigh — it's a fixed fact about the language, true in every version of Python 3, with no configuration or heuristic to get wrong:
 
 - **CH010** extends to cover a nested `def` capturing a loop variable, the same shape bugbear's `B023` covers alongside its lambda case — the same storage-based precision guard (only fires if the function is actually stored past the iteration) applies to both.
 - **CH032** takes bugbear's `B008` idea — "a call as a default argument is suspicious" — and narrows it to a curated list of ten functions (`time.time`, `datetime.now`, `random.random`, `uuid.uuid4`, …) whose result is *never* sensibly the same across calls. B008 as written also flags `def f(x=some_factory()):`, which is frequently a deliberate compute-once memoization; that ambiguity is exactly why this project didn't just port the broader rule.
 - **CH033** takes `B005`'s "`.strip()` with a multi-character argument is misleading" and adds one precision pass B005 doesn't: skip the argument entirely when it contains no letter or digit. Scanning ~30 real frameworks turned up over a hundred multi-character `.strip()` calls, and the overwhelming majority — `.strip('\r\n')`, `.strip('[]')`, `.strip('\'"')`, box-drawing tree glyphs — were deliberate, correct uses of the character-*set* semantics, not the substring mistake the rule exists to catch. Only the argument that reads as a word or token (`data:`, `/v1`, `THREAD#`) is the real bug; a bag of punctuation isn't. Full before/after counts in [`docs/FINDINGS.md`](docs/FINDINGS.md).
+- **CH034** (`B016`) — `raise <literal>` always raises a different, unrelated `TypeError` instead of the exception the author wrote. **CH035** (`B029`) — `except ():` can never match anything; the handler is dead code. **CH036** (`B003`) — `os.environ = {...}` rebinds the name without calling `putenv`/`unsetenv`, so the real process environment silently doesn't change. All three verified directly in a REPL before writing any AST code (`docs/FINDINGS.md` has the exact repro for each), and all three have zero false-positive risk: there's no legitimate Python where raising a literal succeeds, an empty exception tuple catches something, or reassigning `os.environ` actually syncs the environment.
 
 What actually seems to be missing elsewhere, as far as I've been able to find:
 
@@ -73,7 +74,7 @@ And a difference in kind, not just coverage: every check here is checked against
 pip install codehound
 ```
 
-Zero dependencies — it's ~4,300 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
+Zero dependencies — it's ~4,450 lines on top of the standard-library `ast` module, so this installs instantly and runs fully offline, no API key or network call involved.
 
 <details>
 <summary>From a clone instead (for development)</summary>
@@ -166,7 +167,7 @@ Uploads findings to the repo's **Security → Code Scanning** tab via SARIF, in
 ```yaml
 repos:
   - repo: https://github.com/kratos0718/codehound
-    rev: v1.9.0
+    rev: v1.10.0
     hooks:
       - id: codehound
 ```
@@ -210,6 +211,9 @@ repos:
 | **CH031** | `unclosed-pool` | `multiprocessing.Pool()` never `.close()`d/`.terminate()`d — worker processes leak for the life of the parent. | hardening rule |
 | **CH032** | `nondeterministic-default-argument` | A default argument computed from `time.time()`/`datetime.now()`/`random.random()`/`uuid.uuid4()` etc. — evaluated once at definition time, so every call using the default gets the *same* value forever. (inspired by flake8-bugbear B008, narrowed to a curated function list — see below) | hardening rule — real hit in litellm (`BudgetManager.create_budget`'s `created_at=time.time()` default) |
 | **CH033** | `strip-multichar-argument` | `.strip()`/`.lstrip()`/`.rstrip()` called with a multi-character string that contains a letter or digit — `str.strip(chars)` removes any of those *characters*, not the substring, from each end. (inspired by flake8-bugbear B005, narrowed to skip punctuation-only character sets — see below) | hardening rule — real hit in huggingface_hub (SSE parsing: `line.lstrip("data:").rstrip("/n")`, the second almost certainly meant `"\n"`) |
+| **CH034** | `raise-literal` | `raise "some error"` / `raise None` / `raise (1, 2)` — raising anything that isn't an exception instance always fails with a *different*, unrelated `TypeError` at the exact moment something has already gone wrong. (flake8-bugbear B016) | hardening rule — real hit in llama_index (an `ImportError` fallback that raises a bare string instead) |
+| **CH035** | `empty-except-tuple` | `except ():` — an empty tuple matches nothing, so the handler can never run; every exception still propagates past it. (flake8-bugbear B029) | hardening rule — zero corpus hits (see below) |
+| **CH036** | `environ-reassignment` | `os.environ = {...}` rebinds the name but doesn't call `putenv`/`unsetenv` — the real process environment (what child processes and C-level `getenv` see) stays unchanged. (flake8-bugbear B003) | hardening rule — real hit in HuggingFace `datasets` (a multiprocessing restore that silently doesn't reach spawned worker processes) |
 
 `codehound list` prints this from the source of truth.
