agent-sanitizer 2.2.2 → 2.4.0

package/claude-hooks/lib/secret-annotate.mjs

@@ -0,0 +1,56 @@
+/**
+ * Layer-4 pre-gate helpers for env-bound secrets. The redaction transport (the
+ * daemon call) stays with the sanitize-output hook; this module owns only the
+ * cheap, deterministic checks around it.
+ */
+import { minEnvSecretLen, envBoundSecretVars } from "./env-config.mjs";
+
+// Zero-width / format (Cf) characters an attacker can splice between a value's
+// characters to break an exact-substring pre-gate while the daemon's redactor
+// still matches across them. This is a curated subset of the common bidi /
+// zero-width controls, NOT an exact copy of the daemon's full dynamic Cf set — it
+// is a defense-in-depth backstop, because Layer 1 (applyLayer1) strips every Cf
+// splice from the text BEFORE this pre-gate runs, so hasEnvBoundSecret already
+// sees the plain value. A run of zero-or-more is allowed at each interior gap, so
+// the plain value still matches (a superset of `includes`). Required literals
+// between every gap keep the pattern linear — no ReDoS.
+const ENV_INVIS_RUN =
+  "[\\u200b\\u200c\\u200d\\u2060\\ufeff\\u00ad\\u180e\\u200e\\u200f\\u202a-\\u202e\\u2066-\\u2069]*";
+
+/**
+ * Regex matching `value` tolerating invisible chars spliced between its
+ * characters (mirrors the engine's env-value regex). Code-point split so
+ * an astral character is escaped whole, not as two surrogate halves.
+ * @param {string} value
+ * @returns {RegExp}
+ */
+export function envValueRegex(value) {
+  return new RegExp(
+    [...value]
+      .map((ch) => ch.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+      .join(ENV_INVIS_RUN),
+  );
+}
+
+/**
+ * True when tool output contains the literal value of a configured env-bound
+ * secret. The shape-based secret hint can't match a prefix-less key or a host
+ * credential, so the pre-gate must also fire on the value itself — otherwise
+ * the engine's env-bound redaction never runs. Invisible-tolerant so a
+ * value with spliced Cf chars (which the daemon still redacts) trips it too.
+ * @param {string} text
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {boolean}
+ */
+export function hasEnvBoundSecret(text, env = process.env) {
+  const minLen = minEnvSecretLen();
+  return envBoundSecretVars().some((name) => {
+    const value = env[name];
+    // Code-point length to match envValueRegex's code-point split — an astral
+    // char counts once, not as two UTF-16 units, so minLen means the same thing
+    // on both sides of the gate.
+    return (
+      value && [...value].length >= minLen && envValueRegex(value).test(text)
+    );
+  });
+}

package/claude-hooks/lib/trace.mjs

@@ -0,0 +1,60 @@
+/**
+ * Opt-in structured trace channel for the hooks. When _AGENT_SANITIZER_TRACE
+ * names a level (info|debug; off/empty disables), each call appends one JSON line
+ *   {"ts":<epoch_ms>,"level":"info","event":"<name>",...<fields>}
+ * to the sink — the file named by _AGENT_SANITIZER_TRACE_FILE, else stderr. The
+ * point is that every defense layer announces it ENGAGED, so a missing
+ * announcement is loud. It is best-effort: a sink it can't write never throws, so
+ * dropping a trace() onto a hook path costs nothing and risks nothing.
+ *
+ * METADATA ONLY — never pass a tool_input body or secret material as a field; the
+ * channel is not redaction-aware.
+ */
+
+import { appendFileSync } from "node:fs";
+
+/** Trace-channel event names. */
+export const TraceEvent = Object.freeze({
+  HOOK_RAN: "hook_ran",
+  SCAN_INVISIBLE_CHARS_RAN: "scan_invisible_chars_ran",
+});
+
+const LEVELS = Object.freeze({ off: 0, info: 1, debug: 2 });
+
+/**
+ * Numeric verbosity from _AGENT_SANITIZER_TRACE: 0 off, 1 info, 2 debug.
+ * Unknown, empty, or "off" → 0.
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {number}
+ */
+export function traceThreshold(env = process.env) {
+  const value = (env._AGENT_SANITIZER_TRACE ?? "").toLowerCase();
+  if (value === "debug" || value === "2") return LEVELS.debug;
+  if (["info", "1", "true", "on"].includes(value)) return LEVELS.info;
+  return LEVELS.off;
+}
+
+/**
+ * Emit one JSON trace line for `event` at `level` (default "info") carrying the
+ * metadata `fields`. No-op when the channel is below `level`; best-effort on write.
