agent-sanitizer 2.19.3 → 2.19.4

package/src/ansi.mjs

@@ -0,0 +1,207 @@
+/**
+ * The ONE ANSI grammar: the raw control-introducer charset and the tokenizer
+ * every consumer scans with.
+ *
+ * Two modules need this grammar and they cannot import each other —
+ * `layer1.mjs` imports `invisible.mjs`, so `invisible.mjs` (which owns the
+ * public `isSgrOnly` / `SGR_RE`) must not import back. Before this module the
+ * grammar was therefore written out twice with DIFFERENT param rules
+ * (`invisible.mjs`'s SGR regex accepted any digit run, `layer1.mjs`'s CSI
+ * branch capped each parameter at four digits), and the introducer charset
+ * three times. The looser copy suppressed the operator warning for a sequence
+ * the stripper could not match: `ESC[12345m` read as "display-only colour"
+ * while `[12345m` was spliced into the model's view as visible text. One
+ * tokenizer, one charset, consumed by both — the disagreement cannot recur.
+ *
+ * Same precedent (and same reason) as `cf-charset.mjs`: a dependency-free leaf
+ * module both layers read from.
+ */
+
+// Raw control introducers that must not survive Layer 1: 7-bit ESC (U+001B) and
+// the entire 8-bit C1 control block (U+0080-U+009F) — which includes CSI
+// (U+009B), the string introducers DCS/SOS/OSC/PM/APC
+// (U+0090/0098/009D/009E/009F), and ST (U+009C). Gating the whole C1 block, not
+// just the introducers the sequence grammar below names, fails closed: a
+// DCS/SOS/PM/APC string the grammar does not consume still loses its introducer
+// and terminator, so no terminal can hide-render its body as a control payload.
+//
+// A SOURCE STRING, not a literal: three call sites need it with different flags
+// (`g` for the Layer-1 sweep, unflagged for the prompt gate, `g` again to drive
+// the scan below), and spelling the class out at each site is how the three
+// copies came to spell the same byte two different ways — which defeats a
+// grep-based drift check as well. Building from `\uXXXX` escapes keeps every
+// raw control byte out of the source (no `no-control-regex` disable needed).
+export const CONTROL_INTRODUCER_SOURCE = "[\\u001b\\u0080-\\u009f]";
+
+// SGR (Select Graphic Rendition): colors, bold, reset. The grammar is closed:
+// params are [0-9;:]* and the final byte is `m`, so a match can only restyle
+// text — never reposition the cursor, erase, or smuggle an OSC string. `:` is
+// included alongside `;` because ITU T.416 colon-separated SGR sub-parameters
+// (truecolor `ESC[38:2:255:0:0m`, as emitted by tmux/kitty/mintty) are pure
+// display-only SGR too. A SGR sequence has TWO encodings: the 7-bit `ESC [ … m`
+// and the 8-bit C1 form where a single U+009B (CSI) replaces `ESC [`; both must
+// be recognized, or a C1-introduced `U+009B 31m … 0m` is pure color yet is
+// misread as a non-SGR payload.
+const SGR_SOURCE = "(?:\\u001b\\[|\\u009b)[0-9;:]*m";
+
+/**
+ * Public alias kept for compatibility (re-exported by `invisible.mjs` and the
+ * package root). It is now DERIVED: {@link scanAnsi} classifies a token as SGR
+ * by testing the token's own text against this exact source, so the predicate
+ * and the regex can no longer describe different languages.
+ */
+export const SGR_RE = new RegExp(SGR_SOURCE, "g");
+
+// The same language, anchored — the SGR/CSI discriminator for a token the
+// scanner has already delimited.
+const SGR_ANCHORED_RE = new RegExp(`^${SGR_SOURCE}$`);
+
+// Private parameter-prefix and intermediate bytes that may follow an
+// introducer before the parameters (`ESC[?25h`, `ESC(B`, `ESC#8`). Also covers
+// the 7-bit `ESC [` CSI introducer's bracket itself.
+const CSI_INTRO_RE = /[[()#;?]/;
+
+// ECMA-48 parameter bytes.
+const CSI_PARAM_RE = /[0-9;:]/;
+
+// ECMA-48 final bytes, minus the ones a terminal never accepts here. Digits are
+// PARAMETER bytes and can never terminate a sequence — an unterminated `ESC[`
+// must not eat trailing visible digits (`ESC[2024 report` is NOT `ESC[` +
+// final-byte `2`; it is an incomplete intro whose ESC the residual sweep
+// removes, leaving "2024 report" intact). `<=>?` (0x3C-0x3F) are private
+// PARAMETER-prefix bytes per ECMA-48 § 5.4, not finals — including them let a
+// private-marker sequence terminate one byte too early. `~` (0x7E) IS a real
+// final byte (vt220 function keys, `ESC[3~` for Delete) and is kept.
+const CSI_FINAL_RE = /[A-PR-TZcf-nqrty~]/;
+
+const ESC = 0x1b;
+const CSI_C1 = 0x9b;
+const ST_C1 = 0x9c;
+const OSC_C1 = 0x9d;
+const BEL = 0x07;
+
+/** The four things an introducer can turn out to be. */
+export const TOKEN_KIND = Object.freeze({
+  /** A display-only `ESC[…m` / `U+009B…m` colour sequence. */
+  SGR: "sgr",
+  /** Any other complete CSI / two-byte escape (cursor move, erase, charset). */
