agent-sanitizer 2.56.1 → 2.57.0

package/claude-hooks/pretooluse-sanitize.mjs

@@ -713,6 +713,11 @@ export function depLoadHint(
  * — redactor daemon down, package not loaded) is the sanitizer being UNAVAILABLE,
  * so it ASKS to keep a human in the loop rather than hard-block on infrastructure.
  *
+ * An UNATTENDED host has no human for that ask to reach, so the ask stops the
+ * call and buys no review. Such a host passes `unavailableDecision: DENY` and
+ * gets a hard refusal on the clean-parse arm too, with the same reason text.
+ * The default stays ASK, so a host that wires nothing keeps today's behavior.
+ *
  * Deliberately knob-blind: this is the fail-CLOSED posture itself, so it ignores
  * AGENT_SANITIZER_FAIL_OPEN — a host that wires it directly keeps strictness by
  * construction, with no env var to remember. A host that instead wants the
@@ -720,19 +725,27 @@ export function depLoadHint(
  * which delegates here when the posture is closed.
  * @param {boolean} parsedOk whether the input parsed before the failure
  * @param {unknown} err
- * @param {{ messages?: Partial<typeof PRE_TOOL_USE_MESSAGES>, hint?: string }} [opts]
+ * @param {{
+ *   messages?: Partial<typeof PRE_TOOL_USE_MESSAGES>,
+ *   hint?: string,
+ *   unavailableDecision?: (typeof PermissionDecision)[keyof typeof PermissionDecision],
+ * }} [opts]
  * @returns {Record<string, unknown>}
  */
 export function failClosedFields(parsedOk, err, opts = {}) {
-  const { hint = depLoadHint(err) } = opts;
+  const { hint = depLoadHint(err), unavailableDecision } = opts;
   // Merged, not substituted — see judgePreToolUseSanitize. This is the call site
   // where a missing field would throw out of the catch and fail OPEN.
   const messages = { ...PRE_TOOL_USE_MESSAGES, ...opts.messages };
   const cause = `${safeErrMessage(err)}${hint}`;
+  // An unknown or absent override falls back to ASK rather than being trusted:
+  // a typo must not silently widen this arm past the two closed verdicts.
+  const unavailable =
+    unavailableDecision === PermissionDecision.DENY
+      ? PermissionDecision.DENY
+      : PermissionDecision.ASK;
   return {
-    permissionDecision: parsedOk
-      ? PermissionDecision.ASK
-      : PermissionDecision.DENY,
+    permissionDecision: parsedOk ? unavailable : PermissionDecision.DENY,
     permissionDecisionReason: parsedOk
       ? messages.failed(cause)
       : messages.unparsable(cause),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.56.1",
+  "version": "2.57.0",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/types/claude-hooks/pretooluse-sanitize.d.mts

@@ -109,6 +109,11 @@ export function depLoadHint(err: unknown, remedy?: string, failedPackages?: () =
  * — redactor daemon down, package not loaded) is the sanitizer being UNAVAILABLE,
  * so it ASKS to keep a human in the loop rather than hard-block on infrastructure.
  *
+ * An UNATTENDED host has no human for that ask to reach, so the ask stops the
+ * call and buys no review. Such a host passes `unavailableDecision: DENY` and
+ * gets a hard refusal on the clean-parse arm too, with the same reason text.
+ * The default stays ASK, so a host that wires nothing keeps today's behavior.
+ *
  * Deliberately knob-blind: this is the fail-CLOSED posture itself, so it ignores
  * AGENT_SANITIZER_FAIL_OPEN — a host that wires it directly keeps strictness by
  * construction, with no env var to remember. A host that instead wants the
@@ -116,12 +121,17 @@ export function depLoadHint(err: unknown, remedy?: string, failedPackages?: () =
  * which delegates here when the posture is closed.
  * @param {boolean} parsedOk whether the input parsed before the failure
  * @param {unknown} err
- * @param {{ messages?: Partial<typeof PRE_TOOL_USE_MESSAGES>, hint?: string }} [opts]
+ * @param {{
+ *   messages?: Partial<typeof PRE_TOOL_USE_MESSAGES>,
+ *   hint?: string,
+ *   unavailableDecision?: (typeof PermissionDecision)[keyof typeof PermissionDecision],
+ * }} [opts]
  * @returns {Record<string, unknown>}
  */
 export function failClosedFields(parsedOk: boolean, err: unknown, opts?: {
     messages?: Partial<typeof PRE_TOOL_USE_MESSAGES>;
     hint?: string;
+    unavailableDecision?: (typeof PermissionDecision)[keyof typeof PermissionDecision];
 }): Record<string, unknown>;
 /**
  * True when a faulting PreToolUse call is the one case the OPEN posture must
@@ -225,4 +235,5 @@ export type HostGate = (input: {
     permission_mode?: string;
 }) => string | null | undefined;
 declare const rehydrateRedacted: typeof import("agent-sanitizer/rehydrate").rehydrateRedacted;
+import { PermissionDecision } from "./lib/hook-io.mjs";
 export {};