agent-sanitizer 2.19.3 → 2.19.4

package/claude-hooks/sanitize-output.mjs

@@ -26,15 +26,13 @@ import {
   lazyImport,
   emitHookResponse,
   errMessage,
-  safeErrMessage,
-  failOpenEnabled,
-  failOpenContext,
   makeDeadline,
   lazyImportErrorFor,
   missingPackageMessage,
   DEFAULT_MISSING_PACKAGE_REMEDY,
   HookEvent,
 } from "./lib/hook-io.mjs";
+import { registerFaultPolicy, hookFaultOutcome } from "./lib/hook-fault.mjs";
 import { controlPlane, runJudgeCli } from "./lib/control-plane.mjs";
 import { bestEffortTrace, trace, TraceEvent } from "./lib/trace.mjs";
 import { hasEnvBoundSecret } from "./lib/secret-annotate.mjs";
@@ -552,19 +550,48 @@ export function emitFailClosed(
   message,
   emit = (fields) => emitHookResponse(HookEvent.POST_TOOL_USE, fields),
   remedy = DEFAULT_MISSING_PACKAGE_REMEDY,
+) {
+  const { fields, fallbackFields } = failClosedParts(input, message, remedy);
+  try {
+    emit(fields);
+  } catch {
+    emit(fallbackFields);
+  }
+}
+
+/**
+ * The fail-closed response fields plus the shallow fallback to emit if
+ * serializing them throws. Split out from {@link emitFailClosed} so the posture
+ * table can state this hook's CLOSED verdict as a VALUE — the table is what
+ * `test/claude-hooks-posture.test.mjs` compares each hook's emission against, so
+ * a verdict reachable only by running the emitter could not be pinned there.
+ * @param {any} input  parsed hook input, or undefined if parsing threw
+ * @param {string} message
+ * @param {string} [remedy]  what a reader should run; hosts pass their own
+ * @returns {{ fields: Record<string, unknown>, fallbackFields: Record<string, unknown> }}
+ */
+function failClosedParts(
+  input,
+  message,
+  remedy = DEFAULT_MISSING_PACKAGE_REMEDY,
 ) {
   // Threaded rather than defaulted here: this is the ONLY production caller of
   // failClosedContext, so a remedy it does not pass is a remedy no host can ever
   // reach — the parameter would be live only from tests.
   const additionalContext = failClosedContext(sanitizerDepsLoaded, remedy);
+  const fallbackFields = { updatedToolOutput: message, additionalContext };
+  let updatedToolOutput;
   try {
-    emit({
-      updatedToolOutput: failClosedReplacement(input, message),
-      additionalContext,
-    });
+    updatedToolOutput = failClosedReplacement(input, message);
   } catch {
-    emit({ updatedToolOutput: message, additionalContext });
+    // The shape-matching walk overflowed on a pathologically deep (but valid)
+    // tool_response. The bare string is shallow, always serializable, and still
+    // a valid string tool_response — so the hook stays CLOSED rather than
+    // throwing out of its own failure path, which would emit nothing and let
+    // the harness show the raw, unvetted output.
+    return { fields: fallbackFields, fallbackFields };
   }
+  return { fields: { updatedToolOutput, additionalContext }, fallbackFields };
 }
 
 /**
@@ -595,20 +622,40 @@ export function emitHookFailure(
   remedy = DEFAULT_MISSING_PACKAGE_REMEDY,
   env = process.env,
 ) {
-  if (failOpenEnabled(env)) {
-    emit({
-      additionalContext: failOpenContext("sanitize-output", "tool output", err),
-    });
-    return;
+  const outcome = hookFaultOutcome(HOOK_NAME, err, { input, remedy, env });
+  const fields = /** @type {Record<string, unknown>} */ (outcome.fields);
+  try {
+    emit(fields);
+  } catch (emitErr) {
+    // The open posture's fields are a lone string context — always
+    // serializable — so it declares no fallback, and a throw there is a real
+    // bug the caller must see rather than a suppression to retry.
+    if (outcome.fallbackFields === null) throw emitErr;
+    emit(outcome.fallbackFields);
   }
-  emitFailClosed(
-    input,
-    `[SANITIZATION FAILED — original output suppressed for safety. Hook error: ${safeErrMessage(err)}]`,
-    emit,
-    remedy,
-  );
 }
 
