agent-sanitizer 2.34.8 → 2.34.9

package/claude-hooks/lib/authored-content.mjs

@@ -53,36 +53,11 @@ import { lazyImport } from "./hook-io.mjs";
 const { stripAnsiFully } = /** @type {typeof import("agent-sanitizer")} */ (
   await lazyImport("agent-sanitizer")
 );
-const { STRIP, LONG_RUN_THRESHOLD, SCATTERED_THRESHOLD, stripInvisible } =
+const { STRIP, SCATTERED_THRESHOLD, hasLongRun, stripInvisible } =
   /** @type {typeof import("agent-sanitizer/invisible")} */ (
     await lazyImport("agent-sanitizer/invisible")
   );
 
-/**
- * "A run of {@link LONG_RUN_THRESHOLD} or more invisibles", bounded per match.
- *
- * Built from the engine's own class and threshold rather than imported as a
- * ready-made pattern or scan function, because the bundle resolves
- * `agent-sanitizer` to the PINNED published engine, which trails this repo:
- * anything this hook imports has to exist in that pin, or the import binds
- * undefined and the hook fails closed on every payload. STRIP and
- * LONG_RUN_THRESHOLD are the primitives that define a long run, so deriving the
- * pattern here keeps the answer identical to the engine's across pins, with no
- * version-specific scan API to adopt when the pin moves.
- *
- * The upper bound is what makes it safe on a large payload: V8 pushes one
- * backtrack entry per iteration of a quantifier onto a stack capped at 64 MB,
- * so an UNBOUNDED run pattern throws `RangeError: Maximum call stack size
- * exceeded` once a single run passes ~8.4 M code points — an 8 MB paste of
- * zero-widths into a Write body is exactly that. A bound of 2^20 iterations
- * sits ~8x under the ceiling, and a longer run still answers yes: any run of at
- * least the threshold contains a prefix this matches.
- */
-const LONG_RUN_CHUNK_RE = new RegExp(
-  `(?:${STRIP.source}){${LONG_RUN_THRESHOLD},${1 << 20}}`,
-  "gu",
-);
-
 // Content fields the model authors, per tool. Paths and confusables are the
 // confusable layer's domain; here we target the free-text fields that carry
 // model-authored prose / code / data out into persisted or displayed artifacts.
@@ -165,8 +140,10 @@ export function authoredScopeDecision(tool) {
 // user→model surfaces share one definition of "stego payload".
 /** @param {string} text */
 function isPayloadCapable(text) {
-  LONG_RUN_CHUNK_RE.lastIndex = 0;
-  if (LONG_RUN_CHUNK_RE.test(text)) return true;
+  // hasLongRun, not a pattern built here: the engine's scan is bounded per
+  // `exec`, which is what keeps an 8 MB run of zero-widths in a Write body from
+  // throwing `RangeError: Maximum call stack size exceeded` out of this hook.
+  if (hasLongRun(text)) return true;
   return (text.match(STRIP)?.length ?? 0) >= SCATTERED_THRESHOLD;
 }
 

package/claude-hooks/sanitize-output.mjs

@@ -82,8 +82,11 @@ export const { applyLayer1, matchesSecretHint, SECRET_HINT, SECRET_HINT_EXT } =
 const _output = /** @type {typeof import("agent-sanitizer/output")} */ (
   await lazyImport("agent-sanitizer/output")
 );
-const { sanitizeText: sanitizeTextSeam, composeContext: composeContextSeam } =
-  _output;
+const {
+  sanitizeText: sanitizeTextSeam,
+  composeContext: composeContextSeam,
+  withheldWarning,
+} = _output;
 export const { describeRemoved, describeWarned, suppressToolOutput } = _output;
 
 const HOOK_NAME = "sanitize-output";
@@ -94,12 +97,7 @@ const HOOK_NAME = "sanitize-output";
 // splice/withhold warnings make is NOT kept for this output. Fixed prose, no
 // error text — the redactor runs on attacker-influenced content and this line
 // reaches the model-facing context. Exported so tests assert it by reference.
-// Deliberately a LOCAL constant rather than a shared engine builder alongside
-// output.mjs's "Withheld the ${label}" template: the plugin bundle resolves
-// the engine to the pinned registry release, so hook code cannot use a new
-// engine export until the pin advances past it.
-export const REVEAL_WITHHELD_WARNING =
-  "Withheld the reveal sidecar: it could not be vetted for secrets";
+export const REVEAL_WITHHELD_WARNING = withheldWarning("reveal sidecar");
 
