diff --git a/CHANGELOG.d/1099-claude-plugin-supply-chain.md b/CHANGELOG.d/1099-claude-plugin-supply-chain.md
index 9e180c1c..d8a7cf2b 100644
--- a/CHANGELOG.d/1099-claude-plugin-supply-chain.md
+++ b/CHANGELOG.d/1099-claude-plugin-supply-chain.md
@@ -137,7 +137,12 @@
   ``gh pr review``, ``gh release list``, ``kubectl get``, ``docker ps``,
   ``terraform apply`` fails as `claude-plugin-terraform-apply-command`.
   ``helm install`` fails as `claude-plugin-helm-install-command`.
-  ``terraform plan``, ``helm list``, ``vercel deploy``, and ``fly deploy``
+  ``vercel deploy`` fails as `claude-plugin-vercel-deploy-command`.
+  ``fly deploy`` and ``flyctl deploy`` fail as
+  `claude-plugin-fly-deploy-command`. Hook comments and
+  ``echo``/``printf`` lookalikes are not those classes.
+  ``terraform plan``, ``helm list``,
+  ``vercel ls``, and ``fly status``
   stay inventory. Hardcoded
   PATs stay `claude-plugin-github-write-token`. Snippets are command
   labels, not tokens.
diff --git a/appguardrail_core/claude_plugin_detector.py b/appguardrail_core/claude_plugin_detector.py
index 66cabe05..9951ba80 100644
--- a/appguardrail_core/claude_plugin_detector.py
+++ b/appguardrail_core/claude_plugin_detector.py
@@ -24,7 +24,10 @@
 Hook or manifest ``kubectl apply`` and ``docker push`` fail closed as
 deployment-write command findings. Hook or manifest ``terraform apply``
 and ``helm install`` fail closed as infra-write command findings.
-``terraform plan``, ``helm list``, ``vercel deploy``, and ``fly deploy``
+Hook or manifest ``vercel deploy`` and ``fly deploy`` fail closed as
+hosted-deploy command findings. Unquoted ``#`` comments and
+``echo``/``printf``/``print`` lookalikes are not that class.
+``terraform plan``, ``helm list``, ``vercel ls``, and ``fly status``
 stay inventory. Hook or manifest paths into
 ``~/.netrc``, ``~/.aws/credentials``,
 GitHub CLI hosts, Docker auth ``config.json``, cookie jars, and
@@ -32,7 +35,8 @@
 Chrome and Firefox profile stores stay browser-profile findings.
 Hardcoded PATs stay write-token findings.
 ``gh issue create``, ``gh pr review``, ``kubectl get``, ``docker ps``,
-``terraform plan``, and ``helm list`` stay inventory. Skill
+``terraform plan``, ``helm list``, ``vercel ls``, and ``fly status``
+stay inventory. Skill
 homoglyph, injection, exfiltration, and placeholder hits reuse #1036 rule
 identities. Skill, command, or agent text that hides tool use, rewrites
 the system prompt, or escalates the declared goal is a separate
@@ -247,6 +251,16 @@
     "is write authority on a cluster. Remove the command. "
     "[CWE-250 - Execution with Unnecessary Privileges]"
 )
+CLAUDE_PLUGIN_VERCEL_DEPLOY_COMMAND_MESSAGE: Final = (
+    "Claude plugin hook or manifest runs vercel deploy. Publishing to a "
+    "hosted platform is write authority. Remove the command. "
+    "[CWE-269 - Improper Privilege Management]"
+)
+CLAUDE_PLUGIN_FLY_DEPLOY_COMMAND_MESSAGE: Final = (
+    "Claude plugin hook or manifest runs fly deploy. Publishing to a "
+    "hosted platform is write authority. Remove the command. "
+    "[CWE-250 - Execution with Unnecessary Privileges]"
+)
 CLAUDE_PLUGIN_DOCKER_SOCKET_MESSAGE: Final = (
     "Claude plugin hook reaches the host Docker socket. Socket access is host "
     "control, not an image push. Remove the socket bind and keep builds "
@@ -379,6 +393,8 @@
 _HELM_INSTALL_COMMAND = re.compile(
     r"\bhelm\s+install(?=$|[\s;&|()<>])", re.IGNORECASE
 )
+_VERCEL_DEPLOY_COMMAND = re.compile(r"\bvercel\s+deploy\b", re.IGNORECASE)
+_FLY_DEPLOY_COMMAND = re.compile(r"\b(?:fly|flyctl)\s+deploy\b", re.IGNORECASE)
 _REPORTING_BUILTINS: Final = frozenset(
     {":", "echo", "false", "print", "printf", "true"}
 )
@@ -643,7 +659,7 @@
         "deployment_write",
         re.compile(
             r"\b(?:kubectl\s+apply|terraform\s+apply|helm\s+install|"
-            r"vercel\s+deploy|fly\s+deploy|docker\s+push)\b",
+            r"vercel\s+deploy|fly(?:ctl)?\s+deploy|docker\s+push)\b",
             re.IGNORECASE,
         ),
     ),
@@ -897,6 +913,8 @@ def inspect_claude_plugin_file(
         hits.extend(_docker_push_command_hits(content, manifest=manifest))
         hits.extend(_terraform_apply_command_hits(content, manifest=manifest))
         hits.extend(_helm_install_command_hits(content, manifest=manifest))
+        hits.extend(_vercel_deploy_command_hits(content, manifest=manifest))
+        hits.extend(_fly_deploy_command_hits(content, manifest=manifest))
         hits.extend(_docker_socket_hits(content))
         hits.extend(_browser_profile_hits(content))
         hits.extend(_credential_store_hits(content))
@@ -1707,6 +1725,44 @@ def _docker_push_command_hits(
             )
     return ()
 
+def _terraform_apply_command_hits(
+    content: str, *, manifest: bool = False
+) -> tuple[PluginHit, ...]:
+    """Return executable terraform apply findings without vars."""
