agent-sanitizer 2.10.0 → 2.11.0

package/README.md

@@ -202,6 +202,26 @@ hook module, and every consumer waits on that path instead. `lib/control-plane`
 resolves the marker at module scope, so a call that lands after that import
 warns on stderr — it cannot steer the wait that already started.
 
+**A host's own remedy can replace the packaged one in every fail-closed
+reason.** Deep call sites (`lib/control-plane`'s missing-package throw) take no
+remedy argument, so by default they can only say `pnpm install`. A host whose
+install has one entry point calls `configureMissingPackageRemedy(text)` (from
+`lib/hook-io`) — typically at its bundle entry — and every remedy-less
+`missingPackageMessage`/`missingPackageError` states that text instead. An
+explicit per-call remedy (including a per-gate `MESSAGES.remedy`) still wins,
+and `null` restores the packaged wording. Keep it to a sentence: past ~260
+characters it overruns the 300-char message budget.
+
+**A host's own secret registry can drive the env-bound redaction set.**
+`configureEnvConfigSource({ minSecretLen, extraVars })` (from `lib/env-config`)
+replaces the placeholder floor and unions extra `[A-Z0-9_]` variable names into
+`envBoundSecretVars()`, so a host that already declares its forwarded
+credentials (and their length floor) in a registry of its own feeds the packaged
+helpers from it instead of forking the module. Unset fields keep the package
+derivation; `null` restores it entirely. A malformed source — a non-object, a
+key the seam does not read, a bad field — throws on first use, inside the
+consuming hook's fail-closed catch, never at configure time.
+
 Hook internals are tuned by `_AGENT_SANITIZER_*` variables (redactor daemon
 path/socket/timeouts, sanitize budget, trace channel, Layer-2 reveal dir). The
 leading underscore marks them unstable — the supported surface is the `--hook=`

package/claude-hooks/lib/env-config.mjs

@@ -30,13 +30,101 @@ export function inferenceKeyVars() {
   return inferenceKeys.vars;
 }
 
