feat(scanner): fail closed on plugin terraform apply and helm install

[seonghobae]

Successor of #1172 / issue #1099. Does not Close those. kubectl apply and docker push stay #1172. Credential stores stay #1171. Pass is not Noema admission.

Unique delta

Fail closed when a plugin hook or manifest runs remaining deployment-write verbs that #1172 left as inventory:

• terraform apply as claude-plugin-terraform-apply-command (CWE-269)
• helm install as claude-plugin-helm-install-command (CWE-250)
• terraform plan, helm list, vercel deploy, and fly deploy stay inventory
• README terraform wording is not a hook command
• kubectl apply stays claude-plugin-kubectl-apply-command
• snippets are command labels, not vars, chart names, tokens, or secrets

Evidence

• Original RED 0e1f365 then GREEN e465cd7.
• Command-context RED 33aae04fec0b3813c1504f4f5a3aede6f272e8a7 proves that hook comments/reporting builtins and manifest description/reporting-only command strings were misclassified as executable terraform/Helm writes, while later real commands remain positive.
• GREEN lineage 1f901a3... → syntax repair 7051748... → parser-token completion 41669d695c60635d38c2f2ef5174141f20f9a24b routes both detectors through structural manifest command extraction and bounded shell command context. The intermediate serialization SyntaxError was caught by exact AST verification and is not present at the current head.
• Exact-head source/test AST passes; production negative command-context probes 3/3 and positive probes 3/3 pass on Python 3.12.13.
• This PR remains Draft because its custom stacked base creates no hosted workflow; downstream PRs must integrate this exact descendant non-destructively before any Ready claim.

Relates to #1099. Relates to #1172.

Current quoted-command context repair

A shared shell-frame precision defect treated inert quoted command names as executable. RED d7384e53d44a426356a73e24b2b9cc3fe153de27 fixes four production-path negatives: double- and single-quoted assignments, a quoted test operand, and reporting-only command substitution. GREEN cb208db431789b35b11064740f3067036ee2e2fa adds bounded root/$(...)/backtick frame tracking; cleanup descendants 3c5fdc447fd563fc909c92c1afe15dfd350264a8 and 3a5b14771cc7abb6553fa1ec9bcd8b62acc947ac remove invalid escapes without changing the policy boundary.

Exact head: 3a5b14771cc7abb6553fa1ec9bcd8b62acc947ac. Source and regression AST parse with SyntaxWarning treated as error. Extracted exact-head helpers pass 4 quoted/reporting negatives and 3 direct/substitution positives. This custom-base PR stays Draft until its own hosted integration and independent review are terminal; no predecessor evidence transfers.

Current assignment-value context repair — 2026-09-08

RED 90ae232e852b3d01463d978f9bccd9157c341fe7 proves that unquoted assignment values such as message=terraform apply and command=helm install are not executable deployment CLIs. GREEN exact head 1e6a3eb43a5bc2d146656af13e7fa6cad2a77315 rejects matches that start inside the current assignment word while preserving TF_IN_AUTOMATION=1 terraform apply, direct commands, and command substitutions as positive. Exact source/test AST passes with SyntaxWarning treated as error; extracted production-helper probes pass 2 assignment negatives, 2 environment-prefix positives, one substitution positive, and one reporting negative. This custom-base candidate remains Draft until hosted integration and independent current-head review are terminal. Earlier head strings in this body are historical evidence only.

Current here-document payload repair — 2026-09-08

RED 6f6be77d6b1bbef327de001ffb3fcaef2623b998 proves that closed literal here-document payload lines are data, not executable Terraform/Helm commands. GREEN 12faf2f46847ba05448ad4885d75559d8f26e301 adds a bounded literal-delimiter parser; fa9df24c67890bf57a7c98bb6f7b65f7d1a19548 preserves positive commands after quoted/commented opener lookalikes, and traceability descendant 184b4b4f55906284ac1d8059e46cec8f0d9cfc9a is the exact head. Quoted delimiters and <<- tab stripping are negative; ambiguous or unclosed forms remain fail-closed. Exact source/test AST passes with SyntaxWarning treated as error; extracted exact-head helpers pass 2 payload negatives and 6 direct/post-boundary/substitution positives. This custom-base candidate remains Draft pending hosted integration and independent current-head review. Earlier exact-head claims are historical evidence only.

