python-vibe-guard 0.7.1__py3-none-any.whl

pyvibe/rules/sqlite_async.py

@@ -0,0 +1,82 @@
+import ast
+from typing import List, Set
+from pyvibe.rules.base import Violation, AsyncBlockingCallVisitor
+
+
+class SqliteAsyncRule(AsyncBlockingCallVisitor):
+    """
+    PYVIBE-008 — sqlite3.connect() inside async def
+
+    sqlite3 is a synchronous library. connect() opens the database file with
+    blocking I/O and all subsequent cursor operations block the OS thread.
+    AI-generated FastAPI examples routinely use sqlite3 inside async handlers.
+
+    Fix: use `aiosqlite.connect()` with async context manager and await.
+    """
+
+    RULE_ID = "PYVIBE-008"
+    SEVERITY = "CRITICAL"
+
+    def __init__(self):
+        super().__init__()
+        # Names bound to the `sqlite3` module via `import sqlite3 [as X]`
+        self._sqlite3_aliases: Set[str] = set()
+        # Names imported directly from sqlite3: `from sqlite3 import connect`
+        self._from_sqlite3: Set[str] = set()
+
+    def visit_Import(self, node: ast.Import):
+        for alias in node.names:
+            if alias.name == "sqlite3":
+                self._sqlite3_aliases.add(alias.asname if alias.asname else alias.name)
+        self.generic_visit(node)
+
+    def visit_ImportFrom(self, node: ast.ImportFrom):
+        if node.module == "sqlite3":
+            for alias in node.names:
+                if alias.name == "connect":
+                    self._from_sqlite3.add(alias.asname if alias.asname else alias.name)
+        self.generic_visit(node)
+
+    def visit_Call(self, node: ast.Call):
+        if self._current_async_func is None:
+            self.generic_visit(node)
+            return
+
+        if self._is_sqlite_connect(node):
+            self.violations.append(Violation(
+                rule_id=self.RULE_ID,
+                severity=self.SEVERITY,
+                line=node.lineno,
+                function_name=self._current_async_func,
+                message="sqlite3.connect() is synchronous — blocks the event loop during I/O",
+                evidence="Use `async with aiosqlite.connect('db.sqlite3') as db:` instead",
+            ))
+
+        self.generic_visit(node)
+
+    def _is_sqlite_connect(self, node: ast.Call) -> bool:
+        # sqlite3.connect(...)
+        # Guard against NAME_COLLISION: only flag when the receiver name is
+        # known to be bound to the sqlite3 module via an import statement.
+        # Without this, any `obj.connect(...)` where the variable happens to
+        # be named `sqlite3` would be a false positive.
+        if (
+            isinstance(node.func, ast.Attribute)
+            and node.func.attr == "connect"
+            and isinstance(node.func.value, ast.Name)
+            and node.func.value.id in self._sqlite3_aliases
+        ):
+            return True
+
+        # from sqlite3 import connect → connect(...)
+        # Guard against NAME_COLLISION: bare `connect()` is an extremely common
+        # name used by asyncpg, aiomysql, aiopg, websockets, aio-pika, asyncssh,
+        # and many other async libraries. Only flag when `connect` was explicitly
+        # imported from sqlite3 (a rare but real pattern: `from sqlite3 import connect`).
+        if (
+            isinstance(node.func, ast.Name)
+            and node.func.id in self._from_sqlite3
+        ):
+            return True
+
+        return False

