agent-sanitizer 2.48.0 → 2.48.1

package/claude-hooks/lib/invisible-alert.mjs

@@ -24,8 +24,10 @@ import { randomBytes } from "node:crypto";
 import { basename, join } from "node:path";
 import { homedir, tmpdir, userInfo } from "node:os";
 import {
+  hookgateMarkerPath,
   lazyImport,
   markerIsTrusted,
+  probeSetupAlive,
   PROJECT_DIR,
   PROJECT_HASH,
   scrubUntrustedText,
@@ -442,8 +444,9 @@ function userGlobalLaunchHasContent(env = process.env) {
 
 /**
  * The one-time context line for a session where no InstructionsLoaded scan ran,
- * or null when the scan has been seen, the notice already ran this session, or
- * neither launch nor `touchedDir` could have fired the event.
+ * or null when the scan has been seen, the notice already ran this session, the
+ * host's cold-start marker says setup is still running, or neither launch nor
+ * `touchedDir` could have fired the event.
  *
  * PURE for the notice: nothing is recorded until the caller confirms it landed
  * in a returned response. Launch-emptiness is cached once found — fixed for the
@@ -472,6 +475,15 @@ export function instructionsLoadedGapNotice(
 ) {
   if (instructionsLoadedSeen(sessionId)) return null;
   if (markerIsTrusted(instructionsLoadedNoticeFile(sessionId))) return null;
+  // The host's setup script is still provisioning this session, so the scanner
+  // may not have been able to run yet: a launch event fires within a second of
+  // SessionStart, and a hook whose file or dependency setup has not written yet
+  // never reached the marker. Every cause below would be wrong, so say nothing
+  // while setup RUNS. Liveness, not the marker alone: a setup killed mid-install
+  // leaves its marker behind, and a marker test alone would then silence this
+  // notice for every later session on the host.
+  const marker = hookgateMarkerPath();
+  if (markerIsTrusted(marker) && probeSetupAlive(marker)) return null;
   const launchCached = markerIsTrusted(launchEmptyFile(sessionId));
   const launchHasBytes =
     !launchCached &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.48.0",
+  "version": "2.48.1",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/types/claude-hooks/lib/invisible-alert.d.mts

@@ -99,8 +99,9 @@ export function launchEmptyFile(sessionId?: string): string;
 export function launchInstructionFiles(dir: string): string[];
 /**
  * The one-time context line for a session where no InstructionsLoaded scan ran,
- * or null when the scan has been seen, the notice already ran this session, or
- * neither launch nor `touchedDir` could have fired the event.
+ * or null when the scan has been seen, the notice already ran this session, the
+ * host's cold-start marker says setup is still running, or neither launch nor
+ * `touchedDir` could have fired the event.
  *
  * PURE for the notice: nothing is recorded until the caller confirms it landed
  * in a returned response. Launch-emptiness is cached once found — fixed for the