 // Total wall-clock budget for one hook invocation's blocking daemon calls — the
 // Layer-4 redactor — SHARED across every string leaf of the tool output. Each
@@ -116,18 +114,6 @@ const SANITIZE_BUDGET_MS = positiveMsOr(
   120000,
 );
 
-// Non-WARNING note for a strip whose only change was INERT ANSI on a local tool:
-// the display-only colour git/pytest/npm/etc. emit by default, and/or a stray
-// escape byte that formed no sequence at all. The engine now returns this text
-// itself, as a NOTE-severity finding alongside the warnings, so this copy is the
-// FALLBACK for exactly one case: a bundle built against a pinned engine older
-// than that severity split, whose result carries `sgrNote` but no `notes`. Same
-// sentence, so a plugin on the old pin keeps today's wording instead of falling
-// back to a bare "output sanitized".
-const SGR_OUTPUT_NOTE =
-  "Inert ANSI stripped (display-only colour and/or a stray escape byte that " +
-  "formed no control sequence); pipe through cat -v to inspect raw escapes.";
-
 // Web-ingress tools always get the Layer 2 HTML rewrite; local tools — Read,
 // Bash, Grep, gh — never do. A local HTML/markdown pass either rewrites bytes the
 // model is about to edit or deletes content (diffs, PR bodies, page
@@ -309,10 +295,8 @@ export async function sanitizeText(
     /** @type {{ cleaned: string, warnings: string[], notes?: string[], modified: boolean, sgrNote: boolean, reveal?: string, splices?: Array<{ placeholder: string, original: string }> }} */ (
       await sanitizeTextSeam(text, seamOptions)
     );
-  // The one place the seam's shape is normalized: `notes` is absent when the
-  // engine predates the severity split, which is the shipped plugin's pinned
-  // case (see SGR_OUTPUT_NOTE). Defaulting here means nothing downstream has to
-  // know that, and the banner composer sees one shape either way.
+  // The one place the seam's shape is normalized, so nothing downstream has to
+  // branch on an absent `notes` and the banner composer sees one shape.
   const result = { ...seamResult, notes: seamResult.notes ?? [] };
   return ext.postText
     ? applyPostText(
@@ -1006,7 +990,7 @@ export async function evaluateToolOutput(input, ext = {}) {
   // hidden-HTML splice to read about does not also need the colour codes).
   const baseContext =
     sgrNote && warnings.length === 0
-      ? noteContext(notes)
+      ? [...new Set(notes)].join(" ")
       : composeContext(modified, warnings, input.tool_name);
   const additionalContext = revealRead
     ? `${REVEAL_READ_ENVELOPE} ${baseContext}`
@@ -1017,20 +1001,6 @@ export async function evaluateToolOutput(input, ext = {}) {
   return emit(modified ? "modified" : "flagged", fields);
 }
 
-/**
- * The model-facing line for a note-only result: the seam's own note text,
- * deduped and joined, with no WARNING prefix.
- *
- * Empty only against a pinned engine that predates the severity split (see
- * SGR_OUTPUT_NOTE): there `sgrNote` still arrives true with no `notes` to go
- * with it, and printing nothing would drop the one thing that run had to say.
- * @param {string[]} notes
- * @returns {string}
- */
-function noteContext(notes) {
-  return notes.length === 0 ? SGR_OUTPUT_NOTE : [...new Set(notes)].join(" ");
-}
-
 /**
  * Judge a normalized PostToolUse event: run the sanitization pipeline and
  * express its outcome as a control-plane Verdict. sanitize-output only ever

package/claude-hooks/scan-invisible-chars.mjs

@@ -41,12 +41,11 @@ import {
 import { bestEffortTrace, trace, TraceEvent } from "./lib/trace.mjs";
 import { reportSlowHook, startHookTimer } from "./lib/hook-timing.mjs";
 // Relative, not the `agent-sanitizer` specifier every other engine import uses:
-// this is the scan's SCOPE, which is hook policy and must move with the hook.
-// Routing it through the specifier would resolve it, in the shipped plugin
-// bundle, against a PINNED older engine that does not export it — leaving the
-// walk with undefined globs while believing it had scanned everything. The
-// module is dependency-free data (see src/claude-context.mjs), so importing it
-// statically carries none of the fail-open hazard lazyImport exists to cover.
+// this is the scan's SCOPE, which is hook policy, and package.json's exports map
+// deliberately does not publish it — routing it through the specifier would fail
+// to resolve. The module is dependency-free data (see src/claude-context.mjs),
+// so importing it statically carries none of the fail-open hazard lazyImport
+// exists to cover.
 import {
   CLAUDE_CONTEXT_SUBDIRS,
   CLAUDE_INSTRUCTION_GLOBS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.34.8",
+  "version": "2.34.9",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {
@@ -53,6 +53,7 @@
     "@stryker-mutator/tap-runner": "^9.6.1",
     "@types/node": "25.9.1",
     "acorn": "^8.18.0",
+    "agent-sanitizer": "link:.",
     "c8": "11.0.0",
     "esbuild": "0.28.1",
     "eslint": "10.4.0",
@@ -60,7 +61,7 @@
     "globals": "17.6.0",
     "lint-staged": "^17.0.5",
     "prettier": "^3.0.0",
-    "sanitizer-engine": "npm:agent-sanitizer@2.20.0",
+    "smol-toml": "^1.7.1",
     "typescript": "6.0.3",
     "typescript-eslint": "8.61.0",
     "yaml": "^2.9.0"

package/src/output.mjs

@@ -263,6 +263,19 @@ export const REDACTION_DOCTRINE =
   " (placeholders rehydrate only via Edit/Write on the owning file; other " +
   "write paths persist the placeholder text and lose the secret)";
 
+/**
+ * The warning prose for a value the caller asked for and is not getting,
+ * because the redactor could not vet it for secrets.
+ *
+ * Exported so the hook layer composes the same sentence for the artifacts it
+ * withholds itself (the reveal sidecar) rather than restating the wording.
+ * @param {string} label what was withheld, as a noun phrase
+ * @returns {string}
+ */
+export function withheldWarning(label) {
+  return `Withheld the ${label}: it could not be vetted for secrets`;
+}
+
 // Layer 2/3 pre-gate and warning prose are shared with the root entry
 // (./index.mjs), which runs the same layers; re-exported here because both were
 // part of this module's public surface before they moved.
@@ -527,9 +540,7 @@ async function vetStageValue(text, redact, findings, label) {
     // A WARNING: the caller asked for this field and is not getting it, and the
     // reason is an unrunnable redactor — the same fault that fails `cleaned`
     // closed, just with a survivable remedy here.
-    findings.push(
-      warning(`Withheld the ${label}: it could not be vetted for secrets`),
-    );
+    findings.push(warning(withheldWarning(label)));
     return undefined;
   }
 }

package/types/claude-hooks/sanitize-output.d.mts

@@ -274,7 +274,7 @@ export const SECRET_HINT_EXT: RegExp;
 export const describeRemoved: typeof import("agent-sanitizer/output").describeRemoved;
 export const describeWarned: typeof import("agent-sanitizer/output").describeWarned;
 export const suppressToolOutput: typeof import("agent-sanitizer/output").suppressToolOutput;
-export const REVEAL_WITHHELD_WARNING: "Withheld the reveal sidecar: it could not be vetted for secrets";
+export const REVEAL_WITHHELD_WARNING: string;
 export const COLLISION_WITHHELD_MESSAGE: "[WITHHELD \u2014 this field's name collided with another after sanitization]";
 export const ON_DISK_PLACEHOLDER_WARNING: string;
 /**

package/types/output.d.mts

@@ -1,3 +1,13 @@
+/**
+ * The warning prose for a value the caller asked for and is not getting,
+ * because the redactor could not vet it for secrets.
+ *
+ * Exported so the hook layer composes the same sentence for the artifacts it
+ * withholds itself (the reveal sidecar) rather than restating the wording.
+ * @param {string} label what was withheld, as a noun phrase
+ * @returns {string}
+ */
+export function withheldWarning(label: string): string;
 /**
  * Delete each verbatim span in `spans` from `text`. The secure Layer-5
  * primitive: a filter can only ask for deletions, so this can never inject