agent-sanitizer 2.34.7 → 2.34.9

package/claude-hooks/lib/authored-content.mjs

@@ -53,36 +53,11 @@ import { lazyImport } from "./hook-io.mjs";
 const { stripAnsiFully } = /** @type {typeof import("agent-sanitizer")} */ (
   await lazyImport("agent-sanitizer")
 );
-const { STRIP, LONG_RUN_THRESHOLD, SCATTERED_THRESHOLD, stripInvisible } =
+const { STRIP, SCATTERED_THRESHOLD, hasLongRun, stripInvisible } =
   /** @type {typeof import("agent-sanitizer/invisible")} */ (
     await lazyImport("agent-sanitizer/invisible")
   );
 
-/**
- * "A run of {@link LONG_RUN_THRESHOLD} or more invisibles", bounded per match.
- *
- * Built from the engine's own class and threshold rather than imported as a
- * ready-made pattern or scan function, because the bundle resolves
- * `agent-sanitizer` to the PINNED published engine, which trails this repo:
- * anything this hook imports has to exist in that pin, or the import binds
- * undefined and the hook fails closed on every payload. STRIP and
- * LONG_RUN_THRESHOLD are the primitives that define a long run, so deriving the
- * pattern here keeps the answer identical to the engine's across pins, with no
- * version-specific scan API to adopt when the pin moves.
- *
- * The upper bound is what makes it safe on a large payload: V8 pushes one
- * backtrack entry per iteration of a quantifier onto a stack capped at 64 MB,
- * so an UNBOUNDED run pattern throws `RangeError: Maximum call stack size
- * exceeded` once a single run passes ~8.4 M code points — an 8 MB paste of
- * zero-widths into a Write body is exactly that. A bound of 2^20 iterations
- * sits ~8x under the ceiling, and a longer run still answers yes: any run of at
- * least the threshold contains a prefix this matches.
- */
-const LONG_RUN_CHUNK_RE = new RegExp(
-  `(?:${STRIP.source}){${LONG_RUN_THRESHOLD},${1 << 20}}`,
-  "gu",
-);
-
 // Content fields the model authors, per tool. Paths and confusables are the
 // confusable layer's domain; here we target the free-text fields that carry
 // model-authored prose / code / data out into persisted or displayed artifacts.
@@ -165,8 +140,10 @@ export function authoredScopeDecision(tool) {
 // user→model surfaces share one definition of "stego payload".
 /** @param {string} text */
 function isPayloadCapable(text) {
-  LONG_RUN_CHUNK_RE.lastIndex = 0;
-  if (LONG_RUN_CHUNK_RE.test(text)) return true;
+  // hasLongRun, not a pattern built here: the engine's scan is bounded per
+  // `exec`, which is what keeps an 8 MB run of zero-widths in a Write body from
+  // throwing `RangeError: Maximum call stack size exceeded` out of this hook.
+  if (hasLongRun(text)) return true;
   return (text.match(STRIP)?.length ?? 0) >= SCATTERED_THRESHOLD;
 }
 

package/claude-hooks/sanitize-output.mjs

@@ -82,8 +82,11 @@ export const { applyLayer1, matchesSecretHint, SECRET_HINT, SECRET_HINT_EXT } =
 const _output = /** @type {typeof import("agent-sanitizer/output")} */ (
   await lazyImport("agent-sanitizer/output")
 );
-const { sanitizeText: sanitizeTextSeam, composeContext: composeContextSeam } =
-  _output;
+const {
+  sanitizeText: sanitizeTextSeam,
+  composeContext: composeContextSeam,
+  withheldWarning,
+} = _output;
 export const { describeRemoved, describeWarned, suppressToolOutput } = _output;
 
 const HOOK_NAME = "sanitize-output";
@@ -94,12 +97,7 @@ const HOOK_NAME = "sanitize-output";
 // splice/withhold warnings make is NOT kept for this output. Fixed prose, no
 // error text — the redactor runs on attacker-influenced content and this line
 // reaches the model-facing context. Exported so tests assert it by reference.
-// Deliberately a LOCAL constant rather than a shared engine builder alongside
-// output.mjs's "Withheld the ${label}" template: the plugin bundle resolves
-// the engine to the pinned registry release, so hook code cannot use a new
-// engine export until the pin advances past it.
-export const REVEAL_WITHHELD_WARNING =
-  "Withheld the reveal sidecar: it could not be vetted for secrets";
+export const REVEAL_WITHHELD_WARNING = withheldWarning("reveal sidecar");
 
