agent-sanitizer 2.40.0 → 2.40.1

package/README.md

@@ -241,6 +241,8 @@ To wire them yourself instead, one entry dispatches every mode on `--hook=`:
 | `SessionStart`       | `scan-invisible-chars`     |
 | `InstructionsLoaded` | `scan-loaded-instructions` |
 
+**Wire all five.** The instruction-file scan is split across two of them: `SessionStart` covers the files that load at launch, and `InstructionsLoaded` covers every one a subdirectory loads later. A host that wires the first without the second leaves a nested `CLAUDE.md` scanned by nothing, and the one-time PreToolUse coverage notice is the only thing that says so.
+
 `require.resolve("agent-sanitizer/claude-hooks")` gives the path without
 hardcoding a layout. Importing the module rather than spawning it is a no-op.
 

package/THREAT-MODEL.md

@@ -303,9 +303,12 @@ neutralization is to strip the payload from disk (so no reload re-reads it) and
 tell the model to treat what it just read as untrusted data. Auto-cleaning is
 confined to `CLAUDE_PROJECT_DIR` in both — an ancestor file, or one under
 `~/.claude`, is shared with every other project on the machine, so it is reported
-through the cross-hook alert and never rewritten. A Claude Code build that emits
-no `InstructionsLoaded` event loses the lazy half entirely; the PreToolUse gate
-says so once per session rather than leaving the gap silent.
+through the cross-hook alert and never rewritten. Three things lose the lazy half
+entirely: a host that never wired the `InstructionsLoaded` event to
+`scan-loaded-instructions`, a Claude Code build that does not emit that event,
+and `scan-loaded-instructions` switched off in `AGENT_SANITIZER_DISABLED_HOOKS`.
+Nothing on disk tells them apart, so the PreToolUse gate names all three, once
+per session, rather than leaving the gap silent.
 
 That table is a claim about someone else's product, so the event that names a
 loaded file is also what falsifies it. `contextScopeContradiction` checks every

package/claude-hooks/lib/invisible-alert.mjs

@@ -150,10 +150,12 @@ export function recordInstructionsLoaded(sessionId) {
  * instruction files that load at launch, and everything a subdirectory loads
  * later is scanned by the event. No scan, and nothing says so.
  *
- * The notice names the OBSERVABLE — no scan ran — and both of its causes, because
- * the marker cannot tell a host that never emits the event from an operator who
- * switched the hook off in AGENT_SANITIZER_DISABLED_HOOKS, and asserting the
- * first would send an operator who chose the second to the wrong fix.
+ * The notice names the OBSERVABLE — no scan ran — and all three causes, because
+ * the marker cannot tell them apart: a host that never wired the event to
+ * scan-loaded-instructions, a Claude Code that does not emit it, and the hook
+ * switched off in AGENT_SANITIZER_DISABLED_HOOKS; asserting one sends a reader
+ * who is in another to the wrong fix. The wiring cause leads because it is the
+ * only one the reader can repair in this session, and nothing else reports it.
  * @param {string} [sessionId]  the harness's session identity, so the answer
  *   belongs to THIS session (see instructionsLoadedFile)
  * @returns {string | null}
@@ -168,9 +170,11 @@ export function instructionsLoadedGapNotice(sessionId) {
     "instruction files loaded from SUBDIRECTORIES (a nested CLAUDE.md, a " +
     "directory-scoped rule) are reaching the model unscanned for hidden " +
     "Unicode — the session-start scan covers only the files loaded at launch. " +
-    "Tell the user, and name both causes: a Claude Code that does not emit " +
-    "the event (upgrading restores the coverage), or scan-loaded-instructions " +
-    "switched off in AGENT_SANITIZER_DISABLED_HOOKS."
+    "Tell the user, and name all three causes: this host never wired the " +
+    "InstructionsLoaded event to scan-loaded-instructions (wiring it restores " +
+    "the coverage), a Claude Code that does not emit the event (upgrading " +
+    "restores it), or scan-loaded-instructions switched off in " +
+    "AGENT_SANITIZER_DISABLED_HOOKS."
   );
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.40.0",
+  "version": "2.40.1",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/types/claude-hooks/lib/invisible-alert.d.mts

@@ -52,10 +52,12 @@ export function recordInstructionsLoaded(sessionId?: string): void;
  * instruction files that load at launch, and everything a subdirectory loads
  * later is scanned by the event. No scan, and nothing says so.
  *
- * The notice names the OBSERVABLE — no scan ran — and both of its causes, because
- * the marker cannot tell a host that never emits the event from an operator who
- * switched the hook off in AGENT_SANITIZER_DISABLED_HOOKS, and asserting the
- * first would send an operator who chose the second to the wrong fix.
+ * The notice names the OBSERVABLE — no scan ran — and all three causes, because
+ * the marker cannot tell them apart: a host that never wired the event to
+ * scan-loaded-instructions, a Claude Code that does not emit it, and the hook
+ * switched off in AGENT_SANITIZER_DISABLED_HOOKS; asserting one sends a reader
+ * who is in another to the wrong fix. The wiring cause leads because it is the
+ * only one the reader can repair in this session, and nothing else reports it.
  * @param {string} [sessionId]  the harness's session identity, so the answer
  *   belongs to THIS session (see instructionsLoadedFile)
  * @returns {string | null}