open/llm-security
1
0
Fork 0
Code Issues Releases 6 Activity

docs: knowledge-file count from source, no offline claim for the CLI

Browse source 
PLAN § v8.1.3 tillegg b and c.
- b: scanner-reference.md said Knowledge Files (20); knowledge/ holds
  22. Added typosquat-allowlist.json and workflow-injection-patterns.md;
  the test pins header and table to the directory.
- c: ci-cd-guide.md claimed zero network calls, OSV opt-in and "no
  cross-border data transfer". Measured in the code: dep runs npm audit
  (package.json) and pip-audit (requirements.txt, if installed), network
  resolves found domains over DNS, supply-chain queries OSV.dev, none
  with a switch. The guide now says so. scanner-reference.md carried the
  same claim plus a `--online` flag that does not exist (0 hits in
  scanners/); fixed in the same commit because the same gate covers it
  (chosen over leaving a known-false line in a file already edited here).
  That extra check was red on fd7de23's text, verified.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-09-23 11:37:58 +02:00
commit b4d9f83521
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
3 changed files with 33 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

23
tests/lib/doc-consistency.test.mjs
View file

@ -430,15 +430,26 @@ describe('doc-consistency — inventory counts are derived from source (B10)', (
// network calls and that OSV is opt-in. The orchestrated scanners run
// `npm audit` and `pip-audit` (dep), resolve domains over DNS (network) and
// query OSV.dev (supply-chain), with no switch to turn any of them off —
// README says so since the v8.1.2 README rewrite.
// README says so since the v8.1.2 README rewrite. docs/scanner-reference.md
// carried the same claim (plus a `--online` flag that does not exist).
describe('doc-consistency — ci-cd-guide tells the truth about network calls (v8.1.3)', () => {
const content = readFileSync(join(PLUGIN_ROOT, 'docs', 'ci-cd-guide.md'), 'utf-8');
const OFFLINE_CLAIMS = [
/zero network calls/i,
/no external API calls/i,
/OSV\.dev[^\n]{0,20}\(opt-in\)/i,
/no cross-border data transfer/i,
/offline mode/i,
];
it('makes no offline claim', () => {
for (const claim of [/zero network calls/i, /no external API calls/i, /OSV\.dev queries \(opt-in\)/i, /no cross-border data transfer/i]) {
assert.equal(claim.test(content), false, `ci-cd-guide.md still claims ${claim}`);
}
});
for (const rel of ['docs/ci-cd-guide.md', 'docs/scanner-reference.md']) {
it(`${rel} makes no offline claim`, () => {
const text = readFileSync(join(PLUGIN_ROOT, rel), 'utf-8');
for (const claim of OFFLINE_CLAIMS) {
assert.equal(claim.test(text), false, `${rel} still claims ${claim}`);
}
});
}
it('names every network path the CLI takes', () => {
for (const path of [/npm audit/, /pip-audit/, /DNS/, /OSV\.dev/]) {