pycheck-neuron 1.0.0__py3-none-any.whl

pycheck/__init__.py

@@ -0,0 +1,10 @@
+"""
+PyCheck — NEURON ML Safety Analyzer
+Catches temporal leaks, causal confusion, and uncertainty bugs in Python ML scripts.
+"""
+
+__version__ = "0.2.0"
+
+from pycheck.analyzer import analyze_file, format_output
+from pycheck.rules import ALL_RULES, RULES_BY_CODE
+from pycheck.flow import TaintTracker

pycheck/__main__.py

@@ -0,0 +1,3 @@
+"""Enable `python -m pycheck script.py` execution."""
+from pycheck.cli import main
+main()

pycheck/analyzer.py

@@ -0,0 +1,198 @@
+"""
+PyCheck Analyzer — ML Safety Static Analysis Engine
+Uses a rule registry + taint flow analysis to detect temporal leaks,
+causal confusion, and uncertainty bugs in Python ML scripts.
+"""
+
+import ast
+import sys
+import json
+from typing import List, Tuple
+
+from pycheck.rules import ALL_RULES, RULES_BY_CODE, AnalysisContext, Diagnostic
+from pycheck.flow import TaintTracker
+
+
+class PyCheckAnalyzer(ast.NodeVisitor):
+    """
+    AST visitor that runs all registered rules against each node.
+    Also tracks loop context for loop-aware rules.
+    """
+    
+    def __init__(self, source_lines: List[str], filepath: str):
+        self.ctx = AnalysisContext(source_lines, filepath)
+        self.diagnostics: List[Diagnostic] = []
+        self.rules = ALL_RULES
+    
+    def _run_rules(self, node: ast.AST):
+        """Run all rules against a single AST node."""
+        for rule in self.rules:
+            results = rule.check_node(node, self.ctx)
+            self.diagnostics.extend(results)
+    
+    def generic_visit(self, node):
+        """Override to run rules on every node."""
+        self._run_rules(node)
+        super().generic_visit(node)
+
+    def visit_Assign(self, node):
+        """Track literal constant assignments for constant folding / alias analysis."""
+        for target in node.targets:
+            if isinstance(target, ast.Name):
+                val = None
+                if isinstance(node.value, ast.Constant) and isinstance(node.value.value, (int, float)):
+                    val = node.value.value
+                elif isinstance(node.value, ast.UnaryOp) and isinstance(node.value.op, ast.USub):
+                    if isinstance(node.value.operand, ast.Constant) and isinstance(node.value.operand.value, (int, float)):
+                        val = -node.value.operand.value
+                if val is not None:
+                    self.ctx.constants[target.id] = val
+                self.ctx.assignments[target.id] = node.value
+        self._run_rules(node)
+        self.generic_visit(node)
+    
+    def visit_For(self, node):
+        """Track loop context for rules that need it."""
+        old_in_loop = self.ctx.in_loop
+        old_loop_var = self.ctx.loop_var
+        
+        self.ctx.in_loop = True
+        if isinstance(node.target, ast.Name):
+            self.ctx.loop_var = node.target.id
+        
+        self._run_rules(node)
+        # Visit body with loop context
+        for child in ast.iter_child_nodes(node):
+            self.visit(child)
+        
+        self.ctx.in_loop = old_in_loop
+        self.ctx.loop_var = old_loop_var
+    
+    def visit_While(self, node):
+        """Track loop context."""
+        old_in_loop = self.ctx.in_loop
+        self.ctx.in_loop = True
+        
+        self._run_rules(node)
+        for child in ast.iter_child_nodes(node):
+            self.visit(child)
+        
+        self.ctx.in_loop = old_in_loop
+
+
+def analyze_file(filepath: str) -> Tuple[List[dict], List[str]]:
+    """
+    Analyze a Python (.py) or Jupyter notebook (.ipynb) file for ML safety issues.
+    Returns (diagnostics_list, source_lines).
