agent-sanitizer 2.34.10 → 2.34.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.34.10",
+  "version": "2.34.11",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/src/output.mjs

@@ -407,10 +407,10 @@ function processLayer1(text, sgrCarveOut) {
  * vet them before they leave. The transform itself stays pure — the caller owns
  * any persistence.
  * @param {PipelineState} state
- * @param {{ html?: boolean, exfilScan?: boolean }} options
+ * @param {{ html?: boolean, exfilScan?: boolean, deadline?: Deadline }} options
  * @returns {Promise<{ reveal: string | undefined, splices: Array<{ placeholder: string, original: string }> }>}
  */
-async function applyMarkdownPipeline(state, { html, exfilScan }) {
+async function applyMarkdownPipeline(state, { html, exfilScan, deadline }) {
   const inputText = state.text;
   /** @type {string | undefined} */
   let reveal;
@@ -418,6 +418,20 @@ async function applyMarkdownPipeline(state, { html, exfilScan }) {
   const splices = [];
   if ((!html && !exfilScan) || !needsMarkdownPipeline(inputText))
     return { reveal: undefined, splices };
+  // INVARIANT: this refusal stops a layer below from STARTING with no budget
+  // left. Each parses the whole document in ONE synchronous call, so nothing
+  // interrupts it, and a host that kills the overrun hook shows the RAW text.
+  // Called before EACH parse: Layer 2 spends the budget Layer 3 then runs on.
+  // After the pre-gate: a declined call costs no time. Fail closed, as Layer 4.
+  const refuseIfSpent = () => {
+    if (deadline && deadline.remainingMs() <= 0)
+      throw new Error(
+        "CRITICAL: the sanitization time budget ran out before the hidden-HTML " +
+          "and exfil-URL layers finished, so this text was not fully checked. " +
+          "Failing closed — tool output suppressed.",
+      );
+  };
+  refuseIfSpent();
   let sanitizeHtml, detectExfil;
   /* c8 ignore start -- a rejected dynamic import of a module that ships in
      this very package (not an optional peer dep) requires corrupting
@@ -478,6 +492,7 @@ async function applyMarkdownPipeline(state, { html, exfilScan }) {
   // URL hidden inside a display:none element or an HTML comment is MORE
   // suspicious, not less, yet Layer 2 has already removed it from `cleaned`.
   if (exfilScan) {
+    refuseIfSpent();
     const threats = detectExfil(inputText);
     // Severity tracks who does the fetching. An auto-fetched target — an image,
     // a stylesheet, a form action, a meta refresh — exfiltrates the moment the
@@ -552,9 +567,19 @@ async function vetStageValue(text, redact, findings, label) {
  *   redact?: (text: string) => Promise<RedactResult|null> | (RedactResult|null),
  *   filterInjection?: (text: string) => Promise<Layer5Result|null> | (Layer5Result|null),
  *   sgrCarveOut?: boolean,
+ *   deadline?: Deadline,
  * }} SanitizeTextOptions
  */
 
+/**
+ * A caller's shared wall-clock budget across one run of this pipeline.
+ * `remainingMs()` returns the milliseconds left; at or below zero it is spent.
+ * Layer 4's injected redactor reads its own copy of the same budget, so this
+ * option is what lets the layers inside this module read it too. Omitted means
+ * no budget, which is the standalone default: every layer runs to completion.
+ * @typedef {{ remainingMs: () => number }} Deadline
+ */
+
 /**
  * Run the configured layers over a single text blob. Layer 1 always runs; the
  * rest are opt-in via `options`. Layer 4 (`redact`) is the fail-closed path: a

package/types/output.d.mts

@@ -41,8 +41,17 @@ export function deleteVerbatimSpans(text: string, spans: string[]): {
  *   redact?: (text: string) => Promise<RedactResult|null> | (RedactResult|null),
  *   filterInjection?: (text: string) => Promise<Layer5Result|null> | (Layer5Result|null),
  *   sgrCarveOut?: boolean,
+ *   deadline?: Deadline,
  * }} SanitizeTextOptions
  */
+/**
+ * A caller's shared wall-clock budget across one run of this pipeline.
+ * `remainingMs()` returns the milliseconds left; at or below zero it is spent.
+ * Layer 4's injected redactor reads its own copy of the same budget, so this
+ * option is what lets the layers inside this module read it too. Omitted means
+ * no budget, which is the standalone default: every layer runs to completion.
+ * @typedef {{ remainingMs: () => number }} Deadline
+ */
 /**
  * Run the configured layers over a single text blob. Layer 1 always runs; the
  * rest are opt-in via `options`. Layer 4 (`redact`) is the fail-closed path: a
@@ -262,6 +271,17 @@ export type SanitizeTextOptions = {
     redact?: (text: string) => Promise<RedactResult | null> | (RedactResult | null);
     filterInjection?: (text: string) => Promise<Layer5Result | null> | (Layer5Result | null);
     sgrCarveOut?: boolean;
+    deadline?: Deadline;
+};
+/**
+ * A caller's shared wall-clock budget across one run of this pipeline.
+ * `remainingMs()` returns the milliseconds left; at or below zero it is spent.
+ * Layer 4's injected redactor reads its own copy of the same budget, so this
+ * option is what lets the layers inside this module read it too. Omitted means
+ * no budget, which is the standalone default: every layer runs to completion.
+ */
+export type Deadline = {
+    remainingMs: () => number;
 };
 import { needsMarkdownPipeline } from "./gates.mjs";
 export { describeExfil, describeRemoved, describeWarned } from "./warnings.mjs";