+  CSI: "csi",
+  /** An OSC string: introducer, body and terminator as one unit. */
+  OSC: "osc",
+  /** An introducer that starts no sequence the grammar recognizes. */
+  ORPHAN: "orphan-introducer",
+});
+
+/**
+ * @typedef {object} AnsiToken
+ * @property {number} start Index of the introducer.
+ * @property {number} end Index one past the last character of the token.
+ * @property {string} kind One of {@link TOKEN_KIND}.
+ */
+
+/**
+ * End index of the OSC string starting at `start`, or -1 if no OSC introducer
+ * is there.
+ *
+ * An OSC (Operating System Command) string is `<introducer> body <terminator>`:
+ * a title, a clickable-hyperlink URL, a clipboard write — i.e. attacker-
+ * controlled PAYLOAD TEXT. Consuming the introducer alone would leave that
+ * payload in the model's view, so the whole string is one token. Three ways it
+ * can end:
+ *   1. a real terminator — ST (`ESC\` or the 8-bit C1 ST U+009C) or the legacy
+ *      BEL — which is consumed with the body.
+ *   2. an ABORT: per ECMA-48/xterm a bare ESC (one not forming ST) drops the
+ *      terminal out of the OSC string, and a nested C1 OSC introducer likewise
+ *      starts something new. The token ends BEFORE that byte so the scan
+ *      re-reads it as its own sequence — without this, an interior ESC deleted
+ *      the rest of the document via case 3.
+ *   3. end of input, for a genuinely unterminated string: fail closed and drop
+ *      everything from the introducer on, so no OSC body survives.
+ * @param {string} text
+ * @param {number} start
+ * @returns {number}
+ */
+function scanOsc(text, start) {
+  const code = text.charCodeAt(start);
+  let i = -1;
+  if (code === OSC_C1) i = start + 1;
+  if (code === ESC && text[start + 1] === "]") i = start + 2;
+  if (i < 0) return -1;
+  for (; i < text.length; i++) {
+    const byte = text.charCodeAt(i);
+    if (byte === BEL || byte === ST_C1) return i + 1;
+    if (byte === ESC) return text[i + 1] === "\\" ? i + 2 : i;
+    if (byte === OSC_C1) return i;
+  }
+  return text.length;
+}
+
+/**
+ * End index of the CSI / two-byte escape sequence starting at `start`, or -1
+ * when the introducer completes no sequence.
+ *
+ * Single-pass and greedy: intro bytes, then parameter bytes, then exactly one
+ * final byte. The previous regex form had to BOUND the intro run ({0,12})
+ * because `;` lives in both the intro and parameter classes, so an unbounded
+ * run let a `;#;#…` string be split between the two quantifiers — quadratic
+ * backtracking (CodeQL js/polynomial-redos). A hand-written scanner never
+ * backtracks, so the bound is gone and the scan is linear by construction.
+ * @param {string} text
+ * @param {number} start
+ * @returns {number}
+ */
+function scanCsi(text, start) {
+  const code = text.charCodeAt(start);
+  if (code !== ESC && code !== CSI_C1) return -1;
+  let i = start + 1;
+  while (i < text.length && CSI_INTRO_RE.test(text[i])) i++;
+  while (i < text.length && CSI_PARAM_RE.test(text[i])) i++;
+  if (i < text.length && CSI_FINAL_RE.test(text[i])) return i + 1;
+  return -1;
+}
+
+// Drives the scan: jumping introducer-to-introducer keeps the common case (text
+// with no escapes at all) a single native regex scan rather than a per-character
+// JS loop.
+const INTRODUCER_SCAN_RE = new RegExp(CONTROL_INTRODUCER_SOURCE, "g");
+
+/**
+ * Tokenize every raw control introducer in `text`.
+ *
+ * Every introducer yields exactly one token — an ORPHAN when it starts nothing
+ * the grammar recognizes — so "which introducers are in this text" and "which
+ * sequences are in this text" are answered by the same scan. That is what lets
+ * the stripper (splice every non-orphan token, then sweep) and the SGR-only
+ * predicate (every token is SGR) agree by construction.
+ *
+ * Tokens are disjoint and ordered by `start`; each `end` is strictly greater
+ * than its `start`, so the scan always advances.
+ * @param {string} text
+ * @returns {AnsiToken[]}
+ */
+export function scanAnsi(text) {
+  /** @type {AnsiToken[]} */
+  const tokens = [];
+  INTRODUCER_SCAN_RE.lastIndex = 0;
+  let match;
+  while ((match = INTRODUCER_SCAN_RE.exec(text)) !== null) {
+    const start = match.index;
+    const oscEnd = scanOsc(text, start);
+    const csiEnd = oscEnd < 0 ? scanCsi(text, start) : -1;
+    let end = start + 1;
+    /** @type {string} */
+    let kind = TOKEN_KIND.ORPHAN;
+    if (oscEnd >= 0) {
+      end = oscEnd;
+      kind = TOKEN_KIND.OSC;
+    } else if (csiEnd >= 0) {
+      end = csiEnd;
+      kind = SGR_ANCHORED_RE.test(text.slice(start, csiEnd))
+        ? TOKEN_KIND.SGR
+        : TOKEN_KIND.CSI;
+    }
+    tokens.push({ start, end, kind });
+    INTRODUCER_SCAN_RE.lastIndex = end;
+  }
+  return tokens;
+}

