From 4f6fc4a2a5356b13aea8cb0aa47d0ba9899e47ac Mon Sep 17 00:00:00 2001 From: Kjell Tore Guttormsen Date: Mon, 18 May 2026 21:38:27 +0200 Subject: [PATCH] =?UTF-8?q?chore(llm-security):=20v7.7.1=20release=20?= =?UTF-8?q?=E2=80=94=20formaliser=20playground=20UX-strip-fixes?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Tre fixes commited etter v7.7.0-tagen (b732eee + 2a6f73f + 81b7beb) viste versjons-inkonsistens: package.json + plugin.json + README badge + CLAUDE.md header satt fortsatt på v7.7.0 mens commit-meldinger og inline-kommentarer refererte v7.7.1 som om det var en release. Per feedback_version_sync.md skal alle versjonsreferanser stemme — denne commiten lukker gapet. Endringer: - package.json: 7.7.0 → 7.7.1 - .claude-plugin/plugin.json: 7.7.0 → 7.7.1 - plugin README badge: version-7.7.0-blue → version-7.7.1-blue - plugin README "Recent versions"-tabell: ny [7.7.1]-rad - plugin CLAUDE.md header + v7.7.1-highlights state-seksjon - docs/version-history.md: ny v7.7.1-seksjon - playground HTML linje 6935: 'Plugin v7.7.0' → 'Plugin v7.7.1' (samme template-litteral som v7.7.0-bumpen ikke fanget, nå synket) - CHANGELOG.md: ny [7.7.1]-seksjon med full Changed/Fixed/Notes - rot README llm-security-entry: v7.7.0 → v7.7.1 + ny v7.7.1-bullet - rot CLAUDE.md plugin-katalog: v7.7.1-bump Verifisert: - 1820/1820 tester grønne (pre-compact-flake fyrte ikke) - CLI rapporterer fornuftig feilmelding på tom input - Ingen kildefil-treff på 7.7.0 utenfor CHANGELOG/version-history/REMEMBER/TODO/ROADMAP Ingen ny atferd. Kun versjons-synking + dokumentasjon av tre fixes som var deployert som ad-hoc-commits. Co-Authored-By: Claude Opus 4.7 --- CLAUDE.md | 2 +- README.md | 3 +- .../llm-security/.claude-plugin/plugin.json | 2 +- plugins/llm-security/CHANGELOG.md | 43 +++++++++++++++++++ plugins/llm-security/CLAUDE.md | 6 ++- plugins/llm-security/README.md | 3 +- plugins/llm-security/docs/version-history.md | 34 +++++++++++++++ plugins/llm-security/package.json | 2 +- .../playground/llm-security-playground.html | 2 +- 9 files changed, 89 insertions(+), 8 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 82a6d8d..fbbc693 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -10,7 +10,7 @@ plugins/ config-audit/ v3.1.0 — Configuration intelligence (health, opportunities, auto-fix, whats-active) graceful-handoff/ v2.1.0 — Auto-trigger handoff via Stop hook (skill + JSON pipeline + 4-step model-aware context resolution) linkedin-thought-leadership/ v1.2.0 — LinkedIn content pipeline + analytics - llm-security/ v7.7.0 — Security scanning, auditing, threat modeling + HTML-rapport for alle 18 skill-kommandoer (render-report CLI + canonical ESM-modul som speiles bit-identisk i playground) + llm-security/ v7.7.1 — Security scanning, auditing, threat modeling + HTML-rapport for alle 18 skill-kommandoer (render-report CLI + canonical ESM-modul som speiles bit-identisk i playground). v7.7.1 strippet playground til katalog-overflate som eneste rute. ms-ai-architect/ v1.15.0 — Microsoft AI architecture (Cosmo Skyberg persona) + manual KB-refresh slash command + v3 project-view (sidebar med 17 artifacts + main + import-modal overlay, v2-surface fjernet i v1.15.0) okr/ v1.0.0 — OKR guidance for Norwegian public sector voyage/ v5.0.3 — Brief, research, plan, execute, review, continue. Contract-driven Claude Code pipeline (six-command universal pipeline + multi-session resumption + --gates autonomy chain). /trekbrief, /trekplan, and /trekreview each end by running scripts/annotate.mjs against the just-written .md and printing the file:// link to a self-contained operator-annotation HTML modelled on claude-code-100x/build-site.js: pencil-toggle annotation mode, select text or click any element, choose intent (Fiks/Endre/Spørsmål), comment, sidebar groups by section with delete + Copy Prompt, localStorage