feat(scanner): reject plugin kubectl apply and docker push

[seonghobae]

Successor of #1171 / issue #1099. Does not Close those. Merge/release stay #1170. Credential stores stay #1171. Docker sockets stay claude-plugin-docker-socket. Pass is not Noema admission.

Unique delta

Fail closed when a plugin hook or manifest runs cluster or registry write commands:

• kubectl apply fails as claude-plugin-kubectl-apply-command (CWE-269)
• docker push and docker image push fail as claude-plugin-docker-push-command (CWE-250)
• kubectl get, docker ps, terraform apply, and helm install stay inventory
• README deploy wording is not a hook command
• gh pr merge stays claude-plugin-github-merge-command
• host Docker sockets stay claude-plugin-docker-socket
• snippets are command labels, not manifests, image names, tokens, or secrets

#1171 remains owner of host cookie and token stores.

Evidence

• RED 391358f then GREEN 936311c
• tests/test_claude_plugin_deployment_write.py plus sibling merge/credential/supply-chain suites
• plugin coverage suite 369 passed; detector statements 1813/1813 on Python 3.13

Relates to #1099. Relates to #1171.

Current shared command-context repair — 2026-09-08

RED e6d606246de48f3da1cebe5fde60dd62f9b0b99e proves two false-negative classes—structural manifest command plus typed args, and bounded sh|bash -c payloads—and false positives from description prose, reporting commands, assignment values, and noexec payloads. The repair reuses one structural/shell parser for kubectl and Docker instead of joining arbitrary argv.

The first source commit a6efcf514ed13c491888727606b0e56b5689f02d failed exact-tree verification because an overly broad source splice deleted the adjacent dynamic-eval analyzer. The non-destructive descendant de1b7c1f443a8347f1212e72ab4ed7ff281903c0 restores that analyzer and is the exact head. Exact-head compilation and production probes pass 8/8: four direct-argv/nested-shell positives and four prose/reporting/noexec/assignment negatives. Near verbs, malformed/mixed argv, whitespace executable identity, pull/list operations, and pushLocal stay negative.

This custom-base PR remains Draft: it has no hosted workflow, no current-head independent approval, and no unresolved review thread. Successor #1173 includes this exact commit as a second parent and is 0 behind; no stale evidence transfers.

Current GitHub parser predecessor integration — 2026-09-08

Normal two-parent descendant 058fdad051ce05f279a5ef0c4b561815ef9185e1 integrates #1171 exact head f288cfa313a26661a3eaa1f8e74681228dfc20d9 without force. It retains the GitHub command-context corpus and preserves kubectl/Docker, credential-store, and dynamic-eval deltas. GitHub compare reports 8 ahead / 0 behind. This custom-base PR stays Draft pending fresh hosted integration and independent current-head review; earlier exact-head text is historical evidence only.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}