+/**
+ * The suppression placeholder that replaces the tool output under the closed
+ * posture. Named so the posture table and {@link emitFailClosed} cannot drift on
+ * the wording the model sees.
+ * @param {string} cause  the scrubbed hook error
+ * @returns {string}
+ */
+function suppressionMessage(cause) {
+  return `[SANITIZATION FAILED — original output suppressed for safety. Hook error: ${cause}]`;
+}
+
+// This hook's entry in the one posture table (lib/hook-fault.mjs). OPEN is the
+// shared default (a warning context, the original output left in the model's
+// view); CLOSED replaces every string leaf of the output with the placeholder.
+registerFaultPolicy(HOOK_NAME, {
+  event: HookEvent.POST_TOOL_USE,
+  guarded: "tool output",
+  closed: (ctx) =>
+    failClosedParts(ctx.input, suppressionMessage(ctx.message), ctx.remedy),
+});
+
 /**
  * Run the sanitization pipeline over a tool output and return the contract-
  * shaped verdict fields — `mutated_output` (the shape-matching sanitized value)

package/claude-hooks/sanitize-user-prompt.mjs

@@ -20,15 +20,17 @@
  */
 import {
   readStdinJson,
-  safeErrMessage,
-  failOpenEnabled,
-  failOpenContext,
   HookEvent,
   isMain,
   lazyImport,
   missingPackageError,
   DEFAULT_MISSING_PACKAGE_REMEDY,
 } from "./lib/hook-io.mjs";
+import {
+  registerFaultPolicy,
+  hookFaultOutcome,
+  writeFaultOutcome,
+} from "./lib/hook-fault.mjs";
 import { controlPlane, runJudgeCli } from "./lib/control-plane.mjs";
 import { bestEffortTrace, trace, TraceEvent } from "./lib/trace.mjs";
 // classifyPrompt (the user-prompt verdict) and stripAnsiFully (its ANSI stripper)
@@ -73,6 +75,27 @@ export const USER_PROMPT_MESSAGES = Object.freeze({
   remedy: DEFAULT_MISSING_PACKAGE_REMEDY,
 });
 
+const HOOK_NAME = "sanitize-user-prompt";
+
+// This hook's entry in the one posture table (lib/hook-fault.mjs). OPEN is the
+// shared default (a warning context alongside the prompt); CLOSED is a
+// top-level `decision: "block"`, NOT a hookSpecificOutput verdict —
+// UserPromptSubmit has no permissionDecision channel, so this envelope shape is
+// the gate's own and the table records it rather than a reader inferring it.
+registerFaultPolicy(HOOK_NAME, {
+  event: HookEvent.USER_PROMPT_SUBMIT,
+  guarded: "prompt",
+  closed: (ctx) => ({
+    envelope: {
+      decision: "block",
+      reason: {
+        ...USER_PROMPT_MESSAGES,
+        ...ctx.messages,
+      }.hookFailed(ctx.message),
+    },
+  }),
+});
+
 /* c8 ignore start — module-load boundary: the imports resolve in every real
  * run, and their failure (the package absent) can't be simulated in-process, so
  * neither arm is observable to the in-process tests. The judge's typeof guard
@@ -202,13 +225,13 @@ export async function main(read, write, opts = {}) {
   // exactly what may have failed to load. Either way this is the HOOK failing;
   // a prompt the working stripper flagged is still blocked in both postures.
   await runJudgeCli(
-    "sanitize-user-prompt",
+    HOOK_NAME,
     (event) => {
       const verdict = judgeSanitizeUserPrompt(event, strip, messages);
       // Announce engagement on the trace channel like the other stdin hooks —
       // a prompt gate that silently stopped running is otherwise invisible.
       emitTrace(TraceEvent.HOOK_RAN, {
-        hook: "sanitize-user-prompt",
+        hook: HOOK_NAME,
         outcome:
           verdict.decision === controlPlane().Decision.DENY
             ? "deny"
@@ -222,24 +245,9 @@ export async function main(read, write, opts = {}) {
       readInput: read,
       write,
       onError: (err) =>
-        write(
-          JSON.stringify(
-            failOpenEnabled(env)
-              ? {
-                  hookSpecificOutput: {
-                    hookEventName: HookEvent.USER_PROMPT_SUBMIT,
-                    additionalContext: failOpenContext(
-                      "sanitize-user-prompt",
-                      "prompt",
-                      err,
-                    ),
-                  },
-                }
-              : {
-                  decision: "block",
-                  reason: messages.hookFailed(safeErrMessage(err)),
-                },
-          ),
+        writeFaultOutcome(
+          hookFaultOutcome(HOOK_NAME, err, { messages, env }),
+          write,
         ),
     },
   );

