From 3db6b65aba8ba8d794ff2f006e802f99e86adc4e Mon Sep 17 00:00:00 2001 From: Kjell Tore Guttormsen Date: Tue, 19 May 2026 06:47:44 +0200 Subject: [PATCH] =?UTF-8?q?chore(llm-security):=20v7.7.2=20=E2=80=94=20lan?= =?UTF-8?q?guage=20consistency=20pass?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ~/.claude/CLAUDE.md specifies English for code and documentation, Norwegian for dialog only. Norwegian had crept into surface text across v7.5-v7.7. Translated to English in eight surfaces. No scanner, hook, or behavior changes — purely surface text. - 18 skill commands: the HTML Report-step now reads "HTML report: [Open in browser]" instead of "HTML-rapport: [Åpne i nettleser]" - scripts/lib/report-renderers.mjs: key-stat labels, lede defaults, table headers, maturity-ladder descriptions, action-tier labels, clean buckets, dry-run/apply copy, and JS comments. Regex alternations /^high|^høy/ and /resolution|løsning/i preserved. - playground/llm-security-playground.html: same renderer changes mirrored bit-identical, plus playground-only UI strings (catalog, breadcrumb aria-label, theme toggle, builder-modal hint, guide-panel "no projects yet", delete confirmation, alert/copy). Demo-state fixture content for dft-komplett-demo preserved (intentional Norwegian persona). - agents/skill-scanner-agent.md + agents/mcp-scanner-agent.md: Generaliseringsgrense + Parallell Read-strategi sections translated to Generalization boundary + Parallel Read strategy. - README.md: playground architecture prose + Recent versions table (v7.5.0 — v7.7.1). - CLAUDE.md: v7.7.1 highlights translated, new v7.7.2 highlights added. - ../../README.md: llm-security v7.5.0 — v7.7.1 bullets. - ../../CLAUDE.md: llm-security catalog entry. - docs/scanner-reference.md: six runnable-examples table cells. - docs/version-history.md: new v7.7.2 entry. v7.5-v7.7 narrative sections left in original language (deferred per operator). - Version bumped 7.7.1 → 7.7.2 in package.json, .claude-plugin/plugin.json, README badge + Recent versions, CLAUDE.md header + state, docs/version-history.md, playground renderHome hardcoded string, root README + CLAUDE.md llm-security entries. Tests: 1820/1820 green. CLI smoke-test: 18/18 commandIds produce >138 KB self-contained HTML. Browser-dogfood verified. Co-Authored-By: Claude Opus 4.7 --- .claude-plugin/plugin.json | 2 +- CHANGELOG.md | 77 +++++ CLAUDE.md | 10 +- README.md | 103 +++---- agents/mcp-scanner-agent.md | 22 +- agents/skill-scanner-agent.md | 22 +- commands/audit.md | 2 +- commands/clean.md | 2 +- commands/dashboard.md | 2 +- commands/deep-scan.md | 2 +- commands/diff.md | 2 +- commands/harden.md | 2 +- commands/ide-scan.md | 2 +- commands/mcp-audit.md | 2 +- commands/mcp-inspect.md | 2 +- commands/plugin-audit.md | 2 +- commands/posture.md | 2 +- commands/pre-deploy.md | 2 +- commands/red-team.md | 2 +- commands/registry.md | 2 +- commands/scan.md | 2 +- commands/supply-check.md | 2 +- commands/threat-model.md | 2 +- commands/watch.md | 2 +- docs/scanner-reference.md | 24 +- docs/version-history.md | 19 ++ package.json | 2 +- playground/llm-security-playground.html | 358 ++++++++++++------------ scripts/lib/report-renderers.mjs | 128 ++++----- 29 files changed, 455 insertions(+), 348 deletions(-) diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index 8f8f95f..3ab8d30 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -1,5 +1,5 @@ { "name": "llm-security", "description": "Security scanning, auditing, and threat modeling for Claude Code projects. Detects secrets, validates MCP servers, assesses security posture, and