+    """
+    if filepath.endswith('.ipynb'):
+        with open(filepath, 'r', encoding='utf-8') as f:
+            nb = json.load(f)
+        code_lines = []
+        for cell in nb.get('cells', []):
+            if cell.get('cell_type') == 'code':
+                raw = cell.get('source', [])
+                if isinstance(raw, str):
+                    raw = raw.splitlines(True)
+                for line in raw:
+                    s_line = line.strip()
+                    if s_line.startswith('%') or s_line.startswith('!'):
+                        code_lines.append(f"# {line}")
+                    else:
+                        code_lines.append(line)
+                code_lines.append('\n')
+        source = "".join(code_lines)
+    else:
+        with open(filepath, 'r', encoding='utf-8') as f:
+            source = f.read()
+    
+    source_lines = source.split('\n')
+    tree = ast.parse(source, filename=filepath)
+    
+    # Phase 1: Rule-based AST analysis
+    analyzer = PyCheckAnalyzer(source_lines, filepath)
+    analyzer.visit(tree)
+    
+    # Phase 2: Data flow taint analysis
+    tracker = TaintTracker()
+    flow_diagnostics = tracker.analyze(tree, source_lines)
+    
+    # Combine and deduplicate
+    all_diagnostics = analyzer.diagnostics + flow_diagnostics
+    
+    # Deduplicate by (line, code)
+    seen = set()
+    unique = []
+    for d in all_diagnostics:
+        key = (d.line, d.code)
+        if key not in seen:
+            seen.add(key)
+            unique.append(d)
+    
+    # Sort by line number
+    unique.sort(key=lambda d: (d.line, d.col))
+    
+    return [d.to_dict() for d in unique], source_lines
+
+
+def format_output(filepath: str, diagnostics: List[dict], source_lines: List[str],
+                   show_info: bool = False):
+    """Format diagnostics as human-readable output."""
+    
+    # Filter by severity
+    if not show_info:
+        diagnostics = [d for d in diagnostics if d['severity'] != 'info']
+    
+    errors = [d for d in diagnostics if d['severity'] == 'error']
+    warnings = [d for d in diagnostics if d['severity'] == 'warning']
+    infos = [d for d in diagnostics if d['severity'] == 'info']
+    
+    def safe_print(text):
+        try:
+            print(text)
+        except UnicodeEncodeError:
+            print(text.encode('ascii', errors='replace').decode('ascii'))
+    
+    header_sep = "=" * 65
+    line_sep = "-" * 65
+    
+    safe_print(f"\n{header_sep}")
+    safe_print(f"  PyCheck — NEURON ML Safety Analyzer")
+    safe_print(f"  Scanning: {filepath}")
+    safe_print(f"  Rules: {len(ALL_RULES)} active")
+    safe_print(f"{header_sep}\n")
+    
+    if not diagnostics:
+        safe_print("  [OK] No issues found.\n")
+        return
+    
+    safe_print(f"  {len(errors)} error(s), {len(warnings)} warning(s), {len(infos)} info(s)\n")
+    
+    for d in diagnostics:
+        line_num = d['line']
+        
+        # Color-like severity prefix
+        severity_label = d['severity'].upper()
+        safe_print(f"  {severity_label}[{d['code']}]: {d['message']}")
+        safe_print(f"  --> {filepath}:{line_num}:{d['col']}")
+        
+        if 0 < line_num <= len(source_lines):
+            line_text = source_lines[line_num - 1]
+            safe_print(f"   {line_num:>3} |  {line_text}")
+            pointer_start = d['col']
+            safe_print(f"       {' ' * pointer_start}^^^^^^^^^^^")
+        
+        if 'help' in d:
+            safe_print(f"       help: {d['help']}")
+        
+        safe_print("")
+    
+    safe_print(f"{line_sep}")
+    safe_print(f"  Summary: {len(errors)} error(s), {len(warnings)} warning(s), {len(infos)} info(s)")
+    if errors:
+        safe_print(f"  These {len(errors)} error(s) would be COMPILE-TIME ERRORS in NEURON")
+    elif warnings:
+        safe_print(f"  These {len(warnings)} temporal issue(s) are guarded at compile-time in NEURON")
+    safe_print(f"  Explore the zero-leakage language: https://github.com/neuronlabs-ai/neuron-lang")
+    safe_print(f"  Python detected: 0 of these issues at runtime")
+    safe_print(f"{line_sep}\n")

pycheck/cli.py

@@ -0,0 +1,191 @@
+import sys
+import json
+import os
+import hashlib
+from pycheck.analyzer import analyze_file, format_output
+from pycheck.rules import ALL_RULES
+
+
+def main():
+    args = sys.argv[1:]
+    
+    if not args or '--help' in args or '-h' in args:
+        print("PyCheck — NEURON ML Safety Analyzer")
+        print(f"  {len(ALL_RULES)} rules for temporal leaks, causal confusion, and uncertainty bugs\n")
+        print("Usage: pycheck <path> [options]\n")
+        print("Options:")
+        print("  --json               Output diagnostics as JSON")
+        print("  --gitlab             Output diagnostics in GitLab Code Quality JSON format")
+        print("  -o, --output <file>  Write JSON / GitLab report directly to specified file")
