feat(scanner): reject plugin s3 writes and containerapp up

[seonghobae]

Successor of #1177 / issue #1099. Does not Close those. CloudFormation/gcloud/az webapp stay #1177. Hosted vercel/fly stay #1174. Pass is not Noema admission.

Current exact authority — 2026-09-08

• base: feat/claude-plugin-cloud-deploy-1099@fdcda62e0948117231c130f62f47cb61ca1a3a8c
• exact head: 3073ffdbbddbaa30d363f366d7dc5deea250f939
• Draft; custom stacked base has no hosted workflow evidence
• original feature lineage: RED 97cdbd0 → GREEN 8ca0628

Valid product delta

The feature introduces fail-closed rules for object-store/container-app write authority. Review found that the predecessor S3 rule was broader than its own message and security class because _aws_s3_write_command_hits() classified every executable aws s3 cp or aws s3 sync solely from the verb. The current head now distinguishes provable direct S3-to-local downloads from writes to an S3 destination.

Fleet RED f480ae0... adds deterministic direction contracts:

• local → S3 cp remains a finding;
• local → S3 sync remains a finding;
• S3 → S3 copy remains a finding because the destination is a bucket;
• provable direct S3 → local cp stays inventory, not claude-plugin-aws-s3-write-command;
• provable direct S3 → local sync stays inventory;
• existing aws s3 ls, comment/reporting, README, secret-redaction, manifest and CloudFormation regressions remain locked.

Command-direction GREEN 51d1da4... excludes only exact literal S3→local pairs. Follow-up RED 44761c28d8748f63eca052ec6145be1111bc4d68 proves that a safe first download must not hide a later upload; GREEN 3073ffdbbddbaa30d363f366d7dc5deea250f939 scans subsequent executable matches. Exact source AST passes; download negatives 2/2 and write/ambiguous/later-write positives 6/6 pass. Snippets remain command labels.

Normal two-parent integration preserves #1173 command-context repair and compares 0 behind current #1177. No predecessor Checks transfer.

Minimum causal GREEN

Implemented at the command boundary. Only a provably literal direct S3-to-local source/destination pair is excluded. Local-to-S3 and S3-to-S3 remain fail closed. Dynamic variables, substitutions, leading-option forms, or otherwise ambiguous operand direction remain fail closed.

Gates

Keep Draft through RED → minimal source GREEN → exact-head focused/plugin-suite/100% owned-production coverage → repository security/SAST/CodeQL → qualifying independent current-head review. This stack currently uses a feature base; absence of hosted PR workflows is not license for a no-op CI wakeup. Repository workflow admission remains the #1096 prerequisite. Predecessor receipts, self-approval, force-push, destructive rebase, synthetic statuses and gate weakening are not accepted.

Current quoted-command context repair

This descendant inherits #1173 RED d7384e53d44a426356a73e24b2b9cc3fe153de27 and final canonical repair 3a5b14771cc7abb6553fa1ec9bcd8b62acc947ac without copying a leaf workaround. Exact head: f8372ece60fdf2db61a0fbd733414083ea09d3f1; current parent: 7802ad62082696dba275a1734c4fb81841f416db; Git compare is 0 behind and preserves this PR's unique detector/test delta. The top #1183 source AST and extracted helper probes pass quoted/reporting negatives while preserving direct and command-substitution positives. This custom-base PR stays Draft until its own hosted integration and independent review are terminal.

Current assignment-value context repair — 2026-09-08

This normal two-parent descendant inherits canonical #1173 RED 90ae232e852b3d01463d978f9bccd9157c341fe7 and GREEN 1e6a3eb43a5bc2d146656af13e7fa6cad2a77315 without a leaf workaround. Exact head: 10c0a34a14200f6013bd904e5bf205487e4b80e8; current parent: 9e35b6eb1225210b75d2a63a907de44243df0a7d; Git compare is 0 behind and preserves this PR's unique detector/test delta. Assignment-value negatives and environment-prefix/direct/substitution positives are present in the exact tree. This custom-base PR remains Draft until its own hosted integration and independent current-head review are terminal. Earlier head strings in this body are historical evidence only.

Current heredoc-safe restack — 2026-09-08

Canonical #1173 exact head 184b4b4f55906284ac1d8059e46cec8f0d9cfc9a fixes closed literal here-document payload false positives with RED 6f6be77d... → GREEN 12faf2f.... This branch was integrated non-destructively on parent 9e0e4ad0ef263ae8a265482051df871a74bf871c; exact head is 730d42926d383c59e9f01a12df625b32c3824285. GitHub compare reports behind_by=0, ahead_by=16; the PR's unique detector delta remains in the tree. Exact-head hosted integration and independent review are not terminal, so this PR remains Draft. Earlier head strings are historical evidence only.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}