+    for source, first_line in _hosted_command_sources(content, manifest=manifest):
+        match = _executable_command_match(source, _TERRAFORM_APPLY_COMMAND)
+        if match is None:
+            continue
+        return (
+            PluginHit(
+                rule_id="claude-plugin-terraform-apply-command",
+                line=first_line + source[: match.start()].count("\n"),
+                snippet="terraform apply",
+                message=CLAUDE_PLUGIN_TERRAFORM_APPLY_COMMAND_MESSAGE,
+            ),
+        )
+    return ()
+
+
+def _helm_install_command_hits(
+    content: str, *, manifest: bool = False
+) -> tuple[PluginHit, ...]:
+    """Return executable helm install findings without chart names."""
+    for source, first_line in _hosted_command_sources(content, manifest=manifest):
+        match = _executable_command_match(source, _HELM_INSTALL_COMMAND)
+        if match is None:
+            continue
+        return (
+            PluginHit(
+                rule_id="claude-plugin-helm-install-command",
+                line=first_line + source[: match.start()].count("\n"),
+                snippet="helm install",
+                message=CLAUDE_PLUGIN_HELM_INSTALL_COMMAND_MESSAGE,
+            ),
+        )
+    return ()
+
+
 def _unquoted_hash_index(line: str) -> int | None:
     """Return the index of an unquoted ``#`` shell comment, if any.
 
@@ -2103,8 +2159,6 @@ def _executable_command_match(    content: str, pattern: re.Pattern[str]
                     return match
                 break
     return None
-
-
 def _shell_payload_index(
     arguments: tuple[str, ...] | list[str], *, shell_name: str
 ) -> int | None:
@@ -2284,6 +2338,62 @@ def _helm_install_command_hits(
     return ()
 
 
+def _vercel_deploy_command_hits(
+    content: str, *, manifest: bool = False
+) -> tuple[PluginHit, ...]:
+    """Return ``vercel deploy`` findings with a command label, not tokens.
+
+    Args:
+        content: Hook or manifest text.
+
+    Returns:
+        One hit when an executable ``vercel deploy`` is present.
+        ``vercel ls``, README wording, hook comments, and echo/printf
+        lookalikes are not this class.
+    """
+    for source, first_line in _hosted_command_sources(content, manifest=manifest):
+        match = _executable_command_match(source, _VERCEL_DEPLOY_COMMAND)
+        if match is None:
+            continue
+        return (
+            PluginHit(
+                rule_id="claude-plugin-vercel-deploy-command",
+                line=first_line + source[: match.start()].count("\n"),
+                snippet="vercel deploy",
+                message=CLAUDE_PLUGIN_VERCEL_DEPLOY_COMMAND_MESSAGE,
+            ),
+        )
+    return ()
+
+
+def _fly_deploy_command_hits(
+    content: str, *, manifest: bool = False
+) -> tuple[PluginHit, ...]:
+    """Return ``fly deploy`` findings with a command label, not app names.
+
+    Args:
+        content: Hook or manifest text.
+
+    Returns:
+        One hit for executable ``fly deploy`` or ``flyctl deploy``.
+        ``fly status``, hook comments, and echo/printf lookalikes are
+        not this class.