generates threat models aligned with OWASP LLM Top 10.", - "version": "7.7.1" + "version": "7.7.2" } diff --git a/CHANGELOG.md b/CHANGELOG.md index 6013b43..248f98f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,83 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] +## [7.7.2] - 2026-05-19 + +Language consistency pass. Norwegian had crept into surface text across +v7.5-v7.7. Per the `~/.claude/CLAUDE.md` convention (English for code and +documentation, Norwegian for dialog only), surface text was translated to +English. No scanner, hook, or behavior changes — purely surface text. + +### Changed + +- **18 skill commands `commands/*.md`** — the "HTML Report"-step appended + by each `/security ` flow now reads + `> **HTML report:** [Open in browser](file:///abs/path.html)` (previously + Norwegian). +- **CLI canonical module `scripts/lib/report-renderers.mjs`** — translated + KEY_STATS_CONFIG labels (`TOTALT` → `TOTAL`, `KRITISK` → `CRITICAL`, + `HØY` → `HIGH`, `FUNN` → `FINDINGS`, `PROSJEKTER` → `PROJECTS`, + `MASKINKLASSE` → `MACHINE GRADE`, `SVAKEST` → `WEAKEST`, + `NÅ-GRADE` → `CURRENT GRADE`, `AKSJONER` → `ACTIONS`, `MODUS` → `MODE`), + the 5-step maturity ladder descriptions, the suppressed-group desc, + 4 table-header sets, the 6 renderer `lede` defaults (plugin-audit, + mcp-audit, harden, diff, watch, clean), the action tier labels + (Umiddelbar/Høy prioritet/Medium prioritet → Immediate/High priority/ + Medium priority), the clean buckets, and the dry-run/apply text. JS + comments translated for consistency. Preserved the regex alternations + `/^high|^høy/` and `/resolution|løsning/i` — they intentionally match + Norwegian-language report markdown. +- **Playground `playground/llm-security-playground.html`** — the same + display strings as the canonical module (kept bit-identical), plus + playground-specific UI text: catalog row labels, search placeholder, + breadcrumb aria-label, theme-toggle labels, primary nav aria-label, + builder-modal hints, "no projects yet" guide-panel, delete-project + confirmation, alert/copy-confirm strings, and the field-from-tag + "felles" pill (now "shared"). The hardcoded `Plugin v7.7.1` in + `renderHome` bumped to `Plugin v7.7.2`, and `prosjekter`/`kommandoer` + there became `projects`/`commands`. Demo-state fixture content for the + `dft-komplett-demo` project (intentional Norwegian persona) and regex + tokens were preserved. +- **Agent prompts `agents/skill-scanner-agent.md` + + `agents/mcp-scanner-agent.md`** — translated the `Generaliseringsgrense` + and `Parallell Read-strategi` sections (identical content in both files) + to `Generalization boundary` and `Parallel Read strategy`. +- **`README.md`** — translated the Recent versions table rows for v7.5.0 + → v7.7.1 and the playground architecture prose (L495-553). Version + badge bumped to 7.7.2. +- **`CLAUDE.md`** — translated the v7.7.1 highlights paragraph and added a + new v7.7.2 highlights paragraph. Header and "release notes" sentinel + bumped to v7.7.2. +- **Marketplace root `../../README.md`** — translated the v7.5.0 → v7.7.1 + llm-security bullet entries (lines 39-43). Version label in the + header bumped to v7.7.2. The voyage and ms-ai-architect entries on + lines 90-91 / 192-197 were not touched (strict plugin scope). +- **Marketplace root `../../CLAUDE.md`** — translated the llm-security + catalog entry on line 13 and bumped its version to v7.7.2. +- **`docs/scanner-reference.md`** — translated the six runnable-examples + table cells (L114-122) and the surrounding paragraph. +- **`docs/version-history.md`** — added a