From 24949860f538ac12afc58d69131e659a3fead3d7 Mon Sep 17 00:00:00 2001 From: Kjell Tore Guttormsen Date: Sat, 18 Jul 2026 09:02:02 +0200 Subject: [PATCH] =?UTF-8?q?chore(llm-security):=20STATE=20=E2=80=94=20v7.8?= =?UTF-8?q?.1=20shipped;=20next=20=3D=20the=20~6=20HIGH=20(v7.8.2)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01TcQyMTQfyrsAapaCMPxTtQ --- STATE.md | 96 +++++++++++++++++++++++++++++++------------------------- 1 file changed, 54 insertions(+), 42 deletions(-) diff --git a/STATE.md b/STATE.md index 7faf740..28941f1 100644 --- a/STATE.md +++ b/STATE.md @@ -1,49 +1,61 @@ # STATE β€” llm-security -**Active focus:** NONE active. v7.8.0 RELEASED; security-fix track (F-1/F-2/F-3) + -TRG/SIG/AST scanners ALL DONE; **internal codename fully scrubbed from Forgejo + force-pushed -(DONE this session).** Only loose end = **F-4 (optional, LOW)**. Clean, quiescent state. +**πŸ‘‰ NESTE β€” START HER (fresh session, Opus 4.8 xhigh) β€” v7.8.2: the ~6 HIGH:** +**v7.8.1 SHIPPED** β€” the CRITICAL auto-cleaner RCE is fixed, released, tagged, catalog-synced and +pushed. Next up is the HIGH tier from the same review. Iron Law per defect (regression test FIRST), +one commit per defect, then ship v7.8.2. All six are in the 59-finding review output (harvest source +below). Order them yourself; suggested by blast radius: +1. `rm -rf /` + `rm -rf ~` bypass the root-block β€” `hooks/pre-bash-destructive.mjs:24`. +2. Entropy scanner suppresses ALL findings when the ABSOLUTE path contains test/spec/fix β€” + `scanners/entropy-scanner.mjs:308` (a repo cloned to `/tmp/fix-me/` silently reports nothing). +3. Unparseable JetBrains plugin crashes the whole ide-scan + null-manifest deref β€” + `scanners/ide-extension-scanner.mjs:684` (likely 1 root cause / 2 findings). +4. Obfuscated injections are reported but NOT stripped from the LLM evidence package β€” + `scanners/content-extractor.mjs:119` (defeats the remote-scan injection defense). +5. Out-of-range numeric char-ref raises RangeError, breaking the no-throw contract β€” + `scanners/ide-extension-parser.mjs:147`. +Then the MEDIUM sweep (52 more) β€” likely its own release, not v7.8.2. -## Codename scrub (THIS session β€” operator: "must not appear anywhere on Forgejo") β€” DONE -- Full history-rewrite via `git filter-repo` + **force-push** (`d11de9a` β†’ `a19e9eb`). - Verified: 0 occurrences in any blob across all refs, 0 in any commit message, 0 filenames. -- Tip prose reworded by hand (CHANGELOG, CLAUDE.md, README, docs/version-history.md, STATE.md); - scanners now referred to as TRG/SIG/AST only. -- Two `docs/plans/` docs (a gap-analysis + its trekplan, both named after the codename) - deleted from ALL history via `--invert-paths` (the `.html` render was git-ignored β€” deleted - locally only). Leftover historical blobs + 2 commit messages scrubbed via - `--replace-text`/`--replace-message` (`(?i) ==> TRG/SIG/AST`). -- Backup of pre-scrub history: `/tmp/llm-security-pre-scrub-backup.bundle` (all refs; old HEAD - `d11de9a`) β€” LOCAL only, never on Forgejo; delete once satisfied. -- RESIDUAL (server-side): old unreachable objects may linger on Forgejo until git GC. To - guarantee physical removal, run repo housekeeping/GC as Forgejo admin (`ktg`). +**Review output (harvest source):** confirmed array + per-finding adversarial reasoning in task +`w8s4rsaw8` output: `…/dfcab047-5467-4484-ab1a-5d6526439f78/tasks/w8s4rsaw8.output` (result.confirmed, +59 items). Durable journal (one result-line/agent): `~/.claude/projects/-Users-…-llm-security/ +f99dcf73-d344-4377-b8ba-09fe878f32a2/subagents/workflows/wf_99daed37-f8b/journal.jsonl`. -## What shipped (DONE β€” do NOT re-derive) -- **v7.8.0 release β€” Session C. DONE** (pure version-sync; no production code). Bumped - 7.7.2 β†’ 7.8.0 across `.claude-plugin/plugin.json`, `package.json`, `README.md` badge, - `CLAUDE.md` header + range sentinel; CHANGELOG `[7.8.0]`, version-history section, README - "Recent versions" row, CLAUDE.md highlights added. Release gate: `node --test` 1863/0. - Tagged `v7.8.0` (annotated, commit `6d3c4b5`) + pushed; catalog `ref`/README synced - 7.7.2 β†’ 7.8.0 (catalog commit `843254d`) β€” version-consistency gate β†’ OK. -- **TRG/SIG/AST scanners β€” Steps 1–7. DONE** (`54115a9`..