agent-sanitizer 2.10.0 → 2.10.1

package/claude-hooks/scan-invisible-chars.mjs

@@ -136,16 +136,28 @@ function findMdFiles(dir) {
  * under `dir`. Claude Code loads these as project instructions on entry to their
  * containing directory — a load path that bypasses the PostToolUse sanitizer — so
  * a payload planted in e.g. `packages/foo/CLAUDE.md` reaches the model uncleaned
- * unless it is scanned here. Skips node_modules; `**` skips dot directories by
- * default (`.git`, and `.claude`, which the caller scans separately).
+ * unless it is scanned here. Skips node_modules.
+ *
+ * `**` does not descend into dot directories, so NESTED `.claude/` trees need
+ * their own pattern: the caller scans only the project-root `.claude`, which
+ * would leave a directory-scoped skill at `packages/foo/.claude/skills/x/SKILL.md`
+ * — model context by the same load path — never scanned.
  * @param {string} dir
  * @returns {string[]}
  */
 function findInstructionFiles(dir) {
-  return globSync(["**/CLAUDE.md", "**/CLAUDE.local.md", "**/AGENTS.md"], {
-    cwd: dir,
-    exclude: (name) => name === "node_modules",
-  }).map((name) => join(dir, name));
+  return globSync(
+    [
+      "**/CLAUDE.md",
+      "**/CLAUDE.local.md",
+      "**/AGENTS.md",
+      "**/.claude/**/*.md",
+    ],
+    {
+      cwd: dir,
+      exclude: (name) => name === "node_modules",
+    },
+  ).map((name) => join(dir, name));
 }
 
 // Scanner

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.10.0",
+  "version": "2.10.1",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/python/agent_sanitizer/secrets/data/credential-names.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "The credential-noun vocabulary: the words that make an identifier name a secret. Published so every consumer derives its own matcher from ONE list — a newly recognized noun reaches them all through a version bump instead of N hand edits. Read it from Python via agent_sanitizer.secrets (credential_name_segments / credential_field_name_patterns / non_secret_name_segments) or from JavaScript via the npm subpath export `agent-sanitizer/credential-names`. `parts` are the lowercase words of the noun; a consumer renders them for its own matcher (underscore-joined `API_KEY` and bare-joined `APIKEY` for an env-var NAME, `api[_-]?key` for a `field = value` regex). `uses` says which matcher may use the noun, because the two are not interchangeable: `env-name` matches a variable NAME and never inspects a value, so a broad noun there costs nothing, while `field-value` redacts whatever follows `noun = ` and a broad noun there mangles ordinary text — `key = <20 chars>` is a false-positive flood, so `key`, `pat`, `credential`, `credentials`, `secrets` and `passphrase` are env-name only. `nonSecretSuffixes` are the trailing words that make a credential-shaped name hold a NON-secret (a key's identifier, the public half of a keypair), which a consumer must not redact. Every part is restricted to a-z0-9 so it carries no regex metacharacter; the accessors enforce that and fail closed on a violation, an empty list, or an unknown `uses` value. It sits inside the Python package because a wheel can only ship data under its package directory, while npm's `files`/`exports` can name any path — so ONE physical file backs both ecosystems and there is no copy to drift.",
+  "$comment": "The credential-noun vocabulary: the words that make an identifier name a secret. Published so every consumer derives its own matcher from ONE list — a newly recognized noun reaches them all through a version bump instead of N hand edits. Read it from Python via agent_sanitizer.secrets (credential_name_segments / credential_field_name_patterns / non_secret_name_segments) or from JavaScript via the npm subpath export `agent-sanitizer/credential-names`. `parts` are the lowercase words of the noun; a consumer renders them for its own matcher (underscore-joined `API_KEY` and bare-joined `APIKEY` for an env-var NAME, `api[_-]?key` for a `field = value` regex). `uses` says which matcher may use the noun, because the two are not interchangeable: `env-name` matches a variable NAME and never inspects a value, so a broad noun there costs nothing, while `field-value` redacts whatever follows `noun = ` and a broad noun there mangles ordinary text — `key = <20 chars>` is a false-positive flood, so `key`, `pat`, `credential`, `credentials` and `secrets` are env-name only — `credential`/`credentials` are everyday variable names, and an attribute chain (`credentials = service_account.Credentials.from_service_account_info(info)`) escapes every value-shape skip, so a field-value rendering would redact ordinary source lines. `passphrase` is the exception among them: it is as shape-specific as `password`, and detect-secrets' own KeywordDetector DENYLIST omits it, so name-only would let `passphrase = <secret>` reach the model in cleartext. `nonSecretSuffixes` are the trailing words that make a credential-shaped name hold a NON-secret (a key's identifier, the public half of a keypair), which a consumer must not redact. Every part is restricted to a-z0-9 so it carries no regex metacharacter; the accessors enforce that and fail closed on a violation, an empty list, or an unknown `uses` value. It sits inside the Python package because a wheel can only ship data under its package directory, while npm's `files`/`exports` can name any path — so ONE physical file backs both ecosystems and there is no copy to drift.",
   "nouns": [
     { "parts": ["api", "key"], "uses": ["env-name", "field-value"] },
     { "parts": ["access", "key"], "uses": ["env-name", "field-value"] },
@@ -12,7 +12,7 @@
     { "parts": ["authorization"], "uses": ["env-name", "field-value"] },
     { "parts": ["password"], "uses": ["env-name", "field-value"] },
     { "parts": ["passwd"], "uses": ["env-name", "field-value"] },
-    { "parts": ["passphrase"], "uses": ["env-name"] },
+    { "parts": ["passphrase"], "uses": ["env-name", "field-value"] },
     { "parts": ["bearer"], "uses": ["env-name", "field-value"] },
     { "parts": ["secret"], "uses": ["env-name", "field-value"] },
     { "parts": ["secrets"], "uses": ["env-name"] },