+ * @param {string} event
+ * @param {Record<string, unknown>} [fields]
+ * @param {"info"|"debug"} [level]
+ * @returns {void}
+ */
+export function trace(event, fields = {}, level = "info") {
+  // info|debug are the only real levels; anything else (a producer typo) clamps
+  // to info for BOTH the gate and the recorded field, so a line never carries a
+  // level outside {info,debug} for a reader to bucket on.
+  const lvl = level === "debug" ? "debug" : "info";
+  if (traceThreshold() < LEVELS[lvl]) return;
+  const line =
+    JSON.stringify({ ts: Date.now(), level: lvl, event, ...fields }) + "\n";
+  const file = process.env._AGENT_SANITIZER_TRACE_FILE;
+  try {
+    if (file) appendFileSync(file, line);
+    else process.stderr.write(line);
+  } catch {
+    // best-effort: a trace we can't write must never break a hook.
+  }
+}

package/claude-hooks/plugin-hooks.mjs

@@ -0,0 +1,133 @@
+/**
+ * Entry point: ALL FOUR sanitization hooks behind one dispatch flag. The four
+ * hooks share almost the entire package graph, so one bundle per hook would ship
+ * four near-identical copies; a single entry with a `--hook=<name>` flag
+ * selecting the hook ships the graph once (hooks.json passes the flag).
+ *
+ * The plugin's shipped artifact is the esbuild BUNDLE with every package inlined
+ * at build time — there is no node_modules for a runtime import to resolve — so
+ * this binder statically imports the packages the hooks lazy-load and
+ * pre-registers them BEFORE any hook module is imported. Each hook module is
+ * loaded through a literal dynamic import so the registration (and the CLI-slot
+ * claim) precede its top-level lazyImport calls, then its own exported CLI runs.
+ *
+ * Layer 2/3 (the remark/rehype HTML parser graph) is inlined and runs locally.
+ */
+import {
+  claimCliEntry,
+  isMain,
+  registerLazyModules,
+  readFlag,
+  readStdinJson,
+} from "./lib/hook-io.mjs";
+
+// The packages the hooks lazy-load, each behind a thunk whose import specifier
+// is a LITERAL — esbuild only inlines `import("…")` it can read statically, so
+// an `import(variable)` here would survive into the bundle as a runtime dial
+// against a node_modules the plugin does not ship, and every registration would
+// fail at once.
+const LAZY_LOADERS = {
+  "agent-control-plane-core": () => import("agent-control-plane-core"),
+  "agent-control-plane-core/claude": () =>
+    import("agent-control-plane-core/claude"),
+  "agent-sanitizer": () => import("agent-sanitizer"),
+  "agent-sanitizer/confusables": () => import("agent-sanitizer/confusables"),
+  "agent-sanitizer/invisible": () => import("agent-sanitizer/invisible"),
+  "agent-sanitizer/output": () => import("agent-sanitizer/output"),
+  "agent-sanitizer/rehydrate": () => import("agent-sanitizer/rehydrate"),
+  "namespace-guard": () => import("namespace-guard"),
+};
+
+/**
+ * Pre-register every package the hooks lazy-load, skipping any that will not
+ * load.
+ *
+ * A top-level static import of these would abort the process before `main`
+ * runs, and an aborted hook writes NOTHING to stdout — which Claude Code reads
+ * as a non-blocking hook error and shows the raw tool output. That is a
+ * fail-OPEN on the very hook that withholds secrets. Registering what resolves
+ * and leaving the rest absent hands the gap to each hook's own lazyImport
+ * guard, whose posture is to block.
+ * @returns {Promise<void>}
+ */
+async function registerAvailableModules() {
+  /** @type {Record<string, Record<string, any>>} */
+  const loaded = {};
+  await Promise.all(
+    Object.entries(LAZY_LOADERS).map(async ([specifier, load]) => {
+      try {
+        loaded[specifier] = await load();
+      } catch {
+        // Left unregistered on purpose — see the fail-open note above.
+      }
+    }),
+  );
+  registerLazyModules(loaded);
+}
+
+/**
+ * Dispatch to the hook named by `--hook=<name>` in argv. Exported and guarded by
+ * isMain below so importing this module (the published entry point) is a no-op:
+ * only a direct `node plugin-hooks.mjs --hook=…` run consumes stdin and exits.