v7.7.2 entry describing this + pass. The v7.5.0 → v7.7.1 narrative sections retain the Norwegian they + were written in (deferred per operator decision). +- **`package.json` + `.claude-plugin/plugin.json`** — version 7.7.1 → + 7.7.2. + +### Preserved (intentional Norwegian) + +- Demo-state `dft-komplett-demo` JSON `description`, `system_description`, + and parsed-data `"label": "HØY"` / `"label": "NÅ-GRADE"` entries — + intentional Norwegian persona for the public-sector reference scenario. +- Regex alternations `/^high|^høy/` and `/resolution|løsning/i` in both + the canonical renderer and the playground inline copy — they let + reports written in Norwegian still parse and route correctly. +- `knowledge/norwegian-context.md` and other knowledge files — out of + scope. +- The v7.5.0 → v7.7.1 entries in CHANGELOG.md and `docs/version-history.md` + remain in the language they were written in; rewriting historical + release notes was deferred. +- `REMEMBER.md`, `TODO.md`, `ROADMAP.md`, `*.local.md`, commit messages, + test fixtures, and the `playground/A11Y-RAPPORT.md` artifact. + ## [7.7.1] - 2026-05-18 Playground UX-strip etter v7.7.0-operatør-feedback. Hjem-overflaten ledet diff --git a/CLAUDE.md b/CLAUDE.md index cdef7d0..892a2c3 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1,12 +1,14 @@ -# LLM Security Plugin (v7.7.1) +# LLM Security Plugin (v7.7.2) Security scanning, auditing, and threat modeling for Claude Code projects. 5 frameworks: OWASP LLM Top 10, Agentic AI Top 10 (ASI), Skills Top 10 (AST), MCP Top 10, AI Agent Traps (DeepMind). 1820+ unit, integration, and end-to-end tests (`tests/e2e/` covers the multi-hook attack chain, multi-session state simulation, and the full scan-orchestrator pipeline); mutation-testing coverage not published. -Release notes for v7.0.0 → v7.7.1: see `docs/version-history.md` — read on demand. +Release notes for v7.0.0 → v7.7.2: see `docs/version-history.md` — read on demand. -**v7.7.1 highlights** — Playground UX-strip etter operatør-feedback: katalog er nå eneste levende overflate (onboarding/home/project-render-funksjonene er bevart i kildekoden men ikke rutbare før funksjonalitet legges til igjen). Topbar-breadcrumb leser ikke lenger demo-state-orgnavn; viser nøytralt `llm-security · Katalog`. Hardkodet versjons-streng i `renderHome` synket. Ingen scanner- eller hook-atferdsendringer. +**v7.7.2 highlights** — Language consistency pass. Norwegian had crept into the playground UI strings, the canonical CLI renderer (`scripts/lib/report-renderers.mjs`), the HTML Report-step appended by all 18 skill commands, two agent prompts, and the marketplace + plugin README/CLAUDE.md state sections. Per the `~/.claude/CLAUDE.md` convention (English for code and documentation, Norwegian for dialog only), surface text was translated to English. Demo-state fixture content for the `dft-komplett-demo` project (intentional Norwegian persona) and regex alternations that match Norwegian-language report markdown (`/^high|^høy/`, `/resolution|løsning/`) were preserved. No scanner, hook, or behavior changes. -**v7.7.0 highlights** — All 18 report-producing skill commands now emit a clickable `file://` link to a self-contained HTML version of their markdown report. The new `scripts/render-report.mjs` CLI converts any of the 18 report types via a canonical `scripts/lib/report-renderers.mjs` (18 parsers + 18 renderers, bit-identical to the playground). HTML wraps the Tier 1/2/3 design system inline; no external assets, system fonts only (~140 KB per report). Playground also got list-view, copy-button, and