+        print("  --info               Include info-level diagnostics")
+        print("  --quiet              Only show errors (no warnings)")
+        print("  --list               List all available rules")
+        print("  -h, --help           Show this help message")
+        sys.exit(0)
+    
+    if '--list' in args:
+        print(f"\nPyCheck Rules ({len(ALL_RULES)} total):\n")
+        current_cat = ""
+        for rule in ALL_RULES:
+            if rule.category != current_cat:
+                current_cat = rule.category
+                print(f"\n  [{current_cat}]")
+            print(f"    {rule.code}  {rule.severity:<8}  {rule.name}")
+        print()
+        sys.exit(0)
+    
+    show_info = '--info' in args
+    is_quiet = '--quiet' in args
+    is_json = '--json' in args
+    is_gitlab = '--gitlab' in args
+
+    output_file = None
+    if '--output' in args:
+        idx = args.index('--output')
+        if idx + 1 < len(args):
+            output_file = args[idx + 1]
+    elif '-o' in args:
+        idx = args.index('-o')
+        if idx + 1 < len(args):
+            output_file = args[idx + 1]
+
+    # Get target path (first non-flag argument not consumed by an option)
+    filepath = None
+    skip_next = False
+    for a in args:
+        if skip_next:
+            skip_next = False
+            continue
+        if a in ('--output', '-o'):
+            skip_next = True
+            continue
+        if not a.startswith('-'):
+            filepath = a
+            break
+    
+    if not filepath:
+        filepath = "."
+    
+    if not os.path.exists(filepath):
+        print(f"Error: Path not found: {filepath}")
+        sys.exit(1)
+
+    # Collect target files
+    files_to_scan = []
+    if os.path.isdir(filepath):
+        ignored_dirs = {'.git', '__pycache__', '.pytest_cache', '.venv', 'venv', 'env', 'node_modules', 'dist', 'build', '.egg-info'}
+        for root, dirs, files in os.walk(filepath):
+            dirs[:] = [d for d in dirs if d not in ignored_dirs and not d.startswith('.')]
+            for f in files:
+                if f.endswith('.py') or f.endswith('.ipynb'):
+                    files_to_scan.append(os.path.join(root, f))
+    else:
+        files_to_scan = [filepath]
+
+    if not files_to_scan:
+        if not is_json and not is_gitlab:
+            print(f"No Python (.py) or notebook (.ipynb) files found in {filepath}")
+        sys.exit(0)
+
+    total_errors = 0
+    total_warnings = 0
+    files_with_issues = 0
+    all_json_results = {}
+    gitlab_issues = []
+
+    for f_path in files_to_scan:
+        try:
+            diagnostics, source_lines = analyze_file(f_path)
+        except SyntaxError as e:
+            if not is_json and (not is_gitlab or output_file):
+                print(f"Syntax error in {f_path}: {e}")
+            total_errors += 1
+            continue
+        except Exception as e:
+            if not is_json and (not is_gitlab or output_file):
+                print(f"Error analyzing {f_path}: {e}")
+            continue
+
+        if is_quiet:
+            diagnostics = [d for d in diagnostics if d['severity'] == 'error']
+        elif not show_info:
+            diagnostics = [d for d in diagnostics if d['severity'] != 'info']
+
+        err_count = sum(1 for d in diagnostics if d['severity'] == 'error')
+        warn_count = sum(1 for d in diagnostics if d['severity'] == 'warning')
+        total_errors += err_count
+        total_warnings += warn_count
+
+        if diagnostics:
+            files_with_issues += 1
+            if is_json:
+                all_json_results[f_path] = diagnostics
+            elif is_gitlab:
+                rel_path = os.path.relpath(f_path).replace("\\", "/")
+                for d in diagnostics:
+                    sev_map = {
+                        'error': 'critical',
+                        'warning': 'major',
+                        'info': 'info'
+                    }
+                    gl_sev = sev_map.get(d.get('severity', 'warning'), 'major')
+                    fp = hashlib.md5(f"{rel_path}:{d.get('line', 1)}:{d.get('code', 'P000')}".encode('utf-8')).hexdigest()
+                    gitlab_issues.append({
+                        "description": f"[{d.get('code', 'PYCHECK')}] {d.get('message', '')}. Guarded at compile-time in NEURON: https://github.com/neuronlabs-ai/neuron-lang",
+                        "check_name": d.get('code', 'pycheck'),
+                        "fingerprint": fp,
+                        "severity": gl_sev,
+                        "location": {
+                            "path": rel_path,
+                            "lines": {
+                                "begin": d.get('line', 1)
+                            }
+                        }
+                    })
+                if output_file:
