feat(scanner): fail closed on plugin terraform apply and helm install - #1173

Draft

seonghobae wants to merge 42 commits into

feat/claude-plugin-deployment-write-1099from

feat/claude-plugin-terraform-helm-1099

Commits on Sep 8, 2026

test(scanner): fail closed on plugin terraform apply and helm install
seonghobae
committed
0e1f365
feat(scanner): fail closed on plugin terraform apply and helm install
seonghobae
committed
e465cd7
test(scanner): reproduce terraform and helm command-context false positives
seonghobae
committed
33aae04
fix(scanner): parse executable terraform and helm commands
seonghobae
committed
1f901a3
fix(scanner): restore executable command parser syntax
seonghobae
committed
7051748
fix(scanner): define command-context parser tokens
seonghobae
committed
41669d6
test(scanner): reject quoted deployment command prose
seonghobae
committed
d7384e5
fix(scanner): distinguish quoted prose from shell commands
seonghobae
committed
cb208db
fix(scanner): remove invalid backtick escapes
seonghobae
committed
3c5fdc4
test(scanner): use literal legacy substitution syntax
seonghobae
committed
3a5b147
test(scanner): expose assignment-value command false positive
seonghobae
committed
90ae232
fix(scanner): ignore command names inside shell assignments
seonghobae
committed
1e6a3eb
test(scanner): reproduce heredoc command prose false positive
seonghobae
committed
6f6be77
fix(scanner): ignore closed literal heredoc payloads
seonghobae
committed
12faf2f
test(scanner): preserve commands after heredoc lookalikes
seonghobae
committed
fa9df24
docs(scanner): trace heredoc command boundary
seonghobae
committed
184b4b4
test(scanner): reproduce no-op argument command false positives
seonghobae
committed
5bdcde7
fix(scanner): ignore no-op command argument prose
seonghobae
committed
873370b
test(scanner): reproduce manifest argv write bypass
seonghobae
committed
82a0cc8
fix(scanner): preserve structured manifest argv
seonghobae
committed
969842d
test(scanner): bound manifest argv to direct executable
seonghobae
committed
c76b1bd
fix(scanner): distinguish direct manifest argv
seonghobae
committed
18ca616
test(scanner): preserve argv identity and terraform options
seonghobae
committed
52a6911
fix(scanner): bound direct argv identity and options
seonghobae
committed
8d7ec9d
test(scanner): reproduce nested shell c bypass
seonghobae
committed
9256810
fix(scanner): inspect bounded shell c payloads
seonghobae
committed
feeac82
fix(scanner): require deployment verb token boundary
seonghobae
committed
4ff4ff3
test(scanner): reproduce split shell option boundaries
seonghobae
committed
9cc0e8f
fix(scanner): parse bounded shell option sequence
seonghobae
committed
15ced2b
test(scanner): cover shell option execution state
seonghobae
committed
40d862d
fix(scanner): model executable shell option states
seonghobae
committed
a9b72de
test(scanner): cover repeated and interactive shell options
seonghobae
committed
89115aa
fix(scanner): admit executable shell option forms
seonghobae
committed
37bdc4d
test(scanner): cover Bash execution-preserving options
seonghobae
committed
71c6187
fix(scanner): cover Bash execution-preserving options
seonghobae
committed
8d35ff9
fix(scanner): reuse command parser for kubectl and Docker
seonghobae
committed
6667472
test(scanner): retain kubectl and Docker parser regressions
seonghobae
committed
0093507
chore(stack): integrate deployment parser prerequisite
seonghobae
committed
825bf7e
fix(scanner): inherit GitHub command parser
seonghobae
committed
2a55098
test(scanner): retain GitHub command-context corpus
seonghobae
committed
62d6bfe
chore(stack): integrate deployment-write predecessor
seonghobae
committed
5e40f91

Commits on Sep 12, 2026

chore(stack): integrate current deployment-write predecessor
seonghobae
committed
6ec09ee