 // Total wall-clock budget for one hook invocation's blocking daemon calls — the
 // Layer-4 redactor — SHARED across every string leaf of the tool output. Each
@@ -116,18 +114,6 @@ const SANITIZE_BUDGET_MS = positiveMsOr(
   120000,
 );
 
-// Non-WARNING note for a strip whose only change was INERT ANSI on a local tool:
-// the display-only colour git/pytest/npm/etc. emit by default, and/or a stray
-// escape byte that formed no sequence at all. The engine now returns this text
-// itself, as a NOTE-severity finding alongside the warnings, so this copy is the
-// FALLBACK for exactly one case: a bundle built against a pinned engine older
-// than that severity split, whose result carries `sgrNote` but no `notes`. Same
-// sentence, so a plugin on the old pin keeps today's wording instead of falling
-// back to a bare "output sanitized".
-const SGR_OUTPUT_NOTE =
-  "Inert ANSI stripped (display-only colour and/or a stray escape byte that " +
-  "formed no control sequence); pipe through cat -v to inspect raw escapes.";
-
 // Web-ingress tools always get the Layer 2 HTML rewrite; local tools — Read,
 // Bash, Grep, gh — never do. A local HTML/markdown pass either rewrites bytes the
 // model is about to edit or deletes content (diffs, PR bodies, page
@@ -309,10 +295,8 @@ export async function sanitizeText(
     /** @type {{ cleaned: string, warnings: string[], notes?: string[], modified: boolean, sgrNote: boolean, reveal?: string, splices?: Array<{ placeholder: string, original: string }> }} */ (
       await sanitizeTextSeam(text, seamOptions)
     );
-  // The one place the seam's shape is normalized: `notes` is absent when the
-  // engine predates the severity split, which is the shipped plugin's pinned
-  // case (see SGR_OUTPUT_NOTE). Defaulting here means nothing downstream has to
-  // know that, and the banner composer sees one shape either way.
+  // The one place the seam's shape is normalized, so nothing downstream has to
+  // branch on an absent `notes` and the banner composer sees one shape.
   const result = { ...seamResult, notes: seamResult.notes ?? [] };
   return ext.postText
     ? applyPostText(
@@ -1006,7 +990,7 @@ export async function evaluateToolOutput(input, ext = {}) {
   // hidden-HTML splice to read about does not also need the colour codes).
   const baseContext =
     sgrNote && warnings.length === 0
-      ? noteContext(notes)
+      ? [...new Set(notes)].join(" ")
       : composeContext(modified, warnings, input.tool_name);
   const additionalContext = revealRead
     ? `${REVEAL_READ_ENVELOPE} ${baseContext}`
@@ -1017,20 +1001,6 @@ export async function evaluateToolOutput(input, ext = {}) {
   return emit(modified ? "modified" : "flagged", fields);
 }
 
