feat(scanner): reject plugin browser-profile stores

[seonghobae]

Current repair boundary — 2026-09-12

• base: feat/claude-plugin-hidden-executable-1099@7bca8ffc0793ad50fc82f957523fe86439711df9
• exact head: f859b134c4db3e99f64eedc28413931c12dbe90c
• exact tree: 393c12c9ccb9d7fb20f890ee3014b1e5a5e9f4d8
• ancestry: ordinary two-parent merge of previous feat(scanner): reject plugin browser-profile stores #1150 head 8a360d2… and current feat(scanner): reject hidden undeclared plugin executables #1146 head 7bca8ff…; no force update
• exact-tree validation: PYTHONPATH=. python -m pytest -q tests/test_claude_plugin*.py → 153 passed; py_compile and git diff --check passed
• lifecycle: Draft / browser-profile delta and all parent repairs preserved / hosted exact-head Checks and independent review absent
• stacked-workflow admission remains owned by fix(ci): admit stacked PR checks without bypassing docs contracts #1096; do not create a source-neutral wake-up commit

Successor of #1146 / issue #1099. Does not Close those. Does not steal G-06 #1133, #1145 eval, or #1146 hidden-executable unique delta. Docker sockets stay claude-plugin-docker-socket.

Unique delta

Fail closed on host browser profile stores (claude-plugin-browser-profile-access):

• hook copy of Google/Chrome Cookies fails admission
• Firefox cookies.sqlite, Chromium Login Data, and %LOCALAPPDATA%\Google\Chrome fail admission
• a plugin.json command string that names Chrome Cookies fails admission
• README documentation of those paths is not this finding
• a bare Firefox product name stays browser_profile_access inventory, not this finding
• /var/run/docker.sock stays claude-plugin-docker-socket
• feat(scanner): reject hidden undeclared plugin executables #1146 hidden undeclared executables stay that class
• snippets omit secrets and raw bidi

#1146 remains owner of hidden undeclared executable/config surfaces.

Test plan

• RED then GREEN (tests/test_claude_plugin_browser_profile.py)
• Detector statement coverage 1444/1444 with plugin suites on Python 3.13
• Exact-head Checks on this head
• Keep Draft until current-head gates are GREEN

Relates to #1099. Relates to #1146.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Stacked successor Draft #1151 (feat/claude-plugin-deceptive-description-1099 @ 822ca12f1d8b55ae81f7feb882cc6f3073587256) adds claude-plugin-deceptive-description only. It does not Close #1099 or #1150. Browser-profile access stays this PR. Inventory remains evidence, not permission.