+    """
+    for source, first_line in _hosted_command_sources(content, manifest=manifest):
+        match = _executable_command_match(source, _FLY_DEPLOY_COMMAND)
+        if match is None:
+            continue
+        return (
+            PluginHit(
+                rule_id="claude-plugin-fly-deploy-command",
+                line=first_line + source[: match.start()].count("\n"),
+                snippet="fly deploy",
+                message=CLAUDE_PLUGIN_FLY_DEPLOY_COMMAND_MESSAGE,
+            ),
+        )
+    return ()
+
+
 def _dynamic_eval_hits(content: str) -> tuple[PluginHit, ...]:
     """Return findings for eval/exec/compile/Function on hook surfaces."""
     match = _DYNAMIC_EVAL.search(content)
diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md
index 7a833f09..0a4274b0 100644
--- a/docs/TRACEABILITY.md
+++ b/docs/TRACEABILITY.md
@@ -22,7 +22,7 @@
 | structural Semgrep-style `pattern:` execution by lightweight engine | built-in scanner | not implemented unless a real structural matcher is added; fixtures are not execution |
 | GitHub Actions transport-only polling loop (#1087, #938 vertical slice) | owned by PR #1088 / issue #1087; YAML rules and RED precision contracts | mapped-family only; this successor does not ship or close the detector |
 | Password/database-url/auth-comment precision and test-file context (#1106) | existing `_scan_file` rules `hardcoded-password`, `hardcoded-database-url`, `todo-skip-auth`, `_finding_context` | implemented-branch regression lock |
-| Claude plugin marketplace/package supply chain (#1099) | `claude-plugin-floating-git-ref`, `claude-plugin-provider-secret`, `claude-plugin-pipe-to-shell`, `claude-plugin-unsigned-executable-download` (hooks and package.json lifecycle scripts), `claude-plugin-unpinned-package-install`, `claude-plugin-undeclared-executable`, `claude-plugin-symlink-escape`, `claude-plugin-archive-path-traversal`, `claude-plugin-unadmitted-submodule`, `claude-plugin-duplicate-json-member`, `claude-plugin-nonstandard-json-constant`, `claude-plugin-malformed-utf8`, `claude-plugin-inconsistent-normalized-name`, `claude-plugin-vendored-scope-undeclared`, `claude-plugin-conflicting-identity`, `claude-plugin-unbounded-mcp`, `claude-plugin-license-missing`, `claude-plugin-license-mismatch`, `claude-plugin-dynamic-eval`, `claude-plugin-hidden-undeclared-executable`, `claude-plugin-concealed-identity`, `claude-plugin-oversized-package`, `claude-plugin-source-mismatch`, `claude-plugin-github-write-token`, `claude-plugin-docker-socket`, `claude-plugin-browser-profile-access`, `claude-plugin-deceptive-description`, `claude-plugin-secret-to-network`, `claude-plugin-secret-to-prompt`, `claude-plugin-secret-to-mcp`, `claude-plugin-hide-actions-directive` / `claude-plugin-self-modify-directive` / `claude-plugin-goal-escalation-directive`, `claude-plugin-setuid-executable` / `claude-plugin-world-writable-executable`, `claude-plugin-decompression-bomb`, reused #1036 `skill-name-homoglyph-confusable` / `skill-manifest-prompt-injection-payload` / `skill-doc-exfiltration-endpoint-directive` / `skill-placeholder-template-unresolved` on plugin skill/agent/command surfaces, deterministic scan receipt with catalog repository/SHA bind, SARIF 2.1.0 `sarif_sha256` bound to the same finding rule_ids, `policy_provenance` bound to the AppGuardrail release plus exact scan-policy digest, and `sbom_sha256` of a deterministic CycloneDX 1.5 document, `claude-plugin-checksum-mismatch` when a first-party SHA256SUMS or sibling `*.sha256` disagrees with bytes on disk, `claude-plugin-github-merge-command` for hook or manifest `gh pr merge`, `claude-plugin-github-release-command` for `gh release create|upload|delete|edit`, `claude-plugin-kubectl-apply-command` for hook or manifest `kubectl apply`, `claude-plugin-docker-push-command` for `docker push`, `claude-plugin-terraform-apply-command` for executable `terraform apply`, `claude-plugin-helm-install-command` for executable `helm install` (closed literal here-document payloads, quoted/commented prose, reporting builtins, and assignment values are negative boundaries; commands after those boundaries remain positive), `claude-plugin-credential-store-access` for host cookie and token stores that are not browser profiles, fail-closed receipt verification | implemented-branch |
+| Claude plugin marketplace/package supply chain (#1099) | `claude-plugin-floating-git-ref`, `claude-plugin-provider-secret`, `claude-plugin-pipe-to-shell`, `claude-plugin-unsigned-executable-download` (hooks and package.json lifecycle