pyvibe/rules/subprocess_async.py

@@ -0,0 +1,54 @@
+import ast
+from typing import List
+from pyvibe.rules.base import Violation, AsyncBlockingCallVisitor
+
+SUBPROCESS_BLOCKING = {"run", "call", "check_output", "Popen"}
+
+
+class SubprocessAsyncRule(AsyncBlockingCallVisitor):
+    """
+    PYVIBE-007 — subprocess blocking calls inside async def
+
+    subprocess.run / call / check_output / Popen all block the OS thread
+    running the event loop for the entire duration of the subprocess.
+    Under concurrent load this serialises execution and eliminates the
+    benefit of async.
+
+    Fix: use asyncio.create_subprocess_exec() or
+         asyncio.create_subprocess_shell() with await proc.communicate().
+    """
+
+    RULE_ID = "PYVIBE-007"
+    SEVERITY = "CRITICAL"
+
+    def visit_Call(self, node: ast.Call):
+        if self._current_async_func is None:
+            self.generic_visit(node)
+            return
+
+        method = self._get_subprocess_method(node)
+        if method:
+            self.violations.append(Violation(
+                rule_id=self.RULE_ID,
+                severity=self.SEVERITY,
+                line=node.lineno,
+                function_name=self._current_async_func,
+                message=f"subprocess.{method}() blocks the event loop for the entire subprocess duration",
+                evidence="Use `proc = await asyncio.create_subprocess_exec(*cmd)` then `await proc.communicate()`",
+            ))
+
+        self.generic_visit(node)
+
+    def _get_subprocess_method(self, node: ast.Call):
+        # subprocess.run(...), subprocess.Popen(...), etc. — qualified form only
+        # Bare names (run, call…) excluded: 'call' is too generic and caused a
+        # false positive in FastAPI where 'call' is a local dependency variable.
+        if (
+            isinstance(node.func, ast.Attribute)
+            and node.func.attr in SUBPROCESS_BLOCKING
+            and isinstance(node.func.value, ast.Name)
+            and node.func.value.id == "subprocess"
+        ):
+            return node.func.attr
+
+        return None

pyvibe/rules/threading_lock.py

@@ -0,0 +1,89 @@
+import ast
+from typing import List, Set
+from pyvibe.rules.base import Violation, AsyncBlockingCallVisitor
+
+# threading.Event is a signalling primitive (set/wait), not a lock — it does not
+# block the event loop in the same way and is legitimately used as a sync↔async
+# bridge (e.g. signalling a Playwright or subprocess thread). Excluded deliberately.
+THREADING_PRIMITIVES = {"Lock", "RLock", "Semaphore", "BoundedSemaphore", "Condition"}
+
+
+class ThreadingLockRule(AsyncBlockingCallVisitor):
+    """
+    PYVIBE-004 — threading.Lock (and other threading primitives) inside async def
+
+    threading.Lock.acquire() is a blocking call. When used inside an async
+    function it blocks the OS thread, preventing the event loop from
+    scheduling other coroutines. This is the async equivalent of
+    synchronized + Virtual Threads pinning in Java.
+
+    AI models mix threading and asyncio when they copy sync patterns into
+    async code — the bug only surfaces under concurrent load.
+
+    Fix: use `asyncio.Lock()` with `async with lock:`.
+    """
+
+    RULE_ID = "PYVIBE-004"
+    SEVERITY = "CRITICAL"
+
+    def __init__(self):
+        super().__init__()
+        # Names bound to the `threading` module via `import threading [as X]`
+        self._threading_aliases: Set[str] = set()
+        # Names imported directly from threading: `from threading import Lock`
+        self._from_threading: Set[str] = set()
+
+    def visit_Import(self, node: ast.Import):
+        for alias in node.names:
+            if alias.name == "threading":
+                self._threading_aliases.add(alias.asname if alias.asname else alias.name)
+        self.generic_visit(node)
+
+    def visit_ImportFrom(self, node: ast.ImportFrom):
+        if node.module == "threading":
+            for alias in node.names:
+                if alias.name in THREADING_PRIMITIVES:
+                    self._from_threading.add(alias.asname if alias.asname else alias.name)
+        self.generic_visit(node)
+
+    def visit_Call(self, node: ast.Call):
+        if self._current_async_func is None:
+            self.generic_visit(node)
+            return
+
+        primitive = self._get_threading_primitive(node)
+        if primitive:
+            self.violations.append(Violation(
+                rule_id=self.RULE_ID,
+                severity=self.SEVERITY,
+                line=node.lineno,
+                function_name=self._current_async_func,
+                message=f"threading.{primitive}() blocks the event loop under contention",
+                evidence="Use `asyncio.Lock()` with `async with lock:` instead",
+            ))
+
+        self.generic_visit(node)
+
+    def _get_threading_primitive(self, node: ast.Call):
+        # threading.Lock(), threading.RLock(), etc.
+        # Guard against NAME_COLLISION: only flag when the receiver is known to
+        # be bound to the `threading` module via an import statement.
+        if (
+            isinstance(node.func, ast.Attribute)
+            and node.func.attr in THREADING_PRIMITIVES
+            and isinstance(node.func.value, ast.Name)
+            and node.func.value.id in self._threading_aliases
+        ):
+            return node.func.attr
+
+        # from threading import Lock → Lock()
+        # Guard against NAME_COLLISION: bare names only fire when the name was
+        # explicitly imported from threading (e.g. anyio.Lock or a custom Lock
+        # class would not be in _from_threading and are correctly skipped).
+        if (
+            isinstance(node.func, ast.Name)
+            and node.func.id in self._from_threading
+        ):
+            return node.func.id
+
+        return None