package/src/html.mjs

@@ -1069,6 +1069,23 @@ const VOID_ELEMENTS = new Set([
   "wbr",
 ]);
 
+// Foreign-content roots. Inside SVG and MathML the HTML parser honours a
+// self-closing `/>` (it does not in HTML content), so such a tag opens and
+// closes in one node and the text after it is a sibling, not its child.
+const FOREIGN_ELEMENTS = new Set(["svg", "math"]);
+
+/**
+ * True when `value` is a foreign-content tag that closed itself. Splicing it as
+ * a balance region instead would run to the container's end and delete every
+ * visible word after a decorative hidden `<svg/>`.
+ * @param {string} tagName
+ * @param {string} value
+ * @returns {boolean}
+ */
+function isSelfClosedForeign(tagName, value) {
+  return FOREIGN_ELEMENTS.has(tagName) && /\/\s*>\s*$/.test(value);
+}
+
 // Elements whose content is RAW TEXT / RCDATA / script data: parse5 recognizes
 // NO markup inside them (a `<!…` is not a comment, a `<b>` is not a tag) until
 // the matching end tag. The per-tag balance walk must model this or it would
@@ -1523,7 +1540,10 @@ function scanInlineChildren(node, text, ranges, warned) {
         // A void element never emits a matching close, so a balance region
         // would extend to the container end and splice out following visible
         // text. Emit a single-node range instead (the source branch does too).
-        if (VOID_ELEMENTS.has(tagName))
+        // A self-closed FOREIGN element behaves the same way: in SVG/MathML
+        // content the HTML spec honours the `/>` flag, so the element closes
+        // immediately and everything after it renders.
+        if (VOID_ELEMENTS.has(tagName) || isSelfClosedForeign(tagName, value))
           ranges.push({ start: base, end, kind: "hidden" });
         else {
           state.tag = tagName;

package/src/invisible.mjs

@@ -13,8 +13,18 @@ import { joiningType, isVirama } from "./joining-type.mjs";
 import { isStandardizedVariant } from "./standardized-variants.mjs";
 import { CF_CODEPOINTS } from "./cf-charset.mjs";
 