package/src/confusables.mjs

@@ -38,8 +38,12 @@
  *
  * ORDERING: the soundness argument assumes no later layer erases code points
  * from the same field, which would let an unmapped glyph the gate relied on
- * disappear after the decision. Layer 4 runs before sanitizeAuthoredContent on
- * Bash.command; keep it there.
+ * disappear after the decision — a zero-width run padded into a token suppresses
+ * the fold, and the erasing layer then removes the very evidence for skipping it.
+ * This fold does NOT run last: on Bash.command the invisible-char strip follows
+ * it. A caller that composes the two is therefore responsible for re-running
+ * this fold on the post-erasure text until it reports nothing, which is what the
+ * hook driver in claude-hooks/lib/layer-pipeline.mjs does.
  *
  * Genuine non-confusable non-ASCII (accented Latin, CJK, emoji) is untouched
  * regardless, since a faithful scanner does not flag it.

package/src/html.mjs

@@ -57,6 +57,13 @@ export {
 // hand-rolled parser kept re-introducing simply cannot arise. Ambiguity still
 // fails OPEN (treated as visible): an unresolved unit, `calc()`, or `var()`
 // never counts as hidden.
+//
+// Every ident in a value — keyword, function name, dimension unit — is
+// escape-decoded and lowercased ONCE at the parse boundary (see
+// {@link canonicalizeValue}), so the detectors below compare canonical tokens
+// against literals. Doing it per-site is what let `left:-9999PX` through: CSS
+// units are ASCII case-insensitive, and every site that forgot `.toLowerCase()`
+// was a one-keystroke bypass of the whole layer.
 