package/claude-hooks/scan-invisible-chars.mjs

@@ -9,13 +9,20 @@ import { readFileSync, globSync, writeFileSync, unlinkSync } from "node:fs";
 import { join, relative } from "node:path";
 import {
   awaitLazyDependency,
+  safeErrMessage,
   hookgateMarkerPath,
+  HookEvent,
   isMain,
   lazyImport,
   markerIsTrusted,
   probeSetupAlive,
   writeFileNoFollow,
 } from "./lib/hook-io.mjs";
+import {
+  registerFaultPolicy,
+  hookFaultOutcome,
+  writeFaultOutcome,
+} from "./lib/hook-fault.mjs";
 import {
   ALERT_FILE,
   ALERT_ACK_FILE,
@@ -77,6 +84,69 @@ async function ensureSanitizerLoaded() {
   /* c8 ignore stop */
 }
 
+const HOOK_NAME = "scan-invisible-chars";
+
+/**
+ * The stderr line both posture arms share: what broke, and what it cost.
+ * @param {{ message: string }} ctx
+ * @returns {string}
+ */
+function faultLine(ctx) {
+  return (
+    `${HOOK_NAME}: ${ctx.message}. Instruction files were NOT fully scanned ` +
+    "for hidden Unicode, so any payload in them reaches the model unvetted."
+  );
+}
+
+// This hook's entry in the one posture table (lib/hook-fault.mjs). It has no
+// stdout verdict channel — SessionStart cannot deny — so BOTH arms are stated
+// explicitly rather than taking the shared additionalContext default: the only
+// enforcement a SessionStart hook can reach is the cross-hook alert, which makes
+// the PreToolUse gate ask once on the next tool call.
+registerFaultPolicy(HOOK_NAME, {
+  event: HookEvent.SESSION_START,
+  guarded: "instruction files",
+  open: (ctx) => ({
+    stderr: `${faultLine(ctx)} Passing through unguarded; set AGENT_SANITIZER_FAIL_OPEN=0 to arm the tool-call gate instead.\n`,
+    exitCode: 1,
+  }),
+  closed: (ctx) => ({
+    stderr: `${faultLine(ctx)} Arming the tool-call gate (AGENT_SANITIZER_FAIL_OPEN=0).\n`,
+    exitCode: 1,
+    armAlert: true,
+  }),
+});
+
+/**
+ * Render this hook's fault under the declared posture, and return the text (if
+ * any) that must ride in the cross-hook alert so a later gate carries the
+ * posture this hook cannot express itself.
+ * @param {unknown} err
+ * @returns {string[]}
+ */
+function reportFault(err) {
+  const outcome = hookFaultOutcome(HOOK_NAME, err);
+  process.exitCode = writeFaultOutcome(outcome);
+  return outcome.armAlert ? [/** @type {string} */ (outcome.stderr)] : [];
+}
+
+/**
+ * Persist the accumulated alert text for the PreToolUse gate, or leave the alert
+ * absent when there is nothing to surface.
+ *
+ * ALERT_FILE sits at a predictable, world-visible $TMPDIR path, so a plain
+ * writeFileSync would follow a co-tenant-planted symlink and overwrite an
+ * arbitrary file this uid owns. Create it symlink-refusingly (see
+ * writeFileNoFollow); the gate treats an absent alert as "nothing to surface",
+ * so a lost race degrades safely rather than to a hijacked write.
+ * @param {string[]} parts
+ * @returns {void}
+ */
+function persistAlert(parts) {
+  if (parts.length === 0) return;
+  writeFileNoFollow(ALERT_FILE, parts.join("\n") + "\n");
+}
+
 // Decoder
 
 /**
@@ -249,50 +319,118 @@ export { formatReport };
 
 // Main (skip when imported for testing)
 
