fix: 3-arg getattr bypass + policy race + re.compile W504

  - _python_scanner: 3-arg getattr only exempted when NOT immediately called.
    getattr(os,system,None)('id') now correctly flagged as dyn-exec.
    x=getattr(cfg,key,def) as plain expression still safe.
  - _policy: get_policy/reload_policy now use threading.Lock to prevent
    concurrent double-load and inconsistent scanner cache.
  - _python_scanner: remove W504 line break after binary operator.

Author: lll-peanut

trpc_agent_sdk/tools/safety/_policy.py

@@ -13,6 +13,7 @@
 
 import hashlib
 import os
+import threading
 from dataclasses import dataclass
 from dataclasses import field
 from pathlib import Path
@@ -228,18 +229,22 @@ def _compute_hash(self) -> str:
 # ---------------------------------------------------------------------------
 
 _default_policy: Optional[SafetyPolicy] = None
+_policy_lock = threading.Lock()
 
 
 def get_policy(policy_path: Optional[str] = None) -> SafetyPolicy:
-    """Return the cached policy or load it from disk on first call."""
+    """Return the cached policy or load it from disk on first call (thread-safe)."""
     global _default_policy  # pylint: disable=global-statement
     if _default_policy is None:
-        _default_policy = PolicyLoader(policy_path).load()
+        with _policy_lock:
+            if _default_policy is None:
+                _default_policy = PolicyLoader(policy_path).load()
     return _default_policy
 
 
 def reload_policy(policy_path: Optional[str] = None) -> SafetyPolicy:
-    """Force-reload the policy from disk."""
+    """Force-reload the policy from disk (thread-safe)."""
     global _default_policy  # pylint: disable=global-statement
-    _default_policy = PolicyLoader(policy_path).load()
+    with _policy_lock:
+        _default_policy = PolicyLoader(policy_path).load()
     return _default_policy

trpc_agent_sdk/tools/safety/_python_scanner.py

@@ -483,10 +483,10 @@ def _handle_call(self, node: ast.Call) -> None:
                 receiver = self._resolve_canonical(node.func.value) if isinstance(node.func, ast.Attribute) else ""
                 if canonical == "compile" and receiver in ("re", "regex"):
                     pass  # re.compile(pattern) — safe, pattern compilation only
-                # getattr with 3+ args (including default) is safe property access
-                elif canonical == "getattr" and (len(node.args) >= 3 or
-                                                 (isinstance(node.func, ast.Call) and len(node.func.args) >= 3)):
-                    pass  # getattr(obj, attr, default) / getattr(...)() — safe
+                # getattr(x, y, default) as plain expression (NOT immediately
+                # called) is safe property access.
+                elif (canonical == "getattr" and len(node.args) >= 3 and not isinstance(node.func, ast.Call)):
+                    pass
                 else:
                     self._findings.append(
                         PythonScanFinding(kind="eval_exec",
@@ -537,7 +537,9 @@ def _check_dynamic_call(self, node: ast.Call, line_no: int, evidence: str) -> No
         if isinstance(func, ast.Call):
             inner = self._resolve_canonical(func.func)
             if inner == "getattr":
-                # getattr(obj, attr, default) with 3 args is safe property access
+                # getattr(obj, attr, default) with 3 args and NOT immediately
+                # called: safe property access (e.g. x = getattr(cfg, "key", 42)).
+                # Called form getattr(os,"system")(...) is caught by _handle_call.
                 if len(func.args) >= 3:
                     pass
                 else: