open/llm-security
1
0
Fork 0
Code Issues Releases 1 Activity

feat(llm-security)!: v8 Phase 3 step 1 - remove the deprecated mode env-vars

Browse source 
BREAKING CHANGE: the four LLM_SECURITY_* configuration env-vars deprecated in
v7.3.0 are removed. .llm-security/policy.json is now the only source:

  LLM_SECURITY_INJECTION_MODE     -> injection.mode
  LLM_SECURITY_TRIFECTA_MODE      -> trifecta.mode
  LLM_SECURITY_ESCALATION_WINDOW  -> trifecta.escalation_window
  LLM_SECURITY_AUDIT_LOG          -> audit.log_path
  LLM_SECURITY_DEPRECATION_QUIET  -> dies with the mechanism it silenced

Setting a removed var is now inert - it does not warn, and it does not
configure. Env-vars with no policy equivalent (PRECOMPACT_MODE,
PRECOMPACT_MAX_BYTES, UPDATE_CHECK, MCP_CACHE_FILE, IDE_ROOTS) are unaffected.

getPolicyValueWithEnvWarn and its one-shot stderr warning are deleted from
policy-loader.mjs, along with the module-scoped warned-var Set. The four call
sites collapse to getPolicyValue. getPolicyValue's JSDoc claimed "environment
variables ALWAYS take precedence" - it never read env itself, so that line
described the shim, and it is corrected rather than deleted.

User-facing hook strings that advertised a removed var as the escape hatch now
name the policy key instead: the inject-scan block reason, its warn-mode note,
both escalation-window advisories, and the trifecta block message. A blocked
user following the old text would have set a var that does nothing.

Tests. tests/lib/v8-env-removal.test.mjs is the regression gate and was written
failing first (8 of 12 red before the change). It pins the NEGATIVE - setting a
removed var does not alter the outcome - because that is the half that rots
silently: a re-introduced process.env read would leave every migrated positive
test green, since those configure through policy.json and never set the var at
all. One assertion walks hooks/scripts and scanners for `process.env.<removed>`
so the re-introduction is caught structurally, not only behaviourally.

The 44 env-driven test occurrences (18 inject-scan, 13+4 session-guard, 9
audit-trail) migrate to a throwaway .llm-security/policy.json via a new
runHookWithPolicy helper in hook-helper.mjs; audit-trail runs in-process, so it
supplies the same policy through CLAUDE_PROJECT_ROOT. The D3 mechanism tests in
policy-loader.test.mjs are deleted with the mechanism.

Suite 2039 tests, 2037 pass (+12 gate, -7 D3 mechanism). The 2 failures are the
known parallel-load timing flakes (pre-compact-scan size-cap,
pre-install-supply-chain F-3); both green when run isolated.

Remaining in Phase 3: posture-scanner TRIFECTA_MODE heuristic, riskScoreV1
removal, ghost-var cleanup, docs + migration note.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BB4vXvwvtW4dxbPRd6vsez
This commit is contained in:
Kjell Tore Guttormsen 2026-08-09 10:17:47 +02:00
commit b6af9b46df
10 changed files with 430 additions and 299 deletions
Download patch file Download diff file Expand all files Collapse all files