 
@@ -510,6 +514,9 @@ Every check has paired tests: the buggy pattern *is* flagged, and the idiomatic
 - [x] 33 checks — nested-`def` loop-closure capture alongside lambdas
       (CH010, same shape as bugbear's B023), nondeterministic default
       arguments, multi-character `.strip()` arguments — CH032-CH033
+- [x] 36 checks — raising a literal instead of an exception, an empty
+      `except ()` tuple that can never match, direct `os.environ`
+      reassignment that doesn't sync the real environment — CH034-CH036
 - [ ] Cross-module resolution for CH007/CH009 (currently same-file only)
 - [ ] Extend CH001 to a curated denylist of sync AI/agent SDK client calls inside async functions (vector-DB clients, LLM SDKs) — the gap flake8-async's stdlib-only denylist leaves open
 

{codehound-1.9.0 → codehound-1.10.0}/src/codehound/__init__.py

@@ -1,9 +1,9 @@
 """codehound - an AST-based static analyzer that hunts real bugs in Python code.
 
-Thirty-three checks. Eight are each backed by a bug that was actually
+Thirty-six checks. Eight are each backed by a bug that was actually
 found and fixed (or opened as a PR) in a popular open-source AI framework
 (agno, crewAI, mem0, llama_index, accelerate, optuna, litellm). The rest
-(CH007-CH009, CH012-CH033) are hardening rules verified against real
+(CH007-CH009, CH012-CH036) are hardening rules verified against real
 false positives across a ~29-framework validation corpus instead - see
 docs/FINDINGS.md.
 
@@ -19,7 +19,7 @@ from __future__ import annotations
 from codehound.checks import ALL_CHECKS, get_checks
 from codehound.core import Check, Finding, scan_file, scan_files, scan_path
 
-__version__ = "1.9.0"
+__version__ = "1.10.0"
 
 __all__ = [
     "ALL_CHECKS",

{codehound-1.9.0 → codehound-1.10.0}/src/codehound/checks/__init__.py

@@ -10,6 +10,8 @@ from codehound.checks.blocking_async import BlockingCallInAsync
 from codehound.checks.collections_abc_import import CollectionsAbcImport
 from codehound.checks.datetime_utcnow import DeprecatedDatetimeUtcnow
 from codehound.checks.discarded_future import DiscardedFuture
+from codehound.checks.empty_except_tuple import EmptyExceptTuple
+from codehound.checks.environ_reassignment import EnvironReassignment
 from codehound.checks.finally_swallows_exception import FinallySwallowsException
 from codehound.checks.floating_process import FloatingProcess
 from codehound.checks.floating_task import FloatingTask
@@ -23,6 +25,7 @@ from codehound.checks.lru_cache_on_method import LruCacheOnMethod
 from codehound.checks.mutable_class_attribute import MutableClassAttribute
 from codehound.checks.mutable_defaults import MutableDefaultArgument
 from codehound.checks.nondeterministic_default import NondeterministicDefault
+from codehound.checks.raise_literal import RaiseLiteral
 from codehound.checks.removed_asyncio_task_methods import RemovedAsyncioTaskMethods
 from codehound.checks.removed_getargspec import RemovedGetargspec
 from codehound.checks.removed_stdlib_attribute import RemovedStdlibAttribute
@@ -71,6 +74,9 @@ ALL_CHECKS: list[type[Check]] = [
     UnclosedPool,
     NondeterministicDefault,
     StripMultichar,
+    RaiseLiteral,
+    EmptyExceptTuple,
+    EnvironReassignment,
 ]
 
 

codehound-1.10.0/src/codehound/checks/empty_except_tuple.py

@@ -0,0 +1,57 @@
+"""CH035 - ``except ():`` catches nothing at all.
+
+`isinstance(exc, ())` is always `False` - an empty tuple has nothing
+to match against - so `except ():` is a handler that can *never* run.
+Verified directly:
+
+    try:
+        raise ValueError("boom")
+    except ():
+        print("caught")   # never printed
+    # ValueError propagates past the handler, as if it wasn't there
+
+This is flake8-bugbear's B029. It's easy to write by accident - a
+`(SomeError,)` tuple that gets refactored down to nothing (a variable
+that used to hold exception types now holds an empty list/tuple,
+or an `except (E1, E2):` where both names got deleted during a merge)
+silently turns into dead code with no error, no warning, and a handler
+that reads as if it's protecting something it no longer protects.