+/**
+ * Host-supplied secret-vocabulary source, consulted before the package configs.
+ * Null (the default) keeps the package derivation.
+ * @type {{ minSecretLen?: number, extraVars?: string[] } | null}
+ */
+let hostEnvConfigSource = null;
+
+const HOST_SOURCE_LABEL = "configureEnvConfigSource";
+
+const HOST_SOURCE_KEYS = ["minSecretLen", "extraVars"];
+
+/**
+ * Adopt a host's own secret config in place of the package's: `minSecretLen`
+ * replaces the placeholder floor, and `extraVars` are unioned into the
+ * env-bound redaction set. This seam is what lets a host whose credential
+ * registry already names its forwarded secrets (and their length floor) drive
+ * the packaged helpers from that registry instead of forking this module —
+ * a fork is the drift channel that lets the two redaction sets silently
+ * disagree. Unset fields keep their package derivation; `undefined` and `null`
+ * both restore it entirely. Like the missing-package remedy seam there is no
+ * too-late window: the source is consulted at each helper call, never resolved
+ * at module scope, so a later call steers every later answer. A malformed
+ * source — a non-object, a key this seam does not read, a bad field — throws
+ * on first use, not here (see {@link hostSource}).
+ * @param {{ minSecretLen?: number, extraVars?: string[] } | null} source
+ *   host config, or null to restore the package derivation
+ * @returns {void}
+ */
+export function configureEnvConfigSource(source) {
+  hostEnvConfigSource = source ?? null;
+}
+
+/**
+ * The stored host source with its shape validated, or null when unconfigured.
+ * Shape errors — a non-object source, a key this seam does not read — throw
+ * HERE, on first use inside the consuming hook's fail-closed catch, never at
+ * configure time: a top-level throw in a bundle entry would kill the hook
+ * before that catch installs (fail OPEN), and silently ignoring the problem
+ * is worse — a typo'd `minSecretLength: 32` must not leave the helpers
+ * running at the package floor while the host believes it configured 32.
+ * @returns {{ minSecretLen?: number, extraVars?: string[] } | null}
+ */
+function hostSource() {
+  const source = hostEnvConfigSource;
+  if (source === null) return null;
+  if (typeof source !== "object")
+    throw new Error(
+      `${HOST_SOURCE_LABEL}: source must be an object, got ${typeof source}`,
+    );
+  for (const key of Object.keys(source))
+    if (!HOST_SOURCE_KEYS.includes(key))
+      throw new Error(
+        `${HOST_SOURCE_LABEL}: unknown key ${JSON.stringify(key)}; it reads ` +
+          `${HOST_SOURCE_KEYS.join(" and ")}`,
+      );
+  return source;
+}
+
 /**
  * The placeholder floor: a candidate value shorter than this is too short to be a
- * real secret and is skipped by the env-bound redaction pre-gate.
+ * real secret and is skipped by the env-bound redaction pre-gate. A malformed
+ * host floor throws rather than degrading to the package's — a host that set 32
+ * must not silently run at a laxer floor, and a non-positive one would admit
+ * empty placeholders as secrets.
  * @returns {number}
  */
 export function minEnvSecretLen() {
-  return inferenceKeys.min_secret_len;
+  const hostLen = hostSource()?.minSecretLen;
+  if (hostLen === undefined) return inferenceKeys.min_secret_len;
+  if (!Number.isInteger(hostLen) || hostLen <= 0)
+    throw new Error(
+      `${HOST_SOURCE_LABEL}: minSecretLen must be a positive integer, got ${JSON.stringify(hostLen)}`,
+    );
+  return hostLen;
+}
+
+/**
+ * The host's declared extra secret variable names, or throw. A malformed entry
+ * fails CLOSED, same contract as {@link extraSecretVars}: dropping it silently
+ * would leave the host believing a forwarded credential is masked while its
+ * value flows to the model verbatim.
+ * @returns {string[]}
+ */
+function hostExtraSecretVars() {
+  const vars = hostSource()?.extraVars;
+  if (vars === undefined) return [];
+  if (!Array.isArray(vars))
+    throw new Error(`${HOST_SOURCE_LABEL}: extraVars must be an array`);
+  for (const name of vars)
+    if (typeof name !== "string" || !EXTRA_TOKEN_RE.test(name))
+      throw new Error(
+        `${HOST_SOURCE_LABEL}: ${JSON.stringify(name)} is not a variable name ` +
+          "(expected [A-Z0-9_] names)",
+      );
+  return vars;
 }
 
 // A rendered vocabulary token. Restricting it to A-Z/0-9/_ is what lets the
@@ -239,10 +327,11 @@ export function extraSecretVars(env = process.env) {
 
 /**
  * The env-bound redaction set: the UNION of the inference keys, the curated host
- * credentials, any credential-shaped var present in the environment, and the
- * operator's declared extras. The redactor binds the same union; every consumer
- * (the sanitize-output pre-gate, the redactor client's per-request env snapshot)
- * must mirror it exactly, else a credential value would never trip the daemon.
+ * credentials, any credential-shaped var present in the environment, the
+ * operator's declared extras, and the host's configured extras. The redactor
+ * binds the same union; every consumer (the sanitize-output pre-gate, the
+ * redactor client's per-request env snapshot) must mirror it exactly, else a
+ * credential value would never trip the daemon.
  * @param {Record<string, string | undefined>} [env]
  * @returns {string[]}
  */
@@ -253,6 +342,7 @@ export function envBoundSecretVars(env = process.env) {
       ...scrubbed.vars,
       ...dynamicSecretVars(env),
       ...extraSecretVars(env),
+      ...hostExtraSecretVars(),
     ]),
   ];
 }

package/claude-hooks/lib/hook-io.mjs

@@ -241,6 +241,33 @@ export function failedLazyPackages() {
 export const DEFAULT_MISSING_PACKAGE_REMEDY =
   "reinstall the hook dependencies (pnpm install) and retry.";
 
