agent-sanitizer 2.0.0

package/bin/sanitize-cli.mjs

@@ -0,0 +1,423 @@
+#!/usr/bin/env node
+/**
+ * Single-source-of-truth CLI over the sanitizer's data-in/data-out entry points,
+ * for non-JS pipelines.
+ *
+ * The logic lives once, in `src/`. This CLI is the supported escape hatch for
+ * callers that can't import the JavaScript directly (a Python pipeline, say): it
+ * speaks JSON over stdin/stdout so any language drives the exact same verdicts
+ * without a second implementation to keep in sync. Only the entry points with no
+ * injected callback are exposed — the agent-pipeline seams that take a homoglyph
+ * scanner, redactor, or file-access object have no language-agnostic wire form
+ * and stay JS-only.
+ *
+ * Protocol — a request is a JSON object with an `op` (default `"sanitize"` so a
+ * bare `{ text, html }` keeps working). Per op:
+ *
+ *   sanitize           { text, html? }            -> { cleaned, found, warnings }
+ *   sanitizeText       { text, html?, exfilScan? } -> { cleaned, warnings, modified, sgrNote }
+ *   classifyPrompt     { text }                    -> { action, reason? }
+ *   scanInstructionFiles { globs, cwd? }           -> { findings: [{ file, findings }] }
+ *   cleanFile          { path }                    -> { changed }
+ *
+ * A failure response is `{ "error": string }`. Two modes, same binary:
+ *
+ *   one-shot (default): read ONE JSON object from stdin (may span lines), write
+ *     ONE response line. A malformed request propagates — non-zero exit, a
+ *     one-line reason on stderr (the message, deliberately not a raw Node stack)
+ *     — so a scripted caller fails loudly.
+ *
+ *   worker (`--worker`): read newline-delimited JSON requests until EOF, write
+ *     EXACTLY one response line per input line, in order — including for a blank
+ *     line (a framing slip on the caller's side), which gets an `{ "error" }`
+ *     line rather than being silently skipped. Skipping a line desyncs every
+ *     later response against a client that reads one response per request. A
+ *     malformed request likewise yields an `{ "error" }` line and the worker
+ *     keeps serving — the specific, necessary recovery that makes a long-lived
+ *     process usable across independent requests (one bad line must not drop the
+ *     whole pipe). JSON string-encodes every newline, so one request and one
+ *     response always occupy one line each.
+ *
+ * Input-size cap: both modes reject a single request larger than
+ * `AGENT_SANITIZER_MAX_INPUT_BYTES` (UTF-8 bytes, default 10 MiB) with a
+ * structured error rather than buffering an unbounded payload into memory —
+ * one-shot exits non-zero, the worker emits an `{ "error" }` line and keeps
+ * serving. Raise or lower the limit via that environment variable.
+ */
+import { Buffer } from "node:buffer";
+import { realpathSync } from "node:fs";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+import { sanitize } from "../src/index.mjs";
+
+/** Largest single request accepted, in UTF-8 bytes. Caps memory per request so
+ * a hostile or runaway caller can't OOM the process; override via the env var. */
+const DEFAULT_MAX_INPUT_BYTES = 10 * 1024 * 1024;
+
+/** Resolve the configured input cap, falling back to the default for an unset,
+ * empty, non-numeric, or non-positive value. */
+function maxInputBytes() {
+  const raw = process.env.AGENT_SANITIZER_MAX_INPUT_BYTES;
+  const parsed = Number(raw);
+  if (
+    raw === undefined ||
+    raw === "" ||
+    !Number.isFinite(parsed) ||
+    parsed <= 0
+  )
+    return DEFAULT_MAX_INPUT_BYTES;
+  return Math.floor(parsed);
+}
+
+/** Throw if `text` exceeds the configured byte cap. The message names the limit
+ * and the env var so a caller can act on it. */
+function enforceSizeLimit(text) {
+  const limit = maxInputBytes();
+  const size = Buffer.byteLength(text, "utf8");
+  if (size > limit)
+    throw new Error(
+      `request too large: ${size} bytes exceeds the ${limit}-byte limit ` +
+        "(raise AGENT_SANITIZER_MAX_INPUT_BYTES to accept it)",
+    );
+}
+
+/** @param {Record<string, unknown>} req @param {string} key */
+function requireString(req, key) {
+  if (typeof req[key] !== "string")
+    throw new Error(`request.${key} must be a string`);
+}
+
+/** Operations the CLI exposes. Each takes the parsed request, returns the JSON
+ * payload object. Non-`sanitize` modules are imported lazily so a caller that
+ * only ever sanitizes never loads prompt/output/instructions code. */
+const OPS = {
+  async sanitize(req) {
+    requireString(req, "text");
+    const { cleaned, found, warnings } = await sanitize(req.text, {
+      html: Boolean(req.html),
+    });
+    return { cleaned, found, warnings };
+  },
+
+  async sanitizeText(req) {
+    requireString(req, "text");
+    // Layers 1–3 only: redact (Layer 4) and filterInjection (Layer 5) are
+    // injected JS callbacks with no wire form, so they're never set here.
