agent-sanitizer 2.27.0 → 2.28.0

package/README.md

@@ -35,6 +35,10 @@ const { cleaned, found, warnings, notes } = await sanitize(untrustedText);
 
 // Opt into the HTML layers for web ingress (lazy-loads ~200 ms of deps):
 const result = await sanitize(pageSource, { html: true });
+
+// Layer 3 alone: flag exfil-shaped URLs without splicing anything (for text
+// that must stay byte-faithful, e.g. a PR diff). Implied by `html: true`.
+const scanned = await sanitize(diffText, { exfilScan: true });
 ```
 
 `sanitize` never throws and never silently drops content—any change comes with

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.27.0",
+  "version": "2.28.0",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/src/index.mjs

@@ -87,20 +87,26 @@ export {
  * to the four fields this entry promises — `modified`/`sgrNote`
  * describe the tool-output pipeline's banner, and `reveal` is produced only by
  * options this facade does not expose. `html` selects Layers 2 AND 3 together
- * here, which is the surface this entry has always had; `sanitizeText` takes
- * them as separate flags for the tool-output pipeline, which needs Layer 3's
- * detection without Layer 2's splice.
+ * here, which is the surface this entry has always had; `exfilScan` exposes
+ * Layer 3's non-destructive detection on its own (unconditionally implied by
+ * `html`, which it can add to but never switch off) for
+ * callers that must keep the visible bytes intact — e.g. a PR diff where the
+ * Layer-2 splice would corrupt legitimate markup — matching the separate
+ * flags `sanitizeText` takes for the tool-output pipeline.
  * @param {string} text
- * @param {{ html?: boolean } | null} [options]
+ * @param {{ html?: boolean, exfilScan?: boolean } | null} [options]
  * @returns {Promise<{ cleaned: string, found: string[], warnings: string[], notes: string[] }>}
  */
 export async function sanitize(text, options) {
   if (typeof text !== "string")
     throw new TypeError("sanitize(text, options): text must be a string");
-  const { html = false } = options ?? {};
+  const { html = false, exfilScan = false } = options ?? {};
   const { cleaned, found, warnings, notes } = await sanitizeText(text, {
     html,
-    exfilScan: html,
+    // `html` implies the scan unconditionally, and `exfilScan` can only ADD it:
+    // an opt-OUT would make `{ html: true, exfilScan: false }` splice Layer 2
+    // while silently dropping Layer 3's report — a fail-open the docs deny.
+    exfilScan: exfilScan || html,
   });
   return { cleaned, found, warnings, notes };
 }

package/types/index.d.mts

@@ -24,15 +24,19 @@
  * to the four fields this entry promises — `modified`/`sgrNote`
  * describe the tool-output pipeline's banner, and `reveal` is produced only by
  * options this facade does not expose. `html` selects Layers 2 AND 3 together
- * here, which is the surface this entry has always had; `sanitizeText` takes
- * them as separate flags for the tool-output pipeline, which needs Layer 3's
- * detection without Layer 2's splice.
+ * here, which is the surface this entry has always had; `exfilScan` exposes
+ * Layer 3's non-destructive detection on its own (unconditionally implied by
+ * `html`, which it can add to but never switch off) for
+ * callers that must keep the visible bytes intact — e.g. a PR diff where the
+ * Layer-2 splice would corrupt legitimate markup — matching the separate
+ * flags `sanitizeText` takes for the tool-output pipeline.
  * @param {string} text
- * @param {{ html?: boolean } | null} [options]
+ * @param {{ html?: boolean, exfilScan?: boolean } | null} [options]
  * @returns {Promise<{ cleaned: string, found: string[], warnings: string[], notes: string[] }>}
  */
 export function sanitize(text: string, options?: {
     html?: boolean;
+    exfilScan?: boolean;
 } | null): Promise<{
     cleaned: string;
     found: string[];