+/**
+ * Host-supplied default remedy, replacing DEFAULT_MISSING_PACKAGE_REMEDY. Null
+ * (the default) keeps the package's wording.
+ * @type {string | null}
+ */
+let missingPackageRemedyOverride = null;
+
+/**
+ * Adopt a host's own remedy as the default {@link missingPackageMessage} and
+ * {@link missingPackageError} state when their caller passes none. This refusal
+ * to hard-code the wording is what prevents a fail-closed reason whose remedy
+ * names a command the host doesn't have: deep call sites (controlPlane's
+ * missing-package throw) never take a remedy argument, so without this seam
+ * they can only ever tell a reader to run `pnpm install` — wrong advice in a
+ * host whose one install entry point is its own setup script. An explicit
+ * per-call remedy still wins over the configured one. Unlike the hookgate
+ * marker there is no too-late window: the remedy is consulted at each throw,
+ * never resolved at module scope, so a later call steers every later message.
+ * Keep it to a sentence — a remedy beyond ~260 characters overruns the 300-char
+ * message budget (see missingPackageMessage).
+ * @param {string | null} remedy  host remedy text, or null to restore the package default
+ * @returns {void}
+ */
+export function configureMissingPackageRemedy(remedy) {
+  missingPackageRemedyOverride = remedy;
+}
+
 /**
  * The fail-closed reason for a package a hook could not load: the recorded
  * loader error plus the remedy. The cause is scrubbed (it is spliced into
@@ -257,7 +284,7 @@ export const DEFAULT_MISSING_PACKAGE_REMEDY =
 export function missingPackageMessage(
   pkg,
   err = lazyImportErrorFor(pkg),
-  remedy = DEFAULT_MISSING_PACKAGE_REMEDY,
+  remedy = missingPackageRemedyOverride ?? DEFAULT_MISSING_PACKAGE_REMEDY,
 ) {
   const prefix = `${pkg} is unavailable: `;
   // 2 for the "; " joiner; 12 for safeErrMessage's own "…[truncated]" marker,
@@ -287,7 +314,7 @@ export function missingPackageMessage(
 export function missingPackageError(
   pkg,
   err = lazyImportErrorFor(pkg),
-  remedy = DEFAULT_MISSING_PACKAGE_REMEDY,
+  remedy = missingPackageRemedyOverride ?? DEFAULT_MISSING_PACKAGE_REMEDY,
 ) {
   return Object.assign(new Error(missingPackageMessage(pkg, err, remedy)), {
     code: "DEP_UNAVAILABLE",

package/claude-hooks/scan-invisible-chars.mjs

@@ -136,16 +136,28 @@ function findMdFiles(dir) {
  * under `dir`. Claude Code loads these as project instructions on entry to their
  * containing directory — a load path that bypasses the PostToolUse sanitizer — so
  * a payload planted in e.g. `packages/foo/CLAUDE.md` reaches the model uncleaned
- * unless it is scanned here. Skips node_modules; `**` skips dot directories by
- * default (`.git`, and `.claude`, which the caller scans separately).
+ * unless it is scanned here. Skips node_modules.
+ *
+ * `**` does not descend into dot directories, so NESTED `.claude/` trees need
+ * their own pattern: the caller scans only the project-root `.claude`, which
+ * would leave a directory-scoped skill at `packages/foo/.claude/skills/x/SKILL.md`
+ * — model context by the same load path — never scanned.
  * @param {string} dir
  * @returns {string[]}
  */
 function findInstructionFiles(dir) {
-  return globSync(["**/CLAUDE.md", "**/CLAUDE.local.md", "**/AGENTS.md"], {
-    cwd: dir,
-    exclude: (name) => name === "node_modules",
-  }).map((name) => join(dir, name));
+  return globSync(
+    [
+      "**/CLAUDE.md",
+      "**/CLAUDE.local.md",
+      "**/AGENTS.md",
+      "**/.claude/**/*.md",
+    ],
+    {
+      cwd: dir,
+      exclude: (name) => name === "node_modules",
+    },
+  ).map((name) => join(dir, name));
 }
 
