open/llm-security
1
0
Fork 0
Code Issues Releases 6 Activity

chore(release): v8.1.2 — node_modules and plugin dir foreign, posture credit honest

Browse source 
Version sync: package.json, .claude-plugin/plugin.json, README badge +
Recent versions row, CLAUDE.md header + v8.1.2 highlights, CHANGELOG
[8.1.2]. The own-working-tree header and CHANGELOG no longer claim that
node_modules and the plugin dir are the only install locations foreign
code lands in (independent review: Python venv, vendor/ still own) —
listed as Known open instead.

Gates on the staged tree: suite 2328 / 2322 pass / 0 fail / 6 skipped,
hooks 370/0, golden 109/7/4 61/61, av-surface 6/6, claude plugin
validate pass (1 known CLAUDE.md warning).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-09-22 21:39:19 +02:00
commit 0bc4c8a6be
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
6 changed files with 70 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

12
scanners/lib/own-working-tree.mjs
View file

@ -21,17 +21,17 @@
// so more findings, never fewer.
//
// v8.1.2 closed the gap for foreign code with NO `.git` of its own under cwd
// (it shares cwd's git root, so the v8.1.1 rule alone called it own). Two
// concrete places put such code under a user's working directory, and both
// are now foreign: (1) any `node_modules` segment on the path from cwd to the
// (it shares cwd's git root, so the v8.1.1 rule alone called it own) for two
// install locations, which are now foreign: (1) any `node_modules` segment on the path from cwd to the
// target (an installed package; only the path BELOW cwd counts, so a package
// the user has cd'd into is own, like a clone they cd'd into), and (2) any
// target under Claude Code's plugin dir — `$CLAUDE_CONFIG_DIR/plugins`, default
// `~/.claude/plugins` (cache/ and marketplaces/). A general "no `.git` of its
// own" rule was not taken: it would shut out ordinary subdirectories of the
// caller's own repo. Known limit: a `git archive` export (or an unpacked
// tarball) under cwd has neither marker and cannot be told apart from an own
// subdirectory — it still counts as own.
// caller's own repo. Known limits — these still count as own: a `git archive`
// export or unpacked tarball under cwd (no marker at all), and other install
// locations this rule does not name (a Python venv's site-packages, a
// composer/bundler `vendor/` dir, skills copied into a git-tracked ~/.claude).
import { resolve, sep, join, dirname, relative } from 'node:path';
import { realpathSync, existsSync } from 'node:fs';