feat(scanner): reject plugin secret-to-prompt and secret-to-log flows

[seonghobae]

Current repair boundary — 2026-09-12

• base: feat/claude-plugin-conflicting-identity-1099@ba1e146c759e3c6dedd5ea14fe651e0733320697
• exact head: 02d9490358aef41974e0367039cb29a3e712aee8
• exact tree: 8c1816d9f20ff215e54a8aec2f20d7addfd02c44
• ancestry: ordinary two-parent merge of previous feat(scanner): reject plugin secret-to-prompt and secret-to-log flows #1158 head 29d4214… and current fix(scanner): reject duplicate invocation identities without namespace false positives #1157 head ba1e146…; no force update
• exact-tree validation: PYTHONPATH=. python -m pytest -q tests/test_claude_plugin*.py → 239 passed; py_compile and git diff --check passed
• lifecycle: Draft / secret-to-prompt delta and all parent detector repairs preserved / hosted exact-head Checks and independent review absent
• stacked-workflow admission remains owned by fix(ci): admit stacked PR checks without bypassing docs contracts #1096; do not create a source-neutral wake-up commit

Successor of #1157 / issue #1099. Does not Close those. Does not steal #1157 conflicting-identity, #1156 vendored-scope, #1137 secret-to-network, or G-06 #1152.

Unique delta

Fail closed when a hook or command interpolates an env/file secret into a prompt, log, or subprocess environment (claude-plugin-secret-to-prompt):

• echo "$OPENAI_API_KEY" > prompt.txt fails admission
• logger.info(os.environ['OPENAI_API_KEY']) and print(os.environ['GITHUB_TOKEN']) fail admission
• logging.info(api_key) and subprocess.run(..., env={**os.environ, 'KEY': secret}) fail admission
• curl -H "Authorization: Bearer $OPENAI_API_KEY" stays claude-plugin-secret-to-network (feat(scanner): reject GitHub write tokens and Docker sockets #1137), not this rule
• echo hello still passes
• reading a secret into a local variable that is not logged or prompted is not this class
• hardcoded sk- provider-secret literals stay that class
• snippets omit secret values and bidi

#1137 remains owner of curl/wget/fetch secret-to-network. #1157 remains owner of conflicting identities.

Stack state

Exact head 29d4214c3d634ac7e5af271d503d39b4c7525691 is an ordinary two-parent merge of prior #1158 head 8c9f2d61236eb6e8cc1b27402d73fcef37128085 and current #1157 head 62d91cdc096f2a8174ad97ca41042bf11052a132. It is three ahead / zero behind #1157, mergeable, and its effective delta remains the intended seven files. The resulting tree 7a346aaa90f55fc5fbcb36ae37c051a355b5c698 matches the locally verified merge tree.

Test plan

• Unique-delta RED then GREEN on predecessor 8c9f2d61... (tests/test_claude_plugin_secret_to_prompt.py)
• Exact merged tree: conflicting-identity plus secret-to-prompt focused modules 34/34, py_compile, and diff check passed
• Re-run detector statement/branch/public-doc coverage on unchanged exact head; predecessor 1878/1878 and 118/118 results do not transfer
• Exact-head hosted Security/SAST/CodeQL and qualifying independent review
• Keep Draft until current-head gates are GREEN

Relates to #1099. Relates to #1157. Relates to #1137.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Stack repair required after live predecessor advance

Live base branch feat/claude-plugin-conflicting-identity-1099 has advanced through current RED 4207f11b2bab1d6e1ea9357b263a483e34af3043. This PR remains on 8c9f2d61236eb6e8cc1b27402d73fcef37128085, which diverged from the predecessor before the command-identity precision repairs; GitHub currently reports this stack as non-mergeable.

Do not resolve this with force push, destructive rebase, or by dropping either lane's valid delta.

Ordinary non-force restack acceptance after #1157 reaches semantic GREEN:

• preserve fix(scanner): reject duplicate invocation identities without namespace false positives #1157 namespace/Skill/legacy-Command/Agent/NFC/vendored identity semantics and its full focused regression corpus;
• preserve this PR's claude-plugin-secret-to-prompt source, test, workflow, CHANGELOG and traceability deltas;
• resolve the shared detector/workflow/docs files by semantic integration rather than choosing one parent wholesale;
• resulting branch must be a descendant of both the current feat(scanner): reject plugin secret-to-prompt and secret-to-log flows #1158 head and the repaired fix(scanner): reject duplicate invocation identities without namespace false positives #1157 head (ordinary merge commit is acceptable);
• rerun detector statement coverage and this PR's secret-to-prompt/network boundary tests on the restacked exact head before any Ready/merge claim.

Until the predecessor RED is repaired and this descendant is restacked, keep Draft and do not transfer predecessor/successor GREEN evidence across commit identities.

[seonghobae]

Ordinary non-force restack completed after #1157 advanced.

• previous child: 8c9f2d61236eb6e8cc1b27402d73fcef37128085
• current parent fix(scanner): reject duplicate invocation identities without namespace false positives #1157: 62d91cdc096f2a8174ad97ca41042bf11052a132
• exact two-parent merge head: 29d4214c3d634ac7e5af271d503d39b4c7525691
• exact tree: 7a346aaa90f55fc5fbcb36ae37c051a355b5c698
• compare to parent: three ahead / zero behind, mergeable, seven effective files

The merge tree preserves all current #1157 namespace/path tests and source repairs plus #1158's secret-to-prompt source, workflow, docs, changelog, and 264-line regression module. Fresh combined focused verification is 34 passed in 0.52s; py_compile and diff checks passed.

Predecessor statement/public-doc coverage does not transfer to this merged head. No hosted workflow or independent review exists for the custom-base head, so the PR remains Draft. No force push, rebase, delta copy loss, or predecessor closure was used.

[seonghobae]

Fresh exact-tree regression expansion: remote head 29d4214c3d634ac7e5af271d503d39b4c7525691 and the locally verified two-parent merge have identical tree 7a346aaa90f55fc5fbcb36ae37c051a355b5c698. PYTHONPATH=. python -m pytest -q tests/test_claude_plugin*.py completed 220 passed in 2.25s. This includes every current #1157 Claude-plugin regression plus #1158's secret-to-prompt module. It is not the repository-wide suite, coverage gate, hosted Checks, formal approval, protected merge, or release; Draft remains correct.