pyvibe/rules/while_true_no_await.py

@@ -0,0 +1,111 @@
+import ast
+from typing import List, Optional
+from pyvibe.rules.base import Violation
+
+
+def _has_await_in_scope(nodes) -> bool:
+    """Return True if any await exists in the given nodes, not crossing function boundaries."""
+    for node in nodes:
+        if isinstance(node, ast.Await):
+            return True
+        if isinstance(node, (ast.AsyncFunctionDef, ast.FunctionDef)):
+            # new scope — awaits inside don't help the outer loop
+            continue
+        for child in ast.iter_child_nodes(node):
+            if _has_await_in_scope([child]):
+                return True
+    return False
+
+
+def _has_yield_in_body(nodes) -> bool:
+    """Return True if body contains yield/yield-from, not crossing function boundaries.
+
+    An async def that yields is an async generator — each `yield` suspends the
+    generator and gives control back to the caller's `await __anext__()`, so it
+    IS a valid event-loop checkpoint and must not be flagged by PYVIBE-018.
+    """
+    for node in nodes:
+        if isinstance(node, (ast.Yield, ast.YieldFrom)):
+            return True
+        if isinstance(node, (ast.AsyncFunctionDef, ast.FunctionDef)):
+            continue  # inner function's yields are its own scope
+        for child in ast.iter_child_nodes(node):
+            if _has_yield_in_body([child]):
+                return True
+    return False
+
+
+class WhileTrueNoAwaitRule(ast.NodeVisitor):
+    """
+    PYVIBE-018 — while True without await inside async def
+
+    An infinite loop in an async function with no await point monopolises the
+    event loop indefinitely — no other coroutine can run, and CPU usage hits
+    100%. AI-generated worker loops frequently omit the await.
+
+    Fix: add `await asyncio.sleep(0)` (yield control) or any real await inside
+    the loop body.
+
+    Exclusion: async generators (async def bodies that contain `yield` or
+    `yield from`) are not flagged — each `yield` suspends the generator and the
+    caller's `await __anext__()` is a real event-loop checkpoint.
+    """
+
+    RULE_ID = "PYVIBE-018"
+    SEVERITY = "CRITICAL"
+
+    def __init__(self):
+        self.violations: List[Violation] = []
+        self._current_async_func: Optional[str] = None
+        self._current_func_is_async_gen: bool = False
+
+    def visit_AsyncFunctionDef(self, node: ast.AsyncFunctionDef):
+        previous = self._current_async_func
+        previous_is_gen = self._current_func_is_async_gen
+        self._current_async_func = node.name
+        self._current_func_is_async_gen = _has_yield_in_body(node.body)
+        self.generic_visit(node)
+        self._current_async_func = previous
+        self._current_func_is_async_gen = previous_is_gen
+
+    def visit_FunctionDef(self, node: ast.FunctionDef):
+        previous = self._current_async_func
+        previous_is_gen = self._current_func_is_async_gen
+        self._current_async_func = None
+        self._current_func_is_async_gen = False
+        self.generic_visit(node)
+        self._current_async_func = previous
+        self._current_func_is_async_gen = previous_is_gen
+
+    def visit_Lambda(self, node: ast.Lambda):
+        previous = self._current_async_func
+        previous_is_gen = self._current_func_is_async_gen
+        self._current_async_func = None
+        self._current_func_is_async_gen = False
+        self.generic_visit(node)
+        self._current_async_func = previous
+        self._current_func_is_async_gen = previous_is_gen
+
+    def visit_While(self, node: ast.While):
+        if (
+            self._current_async_func
+            and not self._current_func_is_async_gen
+            and isinstance(node.test, ast.Constant)
+            and node.test.value is True
+            and not _has_await_in_scope(node.body)
+        ):
+            self.violations.append(Violation(
+                rule_id=self.RULE_ID,
+                severity=self.SEVERITY,
+                line=node.lineno,
+                function_name=self._current_async_func,
+                message=(
+                    "while True loop inside async def has no await — "
+                    "event loop blocked indefinitely"
+                ),
+                evidence=(
+                    "Add `await asyncio.sleep(0)` to yield control, "
+                    "or `await asyncio.sleep(N)` for a real polling interval"
+                ),
+            ))
+        self.generic_visit(node)