From 7f9e57bb37867960f7059bb345764c3cb2f1dedd Mon Sep 17 00:00:00 2001 From: Kjell Tore Guttormsen Date: Mon, 18 May 2026 13:12:21 +0200 Subject: [PATCH] =?UTF-8?q?feat(llm-security):=20v7.7.0=20=E2=80=94=20HTML?= =?UTF-8?q?-rapport=20for=20alle=2018=20skill-kommandoer?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hver /security som produserer rapport printer nå en klikkbar file://-lenke til en self-contained HTML-versjon. Levert over fem sesjoner; sesjon 5 wirer de 14 resterende skill-filene + slipper v7.7.0 (versjonsbump + docs). Sesjon-historikk: - Sesjon 1 (de23a63) — playground katalog list-view + builder-pane med copy-knapp på alle 18 rapporter - Sesjon 2 (ea8da55) — playground prosjekt-surface opprydding (stub-screen + topbar-splitt) - Sesjon 3 (01a8947) — extract 18 inline parsers + 18 inline renderers fra playground til canonical ESM-modul scripts/lib/report-renderers.mjs (playground beholder bit-identisk inline-kopi siden ESM import ikke fungerer fra file://) - Sesjon 4 (c7748d5) — ny zero-dep CLI scripts/render-report.mjs (stdin/file/stdout-modus, kebab→camel commandId-routing, ~140 KB self-contained HTML med 6 inlined DS-stylesheets + lokal .report-table, absolutte file://-paths for Ghostty cmd-click). 4 skills wired: scan, audit, posture, deep-scan. - Sesjon 5 (denne) — 14 resterende skills wired: plugin-audit, mcp-audit, mcp-inspect, ide-scan, supply-check, dashboard, pre-deploy, diff, watch, registry, clean, harden, threat-model, red-team. Hver skill-fil har nå en HTML Report-step som instruerer Claude å skrive markdown verbatim, kjøre CLI, og appende klikkbar file://-lenke til respons. Release-arbeid: - Versjonsbump v7.6.1 → v7.7.0 i 6 plugin-filer + 2 rot-filer (package.json, .claude-plugin/plugin.json, README badge, CLAUDE.md header + state-seksjon, docs/version-history.md, plugin Recent versions- tabell, rot README plugin-entry, rot CLAUDE.md plugin-katalog) - CHANGELOG [7.7.0] med full historikk fra sesjon 1-5 - docs/version-history.md v7.7.0-seksjon Verifisert: - 18/18 commandIds i CLI gir > 138 KB self-contained HTML - 1819/1820 tester grønne (pre-compact-scan-perf-flake fyrte under last, passerer i isolasjon på 1582 ms — pre-eksisterende, defer til v7.7.x) - 18/18 skill-filer har HTML Report-step - Ingen kildefil-treff på 7.6.1 utenfor historiske changelog/version- history/README releases-tabell Ingen scanner- eller hook-atferdsendringer — purely additive surface. Co-Authored-By: Claude Opus 4.7 --- .claude-plugin/plugin.json | 2 +- CHANGELOG.md | 65 ++++++++++++++++++++++++++++++++++++++ CLAUDE.md | 8 +++-- README.md | 3 +- commands/clean.md | 20 ++++++++++++ commands/dashboard.md | 20 ++++++++++++ commands/diff.md | 20 ++++++++++++ commands/harden.md | 20 ++++++++++++ commands/ide-scan.md | 20 ++++++++++++ commands/mcp-audit.md | 20 ++++++++++++ commands/mcp-inspect.md | 20 ++++++++++++ commands/plugin-audit.md | 20 ++++++++++++ commands/pre-deploy.md | 20 ++++++++++++ commands/red-team.md | 20 ++++++++++++ commands/registry.md | 20 ++++++++++++ commands/supply-check.md | 20 ++++++++++++ commands/threat-model.md | 20 ++++++++++++ commands/watch.md | 20 ++++++++++++ docs/version-history.md | 16 ++++++++++ package.json | 2 +- 20 files changed, 370 insertions(+), 6 deletions(-) diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index 0dfb850..7018cb4 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -1,5 +1,5 @@ { "name": "llm-security", "description": "Security scanning, auditing, and threat modeling for Claude Code projects. Detects secrets, validates MCP servers, assesses security posture, and generates threat models aligned with OWASP LLM Top 10.", - "version": "7.6.1" + "version": "7.7.0" } diff --git a/CHANGELOG.md b/CHANGELOG.md index 4a4099c..a3dfb52 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,71 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] +## [7.7.0] - 