+ * @returns {Promise<void>}
+ */
+export async function main() {
+  // This binder owns the process's CLI entry: inside the bundle every inlined
+  // module shares this file's import.meta.url, so without the claim the inlined
+  // hooks' own isMain-guarded CLIs would also fire and consume stdin.
+  claimCliEntry();
+  await registerAvailableModules();
+
+  const mode = readFlag(process.argv, "hook");
+  switch (mode) {
+    case "pretooluse-sanitize": {
+      const { cliMain } =
+        /** @type {typeof import("./pretooluse-sanitize.mjs")} */ (
+          await import("./pretooluse-sanitize.mjs")
+        );
+      await cliMain();
+      break;
+    }
+    case "sanitize-output": {
+      const { cliMain } =
+        /** @type {typeof import("./sanitize-output.mjs")} */ (
+          await import("./sanitize-output.mjs")
+        );
+      await cliMain();
+      break;
+    }
+    case "sanitize-user-prompt": {
+      const { main: promptMain } =
+        /** @type {typeof import("./sanitize-user-prompt.mjs")} */ (
+          await import("./sanitize-user-prompt.mjs")
+        );
+      await promptMain(readStdinJson, (chunk) => process.stdout.write(chunk));
+      break;
+    }
+    case "scan-invisible-chars": {
+      const { cliMain } =
+        /** @type {typeof import("./scan-invisible-chars.mjs")} */ (
+          await import("./scan-invisible-chars.mjs")
+        );
+      await cliMain();
+      break;
+    }
+    default:
+      // An unknown mode means broken hooks.json wiring — fail CLOSED, never fall
+      // through to some default hook and vet the wrong payload class. Exit 2 is
+      // the one non-zero code Claude Code treats as blocking (a plain exit 1 is
+      // a non-blocking hook error that lets the guarded action through
+      // unsanitized); it blocks PreToolUse and UserPromptSubmit, surfaces
+      // stderr for PostToolUse, and is harmless for SessionStart.
+      process.stderr.write(
+        `plugin-hooks: unknown hook mode ${JSON.stringify(mode)}\n`,
+      );
+      process.exit(2);
+  }
+}
+
+// isMain is read BEFORE main() claims the CLI slot (the claim makes every later
+// isMain answer false, including this one).
+if (isMain(import.meta.url)) {
+  await main();
+}

package/claude-hooks/pretooluse-sanitize.mjs

@@ -0,0 +1,341 @@
+/**
+ * PreToolUse content-protection orchestrator. Runs four layers in ONE process:
+ *
+ *   1. Invisible-char injection gate (lib/invisible-alert.mjs)
+ *   2. Confusable/homoglyph normalization of paths & commands
+ *      (agent-sanitizer/confusables, namespace-guard scanner injected)
+ *   3. Stego / terminal-control stripping of model-authored fields
+ *      (lib/authored-content.mjs)
+ *   4. Rehydration of secret-redaction placeholders in Edit/Write inputs
+ *      (agent-sanitizer/rehydrate, redactor-daemon io injected)
+ *
+ * WHY ONE PROCESS: Claude Code runs PreToolUse hooks in parallel and does NOT
+ * chain their `updatedInput` — each hook sees the original input and the last to
+ * finish wins. Registered as three separate hooks, layers 2 and 3 both rewrite
+ * the shared Bash `command` field from the original text, so a command carrying
+ * BOTH a confusable AND a stego payload had one fix non-deterministically
+ * clobbered by the other. Composing them here makes the rewrite deterministic
+ * (normalize, then strip the normalized text) and pays a single Node start
+ * instead of three on the hottest path.
+ *
+ * Layers 2 and 4 are the provider-agnostic transforms in the agent-sanitizer
+ * package; this file binds its peers (namespace-guard, the redactor daemon, the
+ * filesystem) into them.
+ */
+import { createRequire } from "node:module";
+import { readFileSync } from "node:fs";
+import {
+  isMain,
+  lazyImport,
+  registeredLazyModule,
+  emitHookResponse,
+  safeErrMessage,
+  HookEvent,
+  PermissionDecision,
+} from "./lib/hook-io.mjs";
+import { controlPlane, runJudgeCli } from "./lib/control-plane.mjs";
+import {
+  invisibleCharAlert,
+  gateAskReason,
+  gateReminderContext,
+  alertAcknowledged,
+  acknowledgeAlert,
+} from "./lib/invisible-alert.mjs";
+import {
+  sanitizeAuthoredContent,
+  authoredContext,
+} from "./lib/authored-content.mjs";
+import { redactViaDaemon } from "./lib/redactor-client.mjs";
+import { trace, TraceEvent } from "./lib/trace.mjs";
+
+const HOOK_NAME = "pretooluse-sanitize";
+
+// Layers 2 & 4 come from the agent-sanitizer package, bound via lazyImport (see
+// its doc for the fail-OPEN hazard of a bare static npm import); a failed load
+// leaves these bindings undefined, so the layer calls below throw into the CLI's
+// fail-closed catch (ask) instead.
