agent-sanitizer 2.40.0 → 2.40.2

package/README.md

@@ -241,6 +241,8 @@ To wire them yourself instead, one entry dispatches every mode on `--hook=`:
 | `SessionStart`       | `scan-invisible-chars`     |
 | `InstructionsLoaded` | `scan-loaded-instructions` |
 
+**Wire all five.** The instruction-file scan is split across two of them: `SessionStart` covers the files that load at launch, and `InstructionsLoaded` covers every one a subdirectory loads later. A host that wires the first without the second leaves a nested `CLAUDE.md` scanned by nothing, and the one-time PreToolUse coverage notice is the only thing that says so.
+
 `require.resolve("agent-sanitizer/claude-hooks")` gives the path without
 hardcoding a layout. Importing the module rather than spawning it is a no-op.
 

package/THREAT-MODEL.md

@@ -303,9 +303,12 @@ neutralization is to strip the payload from disk (so no reload re-reads it) and
 tell the model to treat what it just read as untrusted data. Auto-cleaning is
 confined to `CLAUDE_PROJECT_DIR` in both — an ancestor file, or one under
 `~/.claude`, is shared with every other project on the machine, so it is reported
-through the cross-hook alert and never rewritten. A Claude Code build that emits
-no `InstructionsLoaded` event loses the lazy half entirely; the PreToolUse gate
-says so once per session rather than leaving the gap silent.
+through the cross-hook alert and never rewritten. Three things lose the lazy half
+entirely: a host that never wired the `InstructionsLoaded` event to
+`scan-loaded-instructions`, a Claude Code build that does not emit that event,
+and `scan-loaded-instructions` switched off in `AGENT_SANITIZER_DISABLED_HOOKS`.
+Nothing on disk tells them apart, so the PreToolUse gate names all three, once
+per session, rather than leaving the gap silent.
 
 That table is a claim about someone else's product, so the event that names a
 loaded file is also what falsifies it. `contextScopeContradiction` checks every
@@ -673,3 +676,44 @@ is only as durable as the files carrying it.
 The knob adds no layer and changes no layer's semantics. Ambiguous input still
 fails open at the detection level (precision over recall), as it always has —
 that is a separate, and unrelated, sense of the phrase.
+
+## Benchmark (`test/injection-corpus.test.mjs`)
+
+The published "invisible prompt injection" corpora fall in two families, and
+only one benchmarks a deterministic transform. Model-susceptibility suites
+(AgentDojo, InjecAgent, Agent Security Bench, LLMail-Inject, Reverse CAPTCHA)
+measure whether a _model_ obeys an injection; scoring against them needs an LLM
+in the loop, and most inject in plaintext — a channel this library does not
+touch. Payload corpora do apply, because ground truth ("this text carries
+operator-hidden content") is checkable with no model.
+
+`test/injection-corpus.test.mjs` is that benchmark, built the way the rest of
+this repo pins behavior: a self-authored, append-only corpus. It transcribes
+each documented encoding — the encoders in the file are the cited spec, not a
+vendored dependency — over benign carrier and payload text, and scores the pair
+a sanitizer is actually responsible for: the concealment is **neutralized** and
+the finding is **reported at the right tier**. One vector per named technique:
+
+- Unicode tags (garak `goodside.Tag`; Cisco Unicode-tag advisory) → Layer 1.
+- Zero-width binary (Reverse CAPTCHA) → Layer 1.
+- Variation-selector smuggling (sneaky-bits; garak `badchars`) → Layer 1.
+- ANSI hidden text (garak `ansiescape`) → Layer 1.
+- Bidi override (Trojan Source; garak `badchars`) → Layer 1.
+- Markdown-image exfil URL (garak `web_injection.MarkdownImageExfil`) → Layer 3.
+- Homoglyph command (garak `smuggling.HomoglyphObfuscation`) → Layer 4.
+
+Two things the corpus fixes that a naive harness gets wrong. It drives Layer 4
+through the wired `namespace-guard` seam, not `sanitize()` — which never reaches
+confusable folding, so a one-entry-point harness reports a false 0% on every
+homoglyph vector. And it pins the _observed_ verdict, not a wished one: a short
+bidi override is stripped and reported (`cf-format`) but is not payload-shaped,
+so `classifyPrompt` passes it — recorded as a measured partial-coverage point
+rather than asserted away.
+
+The benign twin is load-bearing. Every public corpus is positives-only, and a
+recall-only score rewards the over-triggering this repo forbids ("flag
+everything" scores 100%). The corpus pairs the vectors with legitimate inputs —
+preserved ZWNJ/ZWJ joiners, emoji sequences, non-Latin prose, long-but-benign
+opaque-token URLs (presigned S3, OAuth callbacks) — asserting **zero** findings,
+so the number that ships is precision alongside recall. `INJECTION_REPORT=1
+node --test test/injection-corpus.test.mjs` prints the roll-up.

