llm-security/STATE.md

STATE — llm-security

👉 NESTE — START HER: v7.8.3 is CODE-COMPLETE LOCALLY but NOT released. 10 commits on main (tip 4cffa30), suite 2016/0, gitleaks clean, NOT pushed/tagged/catalog-synced. Two things gate "done", both need an operator decision:

1. PUSH the release (public mirror open/llm-security). Saturday → window open, but the commits carry exploit descriptions; held for explicit go. Release mechanics (in order, per convention): git push origin → release-plugin.mjs llm-security --version 7.8.3 --create-tag → release-plugin.mjs llm-security --version 7.8.3 --write --commit --push → check-versions.mjs = 0 ERROR. (release-plugin REFUSES until plugin.json == README badge == 7.8.3 AND the tag exists — both true now / by step 2.)
2. post-mcp-verify.mjs uncommitted change (in working tree, NOT in any commit): reads tool_response ?? tool_output instead of only tool_output — a REAL latent bug (live PostToolUse sends tool_response, so MCP-output injection scanning silently never fired live). +3 tests, green. BUT it is unattributed (appeared pre-staged mid-session, not one of the 52 findings) and OUT of the approved v7.8.3 scope. Decide: ship as a 48th fix (own commit), hold for a follow-up, or it's your edit.

What v7.8.3 is (the MEDIUM sweep)

52 open completion-review findings triaged (5 Opus verifiers) → 48 confirmed, 3 feature-requests, 1 non-defect. Corrected severity: 0 CRITICAL/HIGH, 21 MEDIUM, 27 LOW (every review-claimed HIGH fell to MEDIUM). Shipped: 47 fixes (48 minus #27, deferred). Full triage: docs/medium-triage.local.md (gitignored). Deferred to v8: #11 persistence detector (kept only its doc fix), #27 AST f-string recall, #34/#35/#37 missing AST09/AST10/MCP05 detectors (feature-requests), #49 non-defect.

The 10 commits (all HELD until tag)

b224e18 yaml/workflow (#32,33,43) · 21c6c2b normalization+SIG (#21,23,30,36,42,52,55) · 8a59d61 hooks (#9,10,12,13,#11-doc) · 66e8ce2 misc (#20,22,50,54,56) · 76f190c AST (#28,29) · 196517f supply-chain (#14-19,48) · f3aaf54 trigger/toxic/policy (#26,38,39,40,41,57) · 207385f robustness/DoS (#24,25,31,51,53) · 1407016 tests (#58,59) · 4cffa30 docs+v7.8.3 bump (#8,44,45,46,47). NOTE: git log order differs (parallel waves); hashes above are the authoritative finding→commit map.

Ground truth (verified 2026-07-18)

• npm test = 2016/0 (2013 release + 3 post-mcp-verify). Release tip 4cffa30 = 2013/0.
• plugin.json == package.json == README badge == 7.8.3; test badge 2013; doc-consistency 30/30.
• #30 was scoped: decodeEmbedded is OPT-IN on normalizeForScan (default off — appending a decoded copy double-counted content-extractor's per-match findings; caught by skill-scanner-narrative). Only signature-scanner opts in. Do NOT re-broaden it into the shared normalizer.
• Scanner VERSION constants are frozen at 7.5.0 (not bumped since; left as-is — out of scope).

Guardrails that bit this session (keep)

• NEVER git add -A; stage explicit paths. A pre-staged external change (post-mcp-verify) still rode into commit J via a plain git commit — had to reset --soft + restore --staged to amend it out. Check git status for surprise staged/modified files BEFORE every commit.
• A commit MESSAGE containing the pipe-to-shell literal is blocked by the voyage pre-bash hook — reword release notes.
• Test-pollution trap: jetbrains-parser.test.mjs asserts no llmsec-jb-* mkdtemp survives — use another prefix.

Continuity

origin = Forgejo open/llm-security (PUBLIC, never GitHub). STATE.md is intentionally TRACKED (.gitignore:19-20 NOTE). Disclosure: fix committed, HELD until its release tag exists. Push window: weekdays 20:00–23:00; weekends/holidays anytime. DO NOT PUSH the 3 untracked docs/*.md (parked v8 strategy). Position (v8): llm-security consolidates; growth at family level (security-commons + llm-retrieval-guard).