 // Scanner

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.10.0",
+  "version": "2.11.0",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/python/agent_sanitizer/secrets/data/credential-names.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "The credential-noun vocabulary: the words that make an identifier name a secret. Published so every consumer derives its own matcher from ONE list — a newly recognized noun reaches them all through a version bump instead of N hand edits. Read it from Python via agent_sanitizer.secrets (credential_name_segments / credential_field_name_patterns / non_secret_name_segments) or from JavaScript via the npm subpath export `agent-sanitizer/credential-names`. `parts` are the lowercase words of the noun; a consumer renders them for its own matcher (underscore-joined `API_KEY` and bare-joined `APIKEY` for an env-var NAME, `api[_-]?key` for a `field = value` regex). `uses` says which matcher may use the noun, because the two are not interchangeable: `env-name` matches a variable NAME and never inspects a value, so a broad noun there costs nothing, while `field-value` redacts whatever follows `noun = ` and a broad noun there mangles ordinary text — `key = <20 chars>` is a false-positive flood, so `key`, `pat`, `credential`, `credentials`, `secrets` and `passphrase` are env-name only. `nonSecretSuffixes` are the trailing words that make a credential-shaped name hold a NON-secret (a key's identifier, the public half of a keypair), which a consumer must not redact. Every part is restricted to a-z0-9 so it carries no regex metacharacter; the accessors enforce that and fail closed on a violation, an empty list, or an unknown `uses` value. It sits inside the Python package because a wheel can only ship data under its package directory, while npm's `files`/`exports` can name any path — so ONE physical file backs both ecosystems and there is no copy to drift.",
+  "$comment": "The credential-noun vocabulary: the words that make an identifier name a secret. Published so every consumer derives its own matcher from ONE list — a newly recognized noun reaches them all through a version bump instead of N hand edits. Read it from Python via agent_sanitizer.secrets (credential_name_segments / credential_field_name_patterns / non_secret_name_segments) or from JavaScript via the npm subpath export `agent-sanitizer/credential-names`. `parts` are the lowercase words of the noun; a consumer renders them for its own matcher (underscore-joined `API_KEY` and bare-joined `APIKEY` for an env-var NAME, `api[_-]?key` for a `field = value` regex). `uses` says which matcher may use the noun, because the two are not interchangeable: `env-name` matches a variable NAME and never inspects a value, so a broad noun there costs nothing, while `field-value` redacts whatever follows `noun = ` and a broad noun there mangles ordinary text — `key = <20 chars>` is a false-positive flood, so `key`, `pat`, `credential`, `credentials` and `secrets` are env-name only — `credential`/`credentials` are everyday variable names, and an attribute chain (`credentials = service_account.Credentials.from_service_account_info(info)`) escapes every value-shape skip, so a field-value rendering would redact ordinary source lines. `passphrase` is the exception among them: it is as shape-specific as `password`, and detect-secrets' own KeywordDetector DENYLIST omits it, so name-only would let `passphrase = <secret>` reach the model in cleartext. `nonSecretSuffixes` are the trailing words that make a credential-shaped name hold a NON-secret (a key's identifier, the public half of a keypair), which a consumer must not redact. Every part is restricted to a-z0-9 so it carries no regex metacharacter; the accessors enforce that and fail closed on a violation, an empty list, or an unknown `uses` value. It sits inside the Python package because a wheel can only ship data under its package directory, while npm's `files`/`exports` can name any path — so ONE physical file backs both ecosystems and there is no copy to drift.",
   "nouns": [
     { "parts": ["api", "key"], "uses": ["env-name", "field-value"] },
     { "parts": ["access", "key"], "uses": ["env-name", "field-value"] },
@@ -12,7 +12,7 @@
     { "parts": ["authorization"], "uses": ["env-name", "field-value"] },
     { "parts": ["password"], "uses": ["env-name", "field-value"] },
     { "parts": ["passwd"], "uses": ["env-name", "field-value"] },
-    { "parts": ["passphrase"], "uses": ["env-name"] },
+    { "parts": ["passphrase"], "uses": ["env-name", "field-value"] },
     { "parts": ["bearer"], "uses": ["env-name", "field-value"] },
     { "parts": ["secret"], "uses": ["env-name", "field-value"] },
     { "parts": ["secrets"], "uses": ["env-name"] },

