[John-David Dalton (jdalton)]

Keep commas inside Tier 1 option values instead of splitting them into separate arguments. Repeated --exclude-paths options are documented, and malformed shell quoting gives a configuration error.

Verification covers argument parsing only, not end-to-end exclusions or a published image.

Implementation and validation

Only unquoted commas before a new hyphen-led option act as legacy separators. Documentation explains matching examples, Tier 1 scope, and the Basics workspace default.

Validation: 11 parser tests passed, covering repeated flags, comma lists, quoted/escaped commas, and invalid quoting. Black and Flake8 passed for the test module; git diff --check passed.

Automated review notes

---

[!NOTE]
Medium Risk
Parsing behavior for existing SOCKET_ADDITIONAL_PARAMS strings changes (mostly fixes comma-in-value cases); misconfigured quotes now error instead of running with wrong CLI args passed to socket scan reach.

Overview
Socket Tier 1 socket_additional_params / SOCKET_ADDITIONAL_PARAMS parsing no longer splits on every comma. A new tokenizer keeps commas inside option values (including quoted values) and still treats an unquoted comma before another - flag as the legacy separator, then runs shlex splitting. Malformed quoting now fails fast with ConnectorExecutionError instead of silently mis-splitting args.

Docs and GitHub Action / connector descriptions are aligned: space-separated options, repeat list flags like --exclude-paths, and examples for excluding Tier 1 scan paths via CLI, env, or Action input. Regression tests cover repeated flags, comma-in-values, legacy --view=full,--all, escapes, and bad quotes.

^{Reviewed by Cursor Bugbot for commit bf09322. Configure here.}