persistence per artifact path. v5.0.0 removed the v4.2/v4.3 bespoke playground + /trekrevise + Handover 8; v5.0.1 pointed at /playground document-critique (wrong direction); v5.0.2 was operator-led but too thin; v5.0.3 matches the reference the operator pointed at from day one. diff --git a/README.md b/README.md index 8ae6ef9..9fb3db6 100644 --- a/README.md +++ b/README.md @@ -26,7 +26,7 @@ Then open Claude Code and type `/plugin` to browse and install plugins from the ## Plugins -### [LLM Security](plugins/llm-security/) `v7.7.0` +### [LLM Security](plugins/llm-security/) `v7.7.1` Security scanning, auditing, and threat modeling for agentic AI projects. @@ -36,6 +36,7 @@ Built on OWASP LLM Top 10 (2025), OWASP Agentic AI Top 10, and the AI Agent Trap - **Deterministic scanning** — 23 Node.js scanners (10 orchestrated + 13 standalone) for byte-level analysis: Shannon entropy, Unicode codepoints, typosquatting detection, taint flow, DNS resolution, git forensics, AI-BOM, attack simulation, IDE extension prescan (VS Code + JetBrains — URL fetch from Marketplace / OpenVSX / direct VSIX / JetBrains Marketplace, hardened ZIP extractor for zip-slip / symlinks / bombs, plus OS sandbox via `sandbox-exec` / `bwrap` so the kernel enforces FS confinement), MCP cumulative-drift baseline reset (E14 — sticky baseline catches slow-burn rug-pulls). Bash-normalize T1-T6 for obfuscation-resistant denylists - **Advisory analysis** — 20 commands that scan, audit, and model threats with structured reports, letter grades, and actionable remediation - **Enterprise governance** — Compliance mapping (EU AI Act, NIST AI RMF, ISO 42001), SARIF 2.1.0 output, structured audit trail, policy-as-code, standalone CLI +- **v7.7.1 playground UX-strip (2026-05-18)** — Operatør-feedback umiddelbart etter v7.7.0: katalog-overflaten ble eneste levende rute i playgrounden (onboarding/home/project-render-funksjonene bevart men ikke rutbare). Topbar forenklet til `Katalog`-knapp + state/tema-handlinger. Breadcrumb-orgname erstattet med nøytralt `llm-security`. Onboarding-konseptet (kontekst-injeksjon per kommando) dokumentert som v7.8.0-kandidat i ROADMAP. Ingen scanner- eller hook-atferdsendringer - **v7.7.0 HTML-rapport for alle 18 skill-kommandoer (2026-05-18)** — Hver `/security ` som produserer rapport printer nå en klikkbar `file://`-lenke til en self-contained HTML-versjon. Levert over fem sesjoner: (1) playground katalog list-view + builder-pane med copy-knapp; (2) playground prosjekt-surface opprydding (stub-screen + topbar-splitt); (3) 18 inline parserne + rendererne flyttet til canonical ESM-modul `scripts/lib/report-renderers.mjs` (playground beholder bit-identisk inline-kopi siden ESM `import` ikke fungerer fra `file://`); (4) ny zero-dep CLI `scripts/render-report.mjs` — stdin/file/stdout-modus, kebab→camel commandId-routing, inliner 6 DS-stylesheets, ~140 KB self-contained HTML med system-font-fallback, absolutte `file://`-paths for Ghostty cmd-click; (5) alle 18 skills wired (4 i sesjon 4 + 14 i sesjon 5). Ingen scanner- eller hook-atferdsendringer — purely additive - **v7.6.1 playground visuell-patch (2026-05-06)** — Seks bugs fanget av maintainer ved manuell verifisering i nettleser etter v7.6.0-release. Alle skyldtes mismatch mellom DS-klasser og hvordan playground-rendrere brukte dem (eller manglende DS-implementasjoner av klasser playground-rendrere antok eksisterte): `renderFindingsBlock` brukte `.findings` outer-class (DS' 2-kolonners list+detail-grid) → erstattet med `
` + korrekt `findings__list`-mønster; `.report-table` manglet helt i DS men brukes i 7+ rendrere → lokal CSS-implementasjon; `renderPreDeploy` traffic-lights brukte fast 28×28 px `.sm-card__grade` for "PASS"/"PASS-WITH-NOTES"/"FAIL" → bredde-tilpasset status-pill; threat-model matrix-bobler ikke klikkbare → `