package/src/html.mjs

@@ -1069,6 +1069,23 @@ const VOID_ELEMENTS = new Set([
   "wbr",
 ]);
 
+// Foreign-content roots. Inside SVG and MathML the HTML parser honours a
+// self-closing `/>` (it does not in HTML content), so such a tag opens and
+// closes in one node and the text after it is a sibling, not its child.
+const FOREIGN_ELEMENTS = new Set(["svg", "math"]);
+
+/**
+ * True when `value` is a foreign-content tag that closed itself. Splicing it as
+ * a balance region instead would run to the container's end and delete every
+ * visible word after a decorative hidden `<svg/>`.
+ * @param {string} tagName
+ * @param {string} value
+ * @returns {boolean}
+ */
+function isSelfClosedForeign(tagName, value) {
+  return FOREIGN_ELEMENTS.has(tagName) && /\/\s*>\s*$/.test(value);
+}
+
 // Elements whose content is RAW TEXT / RCDATA / script data: parse5 recognizes
 // NO markup inside them (a `<!…` is not a comment, a `<b>` is not a tag) until
 // the matching end tag. The per-tag balance walk must model this or it would
@@ -1523,7 +1540,10 @@ function scanInlineChildren(node, text, ranges, warned) {
         // A void element never emits a matching close, so a balance region
         // would extend to the container end and splice out following visible
         // text. Emit a single-node range instead (the source branch does too).
-        if (VOID_ELEMENTS.has(tagName))
+        // A self-closed FOREIGN element behaves the same way: in SVG/MathML
+        // content the HTML spec honours the `/>` flag, so the element closes
+        // immediately and everything after it renders.
+        if (VOID_ELEMENTS.has(tagName) || isSelfClosedForeign(tagName, value))
           ranges.push({ start: base, end, kind: "hidden" });
         else {
           state.tag = tagName;

package/src/invisible.mjs

@@ -13,8 +13,18 @@ import { joiningType, isVirama } from "./joining-type.mjs";
 import { isStandardizedVariant } from "./standardized-variants.mjs";
 import { CF_CODEPOINTS } from "./cf-charset.mjs";
 
+// Unicode's Variation_Selector property, whole: the FE00 run, the Mongolian
+// free variation selectors, and the astral E0100 supplement. The Mongolian four
+// are general category Mn, so \p{Cf} does not reach them and CF_CODEPOINTS
+// carries only U+180E (the vowel SEPARATOR) — without them a run of U+180B..D
+// renders as nothing, survives untouched, and counts as VISIBLE length, which
+// also widens the preserved-joiner budget.
 export const VS = [
   ...Array.from({ length: 16 }, (_, i) => 0xfe00 + i),
+  0x180b,
+  0x180c,
+  0x180d,
+  0x180f,
   ...Array.from({ length: 240 }, (_, i) => 0xe0100 + i),
 ]
   .map((codePoint) => String.fromCodePoint(codePoint))

package/src/layer1.mjs

@@ -112,20 +112,27 @@ const ANSI_RE = new RegExp(`(?:${OSC_BRANCH}|${CSI_BRANCH})`, "gu");
 export const LONE_SURROGATE_RE =
   /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
 
