agent-sanitizer 2.34.6 → 2.34.8

package/types/claude-hooks/lib/invisible-alert.d.mts

@@ -26,6 +26,10 @@ export function alertAcknowledged(): boolean;
  */
 export function acknowledgeAlert(): void;
 /**
+ * The blocking ask. The heading states only that the scan did not finish clean:
+ * the alert carries injection findings, unreadable targets, or a scanner fault,
+ * and each report names its own kind. A heading that asserted "injection
+ * detected" mislabelled the other two.
  * @param {string} findings
  * @returns {string}
  */

package/types/claude-hooks/scan-invisible-chars.d.mts

@@ -1,31 +1,17 @@
 /**
- * Scan every instruction file under the project, ACCOUNTING for every target
- * the finder returned: `scanned + skipped.length === targets.length`, always.
- *
- * The accounting is the point. This scan is the only thing standing between a
- * poisoned `CLAUDE.md` and a session that loads it as instructions, and its
- * caller announces "clean" on the trace channel — the channel that exists so a
- * MISSING announcement is loud. A per-file failure swallowed into an empty
- * findings list turns "we could not read this file" into "this file is fine",
- * which is the one lie this hook must never tell. So a file that cannot be read
- * is REPORTED as unscanned, not dropped.
- *
- * ANY errno is a skip; only a non-filesystem throw propagates. The split is
- * between "this file could not be read" (report it and keep scanning) and "this
- * code is broken" (a TypeError from an unloaded binding — nothing here can be
- * trusted, so it goes to the caller's declared failure posture). Catching only
- * ENOENT would invert the enforcement: one EACCES target would discard the
- * result for EVERY other instruction file, leaving them unscanned and
- * un-auto-cleaned, and under the shipped OPEN posture the hook fault arms
- * nothing — so the SUSPICIOUS failure would get weaker enforcement than the
- * benign glob race, which reaches `partial` and arms the gate. Same errno-vs-bug
- * split {@link autoCleanFindings} uses.
+ * Scan every instruction file under the project, bucketing each unreadable
+ * target through {@link classifyReadFailure}. `scanned` is DERIVED from the two
+ * failure buckets, so the accounting invariant — every target is scanned,
+ * skipped or absent — holds by construction and needs no comment restating it.
+ * A target lost from that accounting is an instruction file that reaches the
+ * model while the caller announces "clean".
  * @param {string} [dir]  project root to scan (injectable for tests)
  * @returns {{
  *   targets: string[],
  *   scanned: number,
  *   findings: Array<{file: string, findings: ReturnType<typeof scanFile>}>,
  *   skipped: Array<{file: string, reason: string}>,
+ *   absent: string[],
  * }}
  */
 export function scanProject(dir?: string): {
@@ -39,6 +25,7 @@ export function scanProject(dir?: string): {
         file: string;
         reason: string;
     }>;
+    absent: string[];
 };
 /**
  * The report for targets the scan could not read. Rendered into the alert the