open/llm-security
1
0
Fork 0
Code Issues Releases 6 Activity

chore(release): v8.1.3 — install locations, both config dirs, case, watch cwd

Browse source 
Version 8.1.3 in package.json, .claude-plugin/plugin.json, README badge
and changelog list, CLAUDE.md header and highlights, CHANGELOG. No tag:
release-plugin.mjs is the operator's push round.

Also in this commit: file content no longer carries order IDs or
pointers into the local-only plan (comments and test names in the
own-working-tree, av-surface and watch-cron tests; `punkt N` -> `(N)`).
README's antivirus section now says v8.1.3 touched it.

Suite after `git add`: 2344 tests, 2338 pass, 0 fail, 6 skipped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-09-23 11:55:08 +02:00
commit 34617305c8
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
9 changed files with 100 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CLAUDE.md
View file

@ -1,9 +1,11 @@
# LLM Security Plugin (v8.1.2)
# LLM Security Plugin (v8.1.3)
Security scanning, auditing, and threat modeling for Claude Code projects. 5 frameworks: OWASP LLM Top 10, Agentic AI Top 10 (ASI, 2026 edition), Skills Top 10 (AST), MCP Top 10, AI Agent Traps (DeepMind). 2250+ unit, integration, and end-to-end tests (`tests/e2e/` covers the multi-hook attack chain, multi-session state simulation, and the full scan-orchestrator pipeline); mutation-testing coverage not published.
Release notes for v7.0.0 → v7.8.2: see `docs/version-history.md` — read on demand.
**v8.1.3 highlights** — Patch closing most of the v8.1.2 known-open list, the watch-cron config gap and three README fact-check findings; detection tables, golden baseline and hooks untouched. "Own working tree" (`scanners/lib/own-working-tree.mjs`): a `site-packages` or `vendor` segment below cwd is foreign like `node_modules`; a config dir's `skills/` is foreign like its `plugins/`; the config dirs are BOTH `~/.claude` and `$CLAUDE_CONFIG_DIR` (leading `~` expanded; whether Claude Code expands it is not verified); paths go through `realpathSync.native`, so case is canonical (`NODE_MODULES/x` foreign, `/users/…` own). `scanners/watch-cron.mjs` runs the orchestrator with cwd = the watched project, so its ignore/policy apply (`tests/scanners/watch-cron-scope.test.mjs`). av-surface probe (b2): no runnable base64-to-shell line with a short blob (three removed: gallery runner + README, `tests/e2e/attack-chain.test.mjs`). `docs/ci-cd-guide.md` / `scanner-reference.md` no longer claim the CLI is offline (npm audit, pip-audit, DNS, OSV); knowledge-file count 22. Known open: `git archive`/tarball under cwd, cwd inside `node_modules`, exotic own-side losses (empty `HOME`, relative `CLAUDE_CONFIG_DIR`). 2344 tests.
**v8.1.2 highlights** — Patch closing both v8.1.1 known-open items; detection tables, golden baseline and hooks untouched. "Own working tree" (`scanners/lib/own-working-tree.mjs`) is additionally foreign when the path from cwd to the target has a `node_modules` segment (only the part below cwd counts — a package you `cd`'d into is own) or when the target lies under Claude Code's plugin dir (`$CLAUDE_CONFIG_DIR/plugins`, default `~/.claude/plugins`; foreign even from inside it). PM rule (order 20260922T192716Z), chosen over a general "no `.git` of its own" rule, which would shut out plain subdirs of the own repo (`tests/lib/own-working-tree.test.mjs`, `tests/scanners/foreign-under-cwd-scope.test.mjs`). posture-scanner's NIST Govern credit for `policy.json` now requires `isOwnWorkingTree(projectRoot)` (`tests/scanners/posture-policy-scope.test.mjs`). Known open: a `git archive` export / unpacked tarball under cwd, and install locations the rule does not name (Python venv site-packages, composer/bundler `vendor/`, skills in a git-tracked `~/.claude`), still count as own; the plugin-dir check knows one config dir. Kept on purpose (safe direction): an own worktree under the repo and a case-mismatched target path are foreign. 2328 tests.
**v8.1.1 highlights** — Patch closing the v8.1.0 follow-up list; detection tables, golden baseline and hooks untouched. "Own working tree" (`scanners/lib/own-working-tree.mjs`) now also requires the target to share cwd's git root (nearest `.git`, dir or file; none for both), so a clone, submodule or worktree *under* cwd is foreign and its `.llm-security-ignore` / `policy.json` / custom SIG rules are ignored — closes v8.1.0's known-open item (`tests/lib/own-working-tree.test.mjs`, `tests/scanners/nested-clone-scope.test.mjs`). `ci.failOn` / `ci.compact` from `policy.json` got a real test (the old one never read the policy). README and `.llm-security-ignore` no longer state self-scan counts that drift per commit (git-forensics' 50-commit window). `/security scan` description names the accepted URLs. Known open: a target with no `.git` of its own (`node_modules/`, plugin-cache copy, tarball export) under cwd still counts as own. Windows/Defender quarantine remains **not measured** (no Windows machine). 2306 tests.