-/**
- * The model-facing line for a note-only result: the seam's own note text,
- * deduped and joined, with no WARNING prefix.
- *
- * Empty only against a pinned engine that predates the severity split (see
- * SGR_OUTPUT_NOTE): there `sgrNote` still arrives true with no `notes` to go
- * with it, and printing nothing would drop the one thing that run had to say.
- * @param {string[]} notes
- * @returns {string}
- */
-function noteContext(notes) {
-  return notes.length === 0 ? SGR_OUTPUT_NOTE : [...new Set(notes)].join(" ");
-}
-
 /**
  * Judge a normalized PostToolUse event: run the sanitization pipeline and
  * express its outcome as a control-plane Verdict. sanitize-output only ever

package/claude-hooks/scan-invisible-chars.mjs

@@ -41,12 +41,11 @@ import {
 import { bestEffortTrace, trace, TraceEvent } from "./lib/trace.mjs";
 import { reportSlowHook, startHookTimer } from "./lib/hook-timing.mjs";
 // Relative, not the `agent-sanitizer` specifier every other engine import uses:
-// this is the scan's SCOPE, which is hook policy and must move with the hook.
-// Routing it through the specifier would resolve it, in the shipped plugin
-// bundle, against a PINNED older engine that does not export it — leaving the
-// walk with undefined globs while believing it had scanned everything. The
-// module is dependency-free data (see src/claude-context.mjs), so importing it
-// statically carries none of the fail-open hazard lazyImport exists to cover.
+// this is the scan's SCOPE, which is hook policy, and package.json's exports map
+// deliberately does not publish it — routing it through the specifier would fail
+// to resolve. The module is dependency-free data (see src/claude-context.mjs),
+// so importing it statically carries none of the fail-open hazard lazyImport
+// exists to cover.
 import {
   CLAUDE_CONTEXT_SUBDIRS,
   CLAUDE_INSTRUCTION_GLOBS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.34.7",
+  "version": "2.34.9",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {
@@ -53,6 +53,7 @@
     "@stryker-mutator/tap-runner": "^9.6.1",
     "@types/node": "25.9.1",
     "acorn": "^8.18.0",
+    "agent-sanitizer": "link:.",
     "c8": "11.0.0",
     "esbuild": "0.28.1",
     "eslint": "10.4.0",
@@ -60,7 +61,7 @@
     "globals": "17.6.0",
     "lint-staged": "^17.0.5",
     "prettier": "^3.0.0",
-    "sanitizer-engine": "npm:agent-sanitizer@2.20.0",
+    "smol-toml": "^1.7.1",
     "typescript": "6.0.3",
     "typescript-eslint": "8.61.0",
     "yaml": "^2.9.0"

package/src/html.mjs

@@ -36,7 +36,7 @@ import { unified } from "unified";
 import remarkParse from "remark-parse";
 import remarkGfm from "remark-gfm";
 import rehypeParse from "rehype-parse";
-import { visit, SKIP, EXIT } from "unist-util-visit";
+import { SKIP, EXIT } from "unist-util-visit";
 import {
   HTML_TAG_PRESENT,
   MD_LINK_HINT,
@@ -1374,14 +1374,93 @@ function hasDataSrc(el) {
 // there is exactly one parser configuration to reason about.
 const htmlParser = unified().use(rehypeParse, { fragment: true });
 
