feat(scanner): reject plugin access to cookie and token stores

[seonghobae]

Successor of #1170 / issue #1099. Does not Close those. Browser-profile stays #1150. Hardcoded ghp_ stays #1137. gh pr merge stays #1170. Pass is not Noema admission.

Unique delta

Fail closed when a plugin hook or manifest reads host cookie or token stores that are not browser profiles (claude-plugin-credential-store-access, CWE-522):

• ~/.netrc and ~/.aws/credentials fail admission
• ~/.config/gh/hosts.yml, ~/.docker/config.json auth, cookies.txt, ~/.curl_home, and ~/.ssh/id_* private keys fail admission
• Chrome/Firefox profile paths stay claude-plugin-browser-profile-access
• hardcoded ghp_ stays claude-plugin-github-write-token
• gh pr merge stays claude-plugin-github-merge-command
• README AWS wording, gh issue create, docker push, and a declared 0755 echo hook are not this class
• snippets are path labels, not secret values

#1170 remains owner of GitHub merge and release CLI write verbs.

Evidence

• RED cc3db8c then GREEN 9370a0d
• tests/test_claude_plugin_credential_store.py plus sibling merge/browser suites
• claude_plugin_detector.py statement coverage 2505/2505 on Python 3.13

Relates to #1099. Relates to #1170.

Current GitHub parser predecessor integration — 2026-09-08

Normal two-parent descendant f288cfa313a26661a3eaa1f8e74681228dfc20d9 integrates canonical #1170 exact head c17fc4fc628af573a4136aff8e2157ddcef3a4a2 without force and retains the GitHub command-context regression corpus while preserving this PR's credential-store delta and dynamic-eval analyzer. GitHub compare reports 5 ahead / 0 behind. This custom-base PR stays Draft pending fresh hosted integration and independent current-head review.

Current non-force restack — 2026-09-13

This Draft is an ordinary two-parent descendant of prior head f288cfa313a26661a3eaa1f8e74681228dfc20d9 and current #1170 head f5c75be09b9effa753f1c4f29d931ebe74bc786f. Exact head is c4ad59b28f6c3e9c9c1e5fa11f7db557d98799c3; exact tree is f8002385507b8bb97ba917c7085305b3c2d207e3. GitHub compare reports 6 ahead / 0 behind and preserves #1169 checksum path identity, #1170 GitHub command context, and this credential-store delta. Targeted credential/GitHub/checksum tests are 77/77; the complete exact-tree Claude-plugin regression is 400/400; compile and diff checks pass. No hosted exact-head workflow or qualifying independent review exists, so this custom-base PR remains Draft. Earlier head/check strings are historical evidence only.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head evidence — 2026-09-13: ordinary two-parent head c4ad59b28f6c3e9c9c1e5fa11f7db557d98799c3, tree f8002385507b8bb97ba917c7085305b3c2d207e3, is 6 ahead / 0 behind current #1170 and mergeable. It preserves checksum path identity and GitHub command-context repairs with the credential-store delta. Targeted credential/GitHub/checksum regressions pass 77/77; complete Claude-plugin regressions pass 400/400; compile and diff checks pass. Zero hosted workflows, reviews, and unresolved threads require Draft; no predecessor evidence transfers.