scripts), `claude-plugin-unpinned-package-install`, `claude-plugin-undeclared-executable`, `claude-plugin-symlink-escape`, `claude-plugin-archive-path-traversal`, `claude-plugin-unadmitted-submodule`, `claude-plugin-duplicate-json-member`, `claude-plugin-nonstandard-json-constant`, `claude-plugin-malformed-utf8`, `claude-plugin-inconsistent-normalized-name`, `claude-plugin-vendored-scope-undeclared`, `claude-plugin-conflicting-identity`, `claude-plugin-unbounded-mcp`, `claude-plugin-license-missing`, `claude-plugin-license-mismatch`, `claude-plugin-dynamic-eval`, `claude-plugin-hidden-undeclared-executable`, `claude-plugin-concealed-identity`, `claude-plugin-oversized-package`, `claude-plugin-source-mismatch`, `claude-plugin-github-write-token`, `claude-plugin-docker-socket`, `claude-plugin-browser-profile-access`, `claude-plugin-deceptive-description`, `claude-plugin-secret-to-network`, `claude-plugin-secret-to-prompt`, `claude-plugin-secret-to-mcp`, `claude-plugin-hide-actions-directive` / `claude-plugin-self-modify-directive` / `claude-plugin-goal-escalation-directive`, `claude-plugin-setuid-executable` / `claude-plugin-world-writable-executable`, `claude-plugin-decompression-bomb`, reused #1036 `skill-name-homoglyph-confusable` / `skill-manifest-prompt-injection-payload` / `skill-doc-exfiltration-endpoint-directive` / `skill-placeholder-template-unresolved` on plugin skill/agent/command surfaces, deterministic scan receipt with catalog repository/SHA bind, SARIF 2.1.0 `sarif_sha256` bound to the same finding rule_ids, `policy_provenance` bound to the AppGuardrail release plus exact scan-policy digest, and `sbom_sha256` of a deterministic CycloneDX 1.5 document, `claude-plugin-checksum-mismatch` when a first-party SHA256SUMS or sibling `*.sha256` disagrees with bytes on disk, `claude-plugin-github-merge-command` for hook or manifest `gh pr merge`, `claude-plugin-github-release-command` for `gh release create|upload|delete|edit`, `claude-plugin-kubectl-apply-command` for hook or manifest `kubectl apply`, `claude-plugin-docker-push-command` for `docker push`, `claude-plugin-terraform-apply-command` for `terraform apply`, `claude-plugin-helm-install-command` for `helm install`, `claude-plugin-vercel-deploy-command` for hook or manifest `vercel deploy`, `claude-plugin-fly-deploy-command` for `fly deploy`, `claude-plugin-credential-store-access` for host cookie and token stores that are not browser profiles, fail-closed receipt verification | implemented-branch |
 | Orphaned GitHub Actions registry identities (#929) | owned by PR #966 / issue #929; live registry DAST | mapped-family only; this successor does not ship or close the detector |
 | Org security-failure CI tickets without copied vuln evidence | documented non-detectable family | snapshot in `tests/fixtures/cwl-security-issue-inventory.json` |
 
diff --git a/docs/sast-dast-rule-research.md b/docs/sast-dast-rule-research.md
index 1f66df23..54e3ff10 100644
--- a/docs/sast-dast-rule-research.md
+++ b/docs/sast-dast-rule-research.md
@@ -100,14 +100,16 @@ files being scanned, then applies the union of relevant checks. Examples:
   `claude-plugin-kubectl-apply-command` for ``kubectl apply``,
   `claude-plugin-docker-push-command` for ``docker push``,
   `claude-plugin-terraform-apply-command` for ``terraform apply``,
-  `claude-plugin-helm-install-command` for ``helm install``, and
+  `claude-plugin-helm-install-command` for ``helm install``,
+  `claude-plugin-vercel-deploy-command` for ``vercel deploy``,
+  `claude-plugin-fly-deploy-command` for ``fly deploy``, and
   `claude-plugin-credential-store-access` for host ``~/.netrc``,
   ``~/.aws/credentials``, GitHub CLI hosts, Docker auth, cookie jars, and
   SSH private keys. Chrome/Firefox profile stores stay
   `claude-plugin-browser-profile-access`. Hardcoded PATs stay
   `claude-plugin-github-write-token`. ``gh issue create``, ``gh pr review``,
   ``kubectl get``, ``docker ps``, ``terraform plan``, ``helm list``,
-  ``vercel deploy``, and ``fly deploy`` stay inventory.
+  ``vercel ls``, and ``fly status`` stay inventory.
 - Mapped, not owned here: GitHub Actions transport-only poll loops (#1087,
   PR #1088) and orphaned workflow registry DAST (#929, PR #966).
 - `tool-execute-parameters-passthrough`: Strix-observed dynamic tool execution
diff --git a/tests/test_claude_plugin_hosted_deploy.py b/tests/test_claude_plugin_hosted_deploy.py
new file mode 100644
index 00000000..be1165e4
--- /dev/null
+++ b/tests/test_claude_plugin_hosted_deploy.py
@@ -0,0 +1,384 @@
+"""Hook vercel deploy and fly deploy fail closed; status/list stay inventory."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from appguardrail_core import claude_plugin_detector as detector
+from appguardrail_core.claude_plugin_detector import (
+    _collect_plugin_hits,
+    build_claude_plugin_scan_receipt,
+    inspect_claude_plugin_file,
+    inventory_claude_plugin_capabilities,
+)
+
+
+_PINNED_COMMIT = "a727be1c7bd6064419b6f60d71993a19198adc17"
+_VERCEL_RULE = "claude-plugin-vercel-deploy-command"
+_FLY_RULE = "claude-plugin-fly-deploy-command"
+_TERRAFORM_RULE = "claude-plugin-terraform-apply-command"
+_KUBECTL_RULE = "claude-plugin-kubectl-apply-command"
+_SECRET = "sk-hosted-must-not-leak"
+_BIDI = "\u202e"
+_THIS_CLASS = frozenset({_VERCEL_RULE, _FLY_RULE})
+
+
+def _write_json(path: Path, payload: dict) -> None:
+    """Write one JSON document under ``path``."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(payload, indent=2) + "\n", encoding="utf-8")
+
+
+def _licensed_plugin(root: Path, hook_body: str = "#!/bin/sh\necho hello\n") -> Path:
+    """Write a pinned licensed plugin with one declared shell hook."""