`d19abf0`, SHAs change after rewrite). - Three deterministic deep-scan scanners: `scanners/trigger-scanner.mjs` (TRG, LLM06/AST04), - `scanners/signature-scanner.mjs` (SIG, rules `knowledge/signatures.json`, LLM03/LLM02), - `scanners/ast-taint-scanner.mjs` (AST, parse-only `scanners/lib/py-ast-taint.py` + regex - fallback, LLM01/LLM02/AST02). Wired into orchestrator + policy; prefixes in `output.mjs`. -- **Security-fix track β€” F-1/F-2/F-3 + F-5/F-6. DONE** (Sessions A+B). All shell-injection / - path-traversal sinks closed. Brief: `docs/security-fix-brief-2026-06-20.md`. +## PARKED β€” v8 family strategy (behind an operator visibility decision, DO NOT PUSH) +4 of 6 deliverables written, LOCAL ONLY: `docs/JOBS-TO-BE-DONE.md`, `docs/FAMILY-MAP.md`, +`docs/commons-extraction-plan.md`, `docs/roadmap.md` [gitignored]. Remaining v8 docs (do NOT start until +visibility is decided): formal `docs/completion-review-2026-07-17.md` (findings table + +`severity.mjs` framework-coverage map + citations; roadmap B8/P3 reference it) and `V8-ANNOUNCEMENT.md`. +**⚠️ DO NOT PUSH the 3 untracked docs:** origin `open/llm-security.git` is a PUBLIC mirror; docs describe +cross-repo strategy + a sibling (`claude-code-llm-wiki`, "Private pending Anthropic ToS"). Do NOT `git add` +them without a visibility call (accept-public / keep-local `.local.md` / private family home). +NOTE: `docs/FAMILY-MAP.md:42` still says v7.8.0/1863 tests β€” stale, fix when the parking ends. -## Still open (optional only) -- **F-4 β€” optional, LOW** (by-design MCP spawn; confirm-gate is a judgment call). NOT required. -- Residual gap (inline in F-2 fix): prefix containment in `auto-cleaner.mjs` does not stop a - symlink inside the tree pointing out. Known, accepted. +## Ground truth (verified 2026-07-18) +- **`npm test` = 1865/0 green** at tip. Run tests with `npm test` β€” `node --test tests/` is NOT a valid + invocation (it fails as a harness error, not a regression); the script is `node --test 'tests/**/*.test.mjs'`. +- v7.8.1 released: tag `v7.8.1` pushed, catalog ref bumped, `check-versions.mjs` = **0 ERROR** + (the one WARN is `okr`, pre-existing and unrelated). +- CRITICAL RCE: **reproduced live before the fix** (canary via `$CLEANER_RCE_CANARY` env expansion, + proving a shell parsed the filename), gone after. Both sinks in `scanners/auto-cleaner.mjs` are now + `spawnSync` argv-arrays; `execSync` is no longer imported there. +- Regression coverage is deliberately TWO tests (`tests/scanners/auto-cleaner-rce.test.mjs`): the belt + in `applyFixes` (metachar refusal) stops hostile input BEFORE the sink, so a single applyFixes-level + test would pass without proving the shell was gone. `validateContent` is exported for that reason β€” + do not "tidy" that export away. +- Prior security: F-1/2/3/5/6 fixed; F-4 open (optional/LOW); B1/B2/E14 fixed. +- Stray `undefined/` (scan artifact, 2026-07-17): **removed**. -## COLD START (next session) -1. `pwd` + `git status`. Tip should be `a19e9eb` (or later) on `origin/main`. -2. No active task queued. Options: F-4 confirm-gate if wanted, or a new direction. Do NOT - invent scope β€” ask. (If the codename ever needs re-checking: `git grep -i - $(git rev-list --all)` must stay empty.) +## Position taken (strategic anchor) +llm-security **consolidates**; growth at **family level** (security-commons + `llm-retrieval-guard` +sibling for the LLM08 writeβ†’retrieval seam). JS/TS AST-taint parity + post-clone CLAUDE.md-poisoning +stay here; research artifact-scanners (model/pickle, .ipynb, insecure-ML) relocate to commons/guard. +v8.0.0 = deprecation cleanup (LLM_SECURITY_* env-vars + riskScoreV1) + behaviour-preserving commons +extraction + verified fixes + docs consistency. -## Continuity notes -- origin = Forgejo `open/llm-security` (never GitHub). Push window: weekdays 20:00–23:00; - weekends/holidays anytime. +## Continuity +origin = Forgejo `open/llm-security` (PUBLIC, never GitHub). Push window: weekdays 20:00–23:00; +weekends/holidays anytime. STATE.md is intentionally TRACKED + committed (`.gitignore:19-20` NOTE). +**Disclosure convention (set this session):** a security fix to public code is committed but HELD until +its release tag exists, so the exploit description in the commit/notes never lands before the fixed +version users can upgrade to. Fix, bump, tag, catalog, push β€” one sequence.