-// Stryker disable all: CLI-entry body. It runs only as a spawned subprocess,
-// which in-process tests can't observe, so every mutant here is unkillable by
-// construction (same boundary as the c8-ignored regions below). The exported
-// scanFile/decodeRun above carry the real, mutation-tested logic.
 /**
- * Scan every instruction file under the project for invisible-char findings.
- * @returns {Array<{file: string, findings: ReturnType<typeof scanFile>}>}
+ * Scan every instruction file under the project, ACCOUNTING for every target
+ * the finder returned: `scanned + skipped.length === targets.length`, always.
+ *
+ * The accounting is the point. This scan is the only thing standing between a
+ * poisoned `CLAUDE.md` and a session that loads it as instructions, and its
+ * caller announces "clean" on the trace channel — the channel that exists so a
+ * MISSING announcement is loud. A per-file failure swallowed into an empty
+ * findings list turns "we could not read this file" into "this file is fine",
+ * which is the one lie this hook must never tell. So a file that cannot be read
+ * is REPORTED as unscanned, not dropped.
+ *
+ * ANY errno is a skip; only a non-filesystem throw propagates. The split is
+ * between "this file could not be read" (report it and keep scanning) and "this
+ * code is broken" (a TypeError from an unloaded binding — nothing here can be
+ * trusted, so it goes to the caller's declared failure posture). Catching only
+ * ENOENT would invert the enforcement: one EACCES target would discard the
+ * result for EVERY other instruction file, leaving them unscanned and
+ * un-auto-cleaned, and under the shipped OPEN posture the hook fault arms
+ * nothing — so the SUSPICIOUS failure would get weaker enforcement than the
+ * benign glob race, which reaches `partial` and arms the gate. Same errno-vs-bug
+ * split {@link autoCleanFindings} uses.
+ * @param {string} [dir]  project root to scan (injectable for tests)
+ * @returns {{
+ *   targets: string[],
+ *   scanned: number,
+ *   findings: Array<{file: string, findings: ReturnType<typeof scanFile>}>,
+ *   skipped: Array<{file: string, reason: string}>,
+ * }}
  */
-function scanProject() {
+export function scanProject(dir = PROJECT_DIR) {
   const targets = [
     ...new Set([
-      ...findInstructionFiles(PROJECT_DIR),
-      ...findMdFiles(join(PROJECT_DIR, ".claude")),
+      ...findInstructionFiles(dir),
+      ...findMdFiles(join(dir, ".claude")),
     ]),
   ];
-  const allFindings = [];
+  const findings = [];
+  const skipped = [];
+  let scanned = 0;
   for (const file of targets) {
+    let fileFindings;
     try {
-      const findings = scanFile(file);
-      if (findings.length > 0) {
-        allFindings.push({ file: relative(PROJECT_DIR, file), findings });
-      }
-    } catch {
-      // File doesn't exist or unreadable
+      fileFindings = scanFile(file);
+    } catch (err) {
+      if (/** @type {NodeJS.ErrnoException} */ (err).code === undefined)
+        throw err;
+      // safeErrMessage, not errMessage: this reason is rendered into stderr and
+      // into ALERT_FILE, and an errno message embeds the absolute path globbed
+      // out of a possibly-hostile repo — a filename carrying ANSI or invisible
+      // bytes would otherwise reach the operator's terminal raw.
+      skipped.push({ file: relative(dir, file), reason: safeErrMessage(err) });
+      continue;
     }
+    scanned++;
+    if (fileFindings.length > 0)
+      findings.push({ file: relative(dir, file), findings: fileFindings });
   }
-  return allFindings;
+  return { targets, scanned, findings, skipped };
 }
 