 // A length/opacity/size is "near zero" when its magnitude is below this — a
 // browser renders 0.0001px text or 0.001 opacity as effectively invisible, so
@@ -206,7 +213,9 @@ function isHidingTransform(node) {
   if (!node) return false;
   for (const fn of valueTokens(node)) {
     if (fn.type !== "Function") continue;
-    const name = fn.name.toLowerCase();
+    // Function names, units and idents arrive lowercased and escape-decoded
+    // from parseDeclarations, so a literal compare is correct by construction.
+    const name = fn.name;
     const args = valueTokens(fn);
     if (/^(?:scale|scale3d|scalex|scaley|matrix|matrix3d)$/.test(name)) {
       // scale/matrix collapse to nothing when EITHER axis factor is (near-)zero —
@@ -240,12 +249,8 @@ function isHidingTransform(node) {
       // normalizes deg/grad/rad/turn to [0,360), and a near-90/270 band absorbs
       // the float drift of rad→deg.
       const a = args[0];
-      if (
-        a &&
-        a.type === "Dimension" &&
-        ANGLE_UNITS.has(a.unit.toLowerCase())
-      ) {
-        const degrees = hueDegrees(`${a.value}${a.unit}`.toLowerCase());
+      if (a && a.type === "Dimension" && ANGLE_UNITS.has(a.unit)) {
+        const degrees = hueDegrees(`${a.value}${a.unit}`);
         if (
           degrees !== null &&
           (Math.abs(degrees - 90) < NEAR_ZERO_EPSILON ||
@@ -279,7 +284,7 @@ function isHidingTransform(node) {
 function isHidingFilter(node) {
   if (!node) return false;
   for (const fn of valueTokens(node)) {
-    if (fn.type !== "Function" || fn.name.toLowerCase() !== "opacity") continue;
+    if (fn.type !== "Function" || fn.name !== "opacity") continue;
     const amount = valueTokens(fn)[0];
     if (!amount) continue;
     if (
@@ -321,7 +326,7 @@ function clipEdge(token) {
 function isClipRectHidden(node) {
   if (!node) return false;
   const rect = valueTokens(node).find(
-    (t) => t.type === "Function" && t.name.toLowerCase() === "rect",
+    (t) => t.type === "Function" && t.name === "rect",
   );
   if (!rect) return false;
   const edges = valueTokens(rect).map(clipEdge);
@@ -686,18 +691,50 @@ function canonicalizeColor(raw) {
   return canonicalizeColorFunction(value) ?? value;
 }
 
+// True when a value node paints — or cannot be proven NOT to paint — a
+// background IMAGE layer: a `url()`, a `*-gradient()` or an `image-set()`
+// anywhere in the value. The value AST is walked rather than a re-serialized
+// string regexed: an escaped function name (`\49 mage-set(…)`, which a browser
+// reads as `image-set(…)`) survives serialization escaped and slipped past the
+// regex, so the image layer went unseen and same-colored text painted over an
+// image was spliced as hidden. A `Raw` node — a value css-tree could not parse,
+// which is also what an escaped `url(` degrades to — is unresolvable and so
+// counts as an image layer (fail OPEN: no same-color hide).
+/** @param {any} node value node, or null @returns {boolean} */
+function paintsImageLayer(node) {
+  if (!node) return false;
+  let found = false;
+  csstree.walk(node, {
+    enter(/** @type {any} */ child) {
+      if (child.type === "Url" || child.type === "Raw") found = true;
+      // Names are canonicalized at the parse boundary, so a suffix test covers
+      // every gradient (`linear-`/`radial-`/`conic-`/`repeating-`/`-webkit-`)
+      // and both `image-set` spellings. `url` appears as a Function (not a Url)
+      // node when its name carried an escape — the very case the old regex on
+      // the re-serialized text missed.
+      if (
+        child.type === "Function" &&
+        (child.name === "url" ||
+          child.name.endsWith("gradient") ||
+          child.name.endsWith("image-set"))
+      )
+        found = true;
+    },
+  });
+  return found;
+}
+
 // The leading color token of a `background` shorthand (the first token that
 // canonicalizes to a real color), so `background:#fff` still compares. Returns
-// "" (fail open, no same-color hide) when the shorthand carries an IMAGE layer
-// — `url(...)`, a gradient, or `image-set(...)`: the painted image can make
-// same-colored text perfectly readable over it (and if it fails to load the
-// element's own background shows through), so the flat color token is not
-// provably the rendered backdrop.
-/** @param {string} shorthand @returns {string} */
-function backgroundColor(shorthand) {
-  if (/\burl\(|gradient\(|image-set\(/i.test(shorthand)) return "";
-  for (const token of shorthand.split(/\s+/)) {
-    const color = canonicalizeColor(token);
+// "" (fail open, no same-color hide) when the shorthand carries an IMAGE layer:
+// the painted image can make same-colored text perfectly readable over it (and
+// if it fails to load the element's own background shows through), so the flat
+// color token is not provably the rendered backdrop.
+/** @param {any} node value node for `background`, or null @returns {string} */
+function backgroundColor(node) {
+  if (!node || paintsImageLayer(node)) return "";
+  for (const token of valueTokens(node)) {
+    const color = canonicalizeColor(tokenText(token));
     if (color && (color.startsWith("#") || color === "transparent"))
       return color;
   }
@@ -727,8 +764,7 @@ function insetEdges(fn) {
   /** @type {any[]} */
   const edges = [];
   for (const token of valueTokens(fn)) {
-    if (token.type === "Identifier" && token.name.toLowerCase() === "round")
-      break;
+    if (token.type === "Identifier" && token.name === "round") break;
     edges.push(token);
   }
   return edges;
@@ -748,7 +784,7 @@ function isClipPathHidden(node) {
   if (!node) return false;
   for (const fn of valueTokens(node)) {
     if (fn.type !== "Function") continue;
-    const name = fn.name.toLowerCase();
+    const name = fn.name;
     if (name === "circle") {
       const radius = valueTokens(fn)[0];
       if (
@@ -808,6 +844,13 @@ function isTextPaintedVisible(val) {
   return isConcreteColor(stroke) && stroke !== "transparent";
 }
 