+const { normalizeConfusables, normalizeContext } =
+  /** @type {typeof import("agent-sanitizer/confusables")} */ (
+    await lazyImport("agent-sanitizer/confusables")
+  );
+const { rehydrateRedacted } =
+  /** @type {typeof import("agent-sanitizer/rehydrate")} */ (
+    await lazyImport("agent-sanitizer/rehydrate")
+  );
+
+// Injection seams binding the peer dependencies into the provider-agnostic
+// package functions. namespace-guard (the confusable vision map) and the
+// redactor daemon are external to the package; it imports neither.
+// namespace-guard is lazy-required so its map loads only on the first field that
+// actually carries a non-ASCII glyph — normalizeConfusables applies its ASCII
+// fast-path before ever calling scan.
+const require = createRequire(import.meta.url);
+// Registry first, so a build-time bundle (which has no node_modules for the
+// require to resolve from) reaches its statically-inlined, pre-registered copy;
+// running from source keeps the lazy require. The lookup must stay synchronous —
+// normalizeConfusables calls the scan inline.
+/** @param {string} text */
+const confusableScan = (text) =>
+  (registeredLazyModule("namespace-guard") ?? require("namespace-guard")).scan(
+    text,
+  );
+
+/**
+ * File + redactor-daemon I/O the package's rehydrateRedacted runs against:
+ * `redactMap` yields the redacted view plus ordered (placeholder, original,
+ * start) pairs, `redact` the plain redacted text or null. Both go through the
+ * long-lived redactor daemon so detect-secrets stays the only engine.
+ * @type {import("agent-sanitizer/rehydrate").RehydrateIo}
+ */
+const redactorIo = {
+  readFile: (path) => readFileSync(path, "utf8"),
+  redactMap: async (text) =>
+    /** @type {any} */ (await redactViaDaemon(text, { map: true })),
+  redact: async (text) => {
+    const out = await redactViaDaemon(text, {});
+    return out ? /** @type {string} */ (out.text) : null;
+  },
+};
+
+/**
+ * Default Layer-4 rehydrator: the package's rehydrateRedacted bound to the
+ * redactor-daemon io. Hoisted (not an inline default-param arrow) so tests can
+ * still inject a fake as the second argument to buildPreToolUseResponse.
+ * @param {string} tool
+ * @param {any} toolInput
+ */
+const defaultRehydrate = (tool, toolInput) =>
+  rehydrateRedacted(tool, toolInput, redactorIo);
+
+/**
+ * Trace the response on the way out — "noop" (clean pass-through), "deny",
+ * "ask", or "modified" (input rewritten and/or context attached) — and return
+ * it unchanged. The trace lives on this in-process, mutation-tested path, not in
+ * the CLI block, so engagement is announced (hook_ran — metadata only: hook
+ * name, tool, outcome) for every exit.
+ * @param {string} toolName
+ * @param {Record<string, unknown> | null} fields
+ * @returns {Record<string, unknown> | null}
+ */
+function emitTraced(toolName, fields) {
+  let outcome = "modified";
+  if (fields === null) outcome = "noop";
+  else if (fields.permissionDecision === PermissionDecision.DENY)
+    outcome = "deny";
+  else if (fields.permissionDecision === PermissionDecision.ASK)
+    outcome = "ask";
+  trace(TraceEvent.HOOK_RAN, { hook: HOOK_NAME, tool: toolName, outcome });
+  return fields;
+}
+
+/**
+ * Compose the four protections. Returns the `hookSpecificOutput` fields to
+ * emit, or null for a clean no-op. Throws only if a layer's engine throws; the
+ * caller fails closed (ask) on any throw. Every exit routes through emitTraced.