+const MAX_ANSI_PASSES = 3;
+
 /**
  * Strip ANSI escape sequences to a fixed point. Removing one sequence can
  * reconstitute another around it (a lone ESC left of `ESC[32m[0m` gains the
  * trailing `[0m` once the inner sequence is removed, forming a brand-new valid
- * sequence the single pass would miss), so iterate until stable: every changed
- * pass consumes at least one ESC introducer, so the pass count is bounded by
- * the input's ESC count, and ANSI-free text exits after one pass.
+ * sequence the single pass would miss), so iterate — but only a fixed few
+ * times. Bounding by the input's ESC count is quadratic on attacker-controlled
+ * text: `("\x1b[").repeat(n) + "m".repeat(n)` reconstitutes exactly ONE
+ * sequence per pass, so n full O(n) scans run, and 48 KB already costs seconds.
+ * The passes are not what makes Layer 1 safe — applyLayer1's residual
+ * CONTROL_INTRODUCER_RE sweep is, and it removes every ESC/C1 byte whatever
+ * survives here. Past the bound a reconstituted sequence therefore degrades to
+ * VISIBLE text rather than a hidden control, which is the fail-open direction.
  * @param {string} input
  * @returns {string}
  */
 export function stripAnsiFully(input) {
   let prev = input;
   let out = prev.replace(ANSI_RE, "");
-  while (out !== prev) {
+  for (let pass = 1; pass < MAX_ANSI_PASSES && out !== prev; pass++) {
     prev = out;
     out = prev.replace(ANSI_RE, "");
   }

package/types/claude-hooks/lib/env-config.d.mts

@@ -4,9 +4,33 @@
  * @returns {string[]}
  */
 export function inferenceKeyVars(): string[];
+/**
+ * Adopt a host's own secret config in place of the package's: `minSecretLen`
+ * replaces the placeholder floor, and `extraVars` are unioned into the
+ * env-bound redaction set. This seam is what lets a host whose credential
+ * registry already names its forwarded secrets (and their length floor) drive
+ * the packaged helpers from that registry instead of forking this module —
+ * a fork is the drift channel that lets the two redaction sets silently
+ * disagree. Unset fields keep their package derivation; `undefined` and `null`
+ * both restore it entirely. Like the missing-package remedy seam there is no
+ * too-late window: the source is consulted at each helper call, never resolved
+ * at module scope, so a later call steers every later answer. A malformed
+ * source — a non-object, a key this seam does not read, a bad field — throws
+ * on first use, not here (see {@link hostSource}).
+ * @param {{ minSecretLen?: number, extraVars?: string[] } | null} source
+ *   host config, or null to restore the package derivation
+ * @returns {void}
+ */
+export function configureEnvConfigSource(source: {
+    minSecretLen?: number;
+    extraVars?: string[];
+} | null): void;
 /**
  * The placeholder floor: a candidate value shorter than this is too short to be a
- * real secret and is skipped by the env-bound redaction pre-gate.
+ * real secret and is skipped by the env-bound redaction pre-gate. A malformed
+ * host floor throws rather than degrading to the package's — a host that set 32
+ * must not silently run at a laxer floor, and a non-positive one would admit
+ * empty placeholders as secrets.
  * @returns {number}
  */
 export function minEnvSecretLen(): number;
@@ -63,10 +87,11 @@ export function dynamicSecretVars(env?: Record<string, string | undefined>): str
 export function extraSecretVars(env?: Record<string, string | undefined>): string[];
 /**
  * The env-bound redaction set: the UNION of the inference keys, the curated host
- * credentials, any credential-shaped var present in the environment, and the
- * operator's declared extras. The redactor binds the same union; every consumer
- * (the sanitize-output pre-gate, the redactor client's per-request env snapshot)
- * must mirror it exactly, else a credential value would never trip the daemon.
+ * credentials, any credential-shaped var present in the environment, the
+ * operator's declared extras, and the host's configured extras. The redactor
+ * binds the same union; every consumer (the sanitize-output pre-gate, the
+ * redactor client's per-request env snapshot) must mirror it exactly, else a
+ * credential value would never trip the daemon.
  * @param {Record<string, string | undefined>} [env]
  * @returns {string[]}
  */

