chore(release): v8.1.1 — own-tree rule narrowed, v8.1.0 follow-ups

Version sync: package.json, .claude-plugin/plugin.json, README (badge +
Recent versions), CLAUDE.md (header + highlights), CHANGELOG [8.1.1]
(incl. Known open from the pre-tag review: a target with no .git of its
own under cwd — node_modules, plugin-cache copy, tarball — still counts
as own; not a regression, the v8.1.0 rule honoured it too).
Remaining `8.1.0` strings are history rows and dated code comments.

Gates on the staged tree: suite 2306 / 2300 pass / 0 fail / 6 skip,
golden 109/7/4 61/61 unchanged, av-surface 6/6, plugin validate pass.
Windows/Defender quarantine: not measured (operator, 22.09).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "llm-security",
   "description": "Security scanning, auditing, and threat modeling for Claude Code projects. Detects secrets, validates MCP servers, assesses security posture, and generates threat models aligned with OWASP LLM Top 10.",
-  "version": "8.1.0"
+  "version": "8.1.1"
 }

CHANGELOG.md

@@ -6,6 +6,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [8.1.1] - 2026-09-22
+
+Patch that closes the v8.1.0 follow-up list. Detection tables, golden baseline
+and hooks are unchanged. Windows/Defender quarantine is still not measured:
+there is no Windows machine to measure it on, and the release says so rather
+than guessing. 2306 tests, 2300 pass, 6 skipped, 0 fail.
+
 ### Fixed
 
 - **A clone under the working directory is no longer "own working tree".**
@@ -22,7 +29,42 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   the parent repository no longer applies that checkout's ignore file or
   policy; it now gets the defaults and one stderr line per ignored file.
   Scanning the repository itself or any plain folder inside it is unchanged,
-  and so are hooks, which read the policy from the project root.
+  and so are hooks, which read the policy from the project root. A git
+  worktree of your own repository, checked out inside it, now counts as
+  foreign when scanned from the main checkout; scan it from inside the
+  worktree to apply its configuration.
+
+### Changed
+
+- **The README and `.llm-security-ignore` no longer state the self-scan's
+  suppressed count or its count without the ignore file.** Both changed by
+  one with every commit, because `git-forensics` looks at the last 50 commits
+  — correct behaviour, but it made the figures false one commit after they
+  were written. The verdict, score and finding count with the ignore file,
+  measured on a fresh clone of the release commit, stay.
+
+- **`/security scan` description** names what it accepts: remote git
+  repositories on any host, SSH only for GitHub. It said "GitHub repos".
+
+### Tests
+
+- **`ci.failOn` and `ci.compact` in `policy.json` have a real test.** The old
+  one wrote a policy into a directory it never scanned and passed
+  `--fail-on` on the command line, so it passed without reading the policy.
+
+### Known open
+
+- **A target with no `.git` of its own still counts as the caller's own tree
+  when it sits under the working directory in the same git root (or where
+  neither has one).** That covers what package managers and plugin installs
+  produce: a `node_modules/` package, an installed copy in the Claude Code
+  plugin cache, a tarball or `git archive` export. Such a target's
+  `.llm-security-ignore` and `policy.json` are still read, as in v8.1.0. Git
+  clones, submodules, worktrees and temp-directory clones are covered. Without
+  git there is no general way to tell a fetched folder from your own; a
+  narrower rule for known install locations is being considered.
+- The posture scanner credits a `policy.json` that exists even when the scan
+  would not honour it.
 
 ## [8.1.0] - 2026-09-22
 

CLAUDE.md

@@ -1,9 +1,11 @@
-# LLM Security Plugin (v8.1.0)
+# LLM Security Plugin (v8.1.1)
 
 Security scanning, auditing, and threat modeling for Claude Code projects. 5 frameworks: OWASP LLM Top 10, Agentic AI Top 10 (ASI, 2026 edition), Skills Top 10 (AST), MCP Top 10, AI Agent Traps (DeepMind). 2250+ unit, integration, and end-to-end tests (`tests/e2e/` covers the multi-hook attack chain, multi-session state simulation, and the full scan-orchestrator pipeline); mutation-testing coverage not published.
 
 Release notes for v7.0.0 → v7.8.2: see `docs/version-history.md` — read on demand.
 
