fix(analyzer): cover indirect shell truthiness across Python execution surfaces - #497

Summary

• fix shell=True detection can be bypassed through variable assignment (malicious skill example that bypasses this static detection model) #475 across Python execution surfaces, including .py, .pyw, trusted extensionless Python shebangs, nested artifacts, and transitive scans
• resolve definitely truthy indirect shell= values while preserving conservative behavior for dynamic, ambiguous, or effectful code
• share one bounded tri-state Python source classifier and strict PEP 263 decoder across AST prewarm, static analyzers, artifact inventory, and reporting
• model CPython and env launch forms that can execute the scanned artifact, including explicit -i, PYTHONINSPECT, bare -c path execution, bare -m, GNU/Darwin option differences, and clear-environment ordering
• fail closed when source intent, decoding, traversal, or a child scan is incomplete; preserve exact fatal/risk facts under output caps and keep JSON/SARIF/Markdown stdout parseable and secret-safe

Supported contract

The AST companion follows bounded, source-ordered facts for direct subprocess receivers and imported callables. It handles straight-line assignments, safe protocol/finalizer cases, relevant function/class binding effects, and repeated trusted calls. Imports, arbitrary calls, mutation, rebinding, deletion, and other effects invalidate facts when safety cannot be proved.

Python source eligibility is no longer extension-only. Definite Python sources are analyzed; definite non-Python sources stay out of the Python AST path; runtime-dependent sources are still analyzed conservatively but publish python_source_ambiguous and incomplete status. Invalid source encodings similarly fail closed with python_source_decode_error.

Recursive aggregation now distinguishes work that was not scanned from scanned results omitted only for bounded output. Child failures remain fatal at ledger caps 1 and 2, aggregate risk survives record/serialization caps in every format, and machine-readable stdout is report-only.

Verification

Candidate: c986c3e4da2e7f6cee623ca2eac298a61a99a107

• final repository-wide run excluding only the environment-blocked stdio timing test: 5,223 passed, 14 skipped, 39 deselected, 4 expected xfails
• broad changed-surface matrix: 1,836 passed, 1 skipped
• full CLI suite: 169 passed; related CLI/MCP/completeness/deadline matrix: 220 passed
• build-context/transitive/input integration: 151 passed, 1 skipped
• isolated Python 3.13 and Python 3.14 parser/TM1 matrices: 1,060 passed on each interpreter
• fresh source and installed-wheel matrices: 35/35 each, with semantic parity after removing only generated IDs and timestamps
• recursive CLI: 18/18 source/wheel runs across terminal, JSON, Markdown, and SARIF; stdout/file destinations and strict incomplete mode passed
• installed-wheel MCP public surface: 8 real static scans across all four formats; complete and partial verdict contracts passed
• real Darwin and GNU env execution matrices: 25/25 each; native and Docker PTY, explicit -i, PYTHONINSPECT, and exact bare -c/-m execution probes passed
• real-root transitive fault probe: caps 1 and 2 invoked the child and retained the fatal failure; CLI exited 2; no private exception payload or unaccounted_work
• sdist/wheel build, twine check, isolated Python 3.14 install, 82-package dependency check, compileall, and import/version checks passed
• no-cache arm64 Docker build plus representative scanner, PTY, and relative-exec runtime matrices passed
• Ruff, format, and git diff --check passed; multiple independent review passes found no remaining actionable finding
• fresh GitHub CI on the exact head passed: changes, lint, test-unit, DCO, and Docker smoke

Remaining verification limits

• No live LLM/provider request was made and no credentials were inspected; all runtime scans used --no-llm / use_llm=False.
• No live FreeBSD host was available. FreeBSD-only parsing is regression-tested and bounded by live GNU/Darwin differentials. Local GNU coreutils 9.1 also cannot live-prove newer --env0-from behavior.
• The transitive root scan was real, while the child transport failure was deterministically injected rather than produced by a live remote clone failure.
• The real MCP stdio handshake test could not complete locally within its fixed 15-second timeout under severe endpoint-security and unrelated-workload I/O starvation. A simultaneous clean origin/main control timed out identically (60.193s versus 60.178s for the branch), while all other MCP server tests, direct public MCP scans, and server construction passed. The exact-head GitHub test-unit job passed on its clean runner.
• Docker verification was arm64-only locally.

Fixes #475