+    const { sanitizeText } = await import("../src/output.mjs");
+    const { cleaned, warnings, modified, sgrNote } = await sanitizeText(
+      req.text,
+      {
+        html: Boolean(req.html),
+        exfilScan: Boolean(req.exfilScan),
+      },
+    );
+    return { cleaned, warnings, modified, sgrNote };
+  },
+
+  async classifyPrompt(req) {
+    requireString(req, "text");
+    const { classifyPrompt } = await import("../src/prompt.mjs");
+    return classifyPrompt(req.text);
+  },
+
+  // SECURITY (R8): `scanInstructionFiles` and `cleanFile` take filesystem
+  // paths/globs straight from the request and read (and, for cleanFile, WRITE)
+  // whatever they resolve to, with NO root confinement — `cwd`/`path`/`globs`
+  // may escape any directory (absolute paths, `..`, symlinks). Unlike the
+  // text-in/text-out ops, the request here names files on the host. The stdin
+  // peer that sends these requests must therefore be FULLY TRUSTED: never wire
+  // this CLI's stdin to untrusted/model-controlled input for these ops. If you
+  // must accept untrusted callers, add opt-in root confinement (reject paths
+  // that resolve outside an allow-listed root) before exposing them.
+  async scanInstructionFiles(req) {
+    if (
+      !Array.isArray(req.globs) ||
+      req.globs.some((g) => typeof g !== "string")
+    )
+      throw new Error("request.globs must be an array of strings");
+    // Fail loud on a present-but-non-string cwd rather than silently dropping it
+    // and scanning process.cwd() — a wrong-scope scan is worse than a clear error
+    // (matches the fail-loud contract every other typed field here follows).
+    if ("cwd" in req && typeof req.cwd !== "string")
+      throw new Error("request.cwd must be a string");
+    const { scanInstructionFiles } = await import("../src/instructions.mjs");
+    const opts = typeof req.cwd === "string" ? { cwd: req.cwd } : {};
+    return { findings: scanInstructionFiles(req.globs, opts) };
+  },
+
+  async cleanFile(req) {
+    requireString(req, "path");
+    const { cleanFile } = await import("../src/instructions.mjs");
+    return { changed: cleanFile(req.path) };
+  },
+};
+
+/**
+ * Run one request through the named `op` and serialize the response.
+ * Throws on a malformed request or unknown op; the caller decides whether that
+ * propagates (one-shot) or becomes an `{ error }` line (worker).
+ * @param {string} payload  a single JSON request object
+ * @returns {Promise<string>} a single-line JSON response
+ */
+async function handle(payload) {
+  enforceSizeLimit(payload);
+  const request = JSON.parse(payload);
+  const op = request.op ?? "sanitize";
+  const run = Object.prototype.hasOwnProperty.call(OPS, op) ? OPS[op] : null;
+  if (!run) throw new Error(`unknown op: ${op}`);
+  return JSON.stringify(await run(request));
+}
+
+/** Read the whole stream as UTF-8, aborting as soon as the accumulated bytes
+ * exceed the cap so a hostile one-shot caller can't force unbounded buffering.
