agent-sanitizer 2.41.0 → 2.41.1

package/claude-hooks/lib/hook-io.mjs

@@ -386,6 +386,21 @@ export function lastStdinByteLength() {
   return lastStdinBytes;
 }
 
+/**
+ * A hook run that received no event at all: stdin closed with zero bytes. Its
+ * own type, not the `SyntaxError` an empty string gets from `JSON.parse`,
+ * because the two are different faults with different fixes — a malformed
+ * payload is a sender that sent something wrong, an empty one is a hook wired to
+ * a channel that sent nothing, and a caller that cannot tell them apart reports
+ * the wrong cause and offers remedies for content it never received.
+ */
+export class EmptyStdinError extends Error {
+  constructor() {
+    super("empty stdin: the hook received no payload");
+    this.name = "EmptyStdinError";
+  }
+}
+
 /**
  * @param {number} [maxBytes] cap before aborting (overridable for tests)
  * @returns {Promise<any>}
@@ -393,6 +408,8 @@ export function lastStdinByteLength() {
 export async function readStdinJson(maxBytes = MAX_STDIN_BYTES) {
   const buf = await readAllBounded(process.stdin, maxBytes);
   lastStdinBytes = buf.length;
+  // Before the parse, so the empty case never renders as malformed JSON.
+  if (buf.length === 0) throw new EmptyStdinError();
   return JSON.parse(buf.toString());
 }
 

package/claude-hooks/scan-loaded-instructions.mjs

@@ -20,6 +20,7 @@
 import { readFileSync } from "node:fs";
 import {
   emitHookResponse,
+  EmptyStdinError,
   HookEvent,
   isMain,
   lazyImport,
@@ -82,6 +83,30 @@ function faultLine(ctx) {
   );
 }
 
+/**
+ * The parts for a run that received no event at all, or null when the fault is
+ * anything else. Zero bytes on stdin means no InstructionsLoaded payload was
+ * delivered, so no file was named and none went unscanned: the fault is in how
+ * the hook was INVOKED, not in a scan. Both postures render it the same way and
+ * neither arms the tool-call gate — that gate asks the user to clear something
+ * about this project's instruction files, and this fault says nothing about
+ * them, so arming it blocks the next tool call over a hook that was handed no
+ * event.
+ * @param {import("./lib/hook-fault.mjs").FaultContext} ctx
+ * @returns {import("./lib/hook-fault.mjs").FaultParts | null}
+ */
+function emptyPayloadParts(ctx) {
+  if (!(ctx.err instanceof EmptyStdinError)) return null;
+  return {
+    stderr:
+      `${HOOK_NAME} hook error: ${ctx.message}. No instruction file was named, so nothing ` +
+      "was scanned and nothing was left unguarded. Check how this hook is invoked: it reads " +
+      "its InstructionsLoaded event as JSON on stdin, and one wired to a channel that " +
+      "delivers nothing scans nothing for the whole session.\n",
+    exitCode: 1,
+  };
+}
+
 // This hook's entry in the one posture table (lib/hook-fault.mjs). Like
 // scan-invisible-chars it has no stdout verdict channel — InstructionsLoaded
 // cannot block, and its exit code is ignored — so both arms are stated
@@ -90,15 +115,17 @@ function faultLine(ctx) {
 registerFaultPolicy(HOOK_NAME, {
   event: HookEvent.INSTRUCTIONS_LOADED,
   guarded: "a loaded instruction file",
-  open: (ctx) => ({
-    stderr: `${faultLine(ctx)} Passing through unguarded; set AGENT_SANITIZER_FAIL_OPEN=0 to arm the tool-call gate instead.\n`,
-    exitCode: 1,
-  }),
-  closed: (ctx) => ({
-    stderr: `${faultLine(ctx)} Arming the tool-call gate (AGENT_SANITIZER_FAIL_OPEN=0).\n`,
-    exitCode: 1,
-    armAlert: true,
-  }),
+  open: (ctx) =>
+    emptyPayloadParts(ctx) ?? {
+      stderr: `${faultLine(ctx)} Passing through unguarded; set AGENT_SANITIZER_FAIL_OPEN=0 to arm the tool-call gate instead.\n`,
+      exitCode: 1,
+    },
+  closed: (ctx) =>
+    emptyPayloadParts(ctx) ?? {
+      stderr: `${faultLine(ctx)} Arming the tool-call gate (AGENT_SANITIZER_FAIL_OPEN=0).\n`,
+      exitCode: 1,
+      armAlert: true,
+    },
 });
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.41.0",
+  "version": "2.41.1",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/types/claude-hooks/lib/hook-io.d.mts

@@ -485,6 +485,17 @@ export const DISABLED_HOOKS_ENV: "AGENT_SANITIZER_DISABLED_HOOKS";
  * and take its own fail-closed output down with it.
  */
 export const MAX_STDIN_BYTES: number;
+/**
+ * A hook run that received no event at all: stdin closed with zero bytes. Its
+ * own type, not the `SyntaxError` an empty string gets from `JSON.parse`,
+ * because the two are different faults with different fixes — a malformed
+ * payload is a sender that sent something wrong, an empty one is a hook wired to
+ * a channel that sent nothing, and a caller that cannot tell them apart reports
+ * the wrong cause and offers remedies for content it never received.
+ */
+export class EmptyStdinError extends Error {
+    constructor();
+}
 /**
  * The remedy {@link missingPackageMessage} states when the host does not supply
  * one of its own. A host whose install has a specific entry point (a setup