prosjekt-surface cleanup. +**v7.7.1 highlights** — Playground UX strip after operator feedback: the catalog is now the only routable surface (the onboarding/home/project render functions remain in source but are not routable until the feature is restored). The topbar breadcrumb no longer reads the demo-state org name; it shows a neutral `llm-security · Catalog`. The hardcoded version string in `renderHome` was synced. No scanner or hook behavior changes. + +**v7.7.0 highlights** — All 18 report-producing skill commands now emit a clickable `file://` link to a self-contained HTML version of their markdown report. The new `scripts/render-report.mjs` CLI converts any of the 18 report types via a canonical `scripts/lib/report-renderers.mjs` (18 parsers + 18 renderers, bit-identical to the playground). HTML wraps the Tier 1/2/3 design system inline; no external assets, system fonts only (~140 KB per report). Playground also got list-view, copy-button, and project-surface cleanup. ## Commands diff --git a/README.md b/README.md index 883bc73..657ff30 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ *AI-generated: all code produced by Claude Code through dialog-driven development. [Full disclosure →](../../README.md#ai-generated-code-disclosure)* -![Version](https://img.shields.io/badge/version-7.7.1-blue) +![Version](https://img.shields.io/badge/version-7.7.2-blue) ![Platform](https://img.shields.io/badge/platform-Claude_Code_Plugin-purple) ![Commands](https://img.shields.io/badge/commands-20-orange) ![Agents](https://img.shields.io/badge/agents-6-orange) @@ -492,16 +492,16 @@ a browser (Chrome/Firefox/Safari over `file://`) — no build step, no network calls, no npm install. Theme-bootstrap with FOUC-prevention; state persisted in IndexedDB primary + localStorage fallback. -**v7.6.0 Tier 3-referanse-case:** Playgroundet er nå en visuelt og -strukturelt fullført referanse for `shared/playground-design-system/` -Tier 3-supplementet. 8 nye DS-komponenter integrert i de 18 rapport- -rendererne: `tfa-flow` (lethal trifecta-kjede), `mat-ladder` (modenhets- -stige), `suppressed-group` (narrative-audit), `codepoint-reveal` (Unicode- -steganografi), `top-risks` (rangert top-funn), `recommendation-card[data- -severity]` (severity-tinted advisory), `risk-meter` (band-visualisering -0-100), `card--severity-{level}` (severity-color findings-cards). Pluss -`badge--scope-security`, `verdict-pill-lg` og `form-progress`+`fp-step` -fra wave 1. +**v7.6.0 Tier 3 reference case:** The playground is now a visually and +structurally complete reference for the `shared/playground-design-system/` +Tier 3 supplement. 8 new DS components integrated into the 18 report +renderers: `tfa-flow` (lethal trifecta chain), `mat-ladder` (maturity +ladder), `suppressed-group` (narrative audit), `codepoint-reveal` (Unicode +steganography), `top-risks` (ranked top findings), `recommendation-card +[data-severity]` (severity-tinted advisory), `risk-meter` (band +visualization 0-100), `card--severity-{level}` (severity-color findings +cards). Plus `badge--scope-security`, `verdict-pill-lg`, and +`form-progress`+`fp-step` from wave 1. **Layout:** @@ -509,48 +509,50 @@ fra wave 1. playground/ ├── llm-security-playground.html ← single-file SPA (~10 700 lines) ├── vendor/ -│ └── playground-design-system/ ← synket fra shared/, sjekksum-låst -├── test-fixtures/ ← markdown-fixtures (én per kommando) -├── screenshots/v7.5.0/ ← Playwright-genererte demobilder (12) -├── screenshots/v7.6.0/ ← v7.6.0 demobilder (12, manuelt generert) -└── A11Y-RAPPORT.md ← WCAG 2.1 AA verifisering + Tier 