fix: re.compile/getattr false positive DENY, unused variable

  - _python_scanner: exempt re.compile and regex.compile from dynamic
    execution detection (pattern compilation is safe)
  - _python_scanner: exempt getattr(obj, attr, default) with 3 args
  - _scanner: remove unused has_critical variable (F841)

Author: lll-peanut

trpc_agent_sdk/tools/safety/_python_scanner.py

@@ -476,13 +476,26 @@ def _handle_call(self, node: ast.Call) -> None:
 
         # --- Eval / exec / dynamic execution ---
         if canonical in _DYNAMIC_EXEC_CALLS:
-            self._findings.append(
-                PythonScanFinding(
-                    kind="eval_exec",
-                    canonical_name=canonical,
-                    line_number=line_no,
-                    evidence=evidence,
-                ))
+            # Exempt re.compile / regex.compile (pattern compilation, not code exec).
+            # Also exempt getattr(obj, attr, default) — property access, not exec.
+            if canonical in ("compile", "getattr"):
+                receiver = self._resolve_canonical(node.func.value) if isinstance(node.func, ast.Attribute) else ""
+                if canonical == "compile" and receiver in ("re", "regex"):
+                    pass  # re.compile(pattern) is safe — not dynamic exec
+                elif canonical == "getattr" and len(node.args) >= 3:
+                    pass  # getattr(obj, attr, default) — safe property access
+                else:
+                    self._findings.append(
+                        PythonScanFinding(kind="eval_exec",
+                                          canonical_name=canonical,
+                                          line_number=line_no,
+                                          evidence=evidence))
+            else:
+                self._findings.append(
+                    PythonScanFinding(kind="eval_exec",
+                                      canonical_name=canonical,
+                                      line_number=line_no,
+                                      evidence=evidence))
 
         # --- Concurrent / fork ---
         if canonical in _CONCURRENCY_CALLS:

trpc_agent_sdk/tools/safety/_scanner.py

@@ -280,7 +280,6 @@ def scan(self, scan_input: SafetyScanInput) -> SafetyScanReport:
         # Only upgrades NEEDS_HUMAN_REVIEW; never overrides DENY (blocklist wins).
         # Also refuses to upgrade when any CRITICAL finding exists, regardless
         # of how the policy maps CRITICAL → decision.
-        has_critical = any(f.risk_level == RiskLevel.CRITICAL for f in all_findings)
         has_high_or_critical = any(f.risk_level in (RiskLevel.HIGH, RiskLevel.CRITICAL) for f in all_findings)
         allow_upgraded = False
         # Only upgrade MEDIUM or lower (NEEDS_HUMAN_REVIEW) — never upgrade HIGH/CRITICAL