+ * @param {NodeJS.ReadableStream} stream */
+async function readAll(stream) {
+  stream.setEncoding("utf8");
+  const limit = maxInputBytes();
+  let text = "";
+  let bytes = 0;
+  for await (const chunk of stream) {
+    bytes += Buffer.byteLength(chunk, "utf8");
+    if (bytes > limit)
+      throw new Error(
+        `request too large: input exceeds the ${limit}-byte limit ` +
+          "(raise AGENT_SANITIZER_MAX_INPUT_BYTES to accept it)",
+      );
+    text += chunk;
+  }
+  return text;
+}
+
+/**
+ * Streaming newline-splitter that never buffers a line past the byte `limit`.
+ *
+ * Fed raw stdin chunks one at a time, it yields a sequence of events the worker
+ * turns into exactly one response line each. The reason this exists instead of
+ * `readline`: `readline` buffers an entire newline-less line into memory before
+ * handing it over, so a hostile caller streaming a multi-gigabyte line with no
+ * `\n` defeats the size cap (the cap only fires once the whole line is already
+ * resident). Here the running byte length of the CURRENT unterminated line is
+ * tracked as bytes arrive; the instant it exceeds `limit` the partial buffer is
+ * dropped and the splitter enters a "resync" state that discards every byte up
+ * to (and including) the next `\n`, so peak buffering for one line is bounded by
+ * `limit` plus one chunk — never the whole line.
+ *
+ * Events: `{ kind: "line", text }` for a complete in-cap line (trailing `\r`
+ * stripped, matching `readline`'s `crlfDelay: Infinity` CRLF handling), and
+ * `{ kind: "oversize" }` for a line whose bytes crossed `limit` (emitted once,
+ * at the newline that terminates the discarded line). The worker maps the
+ * former through `handle` and the latter to a "request too large" error line, so
+ * the one-response-per-input-line framing holds even for a dropped line.
+ *
+ * @param {number} limit  per-line byte cap (`maxInputBytes()`)
+ */
+function createLineSplitter(limit) {
+  // The bytes of the current line are held as a LIST of chunk slices plus their
+  // running total, joined into one Buffer only when the line completes. Pushing
+  // a slice is O(1), so assembling an N-byte line costs O(N) overall. The old
+  // single growing `Buffer.concat([buffer, segment])` per segment re-copied the
+  // whole accumulated prefix each time — O(N^2) for a line streamed as many
+  // small chunks (e.g. a multi-MiB line arriving in 1-byte reads). `discarding`
+  // still caps peak buffering at `limit`: once a line would breach it, the
+  // pending slices are dropped and we scan only for the terminating `\n`.
+  /** @type {Buffer[]} */
+  let pending = [];
+  let pendingLen = 0;
+  let discarding = false;
+
+  /** Drop any pending slices (line abandoned or fully consumed). */
+  const reset = () => {
+    pending = [];
+    pendingLen = 0;
+  };
+
+  /** Join the pending slices into one line buffer (single copy) and reset. */
+  const take = () => {
+    const buf =
+      pending.length === 1 ? pending[0] : Buffer.concat(pending, pendingLen);
+    reset();
+    return buf;
+  };
+
+  /** Strip one trailing `\r` so CRLF input frames identically to LF. */
+  const toLine = (buf) => {
+    const stripCr = buf.length > 0 && buf[buf.length - 1] === 0x0d;
+    return buf.toString("utf8", 0, stripCr ? buf.length - 1 : buf.length);
+  };
+
+  // Fold one segment (the bytes of the current line seen so far in this chunk)
+  // into the pending list, flipping to `discarding` if it would breach the cap.
+  // Applies identically to a newline-terminated segment and to the unterminated
+  // tail, so an oversize line is caught WITHIN a chunk, not only at its edge.
