feat(scanner): reject plugin cabal upload and mvn deploy

[seonghobae]

Successor of #1185 / issue #1099. Does not Close those. hex/conda stay #1185. dart/flutter pub stay #1184. gem/nuget stay #1183. Pass is not Noema admission.

Unique delta

Fail closed when a plugin hook or manifest runs remaining Hackage and Maven writes that #1185 left as inventory:

• cabal upload and cabal v2-upload as claude-plugin-cabal-upload-command (CWE-269)
• mvn deploy and mvn deploy:deploy-file as claude-plugin-mvn-deploy-command (CWE-250)
• cabal list and mvn package stay inventory
• hex publish stays claude-plugin-hex-publish-command
• unquoted # comments, echo/printf lookalikes, assignment values, and marketplace description prose are not this class
• README cabal/mvn wording is not a hook command
• snippets are command labels, not tokens or secrets
• composer publish and go upload are not invented; they are not real package-manager CLIs

#1185 remains owner of hex/conda publish.

Evidence

• RED d057c3d then GREEN 98dac50
• tests/test_claude_plugin_cabal_mvn.py plus sibling hex/pub/gem lock
• plugin coverage suite 538 passed on Python 3.13

Relates to #1099. Relates to #1185.

Current heredoc-safe restack — 2026-09-08

Canonical #1173 exact head 184b4b4f55906284ac1d8059e46cec8f0d9cfc9a fixes closed literal here-document payload false positives with RED 6f6be77d... → GREEN 12faf2f.... This branch was integrated non-destructively on #1185 parent e350ee0ad6e2e313c2d1e38cbdc4f0418477280e; exact head is fb44e77367da1746c8460541c0baed3162c850dc. GitHub compare reports behind_by=0, ahead_by=5; the cabal/mvn detector delta remains in the tree. Exact-head hosted integration and independent review are not terminal, so this PR remains Draft. Earlier head strings are historical evidence only.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}