feat(scanner): reject dynamic eval on plugin hook surfaces

[seonghobae]

Current repair boundary — 2026-09-12

• base: feat/claude-plugin-postinstall-download-1099@427c4b314208f5c555ab148399d479539e23b0dc
• exact head: 262650f3c3b34565c3317a10b1fabefbc4dba751
• exact tree: a2a9e9ad9cad241a27abcdc0a8c0694f41b0bbda
• ancestry: ordinary two-parent merge of previous feat(scanner): reject dynamic eval on plugin hook surfaces #1145 head 1d42ac5… and current feat(scanner): reject plugin postinstall downloads #1144 head 427c4b3…; no force update
• exact-tree validation: PYTHONPATH=. python -m pytest -q tests/test_claude_plugin*.py → 133 passed; py_compile and git diff --check passed
• lifecycle: Draft / dynamic-eval delta and all parent repairs preserved / hosted exact-head Checks and independent review absent
• stacked-workflow admission remains owned by fix(ci): admit stacked PR checks without bypassing docs contracts #1096; do not create a source-neutral wake-up commit

Summary

• Fail closed on eval( / exec( / compile( / new Function( / shell eval on plugin hook, script, and command surfaces (claude-plugin-dynamic-eval).
• print() and evaluate() remain negative. Repo-root Python is not a plugin hook surface.
• Does not invent a second download family; feat(scanner): reject plugin postinstall downloads #1144 postinstall download stays unique.
• scan_result=pass is not Noema admission.

Stacked on #1144. Unique remaining #1099 dynamic-evaluation slice. Do not Close #1099 or #1144. Do not steal G-06 #1133.

Test plan

• RED then GREEN (tests/test_claude_plugin_dynamic_eval.py)
• Detector statement coverage 1006/1006 with plugin suites
• Exact-head Checks on this head
• Keep Draft until current-head gates are GREEN

Relates to #1099. Relates to #1144.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Unique remaining #1099 dynamic-evaluation slice on #1144 c66dfaf.

Exact head 1d42ac55df6b576a61e693e5dca57e238ec8d388. Hook eval/exec/compile/Function fail closed. Detector statement coverage 1006/1006. Keep Draft. Do not Close #1099 or #1144.

[seonghobae]

Stacked successor: Draft #1146 (feat/claude-plugin-hidden-executable-1099) targets this branch for the unique remaining #1099 hidden undeclared executable/config slice (claude-plugin-hidden-undeclared-executable). It does not Close #1099 or this PR, does not change the eval/exec delta, and does not treat .git metadata as a plugin executable surface.