+  const accumulate = (segment) => {
+    if (discarding) return;
+    if (pendingLen + segment.length > limit) {
+      reset();
+      discarding = true;
+      return;
+    }
+    if (segment.length > 0) {
+      pending.push(segment);
+      pendingLen += segment.length;
+    }
+  };
+
+  /** Feed one chunk, returning the events it completes (newline-terminated). */
+  const push = (chunk) => {
+    const events = [];
+    let start = 0;
+    for (let i = 0; i < chunk.length; i++) {
+      if (chunk[i] !== 0x0a) continue;
+      accumulate(chunk.subarray(start, i));
+      if (discarding) {
+        events.push({ kind: "oversize" });
+        discarding = false;
+        reset();
+      } else {
+        events.push({ kind: "line", text: toLine(take()) });
+      }
+      start = i + 1;
+    }
+    accumulate(chunk.subarray(start));
+    return events;
+  };
+
+  /**
+   * Flush at EOF. A final line with no trailing `\n` is still a request, so it
+   * gets a response — matching `readline`, which emits its last line on `close`.
+   * An empty tail (stream ended on a `\n`, or was empty) yields nothing.
+   */
+  push.end = () => {
+    if (discarding) {
+      discarding = false;
+      reset();
+      return [{ kind: "oversize" }];
+    }
+    if (pendingLen === 0) return [];
+    return [{ kind: "line", text: toLine(take()) }];
+  };
+
+  return push;
+}
+
+const OVERSIZE_ERROR = (limit) =>
+  JSON.stringify({
+    error:
+      `request too large: input exceeds the ${limit}-byte limit ` +
+      "(raise AGENT_SANITIZER_MAX_INPUT_BYTES to accept it)",
+  });
+
+async function runWorker() {
+  // Stream raw bytes (no encoding) so the splitter tracks UTF-8 byte length, not
+  // decoded characters, and a multi-gigabyte newline-less line is discarded as
+  // it streams rather than buffered whole the way `readline` would.
+  const limit = maxInputBytes();
+  const split = createLineSplitter(limit);
+
+  // EXACTLY one response line per input line. A complete in-cap line goes
+  // through `handle`; its try/catch is the worker's reason to exist — a single
+  // malformed request reports an error and serving continues rather than
+  // tearing down a pipe other requests still use. An oversize line (its bytes
+  // crossed the cap, so it was discarded unbuffered) gets the same structured
+  // "request too large" error a one-shot caller sees. `response` never holds a
+  // newline: `JSON.stringify` of the result or of a one-key error object is
+  // single-line, so the one-line-per-request framing holds.
+  const respond = async (event) => {
+    if (event.kind === "oversize") {
+      process.stdout.write(`${OVERSIZE_ERROR(limit)}\n`);
+      return;
+    }
+    let response;
+    try {
+      response = await handle(event.text);
+    } catch (err) {
+      response = JSON.stringify({ error: err?.message ?? String(err) });
+    }
+    process.stdout.write(`${response}\n`);
+  };
+
+  for await (const chunk of process.stdin) {
+    for (const event of split(Buffer.from(chunk))) await respond(event);
+  }
+  for (const event of split.end()) await respond(event);
+}
+
+async function runOneShot() {
+  // Fail loudly but cleanly: a bad request (or a contract-impossible `sanitize`
+  // throw) exits non-zero with a one-line reason on stderr — not a raw Node
+  // stack, which leaks internals and is noise for a scripted caller. The
+  // message carries the sanitizer-CLI prefix so a wrapping client can attribute
+  // the failure to this bridge.
+  let response;
+  try {
+    response = await handle(await readAll(process.stdin));
+  } catch (err) {
+    process.stderr.write(`sanitize CLI: ${err?.message ?? String(err)}\n`);
+    process.exitCode = 1;
+    return;
+  }
+  process.stdout.write(`${response}\n`);
+}
+
+// Run only when invoked as a script, not when imported (a unit test imports
+// `createLineSplitter` directly and must not have the worker consume its stdin).