2026-05-18 + +HTML-rapport for alle 18 skill-kommandoer som produserer rapport. +Hver `/security ` printer nå en klikkbar `file://`-lenke til en +self-contained HTML-versjon. Levert over fem sesjoner (UX-arbeid + +renderer-extract + CLI + skill-wiring + release). Ingen scanner- +eller hook-atferdsendringer — purely additive surface. + +### Added + +- **Playground katalog list-view + builder-pane** (sesjon 1, `0dc7ff4`). + Katalog-overflaten fikk list-view (grid-toggle) + builder-pane med + copy-knapp på alle 18 rapporter, så onboarding-flytene blir bredere + og dypere uten å forlate playground-modusen. +- **Playground prosjekt-surface opprydding** (sesjon 2, `86d6ecd`). + Stub-screen-håndtering (rapport ikke ferdig parsed → tydelig + placeholder i stedet for tom panel), topbar-splitt (navigasjons- + trinn vs. eksport-handlinger), generell DS-justering for prosjekt- + overflate. +- **`scripts/lib/report-renderers.mjs`** (sesjon 3, `fa5fb48`). + De 18 inline parserne + 18 inline rendererne i playground-HTML-fila + flyttet til canonical ESM-modul. Ren overflate: `import { PARSERS, + RENDERERS } from './lib/report-renderers.mjs'`. Playground beholder + bit-identisk inline-kopi (ESM `import` fungerer ikke fra `file://` + uten Chrome/Firefox-flags). Canonical kilde + playground inline = to + overflater, samme atferd. +- **`scripts/render-report.mjs` CLI** (sesjon 4, `db80854`). + Zero-dep Node-CLI som tar `commandId` + `--in`/`--out`-flags og + konverterer markdown-rapporter til self-contained HTML. + Stdin/file/stdout-modus, kebab→camel commandId-routing (alle 18 + PARSERS fungerer automatisk uten hardkoding). Output inliner 6 + DS-stylesheets (`tokens`, `base`, `components`, `tier2`, `tier3`, + `tier3-supplement`) + lokal `.report-table`-CSS. ~140 KB + self-contained HTML; fonter ikke inlined (ville blåst opp 7x til + ~1 MB), `tokens.css` har `-apple-system, BlinkMacSystemFont, + system-ui` som fallback. Absolutte `file://`-paths i stdout for + Ghostty cmd-click. Default output `reports/-.html` relativt til CWD. +- **HTML-rapport for alle 18 skill-kommandoer** (sesjon 4-5). + Sesjon 4 wired 4 skills (`scan`, `audit`, `posture`, `deep-scan`). + Sesjon 5 wired de 14 resterende (`plugin-audit`, `mcp-audit`, + `mcp-inspect`, `ide-scan`, `supply-check`, `dashboard`, `pre-deploy`, + `diff`, `watch`, `registry`, `clean`, `harden`, `threat-model`, + `red-team`). Hver skill-fil har en avsluttende "HTML Report"-step + som instruerer Claude å (1) compute temp md-path, (2) Write hele + markdown-rapporten verbatim, (3) kjøre CLI, (4) appende + `> **HTML-rapport:** [Åpne i nettleser](file:///abs/sti.html)` + til respons. + +### Changed + +- Playground beholder inline-kopi av parserne og rendererne for å + forbli single-file `file://`-distribuerbar — ESM `import` fungerer + ikke fra `file://`-URLs uten Chrome/Firefox-flags. Canonical kilden + i `scripts/lib/report-renderers.mjs` og playground inline-kopien er + bit-identisk per release. + +### Notes + +- Pre-existing `pre-compact-scan`-perf-flake (1000 ms terskel under + last) gjenstår — defer til v7.7.x patch. +- Sync-test mellom `scripts/lib/report-renderers.mjs` og playground + inline-kopi planlagt som v7.7.x patch (krever scope-utvidelse til + `tests/`). + ## [7.6.1] - 2026-05-06 Playground v7.6.0 visuell-patch. Seks bugs fanget under maintainer- diff --git a/CLAUDE.md b/CLAUDE.md index 696909a..45393b3 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1,8 +1,10 @@ -# LLM Security Plugin (v7.6.1) +# LLM Security Plugin (v7.7.0) -Security scanning, auditing, and threat modeling for Claude Code projects. 5 frameworks: OWASP LLM Top 10, Agentic AI Top 10 (ASI), Skills Top 10 (AST), MCP Top 10, AI Agent Traps (DeepMind). 