package/types/claude-hooks/lib/hook-io.d.mts

@@ -79,6 +79,23 @@ export function lazyImportErrorFor(pkg: string): unknown;
  * @returns {string[]}
  */
 export function failedLazyPackages(): string[];
+/**
+ * Adopt a host's own remedy as the default {@link missingPackageMessage} and
+ * {@link missingPackageError} state when their caller passes none. This refusal
+ * to hard-code the wording is what prevents a fail-closed reason whose remedy
+ * names a command the host doesn't have: deep call sites (controlPlane's
+ * missing-package throw) never take a remedy argument, so without this seam
+ * they can only ever tell a reader to run `pnpm install` — wrong advice in a
+ * host whose one install entry point is its own setup script. An explicit
+ * per-call remedy still wins over the configured one. Unlike the hookgate
+ * marker there is no too-late window: the remedy is consulted at each throw,
+ * never resolved at module scope, so a later call steers every later message.
+ * Keep it to a sentence — a remedy beyond ~260 characters overruns the 300-char
+ * message budget (see missingPackageMessage).
+ * @param {string | null} remedy  host remedy text, or null to restore the package default
+ * @returns {void}
+ */
+export function configureMissingPackageRemedy(remedy: string | null): void;
 /**
  * The fail-closed reason for a package a hook could not load: the recorded
  * loader error plus the remedy. The cause is scrubbed (it is spliced into

package/types/claude-hooks/scan-invisible-chars.d.mts

@@ -29,8 +29,12 @@ export function findMdFiles(dir: string): string[];
  * under `dir`. Claude Code loads these as project instructions on entry to their
  * containing directory — a load path that bypasses the PostToolUse sanitizer — so
  * a payload planted in e.g. `packages/foo/CLAUDE.md` reaches the model uncleaned
- * unless it is scanned here. Skips node_modules; `**` skips dot directories by
- * default (`.git`, and `.claude`, which the caller scans separately).
+ * unless it is scanned here. Skips node_modules.
+ *
+ * `**` does not descend into dot directories, so NESTED `.claude/` trees need
+ * their own pattern: the caller scans only the project-root `.claude`, which
+ * would leave a directory-scoped skill at `packages/foo/.claude/skills/x/SKILL.md`
+ * — model context by the same load path — never scanned.
  * @param {string} dir
  * @returns {string[]}
  */

package/types/layer1.d.mts

@@ -2,9 +2,14 @@
  * Strip ANSI escape sequences to a fixed point. Removing one sequence can
  * reconstitute another around it (a lone ESC left of `ESC[32m[0m` gains the
  * trailing `[0m` once the inner sequence is removed, forming a brand-new valid
- * sequence the single pass would miss), so iterate until stable: every changed
- * pass consumes at least one ESC introducer, so the pass count is bounded by
- * the input's ESC count, and ANSI-free text exits after one pass.
+ * sequence the single pass would miss), so iterate — but only a fixed few
+ * times. Bounding by the input's ESC count is quadratic on attacker-controlled
+ * text: `("\x1b[").repeat(n) + "m".repeat(n)` reconstitutes exactly ONE
+ * sequence per pass, so n full O(n) scans run, and 48 KB already costs seconds.
+ * The passes are not what makes Layer 1 safe — applyLayer1's residual
+ * CONTROL_INTRODUCER_RE sweep is, and it removes every ESC/C1 byte whatever
+ * survives here. Past the bound a reconstituted sequence therefore degrades to
+ * VISIBLE text rather than a hidden control, which is the fail-open direction.
  * @param {string} input
  * @returns {string}
  */