Skip to content

fix(ENG-1961): defender plugin — payload floor, cue threshold, bump to 0.8.2#30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hiskudin merged 7 commits into from
Aug 20, 2026
Merged

fix(ENG-1961): defender plugin — payload floor, cue threshold, bump to 0.8.2 #30

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
2628b8d
fix(ENG-1961): lower PAYLOAD_SKIP_BELOW_BYTES from 500 to 32
hiskudin Aug 19, 2026
17d24bc
fix(ENG-1961): expand maxSentence display from 80 to 300 chars
hiskudin Aug 19, 2026
ef1d356
fix(ENG-1961): bump @stackone/defender to 0.8.2 (exact pin)
hiskudin Aug 19, 2026
d47054e
fix(ENG-1961): raise Suspicious cue threshold from 0.3 to 0.64
hiskudin Aug 19, 2026
e7cfa50
fix(ENG-1961): address PR review — overrides for vuln transitives, RE…
hiskudin Aug 19, 2026
35766e7
fix(ENG-1961): de-flake hook integration test — drop wall-clock asser…
hiskudin Aug 19, 2026
1a9c61b
fix(ENG-1961): drop vacuous FP-guard hook test, add long-benign fixtu…
hiskudin Aug 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions plugins/security/stackone-defender/README.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -28,7 +28,7 @@ Requires Node ≥ 22.
/plugin install stackone-defender@stackone-agent-plugins
```

**3. Trigger the first run.** Use any tool that returns more than ~500 bytes (e.g. `Read` a file, or `WebFetch` any URL). The hook self-installs its ML dependencies (`@stackone/defender`, `onnxruntime-node`, `@huggingface/transformers`, `fasttext.wasm`) into the plugin's own `node_modules` on this first call. Expect a one-time 5–10 second pause; subsequent calls reuse a persistent daemon over `~/.claude/defender.sock` and complete in low milliseconds.
**3. Trigger the first run.** Use any tool that returns tool output (e.g. `Read` a file, or `WebFetch` any URL). The hook self-installs its ML dependencies (`@stackone/defender`, `onnxruntime-node`, `@huggingface/transformers`, `fasttext.wasm`) into the plugin's own `node_modules` on this first call. Expect a one-time 5–10 second pause; subsequent calls reuse a persistent daemon over `~/.claude/defender.sock` and complete in low milliseconds.

That's it. There's no API key, no config file to edit, and no account to create. Defender is active from the next tool call onward.

Expand All@@ -40,7 +40,7 @@ The PostToolUse hook is wired to fire on:
Bash | Read | WebFetch | WebSearch | Monitor | ReadMcpResourceTool | mcp__.*
```

That covers the highest-risk surfaces: shell output, files Claude reads, fetched web content, search results, log streams, and the full universe of MCP tool responses. Payloads smaller than 500 bytes are skipped (nothing meaningful injects in that window).
That covers the highest-risk surfaces: shell output, files Claude reads, fetched web content, search results, log streams, and the full universe of MCP tool responses. Only very tiny payloads (under ~32 bytes, i.e. the JSON wrapper around a sub-10-character string) are skipped to save an IPC round-trip.

## How it works

Expand DownExpand Up@@ -114,7 +114,7 @@ All five are local-only. None of them get written to until Defender actually fir

## Troubleshooting

**Defender doesn't seem to fire.** Tool outputs under 500 bytes are skipped intentionally. Check `~/.claude/defender-daemon.log` to confirm the daemon is alive. If the log is empty, the hook may have failed to install dependencies. Run `cd ~/.claude/plugins/cache/<marketplace>/stackone-defender/<version> && npm install` manually (or `cd` into the plugin directory shown by `/plugin info stackone-defender`). `$CLAUDE_PLUGIN_ROOT` is set by Claude Code at hook-runtime and is not available in your interactive shell.
**Defender doesn't seem to fire.** Tool outputs under ~32 bytes are skipped intentionally (JSON-wrapper floor — anything below is too small for defender's own per-string threshold). Check `~/.claude/defender-daemon.log` to confirm the daemon is alive. If the log is empty, the hook may have failed to install dependencies. Run `cd ~/.claude/plugins/cache/<marketplace>/stackone-defender/<version> && npm install` manually (or `cd` into the plugin directory shown by `/plugin info stackone-defender`). `$CLAUDE_PLUGIN_ROOT` is set by Claude Code at hook-runtime and is not available in your interactive shell.

**"Slow first scan."** Cold start spawns the daemon and warms up the ONNX session. Steady-state latency is a few milliseconds; first call after a fresh login can take 5–10 seconds.

Expand Down
Loading
Loading