[mohgupta-ship-it]

Summary

Maintenance fixes for the 2.13.x line. A downstream CI pinned to 2.13.3 reported 193 incomplete scans in one day. The most common causes were static_parse_limit from the tool-misuse parser and llm_structured_response_invalid from semantic_developer_intent. This PR fixes the parser regression that 2.13.3 introduced, hardens LLM JSON output on gateway Claude routes, reports why each model answer was rejected, and raises the OSV per-package advisory cap. Each change is its own commit.

Commit	Change
fix(parser)	Backtick words in Python docstrings no longer cause static_parse_limit
fix(llm)	Ask Claude models on OpenAI-compatible routes for exactly one JSON object when the schema is bound as json_schema
fix(llm)	Add a content-free diagnostic to rejected-response ledger rows and logs
fix(sc4)	Retain up to 64 OSV advisories per locked package (was 16)

Root causes

• Parse limits: of 35 files that are partial only on 2.13.3, 18 were complete on 2.12.0 and on main. All 18 bisect to cd0e5791, the 2.13.3 backport of fix(static): preserve shell and browser template boundaries #948.
  • That backport stopped treating Python quotes as shell quotes, so a backtick word inside a string, such as else `tool` on PATH in a docstring, became its own command-word candidate.
  • Its operands are bounded by the string's value, but the 2.13-only string-value guard (0e96f345, not on main) keeps the whole-source fallback for many ordinary constructs, such as re.compile, os.makedirs, getattr and type(e).__name__. The scan therefore fails closed.
  • Fix: a docstring or other bare string statement is discarded, so its own body bounds the word. The exception is a module that reads docstrings back through __doc__ or getdoc.
  • The guard also treats non-executing os calls and the __name__, __qualname__, __module__ and __file__ attributes as inert. Shell sinks, reflection, dynamic imports and object escapes keep the fallback, and destructive operands inside a docstring still exhaust the check. All existing guard tests pass unchanged.
• LLM validation: for the gateway route, the OpenAI provider binds strict json_schema, and the analyzer prompts carry no output-format instruction. A gateway can serve that format for Claude through a tool the model is not forced to call, because Claude 5.5 rejects forced tool calls. A prose answer then fails every bounded retry as "not a JSON object". Every failure in the CI sample is of that class. The instruction is limited to Claude model IDs on OpenAI-protocol clients bound with json_schema; validation is unchanged.
• output_limit on poetry.lock: filelock==4.1.1 has 17 OSV advisories, one more than the per-package cap. The per-scan detail and result budgets are unchanged.

Validation

• Replay of 59 production skills fetched at the commits from the failing jobs, static analysis only. Private inputs and reports are retained locally. reference_missing is treated as advisory, as in the downstream CI.

  	2.13.3	This branch
  Skills with no blocking rows	19	26
  static_parse_limit rows	65	50
  output_limit rows	1	0

  No skill gained a blocking row. Mapped onto the 193 incomplete CI scans: 62 are in skills not available locally. Of the rest, 24 now clear on static grounds, against 4 on 2.13.3, and 10 more are left with only LLM rows.

• Unit tests: 13,386 passed. 23 failures and 51 errors are identical on unmodified 2.13.3 in the local sandbox: the TP4 HTTP fixtures cannot bind a local port, the real-uv launcher tests cannot run, and three tests are timing-bound.

• New tests: 24 parser tests, including docstrings read back through __doc__, getattr and getdoc, destructive docstrings, and assigned strings that reach a shell. Also 8 tests for the LLM output instruction, one OSV test, and the diagnostics tests.

• ruff check and ruff format --check pass.

Not validated

• The LLM change has not been run against the gateway; no gateway credential was available. With the new diagnostics, any remaining failure on that route will name the rejecting check in the CI report.

Out of scope

• 4 files stay partial where the module loads code through importlib or a bundled import; the guard stays closed by design.
• 16 rows fixed on main by fix(analyzer): keep Python and Perl syntax from exhausting the shell parser #778, fix(analyzer): stop prose apostrophes and Python report strings from marking files partial #849, fix(static): stop backticks/apostrophes in comments and prose from tripping static_parse_limit #902, fix(analyzer): recognize JavaScript template literals #801 and fix(analyzer): avoid false parse limits on quoted shell assignments #634; the 2.13 line carries different re-implementations of those changes.
• obfuscated_instruction_text false positives on removal verbs inside inline code, such as subcommand lists and HTTP DELETE routes. These also occur on main.

🤖 Generated with Claude Code

[rng1995]

[SkillSpector Review]

Decision: Changes Requested.

Value and readiness

The maintenance work usefully reduces unnecessary partial scans, makes rejected model answers diagnosable, and retains more advisories under the existing aggregate budget. The new discarded-string exception still treats reachable docstrings as inert in a supported readback form, so it needs one correction before approval.

Material findings

Blocker — src/skillspector/python_tokens.py:941-951 and src/skillspector/nodes/analyzers/static_patterns_tool_misuse.py:3661-3665: preserve the fallback for aliased or indirect docstring readback. The new helper recognizes a literal "__doc__", an attribute named __doc__/getdoc, or a name spelled getdoc. It does not recognize from inspect import getdoc as doc followed by run(doc(find) + ' -rf /'), although that retrieves and executes the same function docstring as the tested inspect.getdoc(find) case. The imported helper is an ast.alias, and the call name is doc; neither matches the guard. getattr(find, '__' + 'doc__') similarly escapes the literal-only check. With a backtick word in find's docstring, python_discarded_string_spans therefore returns its span even when the whole-module shell/reflection guard has correctly refused isolated bounds. The new _discarded(owner) override then admits that span, and the operand check at lines 2627-2635 can limit inspection to the docstring body while excluding the later destructive operands. This is an unsound ownership proof for a value that actually reaches a shell, rather than a harmless documentation false positive. Separate genuinely discarded bare-string statements from retrievable docstrings, retain the conservative path when introspection aliases/indirect attribute access cannot be excluded, and add regressions for the aliased getdoc and computed __doc__ forms. The existing tests cover only explicit attribute/name/literal spellings.

No separate material blocker found in the other three changes. The gateway instruction is restricted to OpenAI-protocol clients, final model-ID components naming Claude, and json_schema/its default; validation, refusal/completion checks and bounded retries remain in place. The diagnostics derive channel, completion and shape from fixed codes, redact undeclared schema keys to *, exclude validation inputs/context, cap schema entries, and carry the field through batch, TP4, meta and ledger projection paths. The OSV per-package cap rises to 64 while the 64-detail-request, 256-result, response-byte and runtime budgets remain enforced, with limitations retained when exhausted.

PIC tradeoffs

Raising the per-package cap can spend more of the unchanged shared detail budget on an advisory-heavy early package, leaving later details partial; the implementation reports the limitation. Live gateway behavior remains unvalidated, so the additional instruction is a compatibility measure, not evidence of model-quality acceptance. Neither tradeoff requires weakening the existing validation boundary.

Verification and gaps

Read the complete 17-file diff and pinned implementation/test context for discarded-string ownership, the global shell guard and bounded operand consumer, gateway binding, structured-response checks, diagnostic propagation and OSV budget enforcement. Read the complete empty review/comment/thread history. Fresh metadata confirms the head is unchanged, open and non-draft, and all six current checks report success in CI run 41781149578. The older local failures described in the PR body are not being presented as current failures. The readback finding is a static source trace; no end-to-end scan result or runtime reproduction is claimed. No contributor code, tests, snippets, imports, builds, setup, hooks, scanner invocations or model calls were executed.

Reviewed head: 09c81a42b285ee9c19711c408ad2eb637ec89fd1.