feat(scanner): reject plugin sbt publish and conan upload

[seonghobae]

Successor of #1187 / issue #1099. Does not Close those. gradle/luarocks stay #1187. cabal/mvn stay #1186. hex/conda stay #1185. Pass is not Noema admission.

Unique delta

Fail closed when a plugin hook or manifest runs remaining sbt and Conan writes that #1187 left as inventory:

• sbt publish and sbt publishSigned as claude-plugin-sbt-publish-command (CWE-269)
• conan upload as claude-plugin-conan-upload-command (CWE-250)
• sbt compile, sbt publishLocal, and conan list stay inventory
• gradle publish stays claude-plugin-gradle-publish-command
• unquoted # comments, echo/printf lookalikes, assignment values, and marketplace description prose are not this class
• README sbt/conan wording is not a hook command
• snippets are command labels, not tokens or secrets
• composer publish and go upload are not invented; they are not real package-manager CLIs

#1187 remains owner of gradle/luarocks publish.

Evidence

• RED a88ac06 then GREEN 34ef68b
• tests/test_claude_plugin_sbt_conan.py plus sibling gradle/cabal lock
• plugin coverage suite 571 passed on Python 3.13

Relates to #1099. Relates to #1187.

Current quoted sbt task repair — 2026-09-08

RED ad3a238b1c35158c1301418928d8fa91e32634f8 proves that executable sbt "publish" and sbt 'publishSigned' were missed. GREEN ccce2a0db42b6998de43fdd85f8f62a3cf7accc4 matches the command from the unquoted sbt token while keeping quoted/unquoted publishLocal negative. Follow-up RED 25e07a631492f797858ce2622c607d5e6560d599 proves the same task inside $(...) or backticks must remain executable; GREEN 935a5fd7f4a8d7e979c46d9822ff6a9a2d05e968 admits those closing delimiters. Exact AST caught and cleanup 63c42a76c7b06d2b00ace53cfdde59d56ae9f0ad removed an invalid fixture escape. Exact source/test AST now passes with SyntaxWarning-as-error; extracted production helpers pass 6/6 positives and 5/5 negatives. The PR remains Draft pending hosted integration and independent current-head review. Earlier head strings are historical evidence only.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}