+    _write_json(
+        root / ".claude-plugin" / "plugin.json",
+        {
+            "name": "safe-plugin",
+            "version": "1.0.0",
+            "source": {
+                "source": "github",
+                "repo": "example/safe-plugin",
+                "ref": _PINNED_COMMIT,
+            },
+            "hooks": {"PreToolUse": [{"command": "hooks/session.sh"}]},
+        },
+    )
+    hook = root / "hooks" / "session.sh"
+    hook.parent.mkdir(parents=True, exist_ok=True)
+    hook.write_text(hook_body, encoding="utf-8")
+    hook.chmod(0o755)
+    (root / "LICENSE").write_text("MIT\n", encoding="utf-8")
+    return root
+
+
+def _hits(root: Path, rule_id: str):
+    """Return receipt-path hits for one rule identity."""
+    return [hit for hit in _collect_plugin_hits(root) if hit.rule_id == rule_id]
+
+
+def test_hook_vercel_deploy_fails_admission(tmp_path: Path) -> None:
+    """``vercel deploy`` on a hook is hosted write authority, not inventory."""
+    root = _licensed_plugin(tmp_path, "#!/bin/sh\nvercel deploy --prod\n")
+    hits = _hits(root, _VERCEL_RULE)
+    receipt = build_claude_plugin_scan_receipt(root)
+    inventory = inventory_claude_plugin_capabilities(root)
+
+    assert hits
+    assert all(hit.snippet == "vercel deploy" for hit in hits)
+    assert receipt.scan_result == "fail"
+    assert _VERCEL_RULE in receipt.finding_summary
+    assert _FLY_RULE not in receipt.finding_summary
+    assert _TERRAFORM_RULE not in receipt.finding_summary
+    assert inventory["deployment_write"] is True
+
+
+def test_hook_fly_deploy_fails_admission(tmp_path: Path) -> None:
+    """``fly deploy`` on a hook is hosted write authority, not inventory."""
+    root = _licensed_plugin(tmp_path, "#!/bin/sh\nfly deploy\n")
+    hits = _hits(root, _FLY_RULE)
+    receipt = build_claude_plugin_scan_receipt(root)
+    inventory = inventory_claude_plugin_capabilities(root)
+
+    assert hits
+    assert all(hit.snippet == "fly deploy" for hit in hits)
+    assert receipt.scan_result == "fail"
+    assert _FLY_RULE in receipt.finding_summary
+    assert _VERCEL_RULE not in receipt.finding_summary
+    assert _KUBECTL_RULE not in receipt.finding_summary
+    assert inventory["deployment_write"] is True
+
+
+def test_flyctl_deploy_is_the_same_class(tmp_path: Path) -> None:
+    """``flyctl deploy`` canonicalizes to the fly-deploy command label."""
+    body = "#!/bin/sh\nflyctl deploy --now\n"
+    hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+    root = _licensed_plugin(tmp_path, body)
+    assert _hits(root, _FLY_RULE)
+    assert any(hit.rule_id == _FLY_RULE and hit.snippet == "fly deploy" for hit in hits)
+
+
+def test_vercel_ls_and_fly_status_stay_inventory(tmp_path: Path) -> None:
+    """Read-only hosted CLIs stay inventory, not this class."""
+    root = _licensed_plugin(tmp_path, "#!/bin/sh\nvercel ls\nfly status\n")
+    receipt = build_claude_plugin_scan_receipt(root)
+
+    assert _hits(root, _VERCEL_RULE) == []
+    assert _hits(root, _FLY_RULE) == []
+    assert _THIS_CLASS.isdisjoint(receipt.finding_summary)
+    assert receipt.scan_result == "pass"
+
+
+def test_readme_vercel_deploy_is_not_this_class(tmp_path: Path) -> None:
+    """README hosted-deploy wording is repository guidance, not a hook command."""
