agent-sanitizer 2.47.1 → 2.47.2

package/THREAT-MODEL.md

@@ -669,8 +669,21 @@ it, so what anchors its trust is worth stating exactly.
   code in the session, which is why the provisioner creates that directory mode
   700 and installs the binary mode 700. A user-owned data directory is the
   assumption; a shared or world-writable one is not supported.
-- **Opting out.** `AGENT_SANITIZER_HOOK_BINARY=0` never downloads and never
-  runs a binary, leaving the node path exactly as it was.
+- **A second artifact under that directory is loaded as code: V8's compile
+  cache.** The launcher points node at
+  `${CLAUDE_PLUGIN_DATA}/node-compile-cache` so the hook bundle is compiled once
+  per install instead of once per tool call. V8 does not treat a code cache as
+  untrusted input, so those files are code the session runs, exactly like the
+  binary above. The launcher creates the directory mode 700 and gates it with
+  `trusted_exec_dir` — the same owner-only-write property, refused with a line on
+  stderr when the directory does not hold it — so the same user-owned data
+  directory is the assumption here too. It carries no digest and needs none:
+  anything able to write there can already run code per the bullet above. Nothing
+  is fetched for it, so it adds no supply-chain surface.
+- **Opting out.** `AGENT_SANITIZER_HOOK_BINARY=0` never downloads and never runs
+  a binary. That leaves the node path running the committed bundle and the
+  compile cache above; `AGENT_SANITIZER_COMPILE_CACHE=0` turns the cache off as
+  well, and an operator's own `NODE_COMPILE_CACHE` is used unchanged.
 
 ## Failure posture (`AGENT_SANITIZER_FAIL_OPEN`)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.47.1",
+  "version": "2.47.2",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/src/invisible.mjs

@@ -1084,9 +1084,20 @@ function isPreservedBlankFiller(cps, i) {
 // defines the unit the preserve budget is charged against (see carveStrip).
 // Grapheme segmentation is locale-independent, so the locale is pinned to "en"
 // only for determinism across hosts.
-const GRAPHEME_SEGMENTER = new Intl.Segmenter("en", {
-  granularity: "grapheme",
-});
+//
+// Built on FIRST USE, never at import: constructing it loads ICU's segmentation
+// tables and costs ~10 ms, the largest single item in this module's setup, and
+// only text with carve candidates ever reaches clusterResolver. The hooks that
+// import this run on every tool call, so building it at import charged every
+// call for a segmenter almost none of them use.
+/** @type {Intl.Segmenter | null} */
+let segmenterCache = null;
+
+/** @returns {Intl.Segmenter} the process-wide grapheme segmenter. */
+function graphemeSegmenter() {
+  segmenterCache ??= new Intl.Segmenter("en", { granularity: "grapheme" });
+  return segmenterCache;
+}
 
 /**
  * The UTF-16 index at which each code point of `cps` starts, plus one final
@@ -1148,7 +1159,7 @@ const CONTAINING_CANDIDATE_SHARE = 4;
 function clusterResolver(body, offsets, candidates) {
   const cpCount = offsets.length - 1;
   if (candidates * CONTAINING_CANDIDATE_SHARE < cpCount) {
-    const segments = GRAPHEME_SEGMENTER.segment(body);
+    const segments = graphemeSegmenter().segment(body);
     return (cp) => {
       // `offsets[cp]` is inside the string for every code-point index the walk
       // asks about, so the segment always exists.
@@ -1165,7 +1176,7 @@ function clusterResolver(body, offsets, candidates) {
   // cursor in step with it so no boundary needs searching for. The iterator is
   // abandoned wherever the last candidate leaves it, so a document whose
   // preserve budget is spent in its first line is never segmented past it.
-  const iterator = GRAPHEME_SEGMENTER.segment(body)[Symbol.iterator]();
+  const iterator = graphemeSegmenter().segment(body)[Symbol.iterator]();
   let start = 0;
   let end = 0;
   return (cp) => {