Current no-op argument repair — 2026-09-08

RED 5bdcde76bde14742c96dbdd9a6919438e2ae6c17 proves that :, true, and false arguments were incorrectly treated as executable Terraform/Helm commands. GREEN exact head 873370bfceba0f161c6d1682459741f84d0ef92a classifies these no-op/status commands with the existing non-executing argument boundary while preserving real commands after ;, ||, and command substitution. Exact source/test AST passes with SyntaxWarning denied; extracted helpers pass 7/7 negative/positive probes. This remains Draft pending hosted integration and independent current-head review. Downstream #1174 is intentionally blocked until this canonical delta is non-force integrated.

Current structured manifest argv repair — 2026-09-08

RED 82a0cc86d2662d5953aa7c088f22ac9435a12c26 proves that structural JSON objects containing "command": "terraform", "args": ["apply"] or "command": "helm", "args": ["install", ...] lost the sibling argv. Independent review rejected the first generic-join GREEN because wrapper argv could become a false executable; boundary RED c76b1bd304b5c3c062a8538c04121e652c69dda4 preserves that case. Identity/options RED 52a6911215deec58537f4d6f3f1828e1fe62292e adds independent executable-path cases, whitespace identity, and bounded Terraform -chdir=DIR. GREEN 8d7ec9d6b2c47f737f5aa4cdf10895ca7a1f9f21 keeps shell strings separate and matches only direct Terraform/Helm argv with exact token boundaries. Final exact-tree probes remain 4/4 positive and 14/14 negative. This fixes the Terraform/Helm family only; older GitHub/kubectl/docker and downstream publish families still need their canonical owners to consume the typed argv descriptor before organization-wide completion can be claimed.

Current nested shell payload repair — 2026-09-08

RED 92568106aebdfcb729cd466fb5dbc5d124c9a4c8 proves that direct hook/manifest sh|bash -c payloads and structural shell argv bypassed Terraform/Helm findings. GREEN feeac8243a1af2565c7a01e85fdc0ef72f4a34d2 adds bounded stdlib tokenization for direct sh, bash, dash, ksh, or zsh execution, optional leading environment assignments, and a shell command payload. Token-boundary repair 4ff4ff3f706b9f6a44f0ca9c769be704fcea5e4c rejects near verbs such as helm install-chart and terraform apply-now.

Independent review then found valid split/compact option sequences and non-executing option states were conflated. RED 9cc0e8f53531c05347589ead4c0ed7ac51b299f0 first bounded split options and uppercase/value-taking false positives; RED 40d862dcbbd327bd3a426734f0af62e67a3d1750 adds runtime-confirmed -ce/-cx positives and -nc/-cn, dash -r, and Bash short-before-long negatives; GREEN a9b72debe4e74454d1d0490f14f00fd877024de2 repairs those states. A second independent review found repeated c, common -s/-i, and Bash --login remained executable false negatives. RED 89115aa107a4ba89ec638f3f69feada54856da8c retains them; GREEN 37bdc4de6966142e834fe64f98ab05fec851af39 repairs those cases. Final review found additional Bash-only execution-preserving short and long options. RED 71c61877eb461c780448504b1ce9bf100730a65b covers the complete runtime-confirmed no-value set while retaining -D, dump-string, noexec, value-taking, and missing-c negatives. Exact GREEN head 8d35ff91e042761d1fda0554b5c93d116d7c8865 accepts one-or-more lowercase c anywhere in an admitted cluster, uses explicit common and Bash-specific execution-preserving allowlists, rejects n noexec, admits r only for Bash, and admits Bash no-value long options only before short options.

Exact source/test AST passes with SyntaxWarning denied. Targeted production-path regressions pass 3/3 tests covering direct argv 4 positive / 14 negative, nested hooks 28 positive / 18 negative, and nested manifests 27 positive / 15 negative. Reporting/assignment/wrapper/comment prose, malformed argv, later $0 arguments, non-write verbs, near-verb suffixes, noexec, unsupported/value-taking options, and invalid ordering stay negative. Bounded FN follow-up remains for env/sudo/control-flow wrappers, nested substitutions, multiline or dynamic payloads. This PR remains Draft because the custom base has no hosted integration or independent current-head acceptance; downstream #1174 is 19 commits behind and must integrate non-force.