+ * @param {any} input parsed PreToolUse event
+ * @param {(tool: string, toolInput: any) => ReturnType<typeof rehydrateRedacted>} [rehydrate]
+ * injectable for tests; the default binds the real redactor-daemon io (the
+ * layer reads the target file and maps secrets through the daemon)
+ * @returns {Promise<Record<string, unknown> | null>}
+ */
+export async function buildPreToolUseResponse(
+  input,
+  rehydrate = defaultRehydrate,
+) {
+  const asks = [];
+  const contexts = [];
+
+  // Layer 1: gate. Persists across the session until the injected files are
+  // cleaned. It asks ONCE (a hard checkpoint, recorded once emitted) then
+  // degrades to a passive reminder, so it doesn't prompt on every tool call.
+  const findings = invisibleCharAlert();
+  let pendingGateAck = false;
+  if (findings) {
+    if (alertAcknowledged()) {
+      contexts.push(gateReminderContext());
+    } else {
+      asks.push(gateAskReason(findings));
+      pendingGateAck = true;
+    }
+  }
+
+  const { tool_name: tool, tool_input: toolInput } = input;
+
+  // Layers 2 then 3, chained: normalize confusables first, then strip authored
+  // stego/terminal-control from the normalized text.
+  let current = toolInput;
+  let changed = false;
+
+  const norm = normalizeConfusables(tool, current, { scan: confusableScan });
+  if (norm) {
+    current = norm.updatedInput;
+    changed = true;
+    contexts.push(normalizeContext(norm.normalized));
+  }
+
+  if (process.env.AGENT_SANITIZER_OUTPUT_DISABLED !== "1") {
+    const authored = sanitizeAuthoredContent(tool, current);
+    if (authored) {
+      current = authored.updatedInput;
+      changed = true;
+      contexts.push(authoredContext(authored.changed));
+    }
+  }
+
+  // Layer 4: re-anchor Edit/Write inputs composed from a sanitized file view
+  // ([REDACTED…] placeholders, stripped invisible characters) back onto the
+  // on-disk bytes. Runs last so it sees the final authored text and its
+  // rehydrated secrets are not re-stripped by layer 3. An unresolvable or
+  // secret-exposing call is denied outright — that verdict outranks any ask
+  // above, so it returns immediately.
+  const rehydrated = await rehydrate(tool, current);
+  if (rehydrated && "deny" in rehydrated)
+    return emitTraced(input.tool_name, {
+      permissionDecision: PermissionDecision.DENY,
+      permissionDecisionReason: rehydrated.deny,
+    });
+  if (rehydrated) {
+    current = rehydrated.updatedInput;
+    changed = true;
+    contexts.push(rehydrated.context);
+  }
+
+  return emitTraced(
+    input.tool_name,
+    assembleResponse({ changed, current, asks, contexts, pendingGateAck }),
+  );
+}
+
+/**
+ * Assemble the hookSpecificOutput fields from the per-layer results, or null
+ * for a clean no-op (nothing asked, changed, or annotated). Records the gate
+ * acknowledgement only when an ask actually lands in the response.
+ * @param {{ changed: boolean, current: any, asks: string[], contexts: string[], pendingGateAck: boolean }} parts
+ * @returns {Record<string, unknown> | null}
+ */
+function assembleResponse({
+  changed,
+  current,
+  asks,
+  contexts,
+  pendingGateAck,
+}) {
+  if (asks.length === 0 && !changed && contexts.length === 0) return null;
+
+  /** @type {Record<string, unknown>} */
+  const fields = {};
+  // Include the rewritten input even alongside an ask: applying it can only
+  // surface a *cleaner* call to the user than the original (and is ignored if
+  // Claude Code doesn't apply updatedInput under an ask).
+  if (changed) fields.updatedInput = current;
+  if (asks.length > 0) {
+    fields.permissionDecision = PermissionDecision.ASK;
+    // Stryker disable next-line StringLiteral: the gate is the only source that
+    // pushes onto `asks`, so the array never holds more than one reason and the
+    // separator is unobservable — join("") is equivalent. The paragraph break is
+    // kept for the day a second ask source is added.
+    fields.permissionDecisionReason = asks.join("\n\n");
+  }
+  if (contexts.length > 0) fields.additionalContext = contexts.join(" ");
+  // Record the gate ack only now that the ask is actually in the response — a
+  // rehydrate deny above returns first, so a preempted ask is not marked seen.
+  if (pendingGateAck) acknowledgeAlert();
+  return fields;
+}
+
+/**
+ * Agent-agnostic judge over the four protections: consumes a control-plane
+ * ToolCallEvent and returns a Verdict, so a non-Claude host can run the same
+ * sanitization pipeline through its own adapter. The wired Claude CLI below
+ * routes through this judge and renders the Verdict with the Claude adapter; on
+ * any throw (a control-plane package-load failure included) it falls back to
+ * failClosedFields — a native response that needs no package — so the
+ * fail-closed posture holds even when the adapter never loaded.
