NEW @W-23791879@ Feature/flow engine cwd shadowing fix

[nikhil-mittal-165]

No description provided.

[git2gus]

Git2Gus App is installed but the .git2gus/config.json doesn't have right values. You should add the required configuration.

[aruntyagiTutu]

Reviewed against the PR review guide. Diff and CI checked.

Correctly identifies and closes a CWE-427 module-shadowing vector: CPython places a spawned process's cwd at sys.path[0], ahead of PYTHONPATH. Since the CLI's cwd is the customer's scanned repo, an attacker-planted flow_scanner-named package there could shadow the bundled scanner and execute arbitrary code when the wrapper invokes -m flow_scanner. Pinning cwd: PATH_TO_FLOW_SCANNER_ROOT in the spawn() call closes this, and is behavior-preserving since all file args the wrapper passes are already absolute — confirmed via the inline comment and by checking PythonCommandExecutor.ts.

Test coverage is thorough and convincing:

• FlowScannerCommandWrapper.test.ts: end-to-end test plants a hostile flow_scanner package (writes a PWNED.txt sentinel + fake empty results) into a simulated scanned-repo cwd, confirms the sentinel is never created, and confirms real results still match the goldfile.
• PythonCommandExecutor.test.ts: lower-level regression test using a new cwd-probe.py fixture asserts the spawned child's cwd/sys.path[0] equals the trusted FlowScanner root, not the attacker-controlled cwd.

Both tests prove the vulnerability would exist without the fix (sentinel-write path) and that the fix closes it. CI green across all platforms. Version bump to 0.41.0-SNAPSHOT is appropriate.

No concerns. Approving.