+
+Zero configuration, zero false-positive risk: an empty tuple can never
+match any exception, so there's no reading of `except ():` where it's
+doing useful work.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding
+
+
+class EmptyExceptTuple(Check):
+    code = "CH035"
+    name = "empty-except-tuple"
+    description = "except () catches nothing - an empty exception tuple can never match, so the handler is dead code."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.ExceptHandler):
+                continue
+            if not (isinstance(node.type, ast.Tuple) and len(node.type.elts) == 0):
+                continue
+            findings.append(
+                Finding(
+                    path=path,
+                    line=node.lineno,
+                    col=node.col_offset,
+                    code=self.code,
+                    message=(
+                        "`except ():` can never match any exception - an empty tuple has "
+                        "nothing to catch, so this handler is dead code and every exception "
+                        "still propagates past it."
+                    ),
+                )
+            )
+        return findings

codehound-1.10.0/src/codehound/checks/environ_reassignment.py

@@ -0,0 +1,69 @@
+"""CH036 - assigning directly to ``os.environ`` doesn't sync the real environment.
+
+`os.environ` isn't a plain dict - it's a special mapping (`os._Environ`)
+that calls `os.putenv`/`os.unsetenv` under the hood so the process's
+*actual* environment (the C-level `environ`, the thing child processes
+inherit) stays in sync with what Python sees. `os.environ = {...}`
+doesn't call any of that - it just rebinds the module attribute to a
+plain dict, leaving the real environment untouched. Verified directly:
+
+    os.environ['TOKEN'] = 'secret'
+    os.environ = {}
+    subprocess.run([...])  # child process still sees TOKEN='secret'
+    os.getenv('TOKEN')     # None - Python's own view says it's gone
+
+Python's own view and the operating system's view now disagree, and
+whichever one a test or a child process happens to read from decides
+whether the "clear" actually took effect. This is flake8-bugbear's
+B003, and it's exactly the kind of gotcha that looks like the obviously
+correct way to reset environment state - `os.environ = old_snapshot`
+inside a test's cleanup/`finally:` block is the single most common
+place this shows up, precisely because it looks like a restore and
+silently isn't one.
+
+Only flags a direct assignment to the `os.environ` attribute -
+`os.environ.clear()`, `os.environ.update(...)`, `os.environ.pop(...)`,
+and `del os.environ[...]` all go through the real mapping and are all
+correct, unflagged uses.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding
+
+
+def _is_os_environ_attribute(node: ast.expr) -> bool:
+    return isinstance(node, ast.Attribute) and node.attr == "environ" and isinstance(node.value, ast.Name) and node.value.id == "os"
+
+
+class EnvironReassignment(Check):
+    code = "CH036"
+    name = "environ-reassignment"
+    description = "os.environ = ... rebinds the name but doesn't sync the real process environment; use .clear()/.update() instead."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Assign):
+                continue
+            for target in node.targets:
+                if not _is_os_environ_attribute(target):
+                    continue
+                findings.append(
+                    Finding(
+                        path=path,
+                        line=node.lineno,
+                        col=node.col_offset,
+                        code=self.code,
+                        message=(
+                            "assigning directly to `os.environ` rebinds the name but doesn't "
+                            "call putenv/unsetenv - the real process environment (what child "
+                            "processes and `os.getenv` from C libraries see) stays unchanged. "
+                            "Use `os.environ.clear()` and/or `.update(...)` instead."
+                        ),
+                    )
+                )
+                break
+        return findings

codehound-1.10.0/src/codehound/checks/raise_literal.py

@@ -0,0 +1,62 @@
+"""CH034 - ``raise`` with a literal instead of an exception instance.
+
+`raise` accepts a `BaseException` instance or class - nothing else.
+A string, number, or container literal isn't either, so it always
+raises a *different* exception than the one the author wrote. Verified
+directly, every shape:
+
+    raise "some error"   # TypeError: exceptions must derive from BaseException
+    raise None            # same TypeError
+    raise f"boom {x}"     # same - still a str at runtime
+    raise (1, 2)          # same, for a tuple literal
+    raise {"error": x}    # same, for a dict literal
+
+This is flake8-bugbear's B016, and it earns a place here for the same
+reason CH025 (`is`-literal-comparison) does: the code that triggers it
+reads like a deliberate, reasonable choice - `raise "config missing"`
+looks like someone chose a plain string over defining a custom
+exception class - and the failure mode is a second, unrelated
+`TypeError` at the exact moment something has already gone wrong, which
+is a uniquely bad time to discover a typo.
+
+Zero configuration, zero false-positive risk: this isn't a style
+opinion or a narrowed heuristic like CH032/CH033 - `raise <literal>`
+has exactly one possible outcome in every version of Python 3, so there
+is no "usually fine, occasionally not" case to guard against.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codehound.core import Check, Finding
+
+_LITERAL_NODE_TYPES = (ast.Constant, ast.JoinedStr, ast.List, ast.Dict, ast.Set, ast.Tuple)
+
+
+class RaiseLiteral(Check):
+    code = "CH034"
+    name = "raise-literal"
+    description = "raise with a literal (str/int/list/dict/...) instead of an exception instance always raises TypeError."