+/**
+ * The report for targets the scan could not read. Rendered into the alert the
+ * PreToolUse gate surfaces, so an incomplete scan reaches the operator as a
+ * checkpoint rather than as silence.
+ * @param {Array<{file: string, reason: string}>} skipped
+ * @returns {string}
+ */
+export function formatSkipped(skipped) {
+  return [
+    "",
+    "━━━ INSTRUCTION FILES NOT SCANNED ━━━",
+    "",
+    "These files load as project instructions but could NOT be read, so they",
+    "were never checked for hidden Unicode. Treat their content as unvetted.",
+    "",
+    ...skipped.map(({ file, reason }) => `  ${file}: ${reason}`),
+    "",
+  ].join("\n");
+}
+
+// Stryker disable all: CLI-entry body. It runs only as a spawned subprocess,
+// which in-process tests can't observe, so every mutant here is unkillable by
+// construction (same boundary as the c8-ignored regions below). The exported
+// scanFile / decodeRun / scanProject above carry the real, tested logic.
 /**
  * The hook's CLI: scan the instruction files, auto-clean what it can, persist
  * the alert for the PreToolUse gate otherwise. Exported so a bundle entry
  * (which must claim the CLI slot before this module loads) can run the exact
  * same scan instead of duplicating it.
- * @param {{ trace?: import("./lib/trace.mjs").TraceFn }} [opts]  `trace` is where
- *   this scan announces engagement; a host with its own trace channel passes its
- *   sink so the announcement lands where its detector reads (see lib/trace.mjs).
+ * @param {{
+ *   trace?: import("./lib/trace.mjs").TraceFn,
+ *   scan?: () => ReturnType<typeof scanProject>,
+ * }} [opts]  `trace` is where this scan announces engagement; a host with its
+ *   own trace channel passes its sink so the announcement lands where its
+ *   detector reads (see lib/trace.mjs). `scan` is the scanner, injectable so the
+ *   FAULT path below — a scanner that throws something other than an errno, i.e.
+ *   a bug — is drivable end to end; no filesystem state can force it, and an
+ *   untested fault path is how a posture goes missing in the first place.
  * @returns {Promise<void>}
  */
-export async function cliMain({ trace: sink = trace } = {}) {
+export async function cliMain({ trace: sink = trace, scan: runScan } = {}) {
   // Bound best-effort: the announcements below run BEFORE the auto-clean and
   // the alert write, with no catch above them, so a throwing host sink would
   // abort the scan silently (see bestEffortTrace).
   const emitTrace = bestEffortTrace(sink);
+  // Everything the PreToolUse gate must surface this session, written once at
+  // the end: an incomplete scan and an uncleanable file are independent reasons
+  // to arm the gate, and two separate writes would have the second clobber the
+  // first.
+  /** @type {string[]} */
+  const alertParts = [];
   /* c8 ignore start -- fail-closed module-load guard: only reachable when the
      agent-sanitizer import above failed, which can't be simulated in the
      spawned-subprocess CLI run the tests observe. */
@@ -301,11 +439,21 @@ export async function cliMain({ trace: sink = trace } = {}) {
     // the trace channel — a scan that never ran is otherwise invisible, and the
     // downstream PreToolUse sanitize gate then passes cleanly all session.
     emitTrace(TraceEvent.SCAN_INVISIBLE_CHARS_RAN, { outcome: "skipped" });
-    process.stderr.write(
-      "scan-invisible-chars: agent-sanitizer failed to load (node deps not " +
-        "installed and session-setup did not finish in time); instruction " +
-        "files were NOT scanned for hidden Unicode. Run `pnpm install`.\n",
+    // Through the shared posture table, NOT a bare exit(1): this hook took an
+    // advisory posture unconditionally, so an operator who pinned
+    // AGENT_SANITIZER_FAIL_OPEN=0 got only a warning on the one hook guarding
+    // session-start ingress, and the PreToolUse gate then passed cleanly for
+    // the rest of the session. The closed arm arms the cross-hook alert, which
+    // is the only channel a SessionStart hook has to make a later gate ask.
+    alertParts.push(
+      ...reportFault(
+        new Error(
+          "agent-sanitizer failed to load (node deps not installed and " +
+            "session-setup did not finish in time); run `pnpm install`",
+        ),
+      ),
     );
+    persistAlert(alertParts);
     process.exit(1);
   }
   /* c8 ignore stop */
@@ -320,22 +468,61 @@ export async function cliMain({ trace: sink = trace } = {}) {
     }
   }
 
-  const allFindings = scanProject();
+  // Only a non-errno throw reaches here — a bug in the scanner, not a file it
+  // could not read (those are accounted for in `skipped`). It is a fault of THIS
+  // hook, so it renders through the same posture table as every other hook's
+  // fault instead of aborting with no announcement at all.
+  let scan;
+  try {
+    scan = (runScan ?? scanProject)();
+  } catch (err) {
+    emitTrace(TraceEvent.SCAN_INVISIBLE_CHARS_RAN, { outcome: "skipped" });
+    alertParts.push(...reportFault(err));
+    persistAlert(alertParts);
+    return;
+  }
+  const { findings: allFindings, skipped, scanned } = scan;
 
