agent-sanitizer 2.55.0 → 2.56.0

package/README.md

@@ -164,7 +164,12 @@ buy you:
 3. Look-alike glyphs in tool inputs are folded to ASCII, so a Cyrillic `а` can't
    walk a command past a deny rule.
 4. Tool output has invisible characters and terminal escapes stripped, hidden
-   HTML spliced out with a placeholder, and exfil-shaped URLs flagged.
+   HTML spliced out with a placeholder, and exfil-shaped URLs flagged. A hex
+   value one digest wide is exempt under a generic query or fragment parameter
+   name, because a commit or blob id in a link is ordinary — under a name that
+   already says credential it still flags, and a path segment never reaches the
+   exemption at all. `AGENT_SANITIZER_FLAG_DIGEST_VALUES=1` turns it off for a
+   consumer that reads such a value as a leak.
 5. With `AGENT_SANITIZER_SECRETS_ENABLED=1` set, secrets in tool output are
    redacted locally by `detect-secrets` — the engine ships with the plugin and
    provisions itself on first run, no further setup from you.

package/claude-hooks/lib/env-config.mjs

@@ -238,6 +238,24 @@ export function secretsEnabled(env = process.env) {
   return env[SECRETS_ENABLED_ENV] === "1";
 }
 
+// Layer 3's digest exemption, which lets a URL carry an exact-digest-length hex
+// value without being read as a payload. A consumer that treats a digest in a
+// URL as exfil — a monitor reading tool output for a leaked commit or blob id —
+// turns the exemption off here. `checkExfilUrl` takes the same option directly;
+// this is the switch for the hook path, which composes its own seam options.
+export const FLAG_DIGEST_VALUES_ENV = "AGENT_SANITIZER_FLAG_DIGEST_VALUES";
+
+/**
+ * True when the operator opted into flagging digest-shaped URL values. `=== "1"`
+ * for the reason {@link secretsEnabled} gives: a typo fails toward the default,
+ * which is the exemption the precision rule prefers.
+ * @param {NodeJS.ProcessEnv | Record<string, string | undefined>} [env]
+ * @returns {boolean}
+ */
+export function digestFlaggingEnabled(env = process.env) {
+  return env[FLAG_DIGEST_VALUES_ENV] === "1";
+}
+
 /**
  * The env-bound redaction set: the UNION of the inference keys, the curated host
  * credentials, any credential-shaped var present in the environment, the

package/claude-hooks/sanitize-output.mjs

@@ -49,7 +49,7 @@ import { registerFaultPolicy, hookFaultOutcome } from "./lib/hook-fault.mjs";
 import { controlPlane, runJudgeCli } from "./lib/control-plane.mjs";
 import { bestEffortTrace, trace, TraceEvent } from "./lib/trace.mjs";
 import { hasEnvBoundSecret } from "./lib/secret-annotate.mjs";
-import { secretsEnabled } from "./lib/env-config.mjs";
+import { digestFlaggingEnabled, secretsEnabled } from "./lib/env-config.mjs";
 import {
   persistReveal,
   persistSpan,
@@ -267,6 +267,10 @@ export async function sanitizeText(
   const seamOptions = {
     html,
     exfilScan: webIngress,
+    // Widens Layer 3 only, and only where the operator asked: without it the
+    // option the seam already accepts is unreachable from this entry, so a hook
+    // consumer that needs a digest in a URL flagged has no way to ask for it.
+    flagDigestValues: digestFlaggingEnabled(),
     sgrCarveOut: !webIngress,
     deadline,
     // Layer 4 — OPT-IN (secretsEnabled): with the knob unset the seam gets no

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.55.0",
+  "version": "2.56.0",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/types/claude-hooks/lib/env-config.d.mts

@@ -67,6 +67,14 @@ export function extraSecretVars(env?: Record<string, string | undefined>): strin
  * @returns {boolean}
  */
 export function secretsEnabled(env?: NodeJS.ProcessEnv | Record<string, string | undefined>): boolean;
+/**
+ * True when the operator opted into flagging digest-shaped URL values. `=== "1"`
+ * for the reason {@link secretsEnabled} gives: a typo fails toward the default,
+ * which is the exemption the precision rule prefers.
+ * @param {NodeJS.ProcessEnv | Record<string, string | undefined>} [env]
+ * @returns {boolean}
+ */
+export function digestFlaggingEnabled(env?: NodeJS.ProcessEnv | Record<string, string | undefined>): boolean;
 /**
  * The env-bound redaction set: the UNION of the inference keys, the curated host
  * credentials, any credential-shaped var present in the environment, the
@@ -79,3 +87,4 @@ export function secretsEnabled(env?: NodeJS.ProcessEnv | Record<string, string |
  */
 export function envBoundSecretVars(env?: Record<string, string | undefined>): string[];
 export const SECRETS_ENABLED_ENV: "AGENT_SANITIZER_SECRETS_ENABLED";
+export const FLAG_DIGEST_VALUES_ENV: "AGENT_SANITIZER_FLAG_DIGEST_VALUES";