+/**
+ * Preorder depth-first walk of a unist tree, calling `visitor(node, index,
+ * parent)` on every node whose `type` is `test` (or on every node when `test` is
+ * null). `EXIT` ends the walk, `SKIP` leaves the node's children unvisited —
+ * the `unist-util-visit` contract, which is what the call sites here are
+ * written against.
+ *
+ * Spelled out rather than imported because `unist-util-visit` allocates a fresh
+ * ancestors array and a closure per node, and on a document that is one long
+ * flat sibling list — 32k `<p>` elements per megabyte of ordinary HTML — that
+ * turns a linear walk super-linear: 3480 ms against this walk's 62 ms over the
+ * same 4 MB tree. The three parallel arrays are the stack, so the walk itself
+ * allocates nothing per node.
+ * @param {any} tree
+ * @param {string | null} test
+ * @param {(node: any, index: number | undefined, parent: any) => unknown} visitor
+ */
+function walk(tree, test, visitor) {
+  /** @type {any[]} */
+  const nodes = [tree];
+  /** @type {Array<number | undefined>} */
+  const indices = [undefined];
+  /** @type {any[]} */
+  const parents = [undefined];
+  while (nodes.length > 0) {
+    const node = nodes.pop();
+    const index = indices.pop();
+    const parent = parents.pop();
+    const result =
+      test === null || node.type === test
+        ? visitor(node, index, parent)
+        : undefined;
+    if (result === EXIT) return;
+    if (result === SKIP) continue;
+    const children = node.children;
+    if (children === undefined) continue;
+    for (let i = children.length - 1; i >= 0; i--) {
+      nodes.push(children[i]);
+      indices.push(i);
+      parents.push(node);
+    }
+  }
+}
+
+/**
+ * `parse` with its most recent (input, tree) pair remembered.
+ *
+ * Layers 2 and 3 each parse the SAME tool output: `sanitizeHtml` tokenizes it to
+ * decide the source-vs-markdown branch, and `detectExfil` tokenizes it again to
+ * read `src`/`href` off the elements — two full parse5 runs and two full
+ * micromark runs over one document, which is most of what the HTML layer costs
+ * on ordinary prose. Every consumer only READS the tree (the sole AST mutation
+ * in this module is over a css-tree value parsed per style string), so one tree
+ * is safe to hand to both.
+ *
+ * One entry, replaced on every miss, so the retained footprint is one tree for
+ * the document most recently sanitized — the tree that call had allocated
+ * anyway. A miss re-parses and answers identically, so the cache can never
+ * change a verdict, only what one costs.
+ * @param {(text: string) => any} parse
+ * @returns {(text: string) => any}
+ */
+function lastParseCached(parse) {
+  /** @type {string | null} */
+  let cachedText = null;
+  /** @type {any} */
+  let cachedTree = null;
+  return (text) => {
+    if (cachedText === text) return cachedTree;
+    // The key is recorded only AFTER the parse returns. A parse that throws —
+    // which is how a pathologically nested fragment reaches the fail-closed
+    // withhold — must leave the entry untouched, or the next call for that same
+    // text hits a key whose tree came from a DIFFERENT document and gets a
+    // verdict about the wrong input instead of the withhold.
+    const tree = parse(text);
+    cachedText = text;
+    cachedTree = tree;
+    return tree;
+  };
+}
+
 /**
  * Parse `html` as an HTML fragment with the real tokenizer (parse5, via rehype).
  * @param {string} html
  * @returns {any}
  */
-function parseFragment(html) {
-  return htmlParser.parse(html);
-}
+const parseFragment = lastParseCached((html) => htmlParser.parse(html));
 
 /**
  * @param {string} htmlValue
@@ -1391,7 +1470,7 @@ function parseHtmlTag(htmlValue) {
   const tree = parseFragment(htmlValue);
   /** @type {any} */
   let firstElement = null;
-  visit(tree, "element", (node) => {
+  walk(tree, "element", (node) => {
     firstElement = node;
     return EXIT;
   });
@@ -1606,7 +1685,7 @@ function scanFragmentTree(html, tree) {
   const warned = newWarned();
   // @ts-ignore -- visit callback returns EXIT/SKIP only on matches; implicit undefined return is intentional
   // eslint-disable-next-line consistent-return
-  visit(tree, (/** @type {any} */ node) => {
+  walk(tree, null, (/** @type {any} */ node) => {
     const isComment = node.type === "comment";
     if (isComment || isHiddenElement(node)) {
       /* c8 ignore start -- parse5 omits positions only on recovery-synthesized
@@ -1635,6 +1714,20 @@ function scanFragmentTree(html, tree) {
 
 const mdParser = unified().use(remarkParse).use(remarkGfm);
 