-  if (allFindings.length === 0) {
+  // "clean" is a claim about EVERY target, so it may only be made when every
+  // target was read. A scan that could not read one says "partial" and arms the
+  // gate: an unread instruction file is UNVETTED context, not absent findings.
+  if (skipped.length > 0) {
+    emitTrace(TraceEvent.SCAN_INVISIBLE_CHARS_RAN, {
+      outcome: "partial",
+      scanned,
+      skipped: skipped.length,
+      files: allFindings.length,
+    });
+    const notice = formatSkipped(skipped);
+    process.stderr.write(notice + "\n");
+    alertParts.push(notice);
+  } else if (allFindings.length === 0) {
     emitTrace(TraceEvent.SCAN_INVISIBLE_CHARS_RAN, { outcome: "clean" });
     return;
+  } else {
+    emitTrace(TraceEvent.SCAN_INVISIBLE_CHARS_RAN, {
+      outcome: "found",
+      files: allFindings.length,
+    });
   }
-  emitTrace(TraceEvent.SCAN_INVISIBLE_CHARS_RAN, {
-    outcome: "found",
-    files: allFindings.length,
-  });
 
-  // Auto-clean contaminated files so the session proceeds without blocking
-  // every tool call; the gate hook is the fallback when cleaning fails.
+  if (allFindings.length > 0)
+    alertParts.push(...autoCleanFindings(allFindings, PROJECT_DIR));
+  persistAlert(alertParts);
+}
+
+/**
+ * Auto-clean the contaminated files so the session proceeds without blocking
+ * every tool call, and return the alert text for whatever could not be cleaned
+ * (empty when everything was). The gate hook is the fallback for the rest.
+ * @param {Array<{file: string, findings: ReturnType<typeof scanFile>}>} allFindings
+ * @param {string} dir  the root the finding paths are relative to
+ * @returns {string[]}
+ */
+function autoCleanFindings(allFindings, dir) {
   let cleaned = 0;
   for (const { file } of allFindings) {
-    const absPath = join(PROJECT_DIR, file);
+    const absPath = join(dir, file);
     try {
       const original = readFileSync(absPath, "utf-8");
       const stripped = stripInvisible(original);
@@ -344,15 +531,21 @@ export async function cliMain({ trace: sink = trace } = {}) {
         cleaned++;
       }
       /* c8 ignore start -- only fires on a file this uid cannot rewrite, which the test run cannot create */
-    } catch {
-      // Unreadable or unwritable: the file stays contaminated and falls into the
-      // alert path below, which hands it to the PreToolUse gate.
+    } catch (err) {
+      // Narrowed to filesystem errnos, and the reason is REPORTED rather than
+      // swallowed: an unwritable file legitimately falls through to the alert
+      // path below, but a throw from stripInvisible is a bug in the sanitizer
+      // and must not be laundered into "this file resisted cleaning".
+      if (/** @type {NodeJS.ErrnoException} */ (err).code === undefined)
+        throw err;
+      process.stderr.write(
+        `scan-invisible-chars: could not clean ${file}: ${safeErrMessage(err)}\n`,
+      );
     }
     /* c8 ignore stop */
   }
 
   const report = formatReport(allFindings);
-
   if (cleaned === allFindings.length) {
     process.stderr.write(
       report +
@@ -363,16 +556,11 @@ export async function cliMain({ trace: sink = trace } = {}) {
         "suspicion, and restart the session if in doubt. Future sessions load " +
         "the cleaned files.\n",
     );
-    /* c8 ignore start -- only reachable when the write catch above fires */
-  } else {
-    process.stderr.write(report + "\n");
-    // ALERT_FILE sits at a predictable, world-visible $TMPDIR path, so a plain
-    // writeFileSync would follow a co-tenant-planted symlink and overwrite an
-    // arbitrary file this uid owns. Create it symlink-refusingly (see
-    // writeFileNoFollow); the PreToolUse gate treats an absent alert as "nothing
-    // to surface", so a lost race degrades safely rather than to a hijacked write.
-    writeFileNoFollow(ALERT_FILE, report + "\n");
+    return [];
   }
+  /* c8 ignore start -- only reachable when the write catch above fires */
+  process.stderr.write(report + "\n");
+  return [report];
   /* c8 ignore stop */
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.19.3",
+  "version": "2.19.4",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {