@clear-capabilities/agentic-security-scanner 0.119.2 → 0.120.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +24 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,29 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.120.0 — model-cost optimizer (per-prompt model + depth advisor)
|
|
4
|
+
|
|
5
|
+
New opt-in Claude Code plugin feature; no functional change to the scanner.
|
|
6
|
+
|
|
7
|
+
- `hooks/model-cost-advisor.js` (UserPromptSubmit): scores each prompt with a
|
|
8
|
+
zero-token local heuristic (length, code fences, file mentions, stack traces,
|
|
9
|
+
cheap vs. expensive verbs) and, when a strictly cheaper model + reasoning depth
|
|
10
|
+
would likely do the job, prints a one-line tip with the estimated token-cost
|
|
11
|
+
savings. Advisory only — Claude Code hooks cannot set the model or effort, so
|
|
12
|
+
the user taps `/model` + `/effort`. The tip is delivered via `systemMessage`
|
|
13
|
+
(out-of-band), never `additionalContext`, so the advisor itself costs no tokens.
|
|
14
|
+
- `hooks/session-start-model-capture.js` (SessionStart): records the session
|
|
15
|
+
model to `.agentic-security/model-optimizer-state.json` — the only channel for
|
|
16
|
+
it, since there is no `$CLAUDE_MODEL` — and the advisor falls back to a
|
|
17
|
+
configurable `assumedModel` when it is absent.
|
|
18
|
+
- Config `.agentic-security/model-optimizer.json` (`{ mode, minSavingsUsd,
|
|
19
|
+
assumedModel }`), default **off**; kill switch
|
|
20
|
+
`AGENTIC_SECURITY_MODEL_OPTIMIZER=off`.
|
|
21
|
+
- `/setup --model-optimizer [--min-savings <usd>]` enables it (config write only;
|
|
22
|
+
the hooks are already registered in `hooks/hooks.json`).
|
|
23
|
+
- Docs: `docs/MODEL_COST_OPTIMIZATION_PRD.md` (spec, R1–R11) and
|
|
24
|
+
`docs/MODEL_COST_OPTIMIZATION.md` (user guide). Tests:
|
|
25
|
+
`hooks/model-cost-advisor.test.js` (10 cases).
|
|
26
|
+
|
|
3
27
|
## 0.119.2 — plugin manifest validation fixes
|
|
4
28
|
|
|
5
29
|
Manifest/packaging hotfix; no functional change to the scanner.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@clear-capabilities/agentic-security-scanner",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.120.0",
|
|
4
4
|
"description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, SARIF ingest, pipeline integrity, compliance attestation, and more.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "src/index.js",
|