Current predecessor parser integration — 2026-09-08

Canonical predecessor #1172 repaired kubectl/Docker typed argv and nested-shell consumption at de1b7c1f443a8347f1212e72ab4ed7ff281903c0 after RED e6d606246de48f3da1cebe5fde60dd62f9b0b99e. This branch adopts the same shared parser in source commit 66674723c0c1414719c2c92a31dff0a6042af03d, retains the regression corpus in 0093507fba039757a1c43afddb4028374c898359, and integrates the prerequisite without force at exact merge head 825bf7e46a829b9a09e1c551d896030b2358a5b4.

Git comparison against #1172 is 38 ahead / 0 behind. Exact-head source compilation and production probes pass 12/12 across kubectl, Docker, Terraform, and Helm positive/negative boundaries. The PR remains Draft because the custom base produces no hosted workflow and there is no current-head independent approval; unresolved review threads are 0. Downstream #1174 must integrate this exact head non-destructively before any Ready claim.

Current GitHub parser predecessor integration — 2026-09-08

Normal two-parent descendant 5e40f9154d411aaaccca3a935f858a8ad5ef7b84 integrates #1172 exact head 058fdad051ce05f279a5ef0c4b561815ef9185e1 without force and retains the GitHub typed-argv regression corpus. GitHub compare reports 41 ahead / 0 behind. Exact source/test AST passes with SyntaxWarning denied; production probes pass 16/16 across GitHub, kubectl/Docker, and Terraform/Helm while preserving dynamic-eval. This custom-base PR stays Draft pending hosted integration and independent current-head review; predecessor Checks do not transfer.

Current non-force restack — 2026-09-13

This Draft is an ordinary two-parent descendant of prior head 5e40f9154d411aaaccca3a935f858a8ad5ef7b84 and current #1172 head 00cdb7966e10f6f6e283b10619723cefb8b4676a. Exact head is 6ec09ee32c972655f9e85eea7424df6ad9d3bff5; exact tree is a3cf421773e52d39843575490d513287889deb0e. GitHub compare reports 42 ahead / 0 behind and preserves every checksum, GitHub write, credential-store, kubectl/Docker deployment-write, Terraform/Helm, and dynamic-eval delta. Targeted deployment/Terraform/Helm/credential/GitHub/checksum tests are 138/138; the complete exact-tree Claude-plugin regression is 461/461; source/test compilation and diff checks pass. No hosted exact-head workflow or qualifying independent review exists, so this custom-base PR remains Draft. Earlier exact-head and check strings are historical evidence only.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Stacked Draft on #1172 936311c. Unique leftover from inventory-only terraform apply / helm install.

Local evidence: RED 0e1f365 then GREEN e465cd7. Plugin coverage suite 375 passed; claude_plugin_detector.py 2563/2563 statements on Python 3.13.

Do not Close #1099 or #1172. kubectl/docker-push stay #1172. Pass is not Noema admission.

[seonghobae]

Current exact head 41669d695c60635d38c2f2ef5174141f20f9a24b closes the raw-command false-positive boundary with RED 33aae04... and verified structural command parsing. Exact source/test AST, 3/3 negative probes, and 3/3 positive probes pass. The PR stays Draft pending stacked integration evidence; no predecessor Checks transfer.

[seonghobae]

2026-09-13 current-head evidence:

• ordinary two-parent restack: prior feat(scanner): fail closed on plugin terraform apply and helm install #1173 head 5e40f9154d411aaaccca3a935f858a8ad5ef7b84 + current feat(scanner): reject plugin kubectl apply and docker push #1172 head 00cdb7966e10f6f6e283b10619723cefb8b4676a
• exact head 6ec09ee32c972655f9e85eea7424df6ad9d3bff5
• exact tree a3cf421773e52d39843575490d513287889deb0e
• GitHub compare: 42 ahead / 0 behind, mergeable
• targeted deployment/Terraform/Helm/credential/GitHub/checksum tests: 138/138
• complete exact-tree Claude-plugin regression: 461/461
• source/test compile and diff checks pass
• hosted exact-head workflows: 0; reviews: 0; unresolved threads: 0

The Terraform/Helm delta and all predecessor repairs remain present. This PR stays Draft because hosted integration and qualifying independent review are absent. No predecessor evidence transfers.