+/** True when a value is exactly the keyword `none`.
+ * @param {any} node @returns {boolean} */
+function isNoneKeyword(node) {
+  const token = soleToken(node);
+  return Boolean(token && token.type === "Identifier" && token.name === "none");
+}
+
 // True when the element paints a background IMAGE layer — a `background-image`
 // longhand set to anything but `none`, or a `background` shorthand carrying
 // `url(...)`, a gradient, or `image-set(...)`. A same-color text/background hide
@@ -819,11 +862,13 @@ function isTextPaintedVisible(val) {
 // only the flat color and missed a co-declared `background-image`, splicing
 // visible text. `background-clip:text` is NOT an image layer here — it paints
 // the background THROUGH the glyphs and is handled by {@link isTextPaintedVisible}.
-/** @param {(key: string) => string} textOf @returns {boolean} */
-function hasImageLayer(textOf) {
-  const img = textOf("background-image");
-  if (img && img !== "none") return true;
-  return /\burl\(|gradient\(|image-set\(/i.test(textOf("background"));
+/** @param {(key: string) => any} nodeOf @returns {boolean} */
+function hasImageLayer(nodeOf) {
+  const img = nodeOf("background-image");
+  // Only the single keyword `none` proves the longhand paints nothing; any
+  // other value (an unresolvable `var()` included) counts as a layer.
+  if (img && !isNoneKeyword(img)) return true;
+  return paintsImageLayer(nodeOf("background"));
 }
 
 /**
@@ -871,12 +916,23 @@ function isFontShorthandHidden(node) {
 const CSS_PROPERTY_IDENT_RE = /^-{0,2}[A-Za-z_][A-Za-z0-9_-]*$/;
 
 /**
- * Reconstruct a declaration's decoded value as a string for keyword/color
- * comparisons. Identifier tokens are escape-decoded through css-tree's ident
- * decoder (so `no\6e e`/`hi\64 den` read as `none`/`hidden`, with FF/CR/CRLF
- * terminators and invalid codepoints handled per the CSS spec); every other
- * token is re-serialized. A whole-value `Raw` (an unparsed value) is returned
- * verbatim — it never matches a hiding keyword, so it fails open.
+ * One value token as text. An Identifier's `name` is already the decoded,
+ * lowercased ident (see {@link canonicalizeValue}), so it is used verbatim
+ * rather than round-tripped through the serializer; every other token is
+ * re-serialized from its (canonicalized) node fields.
+ * @param {any} token
+ * @returns {string}
+ */
+function tokenText(token) {
+  return token.type === "Identifier" ? token.name : csstree.generate(token);
+}
+
+/**
+ * Reconstruct a declaration's canonicalized value as a string for keyword/color
+ * comparisons. Escapes and letter case were resolved at the parse boundary, so
+ * `no\6e e`, `NONE` and `none` all render as `none` here. A whole-value `Raw`
+ * (an unparsed value) is returned verbatim — it never matches a hiding keyword,
+ * so it fails open.
  * @param {any} valueNode
  * @returns {string}
  */
@@ -887,25 +943,50 @@ function declText(valueNode) {
   const parts = [];
   if (valueNode.children)
     valueNode.children.forEach((/** @type {any} */ child) =>
-      parts.push(
-        child.type === "Identifier"
-          ? csstree.ident.decode(child.name)
-          : csstree.generate(child),
-      ),
+      parts.push(tokenText(child)),
     );
   return parts.join(" ");
 }
 
