Kjell Tore Guttormsen
d2648931ef
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TcQyMTQfyrsAapaCMPxTtQ
50 lines
4 KiB
Markdown
50 lines
4 KiB
Markdown
# STATE — llm-security
|
||
|
||
**👉 NESTE — START HER: v7.8.3 is CODE-COMPLETE LOCALLY but NOT released.**
|
||
10 commits on `main` (tip `4cffa30`), suite **2016/0**, gitleaks clean, NOT pushed/tagged/catalog-synced.
|
||
Two things gate "done", both need an operator decision:
|
||
1. **PUSH the release** (public mirror `open/llm-security`). Saturday → window open, but the commits
|
||
carry exploit descriptions; held for explicit go. Release mechanics (in order, per convention):
|
||
`git push origin` → `release-plugin.mjs llm-security --version 7.8.3 --create-tag`
|
||
→ `release-plugin.mjs llm-security --version 7.8.3 --write --commit --push` → `check-versions.mjs` = 0 ERROR.
|
||
(release-plugin REFUSES until plugin.json == README badge == 7.8.3 AND the tag exists — both true now / by step 2.)
|
||
2. **`post-mcp-verify.mjs` uncommitted change** (in working tree, NOT in any commit): reads
|
||
`tool_response ?? tool_output` instead of only `tool_output` — a REAL latent bug (live PostToolUse
|
||
sends `tool_response`, so MCP-output injection scanning silently never fired live). +3 tests, green.
|
||
BUT it is **unattributed** (appeared pre-staged mid-session, not one of the 52 findings) and OUT of the
|
||
approved v7.8.3 scope. Decide: ship as a 48th fix (own commit), hold for a follow-up, or it's your edit.
|
||
|
||
## What v7.8.3 is (the MEDIUM sweep)
|
||
52 open completion-review findings triaged (5 Opus verifiers) → **48 confirmed, 3 feature-requests, 1 non-defect**.
|
||
Corrected severity: **0 CRITICAL/HIGH, 21 MEDIUM, 27 LOW** (every review-claimed HIGH fell to MEDIUM).
|
||
Shipped: **47 fixes** (48 minus #27, deferred). Full triage: `docs/medium-triage.local.md` (gitignored).
|
||
Deferred to v8: **#11** persistence detector (kept only its doc fix), **#27** AST f-string recall,
|
||
**#34/#35/#37** missing AST09/AST10/MCP05 detectors (feature-requests), **#49** non-defect.
|
||
|
||
## The 10 commits (all HELD until tag)
|
||
`b224e18` yaml/workflow (#32,33,43) · `21c6c2b` normalization+SIG (#21,23,30,36,42,52,55) ·
|
||
`8a59d61` hooks (#9,10,12,13,#11-doc) · `66e8ce2` misc (#20,22,50,54,56) · `76f190c` AST (#28,29) ·
|
||
`196517f` supply-chain (#14-19,48) · `f3aaf54` trigger/toxic/policy (#26,38,39,40,41,57) ·
|
||
`207385f` robustness/DoS (#24,25,31,51,53) · `1407016` tests (#58,59) · `4cffa30` docs+v7.8.3 bump (#8,44,45,46,47).
|
||
NOTE: `git log` order differs (parallel waves); hashes above are the authoritative finding→commit map.
|
||
|
||
## Ground truth (verified 2026-07-18)
|
||
- `npm test` = **2016/0** (2013 release + 3 post-mcp-verify). Release tip `4cffa30` = 2013/0.
|
||
- plugin.json == package.json == README badge == **7.8.3**; test badge 2013; doc-consistency 30/30.
|
||
- #30 was scoped: `decodeEmbedded` is OPT-IN on `normalizeForScan` (default off — appending a decoded
|
||
copy double-counted content-extractor's per-match findings; caught by skill-scanner-narrative). Only
|
||
signature-scanner opts in. Do NOT re-broaden it into the shared normalizer.
|
||
- Scanner `VERSION` constants are frozen at 7.5.0 (not bumped since; left as-is — out of scope).
|
||
|
||
## Guardrails that bit this session (keep)
|
||
- **NEVER `git add -A`; stage explicit paths.** A pre-staged external change (post-mcp-verify) still
|
||
rode into commit J via a plain `git commit` — had to `reset --soft` + `restore --staged` to amend it out.
|
||
Check `git status` for surprise staged/modified files BEFORE every commit.
|
||
- A commit MESSAGE containing the pipe-to-shell literal is blocked by the voyage pre-bash hook — reword release notes.
|
||
- Test-pollution trap: `jetbrains-parser.test.mjs` asserts no `llmsec-jb-*` mkdtemp survives — use another prefix.
|
||
|
||
## Continuity
|
||
origin = Forgejo `open/llm-security` (PUBLIC, never GitHub). STATE.md is intentionally TRACKED
|
||
(`.gitignore:19-20` NOTE). Disclosure: fix committed, HELD until its release tag exists. Push window:
|
||
weekdays 20:00–23:00; weekends/holidays anytime. **DO NOT PUSH** the 3 untracked `docs/*.md` (parked v8 strategy).
|
||
Position (v8): llm-security consolidates; growth at family level (security-commons + `llm-retrieval-guard`).
|