+                    format_output(f_path, diagnostics, source_lines, show_info=show_info)
+            else:
+                format_output(f_path, diagnostics, source_lines, show_info=show_info)
+
+    if is_gitlab:
+        gl_content = json.dumps(gitlab_issues, indent=2)
+        if output_file:
+            with open(output_file, 'w', encoding='utf-8') as f:
+                f.write(gl_content)
+        else:
+            print(gl_content)
+    elif is_json:
+        json_content = json.dumps(all_json_results, indent=2)
+        if output_file:
+            with open(output_file, 'w', encoding='utf-8') as f:
+                f.write(json_content)
+        else:
+            print(json_content)
+
+    # Print summary if human output or if output was redirected to a file
+    if (not is_json and not is_gitlab) or output_file:
+        if len(files_to_scan) > 1 or output_file:
+            clean_files = len(files_to_scan) - files_with_issues
+            print("=================================================================")
+            print("  PyCheck Directory Summary")
+            print(f"  Scanned: {len(files_to_scan)} files | Clean: {clean_files} | Flagged: {files_with_issues}")
+            print(f"  Total: {total_errors} error(s), {total_warnings} warning(s)")
+            if output_file:
+                report_type = "GitLab Code Quality" if is_gitlab else "JSON"
+                print(f"  {report_type} Report written to: {output_file}")
+            if files_with_issues > 0:
+                print("-----------------------------------------------------------------")
+                if total_errors > 0:
+                    print(f"  These {total_errors} error(s) would be COMPILE-TIME ERRORS in NEURON")
+                elif total_warnings > 0:
+                    print(f"  These {total_warnings} temporal issue(s) are guarded at compile-time in NEURON")
+                print("  Explore the zero-leakage language: https://github.com/neuronlabs-ai/neuron-lang")
+                print("  Python detected: 0 of these issues at runtime")
+            print("=================================================================\n")
+
+    if total_errors > 0:
+        sys.exit(1)
+
+
+if __name__ == '__main__':
+    main()

pycheck/flow.py

@@ -0,0 +1,265 @@
+"""
+PyCheck Data Flow Engine — Taint Propagation Analysis
+Tracks how data flows through assignments, function returns, and method chains
+to detect when future-tainted data reaches training/prediction sinks.
+"""
+
+import ast
+from typing import Dict, Set, List, Optional, Tuple
+from pycheck.rules import Diagnostic
+
+
+class TaintSource:
+    """Represents a source of tainted (future-leaked) data."""
+    def __init__(self, var_name: str, reason: str, line: int, col: int):
+        self.var_name = var_name
+        self.reason = reason
+        self.line = line
+        self.col = col
+
+
+class TaintTracker:
+    """
+    Tracks taint propagation through Python AST.
+    
+    Taint sources: shift(-n), bfill(), future column access, etc.
+    Taint sinks: .fit(), .predict(), model training calls.
+    
+    When tainted data flows into a sink, a diagnostic is emitted.
+    """
+    
+    def __init__(self):
+        self.tainted_vars: Dict[str, TaintSource] = {}
+        self.diagnostics: List[Diagnostic] = []
+        self.constants: Dict[str, any] = {}
+    
+    def analyze(self, tree: ast.AST, source_lines: List[str]) -> List[Diagnostic]:
+        """Run taint analysis on a full AST."""
+        self.tainted_vars.clear()
+        self.diagnostics.clear()
+        self.constants.clear()
+        
+        # Two-pass analysis:
+        # Pass 1: Identify all taint sources (assignments from leaky operations)
+        # Pass 2: Track propagation and detect sinks
+        self._collect_taints(tree)
+        self._check_sinks(tree)
+        
+        return self.diagnostics
+    
+    def _extract_constant(self, expr):
+        if isinstance(expr, ast.Constant) and isinstance(expr.value, (int, float)):
+            return expr.value
+        if isinstance(expr, ast.UnaryOp) and isinstance(expr.op, ast.USub):
+            if isinstance(expr.operand, ast.Constant) and isinstance(expr.operand.value, (int, float)):
+                return -expr.operand.value
+        return None
+
+    def _is_negative_period(self, expr) -> bool:
+        if isinstance(expr, ast.UnaryOp) and isinstance(expr.op, ast.USub):
+            return True
+        if isinstance(expr, ast.Constant) and isinstance(expr.value, (int, float)) and expr.value < 0:
+            return True
+        if isinstance(expr, ast.Name):
+            val = self.constants.get(expr.id)
+            if val is not None and isinstance(val, (int, float)) and val < 0:
+                return True
+        return False
+
+    def _collect_taints(self, tree: ast.AST):
+        """Pass 1: Walk the AST and mark variables that receive tainted data."""