+**v8.1.1 highlights** — Patch closing the v8.1.0 follow-up list; detection tables, golden baseline and hooks untouched. "Own working tree" (`scanners/lib/own-working-tree.mjs`) now also requires the target to share cwd's git root (nearest `.git`, dir or file; none for both), so a clone, submodule or worktree *under* cwd is foreign and its `.llm-security-ignore` / `policy.json` / custom SIG rules are ignored — closes v8.1.0's known-open item (`tests/lib/own-working-tree.test.mjs`, `tests/scanners/nested-clone-scope.test.mjs`). `ci.failOn` / `ci.compact` from `policy.json` got a real test (the old one never read the policy). README and `.llm-security-ignore` no longer state self-scan counts that drift per commit (git-forensics' 50-commit window). `/security scan` description names the accepted URLs. Known open: a target with no `.git` of its own (`node_modules/`, plugin-cache copy, tarball export) under cwd still counts as own. Windows/Defender quarantine remains **not measured** (no Windows machine). 2306 tests.
+
 **v8.1.0 highlights** — Antivirus surface: a Windows user can clone and install without Defender quarantining a file, and detection is unchanged. No payload sits on disk as a file that would run it — test fixtures (signature, memory-poisoning, trigger, `ast-scan/*.py`) are built in a temp dir at test time from split strings/rot13, the malicious-skill demo and `poisoned-claude-md` ship as encoded archives (`materialize.mjs`), zero-width test lines use `String.fromCodePoint`; sha256 of every removed file asserted. Gate: `tests/av-surface.test.mjs`, probes (a)/(a2) SIG payloads, (b) base64→shell command, (c) Tag/zero-width outside the conformance corpus, (d) malicious trees on disk, (e) runnable literals in session-loaded files. Skill-scanner detection lists moved from `agents/skill-scanner-agent.md` to `knowledge/skill-threat-patterns.md` § Detection Rules (a quarantined agent file breaks the plugin). README § Antivirus false positives (restore, report, sparse checkout; no exclusions recommended). Scope fixes: `.llm-security-ignore` and `.llm-security/policy.json` (incl. `sig.custom_rules_path`, `ast.python_path`, `ci.failOn`) are honoured only for the caller's own working tree (`scanners/lib/own-working-tree.mjs`: target = cwd or below, never under tmpdir) — a foreign target's file is ignored with one stderr line. `git-clone.mjs` accepts HTTPS on any host. Signature tables and golden baseline untouched. Known open: a foreign clone *under* cwd still counts as own tree. 2286 tests.
 
 **v8.0.0 highlights** — Breaking cleanup + commons foundation. BREAKING: the four `LLM_SECURITY_*` env-vars deprecated in v7.3.0 (`INJECTION_MODE`, `TRIFECTA_MODE`, `ESCALATION_WINDOW`, `AUDIT_LOG`, plus `DEPRECATION_QUIET`) are removed — `.llm-security/policy.json` is the only source and a removed variable is **inert** (no warning, silently back to default); `riskScoreV1()` + `SEVERITY_WEIGHTS_V1` deleted (`riskScore()` v2 untouched). Structural, behaviour-preserving: five detection tables are now built from the pull-only vendored subtree `scanners/commons/` (`llm-security-commons`) instead of source literals — codepoint carriers (`scanners/lib/codepoints.mjs`), `OWASP_MAP` (`owasp-map.mjs`), the 83 injection patterns (`injection-lexicon.mjs`), the 19 fixed secret shapes (`secret-egress.mjs`), the 7 SIG rules (`malware-signatures.mjs`; `knowledge/signatures.json` removed). Each swap was measured position-by-position first and diffed record-for-record against the golden baseline (`scripts/golden-baseline.mjs`, `tests/golden/`). The commons root is resolved from the plugin directory only, **never** from a scanned target's policy (a substitutive override would let a hostile repo empty the detection corpus). **Loud failure is contract:** an unresolvable injection lexicon or SIG ruleset writes one stderr line and never throws — an empty table would be the v7.8.2 defect class (clean report, nothing run). Commons conformance spec 1.1 implemented (`tests/lib/conformance-corpus.test.mjs`; not-applicable verdict, derived declaration, anti-narrowing floor). Fixes: `<script>` recall hole + two quadratic `hybrid-xss` rows (whole-table ReDoS gate with inputs derived from each pattern's own prefix), Yarn Berry + nested lockfile-v1 misses in `supply-chain-recheck.mjs`, per-occurrence strip attribution in `content-extractor.mjs`, bare legacy OpenAI keys in `pre-edit-secrets.mjs`, `compileRules()` non-string coercion, SIG self-flag on vendored commons, SARIF multi-OWASP tags. Known open: bounded HTML patterns evade on >256 chars of attribute padding. 2253 tests.