package/claude-hooks/lib/invisible-alert.mjs

@@ -150,10 +150,12 @@ export function recordInstructionsLoaded(sessionId) {
  * instruction files that load at launch, and everything a subdirectory loads
  * later is scanned by the event. No scan, and nothing says so.
  *
- * The notice names the OBSERVABLE — no scan ran — and both of its causes, because
- * the marker cannot tell a host that never emits the event from an operator who
- * switched the hook off in AGENT_SANITIZER_DISABLED_HOOKS, and asserting the
- * first would send an operator who chose the second to the wrong fix.
+ * The notice names the OBSERVABLE — no scan ran — and all three causes, because
+ * the marker cannot tell them apart: a host that never wired the event to
+ * scan-loaded-instructions, a Claude Code that does not emit it, and the hook
+ * switched off in AGENT_SANITIZER_DISABLED_HOOKS; asserting one sends a reader
+ * who is in another to the wrong fix. The wiring cause leads because it is the
+ * only one the reader can repair in this session, and nothing else reports it.
  * @param {string} [sessionId]  the harness's session identity, so the answer
  *   belongs to THIS session (see instructionsLoadedFile)
  * @returns {string | null}
@@ -168,9 +170,11 @@ export function instructionsLoadedGapNotice(sessionId) {
     "instruction files loaded from SUBDIRECTORIES (a nested CLAUDE.md, a " +
     "directory-scoped rule) are reaching the model unscanned for hidden " +
     "Unicode — the session-start scan covers only the files loaded at launch. " +
-    "Tell the user, and name both causes: a Claude Code that does not emit " +
-    "the event (upgrading restores the coverage), or scan-loaded-instructions " +
-    "switched off in AGENT_SANITIZER_DISABLED_HOOKS."
+    "Tell the user, and name all three causes: this host never wired the " +
+    "InstructionsLoaded event to scan-loaded-instructions (wiring it restores " +
+    "the coverage), a Claude Code that does not emit the event (upgrading " +
+    "restores it), or scan-loaded-instructions switched off in " +
+    "AGENT_SANITIZER_DISABLED_HOOKS."
   );
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.40.0",
+  "version": "2.40.2",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/types/claude-hooks/lib/invisible-alert.d.mts

@@ -52,10 +52,12 @@ export function recordInstructionsLoaded(sessionId?: string): void;
  * instruction files that load at launch, and everything a subdirectory loads
  * later is scanned by the event. No scan, and nothing says so.
  *
- * The notice names the OBSERVABLE — no scan ran — and both of its causes, because
- * the marker cannot tell a host that never emits the event from an operator who
- * switched the hook off in AGENT_SANITIZER_DISABLED_HOOKS, and asserting the
- * first would send an operator who chose the second to the wrong fix.
+ * The notice names the OBSERVABLE — no scan ran — and all three causes, because
+ * the marker cannot tell them apart: a host that never wired the event to
+ * scan-loaded-instructions, a Claude Code that does not emit it, and the hook
+ * switched off in AGENT_SANITIZER_DISABLED_HOOKS; asserting one sends a reader
+ * who is in another to the wrong fix. The wiring cause leads because it is the
+ * only one the reader can repair in this session, and nothing else reports it.
  * @param {string} [sessionId]  the harness's session identity, so the answer
  *   belongs to THIS session (see instructionsLoadedFile)
  * @returns {string | null}