3 ARIA +│ └── playground-design-system/ ← synced from shared/, checksum-locked +├── test-fixtures/ ← markdown fixtures (one per command) +├── screenshots/v7.5.0/ ← Playwright-generated demo images (12) +├── screenshots/v7.6.0/ ← v7.6.0 demo images (12, hand-generated) +└── A11Y-RAPPORT.md ← WCAG 2.1 AA verification + Tier 3 ARIA ``` -**Hva playgroundet dekker:** +**What the playground covers:** -- **Onboarding (5 grupper):** organisasjon, scope, profil, plattform, - compliance. Verdier persisteres som `shared`-state og prefylles automatisk - i alle command-skjemaer. -- **Home:** prosjekt-grid, fleet-tracks for posture/scan/red-team. «Last - inn demo-data»-knappen aktiverer 3 prosjekter inkludert `dft-komplett-demo` - med alle 18 rapporter ferdig parsed. -- **Catalog:** alle 20 kommandoer gruppert i 5 kategorier. Søk filtrerer - cards, og «Åpne skjema»-knapp bygger ferdig pipeline-streng for klipp-og- - lim til terminalen. -- **Project surface:** 4 skjermer (Oversikt / Rapporter / Kontekst / - Eksport). Rapporter-tabben har category-tabs (discover / posture / - findings-ops / hardening / adversarial / mcp-ops) og lim-inn-import for - hver rapport-kommando. +- **Onboarding (5 groups):** organization, scope, profile, platform, + compliance. Values persist as `shared` state and prefill every command + form automatically. +- **Home:** project grid, fleet tracks for posture/scan/red-team. The + "Load demo data" button activates 3 projects, including + `dft-komplett-demo` with all 18 reports parsed in advance. +- **Catalog:** all 20 commands grouped into 5 categories. Search filters + cards, and the "Open form" button builds a ready-to-paste pipeline + string for the terminal. +- **Project surface:** 4 screens (Overview / Reports / Context / Export). + The Reports tab has category tabs (discover / posture / findings-ops / + hardening / adversarial / mcp-ops) and paste-import for every report + command. -**Parser/renderer-arkitektur:** Hver `produces_report=true`-kommando i -`CATALOG` har en parser (markdown → struktur) og en renderer (struktur -→ DS-komponenter). 18 archetypes støttes: `findings`, `findings-grade`, -`risk-score-meter`, `posture-cards`, `dashboard-fleet`, `red-team-results`, -`diff-report`, `kanban-buckets`, `matrix-risk`. Parser-kontrakten er -`{ ok: true, data: {...} } | { ok: false, errors: [...] }`. Test-fixtures -under `playground/test-fixtures/` er kontrakt-anker — én markdown-fil per -kommando som speiler `templates/unified-report.md`-formatet. +**Parser/renderer architecture:** Every `produces_report=true` command in +`CATALOG` has a parser (markdown → structure) and a renderer (structure +→ DS components). 18 archetypes are supported: `findings`, +`findings-grade`, `risk-score-meter`, `posture-cards`, `dashboard-fleet`, +`red-team-results`, `diff-report`, `kanban-buckets`, `matrix-risk`. The +parser contract is `{ ok: true, data: {...} } | { ok: false, errors: +[...] }`. The test fixtures under `playground/test-fixtures/` are the +contract anchor — one markdown file per command, mirroring the +`templates/unified-report.md` format. -**Eksponerte testing/automasjons-globaler:** `__store`, `__navigate`, +**Exposed testing/automation globals:** `__store`, `__navigate`, `__loadDemoState`, `__scheduleRender`, `__PARSERS`, `__RENDERERS`, `__CATALOG`, `__inferVerdict`, `__inferKeyStats`, `__renderPageShell`, -`__handlePasteImport`. Aktiverer Playwright-styrt navigasjon og -programmatisk parser/renderer-test mot fixture-katalogen. +`__handlePasteImport`. They enable Playwright-driven navigation and +programmatic parser/renderer tests against the fixture catalog. -**Begrensninger:** SPA er en lim-inn-overflate — den kjører ingen scannere -selv. Output må komme fra Claude Code (`/security scan ...