[hermes] atlasbot: python:S2208 #129

New Issue

hermes-automation · 2026-09-24T21:23:01Z

hermes-automation commented

2026-09-24 21:23:01 +00:00

SonarQube reports python:S2208 in atlasbot/engine/answerer/spine.py. The build is green; this is a standing finding, not a failure.

What is wrong

Line 9 uses a wildcard import (from ._base import *), so it is impossible to tell from this file which names actually come from _base, and the module-level __all__ comprehension at the bottom silently re-exports whatever underscore-prefixed names _base happens to inject into globals(). Any name added to or removed from _base changes this module's public surface without any visible edit here.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (atlasbot/engine/answerer/spine.py:9)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

atlasbot/engine/answerer/spine.py — Replace the star import with an explicit import of exactly the names that _base currently exports (its __all__, or its public names if it has no __all__). Because the trailing __all__ = [name for name in globals() if name.startswith("_") and not name.startswith("__")] picks up wildcard-imported underscore names, the explicit list must include every underscore-prefixed name the star import was bringing in, or downstream from ...spine import * consumers would lose them. Listing them explicitly preserves the exact same set of names in globals() — and therefore the exact same computed `_
... (truncated)

from ._base import (
    _base_helper_one,
    _base_helper_two,
    _base_helper_three,
)

# NOTE for the maintainer applying this by hand: the placeholder names above
# must be replaced with the real list. Enumerate it from the current runtime
# truth so nothing is dropped, e.g.:
#   python -c "from atlasbot.engine.answerer import _base as m; print(sorted(getattr(m, '__all__', None) or [n for n in vars(m) if not n.startswith('__')]))"
# Every name that the wildcard import was injecting (including the
# underscore-prefixed ones, since spine's dynamic __all__ re-exports those)
# must appear in the parenthesized import list.

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=atlasbot&open=AZ2y3T38Ky9i4pkIpSiV
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_4e1246b776604c47a0fe8aadc4ae8fac). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **python:S2208** in `atlasbot/engine/answerer/spine.py`. The build is green; this is a standing finding, not a failure. ## What is wrong Line 9 uses a wildcard import (`from ._base import *`), so it is impossible to tell from this file which names actually come from `_base`, and the module-level `__all__` comprehension at the bottom silently re-exports whatever underscore-prefixed names `_base` happens to inject into globals(). Any name added to or removed from `_base` changes this module's public surface without any visible edit here. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (`atlasbot/engine/answerer/spine.py:9`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`atlasbot/engine/answerer/spine.py`** — Replace the star import with an explicit import of exactly the names that `_base` currently exports (its `__all__`, or its public names if it has no `__all__`). Because the trailing `__all__ = [name for name in globals() if name.startswith("_") and not name.startswith("__")]` picks up wildcard-imported underscore names, the explicit list must include every underscore-prefixed name the star import was bringing in, or downstream `from ...spine import *` consumers would lose them. Listing them explicitly preserves the exact same set of names in globals() — and therefore the exact same computed `_ ... (truncated) ``` from ._base import ( _base_helper_one, _base_helper_two, _base_helper_three, ) # NOTE for the maintainer applying this by hand: the placeholder names above # must be replaced with the real list. Enumerate it from the current runtime # truth so nothing is dropped, e.g.: # python -c "from atlasbot.engine.answerer import _base as m; print(sorted(getattr(m, '__all__', None) or [n for n in vars(m) if not n.startswith('__')]))" # Every name that the wildcard import was injecting (including the # underscore-prefixed ones, since spine's dynamic __all__ re-exports those) # must appear in the parenthesized import list. ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=atlasbot&open=AZ2y3T38Ky9i4pkIpSiV - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_4e1246b776604c47a0fe8aadc4ae8fac](https://triage.bstein.dev/chat?resume=run_4e1246b776604c47a0fe8aadc4ae8fac)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bstein/atlasbot#129