+/**
+ * Canonicalize a parsed value subtree IN PLACE so every downstream comparison
+ * against a literal (`ABSOLUTE_UNITS`, `"rect"`, `"none"`) is correct by
+ * construction instead of depending on each call site remembering to decode and
+ * lowercase. CSS idents — keywords, function names and dimension units — are
+ * escape-decodable and ASCII case-insensitive for every keyword this module
+ * matches, so a browser reads `left:-9999PX`, `left:-9999p\78` and
+ * `left:-9999px` identically; the ad-hoc per-site `.toLowerCase()` did not, and
+ * a single uppercased unit walked straight past the detector.
+ *
+ * `Url.value` is deliberately NOT touched: css-tree already decodes url escapes,
+ * and a second decode would eat a legitimately backslash-bearing path.
+ * @param {any} valueNode
+ * @returns {void}
+ */
+function canonicalizeValue(valueNode) {
+  csstree.walk(valueNode, {
+    enter(/** @type {any} */ node) {
+      // ident.decode is pure string iteration and cannot throw on a token the
+      // tokenizer already produced.
+      if (node.type === "Identifier" || node.type === "Function")
+        node.name = csstree.ident.decode(node.name).toLowerCase();
+      else if (node.type === "Dimension")
+        node.unit = csstree.ident.decode(node.unit).toLowerCase();
+    },
+  });
+}
+
 /**
  * Parse a style string into a map of decoded lowercase property name -> parsed
- * value node, via css-tree's tolerant declaration-list parser. This replaces the
- * hand-rolled declaration splitter, per-declaration salvage, escape decoder, and
- * `!important` stripper in one pass: css-tree recovers per-declaration exactly
- * as a browser does (a bogus declaration is dropped, the rest kept), keeps a `;`
- * inside a string/`url()`/paren as part of the value, and exposes `!important`
- * as `node.important` (so an escaped spelling `none!\69mportant` is stripped for
- * free). Property names are escape-decoded and gated to real CSS idents;
- * anything else is dropped (fail open). Later declarations win, per the cascade.
+ * and canonicalized value node, via css-tree's tolerant declaration-list
+ * parser. This replaces the hand-rolled declaration splitter, per-declaration
+ * salvage, escape decoder, and `!important` stripper in one pass: css-tree
+ * recovers per-declaration exactly as a browser does (a bogus declaration is
+ * dropped, the rest kept), keeps a `;` inside a string/`url()`/paren as part of
+ * the value, and exposes `!important` as `node.important` (so an escaped
+ * spelling `none!\69mportant` is stripped for free). Property names are
+ * escape-decoded and gated to real CSS idents; anything else is dropped (fail
+ * open). Later declarations win, per the cascade.
  * @param {string} styleStr
  * @returns {Map<string, any>}
  */
@@ -934,6 +1015,7 @@ function parseDeclarations(styleStr) {
       // token; property is escape-decoded then gated to a clean CSS ident.
       const property = csstree.ident.decode(node.property).trim().toLowerCase();
       if (!CSS_PROPERTY_IDENT_RE.test(property)) return;
+      canonicalizeValue(node.value);
       decls.set(property, node.value);
     },
   });
@@ -1015,7 +1097,7 @@ export function isHiddenStyle(styleStr) {
     return true;
   const background =
     canonicalizeColor(textOf("background-color")) ||
-    backgroundColor(textOf("background"));
+    backgroundColor(nodeOf("background"));
   // Only flag same-color when BOTH sides resolve to a concrete color (`#rrggbb`
   // or `transparent`), AND no background IMAGE layer is present (an image can
   // make same-colored text readable). `var(--x)`, `inherit`, and `currentColor`
@@ -1027,7 +1109,7 @@ export function isHiddenStyle(styleStr) {
     effectiveColor &&
     effectiveColor === background &&
     isConcreteColor(effectiveColor) &&
-    !hasImageLayer(textOf)
+    !hasImageLayer(nodeOf)
   )
     return true;