+    root = _licensed_plugin(tmp_path)
+    (root / "README.md").write_text("vercel deploy --prod\n", encoding="utf-8")
+    receipt = build_claude_plugin_scan_receipt(root)
+    inventory = inventory_claude_plugin_capabilities(root)
+
+    assert _hits(root, _VERCEL_RULE) == []
+    assert receipt.scan_result == "pass"
+    assert _VERCEL_RULE not in receipt.finding_summary
+    assert inventory["deployment_write"] is True
+
+
+def test_hook_comment_vercel_deploy_is_not_this_class(tmp_path: Path) -> None:
+    """``# vercel deploy`` is hook documentation, not hosted write authority."""
+    root = _licensed_plugin(tmp_path, "#!/bin/sh\n# vercel deploy --prod\necho hello\n")
+    receipt = build_claude_plugin_scan_receipt(root)
+
+    assert _hits(root, _VERCEL_RULE) == []
+    assert _hits(root, _FLY_RULE) == []
+    assert _THIS_CLASS.isdisjoint(receipt.finding_summary)
+    assert receipt.scan_result == "pass"
+
+
+def test_hook_echo_fly_deploy_is_not_this_class(tmp_path: Path) -> None:
+    """``echo "fly deploy"`` prints a label; it does not run flyctl."""
+    root = _licensed_plugin(tmp_path, '#!/bin/sh\necho "fly deploy"\n')
+    receipt = build_claude_plugin_scan_receipt(root)
+
+    assert _hits(root, _FLY_RULE) == []
+    assert _hits(root, _VERCEL_RULE) == []
+    assert _THIS_CLASS.isdisjoint(receipt.finding_summary)
+    assert receipt.scan_result == "pass"
+
+
+def test_hook_printf_vercel_deploy_is_not_this_class() -> None:
+    """``printf`` of a deploy label is not an executable vercel command."""
+    hits = inspect_claude_plugin_file(
+        "session.sh",
+        "hooks/session.sh",
+        "#!/bin/sh\nprintf '%s\\n' \"vercel deploy\"\n",
+    )
+    assert [hit.rule_id for hit in hits if hit.rule_id in _THIS_CLASS] == []
+
+
+def test_comment_then_real_vercel_deploy_still_fails(tmp_path: Path) -> None:
+    """A comment lookalike does not hide a later executable vercel deploy."""
+    root = _licensed_plugin(
+        tmp_path,
+        '#!/bin/sh\n# vercel deploy\necho "fly deploy"\nvercel deploy --prod\n',
+    )
+    receipt = build_claude_plugin_scan_receipt(root)
+
+    assert _hits(root, _VERCEL_RULE)
+    assert _hits(root, _FLY_RULE) == []
+    assert receipt.scan_result == "fail"
+    assert _VERCEL_RULE in receipt.finding_summary
+    assert _FLY_RULE not in receipt.finding_summary
+
+
+def test_echo_then_real_fly_deploy_still_fails() -> None:
+    """``echo done && fly deploy`` still runs fly on the second segment."""
+    hits = inspect_claude_plugin_file(
+        "session.sh",
+        "hooks/session.sh",
+        '#!/bin/sh\necho "done" && fly deploy --now\n',
+    )
+    assert any(hit.rule_id == _FLY_RULE and hit.snippet == "fly deploy" for hit in hits)
+
+
+def test_inline_comment_after_vercel_deploy_still_fails() -> None:
+    """``vercel deploy # note`` remains an executable hosted-write command."""
+    hits = inspect_claude_plugin_file(
+        "session.sh",
+        "hooks/session.sh",
+        "#!/bin/sh\nvercel deploy --prod # documented\n",
+    )
+    assert any(
+        hit.rule_id == _VERCEL_RULE and hit.snippet == "vercel deploy" for hit in hits
+    )
+
+
+def test_vercel_and_fly_on_one_hook_are_distinct_findings(tmp_path: Path) -> None:
+    """One hook can fail closed on both vercel deploy and fly deploy."""
+    root = _licensed_plugin(
+        tmp_path,
+        "#!/bin/sh\nvercel deploy --prod\nfly deploy\n",
+    )
+    receipt = build_claude_plugin_scan_receipt(root)
+
+    assert _hits(root, _VERCEL_RULE)
+    assert _hits(root, _FLY_RULE)
+    assert receipt.scan_result == "fail"
+    assert _VERCEL_RULE in receipt.finding_summary
+    assert _FLY_RULE in receipt.finding_summary
+    assert _TERRAFORM_RULE not in receipt.finding_summary
+
+
+def test_case_insensitive_vercel_deploy_fails_admission(tmp_path: Path) -> None:
+    """``VERCEL DEPLOY`` is the same hosted-write class."""
+    body = "#!/bin/sh\nVERCEL DEPLOY --prod\n"
+    hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+    root = _licensed_plugin(tmp_path, body)
+    assert _hits(root, _VERCEL_RULE)
+    assert any(
+        hit.rule_id == _VERCEL_RULE and hit.snippet == "vercel deploy" for hit in hits
+    )
+
+
+def test_case_insensitive_fly_deploy_fails_admission() -> None:
+    """``FLY DEPLOY`` canonicalizes the snippet to ``fly deploy``."""