+// Compare REAL paths: the published bin is launched through a
+// `node_modules/.bin/sanitize-cli` symlink, so `process.argv[1]` is the symlink
+// path while `import.meta.url` is this module's real file — a raw URL compare
+// would be false and the CLI would silently produce no output. `realpathSync`
+// resolves both to the same on-disk file. A non-existent `argv[1]` (e.g. an
+// `--eval` entry) throws ENOENT and is treated as "not our script".
+function invokedAsScript() {
+  if (process.argv[1] === undefined) return false;
+  try {
+    return (
+      realpathSync(process.argv[1]) ===
+      realpathSync(fileURLToPath(import.meta.url))
+    );
+  } catch {
+    return false;
+  }
+}
+export const USAGE = `sanitize-cli — sanitize untrusted text before an LLM sees it.
+
+Reads JSON on stdin, writes one JSON response line on stdout.
+
+Usage:
+  sanitize-cli            one-shot: read ONE request object from stdin, write one response
+  sanitize-cli --worker   worker: read newline-delimited requests until EOF, one response per line
+  sanitize-cli --help     show this help
+
+Request: { "op"?: string, ...fields }. Ops: sanitize (default), sanitizeText,
+classifyPrompt, scanInstructionFiles, cleanFile. A failure response is { "error": string }.
+`;
+
+/**
+ * Resolve argv to a run mode. `-h`/`--help` prints usage; an unrecognized `-…`
+ * flag is a usage error rather than a silent fall-through to one-shot mode,
+ * which would block reading stdin from a TTY with no output. The only real flag
+ * is `--worker`; a bare invocation (or any non-flag arg) is one-shot.
+ * @param {string[]} argv  process.argv (argv[0]=node, argv[1]=script)
+ * @returns {{ mode: "help" | "worker" | "oneshot" | "error", unknown?: string[] }}
+ */
+export function parseArgs(argv) {
+  const flags = argv.slice(2).filter((arg) => arg.startsWith("-"));
+  if (flags.includes("-h") || flags.includes("--help")) return { mode: "help" };
+  const unknown = flags.filter((flag) => flag !== "--worker");
+  if (unknown.length > 0) return { mode: "error", unknown };
+  return { mode: flags.includes("--worker") ? "worker" : "oneshot" };
+}
+
+if (invokedAsScript()) {
+  const parsed = parseArgs(process.argv);
+  if (parsed.mode === "help") process.stdout.write(USAGE);
+  else if (parsed.mode === "error") {
+    process.stderr.write(
+      `sanitize CLI: unrecognized option(s): ${/** @type {string[]} */ (parsed.unknown).join(", ")}\n\n${USAGE}`,
+    );
+    process.exitCode = 2;
+  } else if (parsed.mode === "worker") await runWorker();
+  else await runOneShot();
+}
+
+export { createLineSplitter };

package/package.json

@@ -0,0 +1,157 @@
+{
+  "name": "agent-sanitizer",
+  "version": "2.0.0",
+  "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/AlexanderMattTurner/agent-sanitizer.git"
+  },
+  "bugs": {
+    "url": "https://github.com/AlexanderMattTurner/agent-sanitizer/issues"
+  },
+  "homepage": "https://github.com/AlexanderMattTurner/agent-sanitizer#readme",
+  "author": "Alexander Turner",
+  "packageManager": "pnpm@11.8.0",
+  "bin": {
+    "sanitize-cli": "bin/sanitize-cli.mjs"
+  },
+  "scripts": {
+    "prepare": "pnpm build:types && if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then git config core.hooksPath .hooks; fi",
+    "test": "c8 node --test",
+    "coverage": "c8 node --test",
+    "check": "tsc --noEmit",
+    "typecheck": "tsc --noEmit",
+    "build:types": "tsc -p tsconfig.build.json",
+    "prepack": "pnpm build:types",
+    "gen:joining-type": "node scripts/gen-joining-type.mjs",
+    "lint": "eslint .",
+    "test:mutation": "stryker run",
+    "format": "prettier --write .",
+    "format:check": "prettier --check ."
