refactor detect_shell without popen