107
tests/lib/policy-loader.test.mjs
View file

@ -5,7 +5,7 @@ import assert from 'node:assert/strict';
import { writeFileSync, mkdirSync, rmSync, existsSync } from 'node:fs';
import { join } from 'node:path';
import { tmpdir } from 'node:os';
import { loadPolicy, getPolicyValue, getPolicyValueWithEnvWarn, getDefaultPolicy, _resetCacheForTest } from '../../scanners/lib/policy-loader.mjs';
import { loadPolicy, getPolicyValue, getDefaultPolicy, _resetCacheForTest } from '../../scanners/lib/policy-loader.mjs';
const TEST_ROOT = join(tmpdir(), `llm-security-policy-test-${Date.now()}`);
const POLICY_DIR = join(TEST_ROOT, '.llm-security');
@ -138,108 +138,3 @@ describe('policy-loader', () => {
assert.equal(val, 'warn');
});
});
// ---------------------------------------------------------------------------
// D3: getPolicyValueWithEnvWarn — env-var deprecation warnings
// ---------------------------------------------------------------------------
describe('getPolicyValueWithEnvWarn (D3)', () => {
const ENV_VAR = 'LLM_SECURITY_TEST_DEPRECATED';
const QUIET_VAR = 'LLM_SECURITY_DEPRECATION_QUIET';
let originalWrite;
let stderrCapture;
beforeEach(() => {
_resetCacheForTest();
mkdirSync(POLICY_DIR, { recursive: true });
delete process.env[ENV_VAR];
delete process.env[QUIET_VAR];
stderrCapture = [];
originalWrite = process.stderr.write.bind(process.stderr);
process.stderr.write = (chunk, ...rest) => {
stderrCapture.push(typeof chunk === 'string' ? chunk : chunk.toString());
return true;
};
});
afterEach(() => {
process.stderr.write = originalWrite;
delete process.env[ENV_VAR];
delete process.env[QUIET_VAR];
_resetCacheForTest();
try { rmSync(TEST_ROOT, { recursive: true }); } catch {}
});
it('env wins over policy.json (existing behaviour unchanged)', () => {
writeFileSync(POLICY_FILE, JSON.stringify({
trifecta: { mode: 'block' },
}));
process.env[ENV_VAR] = 'off';
const val = getPolicyValueWithEnvWarn('trifecta', 'mode', ENV_VAR, 'warn', TEST_ROOT);
assert.equal(val, 'off');
});
it('returns policy value when env-var is unset', () => {
writeFileSync(POLICY_FILE, JSON.stringify({
trifecta: { mode: 'block' },
}));
const val = getPolicyValueWithEnvWarn('trifecta', 'mode', ENV_VAR, 'warn', TEST_ROOT);
assert.equal(val, 'block');
assert.equal(stderrCapture.join(''), ''); // no warning when only policy is set
});
it('returns default when neither env nor policy is set', () => {
rmSync(POLICY_FILE, { force: true });
const val = getPolicyValueWithEnvWarn('trifecta', 'mode', ENV_VAR, 'warn', TEST_ROOT);
assert.equal(val, 'warn');
assert.equal(stderrCapture.join(''), '');
});
it('emits one stderr deprecation warning when env+policy both set', () => {
writeFileSync(POLICY_FILE, JSON.stringify({
trifecta: { mode: 'block' },
}));
process.env[ENV_VAR] = 'off';
const val = getPolicyValueWithEnvWarn('trifecta', 'mode', ENV_VAR, 'warn', TEST_ROOT);
assert.equal(val, 'off');
const stderr = stderrCapture.join('');
assert.match(stderr, /\[llm-security\] Deprecation: env-var LLM_SECURITY_TEST_DEPRECATED/);
assert.match(stderr, /will be removed in v8\.0\.0/);
assert.match(stderr, /policy\.json key trifecta\.mode also set/);
assert.match(stderr, /Suppress with LLM_SECURITY_DEPRECATION_QUIET=1/);
});
it('warns only once per env-var within the same process', () => {
writeFileSync(POLICY_FILE, JSON.stringify({
trifecta: { mode: 'block' },
}));
process.env[ENV_VAR] = 'off';
getPolicyValueWithEnvWarn('trifecta', 'mode', ENV_VAR, 'warn', TEST_ROOT);
getPolicyValueWithEnvWarn('trifecta', 'mode', ENV_VAR, 'warn', TEST_ROOT);
getPolicyValueWithEnvWarn('trifecta', 'mode', ENV_VAR, 'warn', TEST_ROOT);
const stderr = stderrCapture.join('');
const matches = stderr.match(/\[llm-security\] Deprecation:/g) || [];
assert.equal(matches.length, 1);
});
it('LLM_SECURITY_DEPRECATION_QUIET=1 suppresses warning entirely', () => {
writeFileSync(POLICY_FILE, JSON.stringify({
trifecta: { mode: 'block' },
}));
process.env[ENV_VAR] = 'off';
process.env[QUIET_VAR] = '1';
const val = getPolicyValueWithEnvWarn('trifecta', 'mode', ENV_VAR, 'warn', TEST_ROOT);
assert.equal(val, 'off');
assert.equal(stderrCapture.join(''), '');
});
it('does not warn when policy value equals defaultValue (user did not override)', () => {
writeFileSync(POLICY_FILE, JSON.stringify({
trifecta: { mode: 'warn' }, // matches defaultValue
}));
process.env[ENV_VAR] = 'off';
const val = getPolicyValueWithEnvWarn('trifecta', 'mode', ENV_VAR, 'warn', TEST_ROOT);
assert.equal(val, 'off');
assert.equal(stderrCapture.join(''), '');
});
});