+  },
+  "lint-staged": {
+    "*.{css,scss}": [
+      "prettier --write"
+    ],
+    "*.json": [
+      "prettier --write"
+    ],
+    "*.json.example": [
+      "prettier --write --parser json"
+    ],
+    "*.{js,jsx,mjs,cjs,ts,tsx}": [
+      "prettier --write"
+    ],
+    "*.{yaml,yml}": [
+      "prettier --write"
+    ],
+    "*.md": [
+      "prettier --write"
+    ],
+    ".claude/skills/*/SKILL.md": [
+      ".hooks/lint-skills.sh"
+    ],
+    "{*.sh,.hooks/!(*.*)}": [
+      "shfmt -i 2 -w"
+    ],
+    "*.py": [
+      "ruff check --fix",
+      "ruff format"
+    ]
+  },
+  "devDependencies": {
+    "@commitlint/cli": "^21.0.1",
+    "@commitlint/config-conventional": "^21.0.1",
+    "@eslint/js": "10.0.1",
+    "@stryker-mutator/core": "^9.6.1",
+    "@stryker-mutator/tap-runner": "^9.6.1",
+    "@types/node": "25.9.1",
+    "c8": "11.0.0",
+    "esbuild": "0.28.1",
+    "eslint": "10.4.0",
+    "fast-check": "4.8.0",
+    "globals": "17.6.0",
+    "lint-staged": "^17.0.5",
+    "prettier": "^3.0.0",
+    "typescript": "6.0.3",
+    "typescript-eslint": "8.61.0"
+  },
+  "license": "Apache-2.0",
+  "engines": {
+    "node": ">=22"
+  },
+  "keywords": [
+    "llm",
+    "prompt-injection",
+    "sanitize",
+    "unicode",
+    "invisible-characters",
+    "ansi",
+    "exfiltration",
+    "rag",
+    "agent",
+    "security",
+    "homoglyph",
+    "confusables",
+    "redaction",
+    "tool-output",
+    "edit-repair"
+  ],
+  "exports": {
+    ".": {
+      "types": "./types/index.d.mts",
+      "default": "./src/index.mjs"
+    },
+    "./invisible": {
+      "types": "./types/invisible.d.mts",
+      "default": "./src/invisible.mjs"
+    },
+    "./html": {
+      "types": "./types/html.d.mts",
+      "default": "./src/html.mjs"
+    },
+    "./confusables": {
+      "types": "./types/confusables.d.mts",
+      "default": "./src/confusables.mjs"
+    },
+    "./instructions": {
+      "types": "./types/instructions.d.mts",
+      "default": "./src/instructions.mjs"
+    },
+    "./prompt": {
+      "types": "./types/prompt.d.mts",
+      "default": "./src/prompt.mjs"
+    },
+    "./output": {
+      "types": "./types/output.d.mts",
+      "default": "./src/output.mjs"
+    },
+    "./view-map": {
+      "types": "./types/view-map.d.mts",
+      "default": "./src/view-map.mjs"
+    },
+    "./rehydrate": {
+      "types": "./types/rehydrate.d.mts",
+      "default": "./src/rehydrate.mjs"
+    }
+  },
+  "files": [
+    "src/*.mjs",
+    "bin/sanitize-cli.mjs",
+    "types",
+    "LICENSE",
+    "README.md",
+    "THREAT-MODEL.md",
+    "SECURITY.md"
+  ],
+  "dependencies": {
+    "css-tree": "^3.2.1",
+    "rehype-parse": "9.0.1",
+    "remark-gfm": "4.0.1",
+    "remark-parse": "11.0.0",
+    "style-to-object": "1.0.14",
+    "unified": "11.0.5",
+    "unist-util-visit": "5.1.0"
+  }
+}

package/src/cf-charset.mjs

@@ -0,0 +1,43 @@
+/**
+ * GENERATED by scripts/gen-invisible-charset.mjs from Node's Unicode data
+ * (\p{Cf}, Unicode 17.0) — DO NOT EDIT.