+/** The markdown tree for `text`, cached the same way {@link parseFragment} is.
+ * @type {(text: string) => any} */
+const parseMarkdown = lastParseCached((text) => mdParser.parse(text));
+
+// A `code` node is a FENCED or INDENTED block and nothing else, so either a
+// three-run of backticks/tildes or a line opening on a four-column indent must
+// appear somewhere in the text for one to exist. CommonMark expands a tab to
+// the next four-column tab stop, so fewer than four spaces followed by a tab is
+// an indent too ("  \tfoo" is a code block) — hence ` *\t` rather than `\t`.
+// Read over the whole document and deliberately loose (a stray ``` anywhere is
+// enough to parse), because the only sound direction to be wrong in here is
+// towards parsing.
+const MARKDOWN_CODE_HINT = /```|~~~|^(?: {4}| *\t)/m;
+
 // A markup-declaration-open (`<!`) or processing-instruction-ish (`<?`) start.
 // Inside an inline html node these begin a *bogus comment* unless they open a
 // proper `<!--…-->` comment (handled on the fast path) — `<!bogus>`, `<?php?>`,
@@ -1688,7 +1781,7 @@ function commentSpans(value) {
   const tree = parseFragment(value);
   /** @type {Map<number, number>} */
   const spans = new Map();
-  visit(tree, "comment", (/** @type {any} */ node) => {
+  walk(tree, "comment", (/** @type {any} */ node) => {
     if (node.position)
       spans.set(node.position.start.offset, node.position.end.offset);
   });
@@ -1916,7 +2009,7 @@ const FLOW_HTML_PARENTS = new Set([
  * @returns {{ ranges: SpliceRange[], warned: ReturnType<typeof newWarned> }}
  */
 function scanMarkdown(text) {
-  const tree = mdParser.parse(text);
+  const tree = parseMarkdown(text);
   /** @type {SpliceRange[]} */
   const ranges = [];
   const warned = newWarned();
@@ -1924,7 +2017,7 @@ function scanMarkdown(text) {
   // Flow html blocks carry complete markup, so rehype locates comments/hidden
   // elements precisely within them; block-local offsets are shifted to
   // document coordinates.
-  visit(tree, "html", (/** @type {any} */ node, _index, parent) => {
+  walk(tree, "html", (/** @type {any} */ node, _index, parent) => {
     if (!FLOW_HTML_PARENTS.has(parent?.type)) return;
     const base = node.position.start.offset;
     const sub = scanHtmlFragment(text.slice(base, node.position.end.offset));
@@ -1944,7 +2037,7 @@ function scanMarkdown(text) {
   // are walked as part of their root in document order, so the walk is skipped
   // for them here to avoid double-scanning and to keep the absorb state flowing
   // across those boundaries.
-  visit(tree, (/** @type {any} */ node) => {
+  walk(tree, null, (/** @type {any} */ node) => {
     if (!PHRASING_ROOTS.has(node.type)) return;
     if (!hasHtmlLeaf(node)) return;
     scanInlineChildren(node, text, ranges, warned);
@@ -1969,8 +2062,9 @@ function scanMarkdown(text) {
  * @returns {boolean}
  */
 function hasMarkdownCode(text) {
+  if (!MARKDOWN_CODE_HINT.test(text)) return false;
   let found = false;
-  visit(mdParser.parse(text), "code", () => {
+  walk(parseMarkdown(text), "code", () => {
     found = true;
     return EXIT;
   });
@@ -2564,7 +2658,7 @@ function extractHtmlUrls(text) {
   const tree = parseFragment(text);
   /** @type {Array<{ url: string, isImage: boolean, autoFetched: boolean, context: "resource" | "form" | "refresh" }>} */
   const urls = [];
-  visit(tree, "element", (/** @type {any} */ node) => {
+  walk(tree, "element", (/** @type {any} */ node) => {
     // hast element nodes always carry a `properties` object (parse5 sets it).
     const props = node.properties;
     const isImage = node.tagName === "img";
@@ -2640,8 +2734,8 @@ export function detectExfil(text) {
   try {
     // Remark AST handles markdown links/images/definitions (balanced parens,
     // reference links) correctly, unlike a hand-rolled regex.
-    const tree = mdParser.parse(text);
-    visit(tree, (node) => {
+    const tree = parseMarkdown(text);
+    walk(tree, null, (node) => {
       if (
         node.type !== "link" &&
         node.type !== "image" &&