From 405874c0c45b9bd8dbfdab43d7a2b2a48665d36b Mon Sep 17 00:00:00 2001 From: Kjell Tore Guttormsen Date: Sat, 20 Jun 2026 11:23:42 +0200 Subject: [PATCH] =?UTF-8?q?chore(llm-security):=20STATE=20=E2=80=94=20v7.8?= =?UTF-8?q?.0=20released=20(Session=20C);=20only=20F-4=20(optional)=20left?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- STATE.md | 61 +++++++++++++++++++++++++++++--------------------------- 1 file changed, 32 insertions(+), 29 deletions(-) diff --git a/STATE.md b/STATE.md index 9ca837a..bbfe27e 100644 --- a/STATE.md +++ b/STATE.md @@ -1,36 +1,39 @@ # STATE — llm-security -**Active focus:** Security-fix track (from `docs/security-fix-brief-2026-06-20.md`). Critical review -DONE. Must-fixes **F-1 / F-2 / F-3 ALL DONE** across Sessions A + B. **Next = Session C (release).** -TRG/SIG/AST (TRG/SIG/AST) shipped Steps 1–7; v7.8.0 release (Step 8) stays DEFERRED until Session C. +**Active focus:** NONE active — **v7.8.0 RELEASED** (commit `e9476ea`). Security-fix track +(F-1/F-2/F-3) + TRG/SIG/AST (TRG/SIG/AST) + the release are ALL DONE. Only loose end = +**F-4 (optional, LOW)**, still open. Plugin is in a clean, quiescent, shippable state. -## Critical-review verdict (DONE — do NOT re-derive) -- **F-1 / F-2 / F-3 = MUST FIX. ALL DONE.** Verified real, fixes local + mechanical. -- **F-5 / F-6 = cheap cleanup. DONE** (Session A). -- **F-4 = optional** (LOW, by-design MCP spawn; confirm-gate is a judgment call) — still open. -- F-2 prefix containment does NOT stop a symlink-escape — noted inline in the fix; residual gap. +## What just shipped (DONE — do NOT re-derive) +- **v7.8.0 release — Session C. DONE (`e9476ea`).** Pure version-sync, no production code. + - Bumped 7.7.2 → 7.8.0 in every CURRENT pointer: `.claude-plugin/plugin.json`, `package.json`, + `README.md` badge, `CLAUDE.md` header + "release notes" range sentinel. + - Narrative added (prior releases kept as history): `CHANGELOG.md` `[7.8.0]`, + `docs/version-history.md` v7.8.0 section, README "Recent versions" 7.8.0 row, CLAUDE.md + v7.8.0 highlights paragraph. + - Release gate: full `node --test` suite **1863/0** after the doc edits. gitleaks clean. +- **TRG/SIG/AST (TRG/SIG/AST) — Steps 1–7. DONE** (`54115a9`..`d19abf0`). Three deterministic + deep-scan scanners: `scanners/trigger-scanner.mjs` (TRG, LLM06/AST04), + `scanners/signature-scanner.mjs` (SIG, rules in `knowledge/signatures.json`, LLM03/LLM02), + `scanners/ast-taint-scanner.mjs` (AST, parse-only `scanners/lib/py-ast-taint.py` + regex fallback, + LLM01/LLM02/AST02). Wired into orchestrator + policy; prefixes registered in `output.mjs`. +- **Security-fix track — F-1/F-2/F-3 + F-5/F-6. DONE** (Sessions A+B, `5f50899` + `3f64aa5`). + From `docs/security-fix-brief-2026-06-20.md`. All shell-injection / path-traversal sinks closed. -## Multi-session plan — FIXES COMPLETE -- **Session A — F-1 (CRITICAL) + F-5/F-6. DONE (5f50899, pushed).** `git()` → array-arg `spawnSync`. -- **Session B — F-2 + F-3 (both HIGH). DONE (commit 3f64aa5).** - - F-2 `scanners/auto-cleaner.mjs` (~:776): prefix-containment before write — a finding whose - `resolve(target, f.file)` escapes the tree is refused + reported skipped. Repro - `tests/scanners/auto-cleaner-traversal.test.mjs` (`../secret.txt`) RED→GREEN. - - F-3 `hooks/scripts/pre-install-supply-chain.mjs` `inspectNpmPackage`: `npm view` now - `spawnSync('npm',['view',spec,'--json'])` (no shell). Repro - `tests/hooks/supply-chain-injection.test.mjs` (`$(>/abs/PWNED)`) RED→GREEN. `execSafe` kept for - the static `npm audit --json` call (no interpolation). - - Suite 1863/0 (was 1860; +3). gitleaks clean. F-1 repro re-run GREEN (sink still closed). +## Still open (optional only) +- **F-4 — optional, LOW** (by-design MCP spawn; a confirm-gate is a judgment call). NOT required. + Decide deliberately if/when picked up — do not auto-escalate to it. +- Residual gap (documented inline in the F-2 fix): prefix containment in `auto-cleaner.mjs` does + NOT stop a symlink inside the tree pointing out. Known, accepted. -## COLD START (next session = Session C — RELEASE) -1. `pwd` + `git status`. Confirm 3f64aa5 + the STATE commit are present (and pushed — see notes). -2. Cut v7.8.0 (TRG/SIG/AST Step 8) now that the B− → A− security gates pass. Read - `docs/plans/trekplan-2026-06-20-TRG/SIG/AST-gap-analysis.md` Step 8 + `docs/version-history.md`. -3. Version-sync ALL refs before the bump commit (package.json, README badges, CHANGELOG, CLAUDE.md); - check consistency. Optionally add the F-4 confirm-gate. +## COLD START (next session) +1. `pwd` + `git status`. Confirm `e9476ea` (v7.8.0) is present AND pushed (weekend window — should + be on `origin/main`). +2. No active task queued. Options: (a) implement F-4 confirm-gate if the operator wants it; + (b) new direction from the operator. Do NOT invent scope — ask. ## Continuity notes -- Disclosure hold LIFTED: F-1 fix + `review-2026-06-20.md` + brief already on `origin/main`. Push - Session-B fixes normally. -- origin = Forgejo `open/llm-security` (never GitHub). Push window: weekdays 20:00–23:00; weekends/ - holidays anytime. Outside window at session end → commit locally, PARK the push, say so explicitly. +- origin = Forgejo `open/llm-security` (never GitHub). Push window: weekdays 20:00–23:00; + weekends/holidays anytime. Outside window at session end → commit locally, PARK the push, say so. +- Plan of record for TRG/SIG/AST: `docs/plans/trekplan-2026-06-20-TRG/SIG/AST-gap-analysis.md` + (Step 8 = this release, now complete).