+ * @param {import("agent-control-plane-core").ToolCallEvent} event
+ * @param {(tool: string, toolInput: any) => ReturnType<typeof rehydrateRedacted>} [rehydrate]
+ * @returns {Promise<import("agent-control-plane-core").Verdict>}
+ */
+export async function judgePreToolUseSanitize(event, rehydrate) {
+  const { Decision, EventKind } = controlPlane();
+  // A payload the adapter cannot classify (a missing/unexpected hook_event_name)
+  // would drive the pipeline with an empty event and no-op to ALLOW — a silent
+  // fail-OPEN of the gate. This hook is wired only to PreToolUse, so an
+  // unclassifiable payload is harness-contract drift or an out-of-band caller,
+  // never a real call: deny-when-blind. Rewarding an unclassifiable payload with
+  // a pass is the one incentive a gate must never create.
+  if (event.event === EventKind.UNKNOWN)
+    return {
+      decision: Decision.DENY,
+      reason:
+        "PreToolUse sanitization blocked (fail-closed): unrecognized hook payload.",
+    };
+  const fields = await buildPreToolUseResponse(
+    { tool_name: event.tool, tool_input: event.input },
+    rehydrate,
+  );
+  if (fields === null) return { decision: Decision.ALLOW };
+  /** @type {Record<string, unknown>} */
+  const verdict = {
+    decision: fields.permissionDecision ?? Decision.ALLOW,
+  };
+  if (fields.permissionDecisionReason !== undefined)
+    verdict.reason = fields.permissionDecisionReason;
+  if (fields.updatedInput !== undefined)
+    verdict.mutated_input = fields.updatedInput;
+  if (fields.additionalContext !== undefined)
+    verdict.additional_context = fields.additionalContext;
+  return /** @type {import("agent-control-plane-core").Verdict} */ (verdict);
+}
+
+/**
+ * The fail-closed hookSpecificOutput fields for a hook-level failure, chosen by
+ * WHICH failure it was. Corrupt/unparsable INPUT (`parsedOk` false — a JSON parse
+ * error or the oversize-body cap) is a state an adversary can induce with no
+ * upside to failing, so it hard-DENIES: no human to talk past, no approval
+ * fatigue, no latency. A LAYER/engine throw after a clean parse (`parsedOk` true
+ * — redactor daemon down, package not loaded) is the sanitizer being UNAVAILABLE,
+ * so it ASKS to keep a human in the loop rather than hard-block on infrastructure.
+ * @param {boolean} parsedOk whether the input parsed before the failure
+ * @param {unknown} err
+ * @returns {Record<string, unknown>}
+ */
+export function failClosedFields(parsedOk, err) {
+  return {
+    permissionDecision: parsedOk
+      ? PermissionDecision.ASK
+      : PermissionDecision.DENY,
+    permissionDecisionReason: parsedOk
+      ? `PreToolUse sanitization failed (fail-closed): ${safeErrMessage(err)}`
+      : `PreToolUse input unparsable (fail-closed): ${safeErrMessage(err)}`,
+  };
+}
+
+// Stryker disable all: CLI wiring — it runs only in the spawned hook
+// subprocess, never in-process, so every mutant from here down is NoCoverage.
+// The exported judgePreToolUseSanitize and failClosedFields above carry the
+// real, mutation-tested logic.
+/**
+ * The hook's CLI: parse → judge → render, with this hook's fail-closed posture.
+ * Exported so a bundle entry (which must claim the CLI slot before this module
+ * loads) can run the exact same wiring instead of duplicating the onError
+ * posture.
+ * @returns {Promise<void>}
+ */
+export async function cliMain() {
+  await runJudgeCli("pretooluse-sanitize", judgePreToolUseSanitize, {
+    // Fail closed WITHOUT the package: unparsable INPUT (`input` undefined)
+    // hard-denies (adversary-inducible, no benefit to failing); any throw
+    // after a clean parse — a layer engine down or the control-plane package
+    // unavailable — asks to keep a human in the loop. emitHookResponse renders
+    // natively, so this posture holds even when the adapter never loaded.
+    onError: (err, input) =>
+      emitHookResponse(
+        HookEvent.PRE_TOOL_USE,
+        failClosedFields(input !== undefined, err),
+      ),
+  });
+}
+
+if (isMain(import.meta.url)) {
+  await cliMain();
+}