agent-sanitizer 2.47.1 → 2.47.3

package/THREAT-MODEL.md

@@ -669,8 +669,21 @@ it, so what anchors its trust is worth stating exactly.
   code in the session, which is why the provisioner creates that directory mode
   700 and installs the binary mode 700. A user-owned data directory is the
   assumption; a shared or world-writable one is not supported.
-- **Opting out.** `AGENT_SANITIZER_HOOK_BINARY=0` never downloads and never
-  runs a binary, leaving the node path exactly as it was.
+- **A second artifact under that directory is loaded as code: V8's compile
+  cache.** The launcher points node at
+  `${CLAUDE_PLUGIN_DATA}/node-compile-cache` so the hook bundle is compiled once
+  per install instead of once per tool call. V8 does not treat a code cache as
+  untrusted input, so those files are code the session runs, exactly like the
+  binary above. The launcher creates the directory mode 700 and gates it with
+  `trusted_exec_dir` — the same owner-only-write property, refused with a line on
+  stderr when the directory does not hold it — so the same user-owned data
+  directory is the assumption here too. It carries no digest and needs none:
+  anything able to write there can already run code per the bullet above. Nothing
+  is fetched for it, so it adds no supply-chain surface.
+- **Opting out.** `AGENT_SANITIZER_HOOK_BINARY=0` never downloads and never runs
+  a binary. That leaves the node path running the committed bundle and the
+  compile cache above; `AGENT_SANITIZER_COMPILE_CACHE=0` turns the cache off as
+  well, and an operator's own `NODE_COMPILE_CACHE` is used unchanged.
 
 ## Failure posture (`AGENT_SANITIZER_FAIL_OPEN`)
 

package/claude-hooks/pretooluse-sanitize.mjs

@@ -81,7 +81,8 @@ const HOOK_NAME = "pretooluse-sanitize";
  * must be blocked, or null to let the pipeline continue. Hosts use these for
  * policy the package has no view of (a required workflow step, a project-local
  * rule); the package ships none.
- * @typedef {(input: { tool_name: string | null, tool_input: any, session_id?: string })
+ * @typedef {(input: { tool_name: string | null, tool_input: any, session_id?: string,
+ *   permission_mode?: string })
  *   => string | null | undefined} HostGate
  */
 
@@ -595,13 +596,16 @@ export async function judgePreToolUseSanitize(event, rehydrate, opts = {}) {
   // a pass is the one incentive a gate must never create.
   if (event.event === EventKind.UNKNOWN)
     return { decision: Decision.DENY, reason: messages.unknownEvent };
-  // The session identity travels in `meta`, not alongside the tool input; a host
-  // gate keyed on the session (a once-per-session checkpoint) cannot tell two
-  // sessions apart without it.
+  // The session identity and the permission mode travel in `meta`, not alongside
+  // the tool input. A gate keyed on the session (a once-per-session checkpoint)
+  // cannot tell two sessions apart without the first, and a gate keyed on the
+  // mode reads `undefined` without the second — so it fires in EVERY mode, which
+  // is the safe direction but not the intended one.
   const input = {
     tool_name: event.tool,
     tool_input: event.input,
     session_id: event.meta?.session_id,
+    permission_mode: event.meta?.permission_mode,
   };
   // Host gates run BEFORE any rewriting layer, because they decide whether the
   // call may happen at all rather than what its input contains — and returning

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.47.1",
+  "version": "2.47.3",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/src/invisible.mjs

@@ -1084,9 +1084,20 @@ function isPreservedBlankFiller(cps, i) {
 // defines the unit the preserve budget is charged against (see carveStrip).
 // Grapheme segmentation is locale-independent, so the locale is pinned to "en"
 // only for determinism across hosts.
-const GRAPHEME_SEGMENTER = new Intl.Segmenter("en", {
-  granularity: "grapheme",
-});
+//
+// Built on FIRST USE, never at import: constructing it loads ICU's segmentation
+// tables and costs ~10 ms, the largest single item in this module's setup, and
+// only text with carve candidates ever reaches clusterResolver. The hooks that
+// import this run on every tool call, so building it at import charged every
+// call for a segmenter almost none of them use.
+/** @type {Intl.Segmenter | null} */
+let segmenterCache = null;
+
+/** @returns {Intl.Segmenter} the process-wide grapheme segmenter. */
+function graphemeSegmenter() {
+  segmenterCache ??= new Intl.Segmenter("en", { granularity: "grapheme" });
+  return segmenterCache;
+}
 
 /**
  * The UTF-16 index at which each code point of `cps` starts, plus one final
@@ -1148,7 +1159,7 @@ const CONTAINING_CANDIDATE_SHARE = 4;
 function clusterResolver(body, offsets, candidates) {
   const cpCount = offsets.length - 1;
   if (candidates * CONTAINING_CANDIDATE_SHARE < cpCount) {
-    const segments = GRAPHEME_SEGMENTER.segment(body);
+    const segments = graphemeSegmenter().segment(body);
     return (cp) => {
       // `offsets[cp]` is inside the string for every code-point index the walk
       // asks about, so the segment always exists.
@@ -1165,7 +1176,7 @@ function clusterResolver(body, offsets, candidates) {
   // cursor in step with it so no boundary needs searching for. The iterator is
   // abandoned wherever the last candidate leaves it, so a document whose
   // preserve budget is spent in its first line is never segmented past it.
-  const iterator = GRAPHEME_SEGMENTER.segment(body)[Symbol.iterator]();
+  const iterator = graphemeSegmenter().segment(body)[Symbol.iterator]();
   let start = 0;
   let end = 0;
   return (cp) => {

package/types/claude-hooks/pretooluse-sanitize.d.mts

@@ -188,7 +188,8 @@ export function cliMain(opts?: {
  * must be blocked, or null to let the pipeline continue. Hosts use these for
  * policy the package has no view of (a required workflow step, a project-local
  * rule); the package ships none.
- * @typedef {(input: { tool_name: string | null, tool_input: any, session_id?: string })
+ * @typedef {(input: { tool_name: string | null, tool_input: any, session_id?: string,
+ *   permission_mode?: string })
  *   => string | null | undefined} HostGate
  */
 /**
@@ -221,6 +222,7 @@ export type HostGate = (input: {
     tool_name: string | null;
     tool_input: any;
     session_id?: string;
+    permission_mode?: string;
 }) => string | null | undefined;
 declare const rehydrateRedacted: typeof import("agent-sanitizer/rehydrate").rehydrateRedacted;
 export {};