+
+    def run(self, tree: ast.AST, parents: dict, path: str) -> list[Finding]:
+        findings: list[Finding] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Raise) or node.exc is None:
+                continue
+            if not isinstance(node.exc, _LITERAL_NODE_TYPES):
+                continue
+            findings.append(
+                Finding(
+                    path=path,
+                    line=node.lineno,
+                    col=node.col_offset,
+                    code=self.code,
+                    message=(
+                        "raising a literal instead of an exception instance always fails with "
+                        "`TypeError: exceptions must derive from BaseException` - wrap it in an "
+                        "exception, e.g. `raise ValueError(...)`."
+                    ),
+                )
+            )
+        return findings

{codehound-1.9.0 → codehound-1.10.0}/tests/test_checks.py

@@ -1873,3 +1873,113 @@ def test_ch033_flags_argument_with_letters_even_with_punctuation():
     findings = _run(code, ["CH033"])
     assert len(findings) == 1
 
+
+# --- CH034 raise-literal -----------------------------------------------------------------
+
+
+def test_ch034_flags_raise_string_literal():
+    code = "raise 'some error'\n"
+    findings = _run(code, ["CH034"])
+    assert len(findings) == 1
+    assert findings[0].code == "CH034"
+
+
+def test_ch034_flags_raise_fstring():
+    code = "x = 1\nraise f'boom {x}'\n"
+    findings = _run(code, ["CH034"])
+    assert len(findings) == 1
+
+
+def test_ch034_flags_raise_none():
+    code = "raise None\n"
+    findings = _run(code, ["CH034"])
+    assert len(findings) == 1
+
+
+def test_ch034_flags_raise_tuple_literal():
+    code = "raise (1, 2)\n"
+    findings = _run(code, ["CH034"])
+    assert len(findings) == 1
+
+
+def test_ch034_flags_raise_dict_literal():
+    code = "raise {'error': 'bad'}\n"
+    findings = _run(code, ["CH034"])
+    assert len(findings) == 1
+
+
+def test_ch034_ignores_raise_exception_instance():
+    code = "raise ValueError('bad input')\n"
+    assert _run(code, ["CH034"]) == []
+
+
+def test_ch034_ignores_bare_reraise():
+    code = "try:\n    pass\nexcept Exception:\n    raise\n"
+    assert _run(code, ["CH034"]) == []
+
+
+def test_ch034_ignores_raise_from_variable():
+    code = "def f(exc):\n    raise exc\n"
+    assert _run(code, ["CH034"]) == []
+
+
+# --- CH035 empty-except-tuple -------------------------------------------------------------
+
+
+def test_ch035_flags_empty_except_tuple():
+    code = "try:\n    pass\nexcept ():\n    pass\n"
+    findings = _run(code, ["CH035"])
+    assert len(findings) == 1
+    assert findings[0].code == "CH035"
+
+
+def test_ch035_ignores_single_exception_type():
+    code = "try:\n    pass\nexcept ValueError:\n    pass\n"
+    assert _run(code, ["CH035"]) == []
+
+
+def test_ch035_ignores_nonempty_exception_tuple():
+    code = "try:\n    pass\nexcept (ValueError, TypeError):\n    pass\n"
+    assert _run(code, ["CH035"]) == []
+
+
+def test_ch035_ignores_bare_except():
+    code = "try:\n    pass\nexcept:\n    pass\n"
+    assert _run(code, ["CH035"]) == []
+
+
+# --- CH036 environ-reassignment -----------------------------------------------------------
+
+
+def test_ch036_flags_direct_environ_reassignment():
+    code = "import os\nos.environ = {}\n"
+    findings = _run(code, ["CH036"])
+    assert len(findings) == 1
+    assert findings[0].code == "CH036"
+
+
+def test_ch036_flags_environ_reassignment_from_snapshot():
+    code = "import os\nsaved = os.environ.copy()\nos.environ = saved\n"
+    findings = _run(code, ["CH036"])
+    assert len(findings) == 1
+
+
+def test_ch036_ignores_environ_item_assignment():
+    code = "import os\nos.environ['KEY'] = 'value'\n"
+    assert _run(code, ["CH036"]) == []
+
+
+def test_ch036_ignores_environ_clear():
+    code = "import os\nos.environ.clear()\n"
+    assert _run(code, ["CH036"]) == []
+
+
+def test_ch036_ignores_environ_update():
+    code = "import os\nos.environ.update({'KEY': 'value'})\n"
+    assert _run(code, ["CH036"]) == []
+
+
+def test_ch036_ignores_unrelated_attribute_named_environ():
+    code = "config.environ = {}\n"
+    assert _run(code, ["CH036"]) == []
+