agent-sanitizer 2.34.9 → 2.34.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.34.9",
+  "version": "2.34.11",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/src/ansi.mjs

@@ -92,6 +92,13 @@ const ESC = 0x1b;
 const CSI_C1 = 0x9b;
 const ST_C1 = 0x9c;
 const BEL = 0x07;
+// CAN/SUB cancel a control string per ECMA-48 and the xterm parser; LF/CR do
+// not, but bound the body anyway as a fail-closed blast-radius limit (see
+// scanControlString).
+const CAN = 0x18;
+const SUB = 0x1a;
+const LF = 0x0a;
+const CR = 0x0d;
 
 // PROBLEM CLASS — a control string whose body the grammar leaves as visible
 // text. ECMA-48 opens FIVE strings, not one: OSC (`ESC ]` / U+009D), DCS
@@ -209,15 +216,24 @@ export function orphanKindFor(ch, next) {
  * application command — i.e. attacker-controlled PAYLOAD TEXT in every case.
  * Consuming the introducer alone would leave that payload in the model's view,
  * so the whole string is one token. Three ways it can end:
- *   1. a real terminator — ST (`ESC\` or the 8-bit C1 ST U+009C) or the legacy
- *      BEL — which is consumed with the body.
+ *   1. a real terminator — ST (`ESC\` or the 8-bit C1 ST U+009C), the legacy
+ *      BEL, or the CAN/SUB (U+0018/U+001A) that ECMA-48 and xterm cancel a
+ *      string on — which is consumed with the body.
  *   2. an ABORT: per ECMA-48/xterm a bare ESC (one not forming ST) drops the
  *      terminal out of the string, and a nested C1 string introducer likewise
  *      starts something new. The token ends BEFORE that byte so the scan
  *      re-reads it as its own sequence — without this, an interior ESC deleted
- *      the rest of the document via case 3.
- *   3. end of input, for a genuinely unterminated string: fail closed and drop
- *      everything from the introducer on, so no body survives.
+ *      the rest of the document via case 4.
+ *   3. a line break (LF/CR) BOUNDS the body, before the break. This is a fail-
+ *      closed blast-radius limit, NOT terminal behavior: a real terminal ignores
+ *      an interior LF and keeps collecting to a true terminator. Without the
+ *      bound one stray `ESC ]` deleted every later line to end of input, so on a
+ *      consumer that reads the strip as a RECORD (a model, not a display) one
+ *      introducer blinded the whole tail behind a clean-looking prefix. The
+ *      break survives; the payload after it on the same line is dropped.
+ *   4. end of input, for a genuinely unterminated string with no line break:
+ *      fail closed and drop everything from the introducer on, so no body
+ *      survives.
  *
  * BEL terminates every arm here, not just OSC. Only xterm's OSC parser accepts
  * it, so a DCS ending at BEL over-consumes by the width of one body — the
@@ -239,9 +255,11 @@ function scanControlString(text, start) {
   let i = sevenBit ? start + 2 : start + 1;
   for (; i < text.length; i++) {
     const byte = text.charCodeAt(i);
-    if (byte === BEL || byte === ST_C1) return { end: i + 1, kind };
+    if (byte === BEL || byte === ST_C1 || byte === CAN || byte === SUB)
+      return { end: i + 1, kind };
     if (byte === ESC) return { end: text[i + 1] === "\\" ? i + 2 : i, kind };
-    if (STRING_INTRO_C1.has(byte)) return { end: i, kind };
+    if (STRING_INTRO_C1.has(byte) || byte === LF || byte === CR)
+      return { end: i, kind };
   }
   return { end: text.length, kind };
 }