1822+ unit, integration, and end-to-end tests (`tests/e2e/` covers the multi-hook attack chain, multi-session state simulation, and the full scan-orchestrator pipeline); mutation-testing coverage not published. +Security scanning, auditing, and threat modeling for Claude Code projects. 5 frameworks: OWASP LLM Top 10, Agentic AI Top 10 (ASI), Skills Top 10 (AST), MCP Top 10, AI Agent Traps (DeepMind). 1820+ unit, integration, and end-to-end tests (`tests/e2e/` covers the multi-hook attack chain, multi-session state simulation, and the full scan-orchestrator pipeline); mutation-testing coverage not published. -Release notes for v7.0.0 → v7.6.1: see `docs/version-history.md` — read on demand. +Release notes for v7.0.0 → v7.7.0: see `docs/version-history.md` — read on demand. + +**v7.7.0 highlights** — All 18 report-producing skill commands now emit a clickable `file://` link to a self-contained HTML version of their markdown report. The new `scripts/render-report.mjs` CLI converts any of the 18 report types via a canonical `scripts/lib/report-renderers.mjs` (18 parsers + 18 renderers, bit-identical to the playground). HTML wraps the Tier 1/2/3 design system inline; no external assets, system fonts only (~140 KB per report). Playground also got list-view, copy-button, and prosjekt-surface cleanup. ## Commands diff --git a/README.md b/README.md index ac8597b..bfbe9d8 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ *AI-generated: all code produced by Claude Code through dialog-driven development. [Full disclosure →](../../README.md#ai-generated-code-disclosure)* -![Version](https://img.shields.io/badge/version-7.6.1-blue) +![Version](https://img.shields.io/badge/version-7.7.0-blue) ![Platform](https://img.shields.io/badge/platform-Claude_Code_Plugin-purple) ![Commands](https://img.shields.io/badge/commands-20-orange) ![Agents](https://img.shields.io/badge/agents-6-orange) @@ -626,6 +626,7 @@ demonstrations — each with `README.md`, fixture, run script, and | Version | Date | Highlights | |---------|------|------------| +| **7.7.0** | 2026-05-18 | **HTML-rapport for alle 18 skill-kommandoer.** Hver `/security ` som produserer rapport printer nå en klikkbar `file://`-lenke til en self-contained HTML-versjon. Levert over 5 sesjoner. (1) Playground katalog list-view + builder-pane med copy-knapp. (2) Playground prosjekt-surface opprydding (stub-screen-håndtering, topbar-splitt). (3) De 18 inline parserne + rendererne i playground-HTML flyttet til canonical ESM-modul `scripts/lib/report-renderers.mjs` (playground beholder bit-identisk inline-kopi siden ESM `import` ikke fungerer fra `file://`). (4) Ny zero-dep CLI `scripts/render-report.mjs` — stdin/file/stdout-modus, kebab→camel commandId-routing, inliner 6 DS-stylesheets + lokal `.report-table`-CSS, ~140 KB self-contained HTML, system-font-fallback, absolutte `file://`-paths for Ghostty cmd-click. (5) Alle 18 skills wired (4 i sesjon 4: scan/audit/posture/deep-scan, 14 i sesjon 5: plugin-audit/mcp-audit/mcp-inspect/ide-scan/supply-check/dashboard/pre-deploy/diff/watch/registry/clean/harden/threat-model/red-team). Output: `reports/-.html` relativt til CWD. Ingen scanner- eller hook-atferdsendringer — purely additive. | | **7.6.1** | 2026-05-06 | **Playground v7.6.0 visuell-patch.** Seks bugs fanget under maintainer-verifisering i nettleser. Alle skyldtes mismatch mellom DS-klasser og rendrer-bruk (eller manglende DS-implementasjoner playground antok eksisterte). (1) `renderFindingsBlock` brukte `.findings` outer som er DS' 2-kolonners list+detail-grid → erstattet med `
` + korrekt `findings__list > findings__group`-mønster. (2) `.report-table` manglet helt i DS men brukes i 7+ rendrere → lokal CSS-implementasjon i playground-HTML. (3) `renderPreDeploy` traffic-lights brukte `.sm-card__grade` (28×28 px for én A-F-bokstav) for "PASS"/"PASS-WITH-NOTES"/"FAIL" → erstattet med bredde-tilpasset status-pill. (4) Threat-model matrix-bobler ikke klikkbare → `