agent-sanitizer 2.2.1 → 2.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.2.1",
+  "version": "2.3.0",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {
@@ -46,6 +46,9 @@
     ]
   },
   "devDependencies": {
+    "agent-control-plane-core": "0.2.13",
+    "namespace-guard": "0.20.0",
+    "sanitizer-engine": "npm:agent-sanitizer@2.1.0",
     "@commitlint/cli": "^21.0.1",
     "@commitlint/config-conventional": "^21.0.1",
     "@eslint/js": "10.0.1",
@@ -144,8 +147,9 @@
   "scripts": {
     "test": "c8 node --test",
     "coverage": "c8 node --test",
-    "check": "tsc --noEmit",
-    "typecheck": "tsc --noEmit",
+    "coverage:hooks": "c8 --config .c8rc.claude-hooks.json node --test plugin/test/*.test.mjs",
+    "check": "tsc --noEmit && tsc -p tsconfig.hooks.json --noEmit",
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.hooks.json --noEmit",
     "build:types": "tsc -p tsconfig.build.json",
     "gen:joining-type": "node scripts/gen-joining-type.mjs",
     "lint": "eslint .",

package/src/rehydrate.mjs

@@ -183,21 +183,31 @@ async function rehydrateEdit(
       // (the model supplied the secret's real bytes itself, e.g. a rotation)
       // extracts nothing and is left to the literal resolver below.
       const diskSpans = pairDiskSpans(view, deletions);
-      const intrudes = occurrences(content, oldS).some((matchStart) => {
+      let intrusion = null;
+      for (const matchStart of occurrences(content, oldS)) {
         const matchEnd = matchStart + oldS.length;
-        return diskSpans.some(
-          (secret) =>
-            matchStart < secret.end &&
-            secret.start < matchEnd &&
-            !(matchStart <= secret.start && secret.end <= matchEnd),
+        const secret = diskSpans.find(
+          (span) =>
+            matchStart < span.end &&
+            span.start < matchEnd &&
+            !(matchStart <= span.start && span.end <= matchEnd),
         );
-      });
-      if (intrudes)
+        if (secret) {
+          intrusion = { matchStart, matchEnd, secret };
+          break;
+        }
+      }
+      // Report both byte ranges. The refusal is conservative — it fires on an
+      // overlap with the redacted span the caller cannot see — so the caller
+      // needs the ranges to tell a true overlap from a mis-sized redaction.
+      if (intrusion)
         return {
           deny:
-            `old_string matches bytes inside a ${hint}…] redacted secret in ` +
-            `${ti.file_path} that are hidden from your view; edit only text you can ` +
-            `see (include each placeholder whole), or ask the user to make this change`,
+            `old_string does not appear in the sanitized view of ${ti.file_path}; on disk ` +
+            `it matches bytes ${intrusion.matchStart}-${intrusion.matchEnd}, which fall ` +
+            `inside a ${hint}…] redacted secret at bytes ${intrusion.secret.start}-` +
+            `${intrusion.secret.end} that are hidden from your view; edit only text you ` +
+            `can see (include each placeholder whole), or ask the user to make this change`,
         };
       const literalRes = rehydrateNewString(
         oldS,