+ *
+ * The general-category Cf code points, PINNED at generation time. invisible.mjs
+ * strips exactly this set instead of testing \p{Cf} live, and the Python port
+ * reads the SAME set from data/invisible-charset.json's `cf_codepoints`, so both
+ * layers strip an identical Cf set regardless of each runtime's own Unicode
+ * version. Regenerate with `node scripts/gen-invisible-charset.mjs`;
+ * test/invisible-charset.test.mjs fails if this drifts from Node's \p{Cf}.
+ */
+
+export const UNICODE_VERSION = "17.0";
+
+// GENERATED Unicode data, not hand-written logic. Its correctness is pinned by
+// the SSOT round-trip in test/invisible-charset.test.mjs (re-enumerate \p{Cf},
+// then assert every code point matches) — Stryker skips the numeric literals.
+// Stryker disable all
+/** @type {readonly number[]} Sorted ascending. */
+export const CF_CODEPOINTS = Object.freeze([
+  0xad, 0x600, 0x601, 0x602, 0x603, 0x604, 0x605, 0x61c, 0x6dd, 0x70f, 0x890,
+  0x891, 0x8e2, 0x180e, 0x200b, 0x200c, 0x200d, 0x200e, 0x200f, 0x202a, 0x202b,
+  0x202c, 0x202d, 0x202e, 0x2060, 0x2061, 0x2062, 0x2063, 0x2064, 0x2066,
+  0x2067, 0x2068, 0x2069, 0x206a, 0x206b, 0x206c, 0x206d, 0x206e, 0x206f,
+  0xfeff, 0xfff9, 0xfffa, 0xfffb, 0x110bd, 0x110cd, 0x13430, 0x13431, 0x13432,
+  0x13433, 0x13434, 0x13435, 0x13436, 0x13437, 0x13438, 0x13439, 0x1343a,
+  0x1343b, 0x1343c, 0x1343d, 0x1343e, 0x1343f, 0x1bca0, 0x1bca1, 0x1bca2,
+  0x1bca3, 0x1d173, 0x1d174, 0x1d175, 0x1d176, 0x1d177, 0x1d178, 0x1d179,
+  0x1d17a, 0xe0001, 0xe0020, 0xe0021, 0xe0022, 0xe0023, 0xe0024, 0xe0025,
+  0xe0026, 0xe0027, 0xe0028, 0xe0029, 0xe002a, 0xe002b, 0xe002c, 0xe002d,
+  0xe002e, 0xe002f, 0xe0030, 0xe0031, 0xe0032, 0xe0033, 0xe0034, 0xe0035,
+  0xe0036, 0xe0037, 0xe0038, 0xe0039, 0xe003a, 0xe003b, 0xe003c, 0xe003d,
+  0xe003e, 0xe003f, 0xe0040, 0xe0041, 0xe0042, 0xe0043, 0xe0044, 0xe0045,
+  0xe0046, 0xe0047, 0xe0048, 0xe0049, 0xe004a, 0xe004b, 0xe004c, 0xe004d,
+  0xe004e, 0xe004f, 0xe0050, 0xe0051, 0xe0052, 0xe0053, 0xe0054, 0xe0055,
+  0xe0056, 0xe0057, 0xe0058, 0xe0059, 0xe005a, 0xe005b, 0xe005c, 0xe005d,
+  0xe005e, 0xe005f, 0xe0060, 0xe0061, 0xe0062, 0xe0063, 0xe0064, 0xe0065,
+  0xe0066, 0xe0067, 0xe0068, 0xe0069, 0xe006a, 0xe006b, 0xe006c, 0xe006d,
+  0xe006e, 0xe006f, 0xe0070, 0xe0071, 0xe0072, 0xe0073, 0xe0074, 0xe0075,
+  0xe0076, 0xe0077, 0xe0078, 0xe0079, 0xe007a, 0xe007b, 0xe007c, 0xe007d,
+  0xe007e, 0xe007f,
+]);
+// Stryker restore all