package/src/output.mjs

@@ -407,10 +407,10 @@ function processLayer1(text, sgrCarveOut) {
  * vet them before they leave. The transform itself stays pure — the caller owns
  * any persistence.
  * @param {PipelineState} state
- * @param {{ html?: boolean, exfilScan?: boolean }} options
+ * @param {{ html?: boolean, exfilScan?: boolean, deadline?: Deadline }} options
  * @returns {Promise<{ reveal: string | undefined, splices: Array<{ placeholder: string, original: string }> }>}
  */
-async function applyMarkdownPipeline(state, { html, exfilScan }) {
+async function applyMarkdownPipeline(state, { html, exfilScan, deadline }) {
   const inputText = state.text;
   /** @type {string | undefined} */
   let reveal;
@@ -418,6 +418,20 @@ async function applyMarkdownPipeline(state, { html, exfilScan }) {
   const splices = [];
   if ((!html && !exfilScan) || !needsMarkdownPipeline(inputText))
     return { reveal: undefined, splices };
+  // INVARIANT: this refusal stops a layer below from STARTING with no budget
+  // left. Each parses the whole document in ONE synchronous call, so nothing
+  // interrupts it, and a host that kills the overrun hook shows the RAW text.
+  // Called before EACH parse: Layer 2 spends the budget Layer 3 then runs on.
+  // After the pre-gate: a declined call costs no time. Fail closed, as Layer 4.
+  const refuseIfSpent = () => {
+    if (deadline && deadline.remainingMs() <= 0)
+      throw new Error(
+        "CRITICAL: the sanitization time budget ran out before the hidden-HTML " +
+          "and exfil-URL layers finished, so this text was not fully checked. " +
+          "Failing closed — tool output suppressed.",
+      );
+  };
+  refuseIfSpent();
   let sanitizeHtml, detectExfil;
   /* c8 ignore start -- a rejected dynamic import of a module that ships in
      this very package (not an optional peer dep) requires corrupting
@@ -478,6 +492,7 @@ async function applyMarkdownPipeline(state, { html, exfilScan }) {
   // URL hidden inside a display:none element or an HTML comment is MORE
   // suspicious, not less, yet Layer 2 has already removed it from `cleaned`.
   if (exfilScan) {
+    refuseIfSpent();
     const threats = detectExfil(inputText);
     // Severity tracks who does the fetching. An auto-fetched target — an image,
     // a stylesheet, a form action, a meta refresh — exfiltrates the moment the
@@ -552,9 +567,19 @@ async function vetStageValue(text, redact, findings, label) {
  *   redact?: (text: string) => Promise<RedactResult|null> | (RedactResult|null),
  *   filterInjection?: (text: string) => Promise<Layer5Result|null> | (Layer5Result|null),
  *   sgrCarveOut?: boolean,
+ *   deadline?: Deadline,
  * }} SanitizeTextOptions
  */
 
+/**
+ * A caller's shared wall-clock budget across one run of this pipeline.
+ * `remainingMs()` returns the milliseconds left; at or below zero it is spent.
+ * Layer 4's injected redactor reads its own copy of the same budget, so this
+ * option is what lets the layers inside this module read it too. Omitted means
+ * no budget, which is the standalone default: every layer runs to completion.
+ * @typedef {{ remainingMs: () => number }} Deadline
+ */
+
 /**
  * Run the configured layers over a single text blob. Layer 1 always runs; the
  * rest are opt-in via `options`. Layer 4 (`redact`) is the fail-closed path: a

package/types/output.d.mts

@@ -41,8 +41,17 @@ export function deleteVerbatimSpans(text: string, spans: string[]): {
  *   redact?: (text: string) => Promise<RedactResult|null> | (RedactResult|null),
  *   filterInjection?: (text: string) => Promise<Layer5Result|null> | (Layer5Result|null),
  *   sgrCarveOut?: boolean,
+ *   deadline?: Deadline,
  * }} SanitizeTextOptions
  */
+/**
+ * A caller's shared wall-clock budget across one run of this pipeline.
+ * `remainingMs()` returns the milliseconds left; at or below zero it is spent.
+ * Layer 4's injected redactor reads its own copy of the same budget, so this
+ * option is what lets the layers inside this module read it too. Omitted means
+ * no budget, which is the standalone default: every layer runs to completion.
+ * @typedef {{ remainingMs: () => number }} Deadline
+ */
 /**
  * Run the configured layers over a single text blob. Layer 1 always runs; the
  * rest are opt-in via `options`. Layer 4 (`redact`) is the fail-closed path: a
@@ -262,6 +271,17 @@ export type SanitizeTextOptions = {
     redact?: (text: string) => Promise<RedactResult | null> | (RedactResult | null);
     filterInjection?: (text: string) => Promise<Layer5Result | null> | (Layer5Result | null);
     sgrCarveOut?: boolean;
+    deadline?: Deadline;
+};
+/**
+ * A caller's shared wall-clock budget across one run of this pipeline.
+ * `remainingMs()` returns the milliseconds left; at or below zero it is spent.
+ * Layer 4's injected redactor reads its own copy of the same budget, so this
+ * option is what lets the layers inside this module read it too. Omitted means
+ * no budget, which is the standalone default: every layer runs to completion.
+ */
+export type Deadline = {
+    remainingMs: () => number;
 };
 import { needsMarkdownPipeline } from "./gates.mjs";
 export { describeExfil, describeRemoved, describeWarned } from "./warnings.mjs";