+// Unicode's Variation_Selector property, whole: the FE00 run, the Mongolian
+// free variation selectors, and the astral E0100 supplement. The Mongolian four
+// are general category Mn, so \p{Cf} does not reach them and CF_CODEPOINTS
+// carries only U+180E (the vowel SEPARATOR) — without them a run of U+180B..D
+// renders as nothing, survives untouched, and counts as VISIBLE length, which
+// also widens the preserved-joiner budget.
 export const VS = [
   ...Array.from({ length: 16 }, (_, i) => 0xfe00 + i),
+  0x180b,
+  0x180c,
+  0x180d,
+  0x180f,
   ...Array.from({ length: 240 }, (_, i) => 0xe0100 + i),
 ]
   .map((codePoint) => String.fromCodePoint(codePoint))

package/src/layer1.mjs

@@ -112,20 +112,27 @@ const ANSI_RE = new RegExp(`(?:${OSC_BRANCH}|${CSI_BRANCH})`, "gu");
 export const LONE_SURROGATE_RE =
   /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
 
+const MAX_ANSI_PASSES = 3;
+
 /**
  * Strip ANSI escape sequences to a fixed point. Removing one sequence can
  * reconstitute another around it (a lone ESC left of `ESC[32m[0m` gains the
  * trailing `[0m` once the inner sequence is removed, forming a brand-new valid
- * sequence the single pass would miss), so iterate until stable: every changed
- * pass consumes at least one ESC introducer, so the pass count is bounded by
- * the input's ESC count, and ANSI-free text exits after one pass.
+ * sequence the single pass would miss), so iterate — but only a fixed few
+ * times. Bounding by the input's ESC count is quadratic on attacker-controlled
+ * text: `("\x1b[").repeat(n) + "m".repeat(n)` reconstitutes exactly ONE
+ * sequence per pass, so n full O(n) scans run, and 48 KB already costs seconds.
+ * The passes are not what makes Layer 1 safe — applyLayer1's residual
+ * CONTROL_INTRODUCER_RE sweep is, and it removes every ESC/C1 byte whatever
+ * survives here. Past the bound a reconstituted sequence therefore degrades to
+ * VISIBLE text rather than a hidden control, which is the fail-open direction.
  * @param {string} input
  * @returns {string}
  */
 export function stripAnsiFully(input) {
   let prev = input;
   let out = prev.replace(ANSI_RE, "");
-  while (out !== prev) {
+  for (let pass = 1; pass < MAX_ANSI_PASSES && out !== prev; pass++) {
     prev = out;
     out = prev.replace(ANSI_RE, "");
   }

package/types/claude-hooks/scan-invisible-chars.d.mts

@@ -29,8 +29,12 @@ export function findMdFiles(dir: string): string[];
  * under `dir`. Claude Code loads these as project instructions on entry to their
  * containing directory — a load path that bypasses the PostToolUse sanitizer — so
  * a payload planted in e.g. `packages/foo/CLAUDE.md` reaches the model uncleaned
- * unless it is scanned here. Skips node_modules; `**` skips dot directories by
- * default (`.git`, and `.claude`, which the caller scans separately).
+ * unless it is scanned here. Skips node_modules.
+ *
+ * `**` does not descend into dot directories, so NESTED `.claude/` trees need
+ * their own pattern: the caller scans only the project-root `.claude`, which
+ * would leave a directory-scoped skill at `packages/foo/.claude/skills/x/SKILL.md`
+ * — model context by the same load path — never scanned.
  * @param {string} dir
  * @returns {string[]}
  */

package/types/layer1.d.mts

@@ -2,9 +2,14 @@
  * Strip ANSI escape sequences to a fixed point. Removing one sequence can
  * reconstitute another around it (a lone ESC left of `ESC[32m[0m` gains the
  * trailing `[0m` once the inner sequence is removed, forming a brand-new valid
- * sequence the single pass would miss), so iterate until stable: every changed
- * pass consumes at least one ESC introducer, so the pass count is bounded by
- * the input's ESC count, and ANSI-free text exits after one pass.
+ * sequence the single pass would miss), so iterate — but only a fixed few
+ * times. Bounding by the input's ESC count is quadratic on attacker-controlled
+ * text: `("\x1b[").repeat(n) + "m".repeat(n)` reconstitutes exactly ONE
+ * sequence per pass, so n full O(n) scans run, and 48 KB already costs seconds.
+ * The passes are not what makes Layer 1 safe — applyLayer1's residual
+ * CONTROL_INTRODUCER_RE sweep is, and it removes every ESC/C1 byte whatever
+ * survives here. Past the bound a reconstituted sequence therefore degrades to
+ * VISIBLE text rather than a hidden control, which is the fail-open direction.
  * @param {string} input
  * @returns {string}
  */