fix(scanner): require subcommand keyword for subcommand-style runners

Codex re-review (MCP-2445): runnerPackageSpec returned the first positional
even when the runner's required subcommand keyword was absent, so with
pnpm/yarn/bun gated as package runners:

  pnpm start      -> "start"
  bun server.ts   -> "server.ts"
  pipx install x  -> "install"

The wrong token was then fetched/scanned = false coverage + typosquat risk.

Fix: for subcommand-style runners (pnpm/yarn `dlx`, `bun x`, `pipx run`), a
package spec is resolved ONLY when the keyword is present. A bare local
invocation (`pnpm start`, `bun server.ts`, `pipx install foo`) now yields ""
(no package) and degrades to tool-definitions-only instead of fetching a
bogus package. npx/uvx/bunx (no subcommand) are unchanged.

TDD: added pnpm start / pnpm run build / bun server.ts / bun run dev /
yarn build / pipx install cases (-> ""); pnpm dlx <pkg> / npx -y <pkg> /
uvx --from still resolve. Rebased onto origin/main (picks up #676
archive-extraction hardening + the teams/broker -> serveredition/broker move).

Related MCP-2445

Author: Dumbris

internal/security/scanner/package_fetch.go

@@ -168,7 +168,9 @@ func runnerFlagTakesValue(npm bool, flag string) bool {
 // returned verbatim) that a package-runner command will execute, from its command
 // base and argument list. It understands:
 //   - a leading runner subcommand keyword (`pipx run`, `pnpm dlx`, `yarn dlx`,
-//     `bun x`) that precedes the package token;
+//     `bun x`) that precedes the package token — and which is REQUIRED for those
+//     runners: a bare `pnpm start` / `bun server.ts` is a local invocation, not a
+//     remote fetch, and yields "" (no package);
 //   - flags that NAME the target package — uv `--from <pkg>`, npx `--package`/
 //     `-p <pkg>` — whose value is returned directly;
 //   - value-bearing flags whose argument is NOT the target (`--with <dep>`,
@@ -198,10 +200,19 @@ func runnerPackageSpec(commandBase string, args []string) string {
 			}
 			continue
 		}
-		// First positional token. Skip a leading runner subcommand keyword once.
-		if !subSkipped && arg == sub {
-			subSkipped = true
-			continue
+		// First positional token. Subcommand-style runners (pnpm/yarn/bun/pipx)
+		// REQUIRE their keyword (dlx/x/run) before the package token: a bare
+		// `pnpm start`, `bun server.ts`, or `pipx install foo` is a LOCAL
+		// invocation, NOT a remote package fetch, so it must not resolve a spec —
+		// fetching the wrong token would mean false coverage and typosquat risk
+		// (MCP-2445 re-review). Once the keyword is consumed the next positional
+		// is the package.
+		if !subSkipped {
+			if arg == sub {
+				subSkipped = true
+				continue
+			}
+			return ""
 		}
 		return arg
 	}

internal/security/scanner/package_fetch_test.go

@@ -61,6 +61,15 @@ func TestRunnerPackageSpec(t *testing.T) {
 		// uvx -p/--python carries a version, NOT the package.
 		{"uvx -p python", "uvx", []string{"-p", "3.11", "main-pkg"}, "main-pkg"},
 		{"uvx --python", "uvx", []string{"--python", "3.12", "--from", "main-pkg", "cmd"}, "main-pkg"},
+		// Subcommand runners WITHOUT the keyword must NOT resolve a package spec —
+		// these are local invocations, not remote package fetches (MCP-2445 re-review).
+		// Fetching the first positional here = false coverage + typosquat risk.
+		{"pnpm start (local script)", "pnpm", []string{"start"}, ""},
+		{"pnpm run build (local script)", "pnpm", []string{"run", "build"}, ""},
+		{"bun server.ts (local file)", "bun", []string{"server.ts"}, ""},
+		{"bun run dev (local script)", "bun", []string{"run", "dev"}, ""},
+		{"yarn build (local script)", "yarn", []string{"build"}, ""},
+		{"pipx install foo (not ephemeral run)", "pipx", []string{"install", "foo"}, ""},
 		// Degenerate inputs.
 		{"npx flag only", "npx", []string{"-y"}, ""},
 		{"nil", "npx", nil, ""},