`), CLI -(`node scanners/...`) eller stub-fixtures. Demo-state inneholder kun de -3 inline-prosjektene; nye prosjekter er per-bruker og lagres lokalt. +**Limitations:** The SPA is a paste-in surface — it does not run any +scanners itself. Output must come from Claude Code (`/security scan +...`), the CLI (`node scanners/...`), or stub fixtures. Demo state only +contains the 3 inline projects; new projects are per-user and stored +locally. --- @@ -626,11 +628,12 @@ demonstrations — each with `README.md`, fixture, run script, and | Version | Date | Highlights | |---------|------|------------| -| **7.7.1** | 2026-05-18 | **Playground UX-strip.** Operatør-feedback umiddelbart etter v7.7.0: hjem-overflaten ledet med tre prosjekt-tracks (Re-onboard / Nytt prosjekt / Command-katalog) selv om katalog var det viktige. Minimum-strip levert som tre atomic commits (`b732eee` + `2a6f73f` + `81b7beb`): (1) router tvinger alltid `activeSurface = 'catalog'` (onboarding/home/project-render-funksjonene bevart men ikke rutbare); (2) topbar `Hjem` + `Re-onboard`-knapper fjernet, `Katalog` beholdt; (3) breadcrumb-orgname (`shared.organization.name` fra demo-state) erstattet med statisk `llm-security` som nøytralt scope-anker. Fix: hardkodet `'Plugin v7.6.1'` på linje 6933 i `renderHome` (template-litteral som v7.7.0-grep-en ikke fanget) synket. Onboarding-konseptet dokumentert som v7.8.0-kandidat (per-kommando kontekst-injeksjon) i `ROADMAP.md`. Ingen scanner- eller hook-atferdsendringer. | -| **7.7.0** | 2026-05-18 | **HTML-rapport for alle 18 skill-kommandoer.** Hver `/security ` som produserer rapport printer nå en klikkbar `file://`-lenke til en self-contained HTML-versjon. Levert over 5 sesjoner. (1) Playground katalog list-view + builder-pane med copy-knapp. (2) Playground prosjekt-surface opprydding (stub-screen-håndtering, topbar-splitt). (3) De 18 inline parserne + rendererne i playground-HTML flyttet til canonical ESM-modul `scripts/lib/report-renderers.mjs` (playground beholder bit-identisk inline-kopi siden ESM `import` ikke fungerer fra `file://`). (4) Ny zero-dep CLI `scripts/render-report.mjs` — stdin/file/stdout-modus, kebab→camel commandId-routing, inliner 6 DS-stylesheets + lokal `.report-table`-CSS, ~140 KB self-contained HTML, system-font-fallback, absolutte `file://`-paths for Ghostty cmd-click. (5) Alle 18 skills wired (4 i sesjon 4: scan/audit/posture/deep-scan, 14 i sesjon 5: plugin-audit/mcp-audit/mcp-inspect/ide-scan/supply-check/dashboard/pre-deploy/diff/watch/registry/clean/harden/threat-model/red-team). Output: `reports/-.html` relativt til CWD. Ingen scanner- eller hook-atferdsendringer — purely additive. | -| **7.6.1** | 2026-05-06 | **Playground v7.6.0 visuell-patch.** Seks bugs fanget under maintainer-verifisering i nettleser. Alle skyldtes mismatch mellom DS-klasser og rendrer-bruk (eller manglende DS-implementasjoner playground antok eksisterte). (1) `renderFindingsBlock` brukte `.findings` outer som er DS' 2-kolonners list+detail-grid → erstattet med `
` + korrekt `findings__list > findings__group`-mønster. (2) `.report-table` manglet helt i DS men brukes i 7+ rendrere → lokal CSS-implementasjon i playground-HTML. (3) `renderPreDeploy` traffic-lights brukte `.sm-card__grade` (28×28 px for én A-F-bokstav) for "PASS"/"PASS-WITH-NOTES"/"FAIL" → erstattet med bredde-tilpasset status-pill. (4) Threat-model matrix-bobler ikke klikkbare → `