+    body = "#!/bin/sh\nFLY DEPLOY\n"
+    hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+    assert any(hit.rule_id == _FLY_RULE and hit.snippet == "fly deploy" for hit in hits)
+
+
+def test_snippets_are_command_labels_not_secrets(tmp_path: Path) -> None:
+    """Snippets name the CLI command and omit secrets and bidi."""
+    body = f"#!/bin/sh\nvercel deploy --token '{_SECRET}{_BIDI}'\n"
+    root = _licensed_plugin(tmp_path, body)
+    hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+    vercel_hits = [hit for hit in hits if hit.rule_id == _VERCEL_RULE]
+    payload = json.dumps(build_claude_plugin_scan_receipt(root).as_dict())
+
+    assert vercel_hits
+    for hit in vercel_hits:
+        assert hit.snippet == "vercel deploy"
+        assert _SECRET not in hit.snippet
+        assert _BIDI not in hit.snippet
+        assert _SECRET not in hit.message
+    assert _SECRET not in payload
+    assert _BIDI not in payload
+
+
+def test_plugin_manifest_fly_deploy_fails_admission(tmp_path: Path) -> None:
+    """A plugin.json command string that deploys to Fly is the fly class."""
+    root = _licensed_plugin(tmp_path)
+    manifest = json.loads(
+        (root / ".claude-plugin" / "plugin.json").read_text(encoding="utf-8")
+    )
+    manifest["hooks"] = {
+        "PostToolUse": [{"command": "fly deploy --now"}],
+    }
+    _write_json(root / ".claude-plugin" / "plugin.json", manifest)
+    receipt = build_claude_plugin_scan_receipt(root)
+    assert _hits(root, _FLY_RULE)
+    assert receipt.scan_result == "fail"
+    assert _FLY_RULE in receipt.finding_summary
+
+
+def test_empty_hook_is_not_this_class() -> None:
+    """Empty hook text is not hosted deploy write authority."""
+    hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", "")
+    assert [hit.rule_id for hit in hits if hit.rule_id in _THIS_CLASS] == []
+
+
+def test_terraform_apply_without_hosted_deploy_stays_the_terraform_class() -> None:
+    """Infra apply without vercel/fly stays the terraform class."""
+    hits = inspect_claude_plugin_file(
+        "session.sh",
+        "hooks/session.sh",
+        "#!/bin/sh\nterraform apply -auto-approve\n",
+    )
+    rule_ids = {hit.rule_id for hit in hits}
+    assert _TERRAFORM_RULE in rule_ids
+    assert _THIS_CLASS.isdisjoint(rule_ids)
+
+
+def test_print_fly_deploy_lookalike_is_not_this_class() -> None:
+    """A Python ``print`` of fly deploy is not hosted write authority."""
+    hits = inspect_claude_plugin_file(
+        "session.sh",
+        "hooks/session.sh",
+        'print("fly deploy")\n',
+    )
+    assert [hit.rule_id for hit in hits if hit.rule_id in _THIS_CLASS] == []
+
+
+def test_pipeline_and_or_segments_keep_executable_fly_deploy() -> None:
+    """Unquoted ``||``, ``;``, ``|``, and ``&`` still run fly deploy."""
+    body = "#!/bin/sh\nfalse || fly deploy; true | flyctl deploy & fly deploy\n"
+    hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+    assert any(hit.rule_id == _FLY_RULE and hit.snippet == "fly deploy" for hit in hits)
+
+
+def test_quoted_ampersand_echo_is_not_this_class() -> None:
+    """Quoted ``&&`` inside echo does not invent a second command segment."""
+    hits = inspect_claude_plugin_file(
+        "session.sh",
+        "hooks/session.sh",
+        '#!/bin/sh\necho "ready && fly deploy"\n',
+    )
+    assert [hit.rule_id for hit in hits if hit.rule_id in _THIS_CLASS] == []
+
+
+def test_hosted_deploy_helpers_cover_comment_quote_and_token_edges() -> None:
+    """Comment, escape, splitter, and token helpers keep executable matches only."""