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Assign):
+                for target in node.targets:
+                    if isinstance(target, ast.Name):
+                        val = self._extract_constant(node.value)
+                        if val is not None:
+                            self.constants[target.id] = val
+
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Assign):
+                self._check_assignment_taint(node)
+            elif isinstance(node, ast.AugAssign):
+                self._check_augassign_taint(node)
+    
+    def _check_assignment_taint(self, node: ast.Assign):
+        """Check if an assignment creates or propagates a taint."""
+        # Get the taint from the RHS
+        taint_reason = self._expr_taint(node.value)
+        if taint_reason is None:
+            return
+        
+        # Mark all LHS targets as tainted
+        for target in node.targets:
+            var_name = self._get_var_name(target)
+            if var_name:
+                self.tainted_vars[var_name] = TaintSource(
+                    var_name, taint_reason, node.lineno, node.col_offset)
+    
+    def _check_augassign_taint(self, node: ast.AugAssign):
+        """Check if an augmented assignment (+=, etc.) propagates taint."""
+        taint_reason = self._expr_taint(node.value)
+        if taint_reason:
+            var_name = self._get_var_name(node.target)
+            if var_name:
+                self.tainted_vars[var_name] = TaintSource(
+                    var_name, taint_reason, node.lineno, node.col_offset)
+    
+    def _expr_taint(self, node: ast.AST) -> Optional[str]:
+        """
+        Determine if an expression produces tainted data.
+        Returns the taint reason string, or None if clean.
+        """
+        if isinstance(node, ast.Call):
+            return self._call_taint(node)
+        
+        if isinstance(node, ast.Name):
+            # Propagation: if RHS is a tainted variable, the assignment is tainted
+            if node.id in self.tainted_vars:
+                return f"derived from tainted variable '{node.id}' ({self.tainted_vars[node.id].reason})"
+        
+        if isinstance(node, ast.BinOp):
+            # Binary operations propagate taint from either operand
+            left_taint = self._expr_taint(node.left)
+            right_taint = self._expr_taint(node.right)
+            return left_taint or right_taint
+        
+        if isinstance(node, ast.Subscript):
+            # Subscript propagates taint from the value being indexed
+            val_taint = self._expr_taint(node.value)
+            if val_taint:
+                return val_taint
+            # Check if indexing a tainted column name
+            if isinstance(node.slice, ast.Constant) and isinstance(node.slice.value, str):
+                col_lower = node.slice.value.lower()
+                # Only flag column names that unambiguously refer to future data.
+                # 'target' and 'label' are intentionally excluded — they are standard
+                # ML label column names and produce false positives when accessed on a
+                # correctly split train/test dataset.
+                future_cols = {'future_price', 'future_return', 'next_close', 'next_price',
+                               'next_day', 'tomorrow', 'price_change_next_day', 'future_avg_price'}
+                if any(f in col_lower for f in future_cols):
+                    return f"accessing future-named column '{node.slice.value}'"
+        
+        if isinstance(node, ast.Attribute):
+            return self._expr_taint(node.value)
+        
+        return None
+    
+    def _call_taint(self, node: ast.Call) -> Optional[str]:
+        """Check if a function call produces tainted output."""
