Kjell Tore Guttormsen
fdec4b36ad
Closes Phase 3 (B11) of the v8.0.0 plan. Three parts, all with the failing
test written first.
riskScoreV1 removed. scanners/lib/severity.mjs drops riskScoreV1() and its
SEVERITY_WEIGHTS_V1 table - @deprecated since v7.0.0, kept for diff/comparison,
zero callers in code or tests (re-verified, not taken from the plan). The v1
weights are recorded in CHANGELOG so an old score stays re-derivable. riskScore
(v2) is untouched; a test pins that one critical still lands in the 70-95 tier
and that 50 lows score below it, which is exactly the case v1 collapsed to 100.
Posture category 12 no longer keys off an identifier name. The check was
/TRIFECTA_MODE/i over the session-guard source, which measured what a constant
was CALLED rather than whether enforcement was configurable. With the env-var
gone, that regex would have dropped every correctly-migrated project from PASS
to PARTIAL - the gate punishing the migration it exists to encourage. It now
matches getPolicyValue('trifecta', 'mode', ...) and still accepts a pre-v8
vendored guard reading the old env-var, because a third-party project carries
its own hook copy and is equally configurable either way; the evidence line
says which of the two was found. The PARTIAL finding recommended setting an
env-var that v8 ignores; it now names the policy key. The grade-a fixture hook
moves to the policy-era form.
Two never-implemented env-vars deleted from the docs. LLM_SECURITY_SCR_OFFLINE
(ci-cd-guide) and LLM_SECURITY_OFFLINE (supply-chain-attack example) were
documented as OSV.dev / npm-audit kill-switches. No code has ever read either -
verified by grep across scanners, hooks and scripts, which finds them only in
markdown. A promised kill-switch that does nothing is worse than a documented
absence: it is trusted precisely when the run is meant to be air-gapped. The
docs now say there is none and that egress must be blocked at the network
layer. The LLM_SECURITY_AUDIT_* wildcard is narrowed to the one real key.
Docs. Migration section in README + CHANGELOG with the env-var -> policy-key
table, the detection commands (env + shell rc + .envrc + workflows), and the
explicit warning that a removed variable is now INERT rather than an error -
which is the failure mode that loses a project its configuration silently. The
hardening-guide env table splits into surviving vars and a removed-vars
migration table; its "promote to block" runbook named two variables that no
longer exist. Also swept: CLAUDE.md hook table, scanner-reference, ci-cd-guide,
both lethal-trifecta example docs, mitigation-matrix, injection-research.
Test counts in README/CLAUDE.md synced 2034 -> 2045.
Suite 2045 tests, 0 fail (2039 + 4 posture-trifecta + 2 riskScoreV1). The two
known parallel-load flakes did not recur this run.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BB4vXvwvtW4dxbPRd6vsez
42 lines
1.5 KiB
JavaScript
42 lines
1.5 KiB
JavaScript
#!/usr/bin/env node
|
|
// post-session-guard.mjs — Runtime trifecta detection (Rule of Two)
|
|
// v5.0: configurable enforcement mode (block|warn|off), long-horizon 100-call
|
|
// window, behavioral drift via Jensen-Shannon divergence
|
|
// v8.0.0: mode comes from the policy.json key trifecta.mode
|
|
import { readFileSync, appendFileSync } from 'node:fs';
|
|
import { getPolicyValue } from '../../scanners/lib/policy-loader.mjs';
|
|
|
|
const TRIFECTA_MODE = String(getPolicyValue('trifecta', 'mode', 'warn')).toLowerCase();
|
|
const SLIDING_WINDOW = 20;
|
|
const LONG_HORIZON_WINDOW = 100;
|
|
|
|
const input = JSON.parse(readFileSync('/dev/stdin', 'utf-8'));
|
|
const toolName = input.tool_name || '';
|
|
|
|
// Classify tool
|
|
function classifyTool(name) {
|
|
if (/Read|Glob|Grep/.test(name)) return 'read';
|
|
if (/Write|Edit/.test(name)) return 'write';
|
|
if (/Bash/.test(name)) return 'exec';
|
|
if (/WebFetch|WebSearch/.test(name)) return 'network';
|
|
return 'other';
|
|
}
|
|
|
|
// Jensen-Shannon divergence for behavioral drift detection
|
|
function jsDivergence(p, q) {
|
|
const m = p.map((pi, i) => (pi + q[i]) / 2);
|
|
let kl1 = 0, kl2 = 0;
|
|
for (let i = 0; i < p.length; i++) {
|
|
if (p[i] > 0 && m[i] > 0) kl1 += p[i] * Math.log2(p[i] / m[i]);
|
|
if (q[i] > 0 && m[i] > 0) kl2 += q[i] * Math.log2(q[i] / m[i]);
|
|
}
|
|
return (kl1 + kl2) / 2;
|
|
}
|
|
|
|
if (TRIFECTA_MODE === 'off') {
|
|
process.stdout.write(JSON.stringify({ decision: 'allow' }));
|
|
process.exit(0);
|
|
}
|
|
|
|
// Trifecta detection logic would go here (simplified for fixture)
|
|
process.stdout.write(JSON.stringify({ decision: 'allow' }));
|