+    assert detector._unquoted_hash_index("vercel deploy # note") == len("vercel deploy ")
+    assert detector._unquoted_hash_index("echo '# vercel deploy'") is None
+    assert detector._unquoted_hash_index('echo "# fly deploy"') is None
+    assert detector._unquoted_hash_index("echo \\# not-a-comment") is None
+    assert detector._unquoted_hash_index("") is None
+    assert detector._first_shell_token("   ") == ""
+    assert detector._first_shell_token("/usr/bin/echo hi") == "echo"
+    assert detector._first_shell_token("printf.exe hi") == "printf"
+    assert detector._first_shell_token("print('x')") == "print"
+    quoted = 'echo "a && b"'
+    assert detector._iter_unquoted_segment_bounds(quoted) == ((0, len(quoted)),)
+    escaped_line = 'echo \\"x\\" && y'
+    escaped = detector._iter_unquoted_segment_bounds(escaped_line)
+    assert len(escaped) == 2
+    assert escaped_line[escaped[1][0] : escaped[1][1]].strip() == "y"
+    single = "echo 'a | b' ; c"
+    bounds = detector._iter_unquoted_segment_bounds(single)
+    assert bounds[-1][1] == len(single)
+    assert single[bounds[0][0] : bounds[0][1]].startswith("echo")
+    assert detector._executable_command_match("", detector._VERCEL_DEPLOY_COMMAND) is None
+    assert detector._executable_command_match("vercel ls", detector._VERCEL_DEPLOY_COMMAND) is None
+    match = detector._executable_command_match(
+        "vercel deploy",
+        detector._VERCEL_DEPLOY_COMMAND,
+    )
+    assert match is not None
+    assert match.group(0).lower() == "vercel deploy"
+
+
+def test_manifest_reporting_commands_and_description_are_not_this_class(
+    tmp_path: Path,
+) -> None:
+    """Manifest prose and reporting-only command values are not hosted writes."""
+    root = _licensed_plugin(tmp_path)
+    manifest_path = root / ".claude-plugin" / "plugin.json"
+    manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+    manifest["description"] = "operators may later run vercel deploy"
+    manifest["hooks"] = {
+        "PostToolUse": [
+            {"command": "hooks/session.sh"},
+            {"command": 'echo "fly deploy"'},
+            {"command": "printf '%s\\n' 'vercel deploy'"},
+        ],
+    }
+    _write_json(manifest_path, manifest)
+
+    receipt = build_claude_plugin_scan_receipt(root)
+
+    assert _hits(root, _VERCEL_RULE) == []
+    assert _hits(root, _FLY_RULE) == []
+    assert _THIS_CLASS.isdisjoint(receipt.finding_summary)
+    assert receipt.scan_result == "pass"
+
+
+def test_manifest_reporting_command_does_not_hide_later_deploy(
+    tmp_path: Path,
+) -> None:
+    """A later structural command value still exposes hosted write authority."""
+    root = _licensed_plugin(tmp_path)
+    manifest_path = root / ".claude-plugin" / "plugin.json"
+    manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+    manifest["hooks"] = {
+        "PostToolUse": [
+            {"command": 'echo "fly deploy"'},
+            {"command": "vercel deploy --prod"},
+        ],
+    }
+    _write_json(manifest_path, manifest)
+
+    receipt = build_claude_plugin_scan_receipt(root)
+
+    assert _hits(root, _FLY_RULE) == []
+    assert _hits(root, _VERCEL_RULE)
+    assert _VERCEL_RULE in receipt.finding_summary
+    assert receipt.scan_result == "fail"
diff --git a/tests/test_claude_plugin_terraform_helm.py b/tests/test_claude_plugin_terraform_helm.py
index c7bc2b52..af8662fa 100644
--- a/tests/test_claude_plugin_terraform_helm.py
+++ b/tests/test_claude_plugin_terraform_helm.py
@@ -18,6 +18,12 @@
 _HELM_RULE = "claude-plugin-helm-install-command"
 _KUBECTL_RULE = "claude-plugin-kubectl-apply-command"
 _DOCKER_PUSH_RULE = "claude-plugin-docker-push-command"
+_HOSTED_DEPLOY_RULES = frozenset(
+    {
+        "claude-plugin-vercel-deploy-command",
+        "claude-plugin-fly-deploy-command",
+    }
+)
 _SECRET = "sk-tf-must-not-leak"
 _BIDI = "\u202e"
 _THIS_CLASS = frozenset({_TERRAFORM_RULE, _HELM_RULE})
@@ -100,8 +106,10 @@ def test_terraform_plan_and_helm_list_stay_inventory(tmp_path: Path) -> None:
     assert receipt.scan_result == "pass"
 
 
-def test_vercel_deploy_and_fly_deploy_stay_inventory(tmp_path: Path) -> None:
-    """Hosted deploy CLIs stay inventory; this slice does not own them."""
+def test_vercel_and_fly_deploy_stay_outside_terraform_helm_class(
+    tmp_path: Path,
+) -> None:
+    """Hosted deploy findings remain distinct from Terraform and Helm."""
     root = _licensed_plugin(
         tmp_path,
         "#!/bin/sh\nvercel deploy\nfly deploy\n",
@@ -110,7 +118,8 @@ def test_vercel_deploy_and_fly_deploy_stay_inventory(tmp_path: Path) -> None:
     inventory = inventory_claude_plugin_capabilities(root)
 
     assert _THIS_CLASS.isdisjoint(receipt.finding_summary)
-    assert receipt.scan_result == "pass"
+    assert _HOSTED_DEPLOY_RULES.issubset(receipt.finding_summary)
+    assert receipt.scan_result == "fail"
     assert inventory["deployment_write"] is True