README.md

@@ -6,7 +6,7 @@ Security scanning, auditing, and threat modeling for Claude Code projects. OWASP
 
 *AI-generated: all code produced by Claude Code through dialog-driven development. Every change is human-directed, reviewed, and validated before commit. Per Anthropic Consumer Terms §4, ownership of outputs is assigned to the user; this plugin is licensed MIT.*
 
-![Version](https://img.shields.io/badge/version-8.1.0-blue)
+![Version](https://img.shields.io/badge/version-8.1.1-blue)
 ![Platform](https://img.shields.io/badge/platform-Claude_Code_Plugin-purple)
 ![Scanners](https://img.shields.io/badge/scanners-22-cyan)
 ![License](https://img.shields.io/badge/license-MIT-lightgrey)
@@ -779,6 +779,7 @@ line if you run those. A sparse checkout of your own clone does not change what
 
 | Version | Date | Highlights |
 |---------|------|------------|
+| **8.1.1** | 2026-09-22 | **Own-tree rule narrowed, v8.1.0 follow-ups.** A clone, submodule or worktree that sits *under* the working directory no longer counts as the caller's own tree, so its `.llm-security-ignore` and `.llm-security/policy.json` (incl. custom SIG rules) are ignored — the target must share the working directory's git root. `ci.failOn` / `ci.compact` in `policy.json` now have a real test. The README no longer states self-scan counts that change with every commit. Windows/Defender quarantine is still not measured. Detection tables and hooks unchanged. 2306 tests, 0 fail. |
 | **8.1.0** | 2026-09-22 | **Antivirus surface.** Clone and install on Windows without Defender quarantining a file, with detection unchanged. No payload sits on disk as a file that would run it: test fixtures are built in a temp directory at test time, the malicious-skill demo ships encoded and is materialized on demand, and `tests/av-surface.test.mjs` fails the suite if a payload comes back. Skill-scanner detection lists moved from the agent file to `knowledge/`. New section [Antivirus false positives](#antivirus-false-positives). Scope fixes: a scanned repository's own `.llm-security-ignore` and `.llm-security/policy.json` are honoured only when it is your own working tree, so a foreign clone cannot suppress its findings or raise its thresholds. Remote scans accept HTTPS URLs on any host. Signature tables and golden baseline untouched. 2286 tests. |
 | **8.0.0** | 2026-09-18 | **Breaking cleanup + detection tables on vendored commons data.** BREAKING: the four `LLM_SECURITY_*` mode env-vars deprecated in v7.3.0 are removed (`.llm-security/policy.json` is the only source; a removed variable is inert) and `riskScoreV1()` is deleted — see [Migrating to v8.0.0](#migrating-to-v800). The injection lexicon (83 patterns), codepoint carriers, `OWASP_MAP`, the 19 fixed secret shapes and the 7 SIG signatures are now built from the pull-only `scanners/commons/` subtree, each swap proven content-identical against a golden baseline; an unresolvable lexicon fails loudly on stderr instead of scanning with zero patterns. Fixes: `<script>` recall hole, two quadratic `hybrid-xss` patterns (whole-table ReDoS gate added), Yarn Berry + nested lockfile-v1 misses in `supply-check`, a second-occurrence strip miss in `content-extractor.mjs`, bare legacy OpenAI keys, a malformed-SIG-rule false-positive matcher, SARIF multi-OWASP tags. Commons conformance spec 1.1 implemented. 2253 tests. |
 | **7.8.3** | 2026-07-18 | **Completion-review MEDIUM sweep — 47 verified fixes, no CRITICAL/HIGH.** 52 findings triaged (48 confirmed; 3 feature-requests + 1 non-defect scoped out; the #11 persistence detector and #27 AST-taint f-string recall deferred to v8). Supply-chain gate bypasses (npm bare-install blocklist skip, nested-key name derivation, yarn.lock false-BLOCK + Yarn Berry miss, `pip audit` no-op). Hook coverage (pathguard now `Edit|Write`; trifecta window no longer diluted by markers; pipe-to-shell interposition; bare provider-key patterns). Scanner robustness (HTML-pattern ReDoS 28s to 4ms; MCP-stdout memory exhaustion; VSIX redirect loop; scalar-policy TypeError; atomic cache writes). False positives/negatives (toxic-flow substring trifectas, TRG scoped-phrase FPs, leading-BOM HIGH, bare-`if:` Dependabot-spoof FN, reflog `reset` FP, diff duplicate-fingerprint mislabel, hex double-report). Parser divergence (YAML block-scalar key leak + indicators, ANSI-C octal/unicode, embedded-base64 to SIG, `.env.local` discovery). Docs consistency (scanner count 14, posture 16, red-team 72, SARIF version, dangling `ROADMAP.md`). Plus a live-protocol fix: `post-mcp-verify` now reads the PostToolUse `tool_response` field, so MCP-output injection scanning fires in live sessions. 2013 tests, 0 fail. |

package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-security",
-  "version": "8.1.0",
+  "version": "8.1.1",
   "description": "Security scanning, auditing, and threat modeling for Claude Code projects",
   "type": "module",
   "bin": {