fix(agentplugins): reduce security warning noise

[777genius]

Summary

• pin the released LintAI 0.1.3 scanner across all supported platforms
• reserve blocking confirmation for direct high-confidence execution or explicit deny findings
• keep context-sensitive remote command prose visible as non-blocking review notes

Verification

• go test ./agentplugins/adapters/securityscan ./agentplugins/domain
• go test ./internal/agentpluginscli ./cmd/agentplugins/...
• go test ./agentplugins/... passed all changed packages; the unrelated macOS case-collision fixture hit the known case-insensitive temp cleanup failure
• verified the exact v0.1.3 release checksums and GitHub attestation

Summary by CodeRabbit

• Bug Fixes

  • Context-sensitive remote-execution findings are now treated as warnings instead of blocking actions when appropriate.
  • Blocking security checks continue to focus on executable behavior, persistence, host damage, and sensitive-data exfiltration.

• Updates

  • Updated the security scanner to version 0.1.3.
  • Updated the security policy to version 2, including refreshed release assets and integrity information.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 1bf5cb0a-a832-47ba-9804-33e545422553

📥 Commits

Reviewing files that changed from the base of the PR and between cf8b5b0 and 6c2a32c.

📒 Files selected for processing (4)

• install/integrationctl/agentplugins/adapters/securityscan/policy.go
• install/integrationctl/agentplugins/adapters/securityscan/policy_test.go
• install/integrationctl/agentplugins/adapters/securityscan/release.go
• install/integrationctl/agentplugins/domain/security.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The blocking security policy removes SEC102 from blocking rules. Tests verify its warning behavior and the new policy digest. Scanner version, policy version, release URLs, asset names, and SHA-256 digests advance to 0.1.3.

Changes

Security policy and release

Layer / File(s)	Summary
Policy disposition rules install/integrationctl/agentplugins/adapters/securityscan/policy.go, install/integrationctl/agentplugins/adapters/securityscan/policy_test.go	The blocking rules exclude SEC102. Tests verify contextual warnings, blocking behavior for SEC330, and the updated policy digest.
Versioned scanner release install/integrationctl/agentplugins/domain/security.go, install/integrationctl/agentplugins/adapters/securityscan/release.go	The scanner version changes to 0.1.3, the policy version changes to 2, and all release assets reference version 0.1.3 with new SHA-256 digests.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 6c2a3

This updates the scanner to 0.1.3 and makes contextual SEC102 findings warnings while retaining blocking behavior for explicit denials and direct execution findings. The policy and release metadata changes are consistent and ready to merge.

Poem

A rabbit checks the rules at dawn
SEC102’s block is gone
New hashes glint in files so neat
Version three hops down the street
The policy stamp turns two
Tests confirm what warnings do

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the primary behavior change: reducing non-blocking security warning noise by limiting blocking findings.
Description check	✅ Passed	The description explains what changed, why it changed, and records targeted and broader verification. It omits the template's separate Release Impact section and checklist formatting, but it provides …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/security-policy-precision

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}