feat(scanner): reject plugin trees nested past bounded path depth

[seonghobae]

Successor of #1175 / issue #1099. Does not Close those. Unsigned checksum stays #1175. Hosted deploy stays #1174. Checksum mismatch stays #1169. Pass is not Noema admission.

Unique delta

Fail closed when a materialized plugin file or zip/tar member nests past 32 path components (claude-plugin-excessive-path-depth, CWE-400):

• a regular file 33 components deep fails admission
• a file at the 32-component bound is not this class
• zip and tar members with too many components fail closed and are not extracted
• ../ zip-slip stays claude-plugin-archive-path-traversal
• nested zip/tar stays claude-plugin-decompression-bomb
• oversized file-count and byte budgets stay claude-plugin-oversized-package
• one tree finding, not one per nested file
• snippets are the label nested-path

#1175 remains owner of unsigned checksums. #1166 remains owner of archive bombs. #1135 remains owner of zip-slip.

Evidence

• RED 7406d01 then GREEN 815e55d

• tests/test_claude_plugin_path_depth.py plus sibling unsigned/mismatch/bomb lock

• predecessor path-depth plugin coverage suite 426 passed on Python 3.13

• no hosted workflow is created on this stacked custom base; keep Draft until stacked integration evidence is available

• Normal two-parent descendant 6f6e47c46e73ca6d6b802808b4e134203ba59f48 integrates feat(scanner): fail closed on plugin terraform apply and helm install #1173 command-context RED/GREEN without force-push; compare to current parent aa5128fb1156... is 4 ahead / 0 behind and preserves this PR's unique delta.

• Candidate source AST passes; the final stacked detector preserves 3/3 negative command-context and 2/2 later-real-command probes. Custom-base hosted workflow evidence remains absent, so Draft stays required.

Relates to #1099. Relates to #1175.

Current quoted-command context repair

This descendant inherits #1173 RED d7384e53d44a426356a73e24b2b9cc3fe153de27 and final canonical repair 3a5b14771cc7abb6553fa1ec9bcd8b62acc947ac without copying a leaf workaround. Exact head: 854425316ceeee270dec78fb0c6723050af36531; current parent: 77f7ffa03cc97670ae66e329b6b811e6264867a4; Git compare is 0 behind and preserves this PR's unique detector/test delta. The top #1183 source AST and extracted helper probes pass quoted/reporting negatives while preserving direct and command-substitution positives. This custom-base PR stays Draft until its own hosted integration and independent review are terminal.

Current assignment-value context repair — 2026-09-08

This normal two-parent descendant inherits canonical #1173 RED 90ae232e852b3d01463d978f9bccd9157c341fe7 and GREEN 1e6a3eb43a5bc2d146656af13e7fa6cad2a77315 without a leaf workaround. Exact head: bcf82acf97fb9bc7b541659fc61740323fc53a45; current parent: 29011cca6f465dbd988465c6ff67fe7caa18223b; Git compare is 0 behind and preserves this PR's unique detector/test delta. Assignment-value negatives and environment-prefix/direct/substitution positives are present in the exact tree. This custom-base PR remains Draft until its own hosted integration and independent current-head review are terminal. Earlier head strings in this body are historical evidence only.

Current heredoc-safe restack — 2026-09-08

Canonical #1173 exact head 184b4b4f55906284ac1d8059e46cec8f0d9cfc9a fixes closed literal here-document payload false positives with RED 6f6be77d... → GREEN 12faf2f.... This branch was integrated non-destructively on parent bb9cd1dd6af007f2b1e85978974150480da3fad6; exact head is e29cc87bcb33b084c17d563539356f7979136223. GitHub compare reports behind_by=0, ahead_by=13; the PR's unique detector delta remains in the tree. Exact-head hosted integration and independent review are not terminal, so this PR remains Draft. Earlier head strings are historical evidence only.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}