+        if isinstance(node.func, ast.Attribute):
+            method = node.func.attr
+            
+            # Direct taint sources
+            if method == 'shift':
+                for arg in node.args:
+                    if self._is_negative_period(arg):
+                        return "shift() with negative period (future access)"
+                for kw in node.keywords:
+                    if kw.arg == 'periods' and self._is_negative_period(kw.value):
+                        return "shift() with negative period (future access)"
+            
+            if method in ('bfill', 'backfill'):
+                return f".{method}() backfills from future values"
+            
+            if method == 'fillna':
+                for kw in node.keywords:
+                    if kw.arg == 'method' and isinstance(kw.value, ast.Constant):
+                        if kw.value.value in ('bfill', 'backfill'):
+                            return f".fillna(method='{kw.value.value}') backfills from future"
+            
+            if method == 'diff':
+                for arg in node.args:
+                    if self._is_negative_period(arg):
+                        return ".diff() with negative period (future access)"
+                for kw in node.keywords:
+                    if kw.arg == 'periods' and self._is_negative_period(kw.value):
+                        return ".diff() with negative period (future access)"
+            
+            # Taint propagation through method chains
+            obj_taint = self._expr_taint(node.func.value)
+            if obj_taint:
+                # Most method calls on tainted data produce tainted output
+                non_taint_methods = {'shape', 'dtype', 'dtypes', 'columns', 'index',
+                                     'describe', 'info', 'head', 'tail', 'len', '__len__'}
+                if method not in non_taint_methods:
+                    return obj_taint
+        
+        if isinstance(node.func, ast.Name):
+            # Check if calling a function with tainted arguments
+            for arg in node.args:
+                arg_taint = self._expr_taint(arg)
+                if arg_taint:
+                    return f"function receives tainted input: {arg_taint}"
+        
+        # R2-9 fix: Detect getattr(obj, 'shift')(-1) and similar patterns
+        # Pattern: call(getattr(obj, 'shift'), -1) => obj.shift(-1)
+        if isinstance(node.func, ast.Call):
+            inner_call = node.func
+            if isinstance(inner_call.func, ast.Name) and inner_call.func.id == 'getattr':
+                if len(inner_call.args) >= 2 and isinstance(inner_call.args[1], ast.Constant):
+                    attr_name = inner_call.args[1].value
+                    if attr_name == 'shift':
+                        for arg in node.args:
+                            if self._is_negative_period(arg):
+                                return "getattr(..., 'shift')() with negative period (future access)"
+                        for kw in node.keywords:
+                            if kw.arg == 'periods' and self._is_negative_period(kw.value):
+                                return "getattr(..., 'shift')() with negative period (future access)"
+                    elif attr_name == 'diff':
+                        for arg in node.args:
+                            if self._is_negative_period(arg):
+                                return "getattr(..., 'diff')() with negative period (future access)"
+                        for kw in node.keywords:
+                            if kw.arg == 'periods' and self._is_negative_period(kw.value):
+                                return "getattr(..., 'diff')() with negative period (future access)"
+                    elif attr_name in ('bfill', 'backfill'):
+                        return f"getattr(..., '{attr_name}')() backfills from future values"
+        
+        return None
+    
+    def _check_sinks(self, tree: ast.AST):
+        """Pass 2: Check if tainted data flows into sensitive sinks."""
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Call):
+                continue
+            
+            if isinstance(node.func, ast.Attribute):
+                method = node.func.attr
+                sinks = {'fit', 'fit_transform', 'fit_predict', 'train',
+                          'partial_fit', 'predict', 'score'}
+                
+                if method in sinks:
+                    # Check if any positional argument is tainted
+                    for arg in node.args:
+                        arg_taint = self._expr_taint(arg)
+                        if arg_taint:
+                            self.diagnostics.append(Diagnostic(
+                                node.lineno, node.col_offset, "error", "F001",
+                                f"Tainted data flows into .{method}(): {arg_taint}",
+                                "Ensure training/prediction data is free of future information"))
+                    # R2-8 fix: Check keyword arguments for taint as well
+                    for kw in node.keywords:
+                        kw_taint = self._expr_taint(kw.value)
+                        if kw_taint:
+                            kw_name = kw.arg if kw.arg else "**kwargs"
+                            self.diagnostics.append(Diagnostic(
+                                node.lineno, node.col_offset, "error", "F001",
+                                f"Tainted data flows into .{method}() via keyword '{kw_name}': {kw_taint}",
+                                "Ensure training/prediction data is free of future information"))
+    
+    def _get_var_name(self, node: ast.AST) -> Optional[str]:
+        """Extract variable name from an assignment target."""
+        if isinstance(node, ast.Name):
+            return node.id
+        if isinstance(node, ast.Subscript):
+            # df['col_name'] — return as df.col_name
+            base = self._get_var_name(node.value)
+            if isinstance(node.slice, ast.Constant) and isinstance(node.slice.value, str):
+                return f"{base}.{node.slice.value}" if base else node.slice.value
+            return base
+        if isinstance(node, ast.Attribute):
+            base = self._get_var_name(node.value)
+            return f"{base}.{node.attr}" if base else node.attr
+        return None