[hermes] atlasbot: python:S2208 #87

New Issue

hermes-automation · 2026-09-23T00:22:15Z

hermes-automation commented

2026-09-23 00:22:15 +00:00

SonarQube reports python:S2208 in atlasbot/engine/answerer/spine.py. The build is green; this is a standing finding, not a failure.

What is wrong

spine.py uses from ._base import *, a wildcard import. This pollutes the module namespace with every public/underscored name _base.py defines, makes it impossible to tell from this file which names actually come from _base, and risks silent shadowing of the locally defined _spine_*/_format_*/_parse_* helpers if _base ever adds a same-named symbol. Nothing in the visible body of spine.py references a bare name that isn't stdlib, typing.Any, IntentMatch, summary_text, or one of its own locally defined _-prefixed functions, so the wildcard import's only apparent purpose is to feed _base's private helpers into this module's globals() so they get swept up by the trailing __all__ = [name for name in globals() if name.startswith("_") and not name.startswith("__")] re-export line.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (atlasbot/engine/answerer/spine.py:9)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

atlasbot/engine/answerer/spine.py — Replace the wildcard import with an explicit import of the specific names _base provides (or, if none are used directly, import the module object itself). Since the only observable purpose here is re-exporting _base's private helpers via __all__, importing the module and folding its own __all__/private names into this file's __all__ preserves the exact same re-export surface without the wildcard. A maintainer with the actual contents of _base.py should replace <name1>, <name2>, ... with the real list of names _base defines (or its own __all__ if it has one) so the explicit im
... (truncated)

from atlasbot.engine.answerer import _base

# ... existing code ...

__all__ = [name for name in globals() if name.startswith("_") and not name.startswith("__")]
__all__ += [name for name in dir(_base) if name.startswith("_") and not name.startswith("__")]
for _name in list(__all__):
    if _name not in globals() and hasattr(_base, _name):
        globals()[_name] = getattr(_base, _name)

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=atlasbot&open=AZ2y3T38Ky9i4pkIpSiV
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_0419aa356a3c43ce8ae5c37fb9c781c1). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **python:S2208** in `atlasbot/engine/answerer/spine.py`. The build is green; this is a standing finding, not a failure. ## What is wrong spine.py uses `from ._base import *`, a wildcard import. This pollutes the module namespace with every public/underscored name `_base.py` defines, makes it impossible to tell from this file which names actually come from `_base`, and risks silent shadowing of the locally defined `_spine_*`/`_format_*`/`_parse_*` helpers if `_base` ever adds a same-named symbol. Nothing in the visible body of spine.py references a bare name that isn't stdlib, `typing.Any`, `IntentMatch`, `summary_text`, or one of its own locally defined `_`-prefixed functions, so the wildcard import's only apparent purpose is to feed `_base`'s private helpers into this module's `globals()` so they get swept up by the trailing `__all__ = [name for name in globals() if name.startswith("_") and not name.startswith("__")]` re-export line. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (`atlasbot/engine/answerer/spine.py:9`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`atlasbot/engine/answerer/spine.py`** — Replace the wildcard import with an explicit import of the specific names `_base` provides (or, if none are used directly, import the module object itself). Since the only observable purpose here is re-exporting `_base`'s private helpers via `__all__`, importing the module and folding its own `__all__`/private names into this file's `__all__` preserves the exact same re-export surface without the wildcard. A maintainer with the actual contents of `_base.py` should replace `<name1>, <name2>, ...` with the real list of names `_base` defines (or its own `__all__` if it has one) so the explicit im ... (truncated) ``` from atlasbot.engine.answerer import _base # ... existing code ... __all__ = [name for name in globals() if name.startswith("_") and not name.startswith("__")] __all__ += [name for name in dir(_base) if name.startswith("_") and not name.startswith("__")] for _name in list(__all__): if _name not in globals() and hasattr(_base, _name): globals()[_name] = getattr(_base, _name) ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=atlasbot&open=AZ2y3T38Ky9i4pkIpSiV - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_0419aa356a3c43ce8ae5c37fb9c781c1](https://triage.bstein.dev/chat?resume=run_0419aa356a3c43ce8ae5c37fb9c781c1)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bstein/atlasbot#87