agent-sanitizer 2.59.0 → 2.60.1

package/claude-hooks/lib/control-plane.mjs

@@ -152,6 +152,9 @@ export function nativeStdout(response) {
  * @param {(input: unknown) => unknown} [opts.transformInput]  raw-payload normalization before adapter.parse
  * @param {() => Promise<unknown>} [opts.readInput]  injectable stdin reader
  * @param {(chunk: string) => void} [opts.write]  injectable stdout writer
+ * @param {import("./hook-timing.mjs").ReportTo} [opts.reportTo]  the composer
+ *   that owns this hook, which a slow-run notice names and sends the report to;
+ *   omitted, the notice names this package
  * @returns {Promise<void>}
  */
 export async function runJudgeCli(
@@ -162,6 +165,7 @@ export async function runJudgeCli(
     transformInput = (raw) => raw,
     readInput = readStdinJson,
     write = (chunk) => process.stdout.write(chunk),
+    reportTo,
   },
 ) {
   let input;
@@ -200,6 +204,7 @@ export async function runJudgeCli(
           cpuMs: timer.cpuMs(),
           redactorMs: timer.redactorMs(),
           hostMs: timer.hostMs(),
+          reportTo,
         }),
         event,
       ),
@@ -218,6 +223,7 @@ export async function runJudgeCli(
         cpuMs: timer.cpuMs(),
         redactorMs: timer.redactorMs(),
         hostMs: timer.hostMs(),
+        reportTo,
       });
     onError(err, input);
   }

package/claude-hooks/lib/hook-timing.mjs

@@ -102,8 +102,10 @@ const ISSUE_URL =
  *                                             module at `claude-hooks/lib/` and
  *                                             carries the published version
  *
- * First hit wins, and each candidate exists only inside the artifact it belongs
- * to, so no foreign manifest is ever a candidate.
+ * First hit wins, and only a manifest naming {@link OWN_NAME} counts. The offsets
+ * alone do not exclude foreign manifests: a composer that bundles this module
+ * into its own `.claude/hooks/` puts `../../package.json` on the COMPOSER's
+ * manifest, whose version would otherwise be reported as this build's.
  */
 const VERSION_MANIFESTS = [
   "../../.claude-plugin/plugin.json",
@@ -111,6 +113,9 @@ const VERSION_MANIFESTS = [
   "../../package.json",
 ];
 
+/** The `name` both this package's package.json and its plugin.json carry. */
+const OWN_NAME = "agent-sanitizer";
+
 /** Strict X.Y.Z, the only shape this project's release tooling ever writes. */
 const SEMVER = /^[0-9]+\.[0-9]+\.[0-9]+$/;
 
@@ -131,7 +136,8 @@ function readVersion() {
 }
 
 /**
- * The strict semver `path` carries, or null when it carries none.
+ * The strict semver `path` carries, or null when it carries none or names a
+ * package other than {@link OWN_NAME}.
  *
  * The read and the parse are caught because neither failure is this function's
  * business: every candidate but one is absent in any given artifact, and a
@@ -147,7 +153,9 @@ function readManifest(path) {
   } catch {
     return null;
   }
-  return SEMVER.test(manifest?.version) ? manifest.version : null;
+  return manifest?.name === OWN_NAME && SEMVER.test(manifest.version)
+    ? manifest.version
+    : null;
 }
 
 /** @type {string | null | undefined} */
@@ -182,6 +190,45 @@ function versionClause(version) {
     : "your agent-sanitizer version";
 }
 
+/**
+ * A composer that bundles this hook runtime into hooks of its own names itself
+ * here, so a slow notice from one of ITS hooks charges the cost to it and sends
+ * the report to its tracker rather than this package's.
+ * @typedef {{
+ *   name: string,
+ *   issueUrl: string,
+ *   version?: string | null,
+ * }} ReportTo
+ */
+
+/**
+ * Who a slow-hook notice names as the hook's owner, where it sends the report,
+ * and the version clause the report carries: this package unless `reportTo`
+ * names a composer. A composer that passes no version gets the look-it-up
+ * clause, never this package's version under its name.
+ * @param {ReportTo | undefined} reportTo
+ * @param {string | null | undefined} version  see {@link versionClause}
+ */
+function noticeOwner(reportTo, version) {
+  if (reportTo === undefined)
+    return {
+      label: "agent-sanitizer",
+      owner: "the sanitizer",
+      issueUrl: ISSUE_URL,
+      versionClause: versionClause(version),
+      composer: undefined,
+    };
+  return {
+    label: reportTo.name,
+    owner: reportTo.name,
+    issueUrl: reportTo.issueUrl,
+    versionClause: reportTo.version
+      ? `${reportTo.name} ${reportTo.version}`
+      : `your ${reportTo.name} version`,
+    composer: reportTo.name,
+  };
+}
+
 /**
  * Milliseconds as the seconds string every notice below prints.
  *
@@ -229,6 +276,7 @@ export function formatBytes(bytes) {
  *   cpuMs?: number | null,
  *   redactorMs?: number | null,
  *   hostMs?: number | null,
+ *   reportTo?: ReportTo,
  * }} SlowHookContext
  */
 
@@ -555,9 +603,10 @@ export function startHookTimer(now = Date.now, cpuNow = processCpuMs) {
  * @param {number} redactorMs
  * @param {number | undefined} hostMs  absent when the caller measures no host
  *   callbacks; a caller that does pass 0 when none ran
+ * @param {ReturnType<typeof noticeOwner>} owner
  * @returns {string}
  */
-function attributeWait(elapsedMs, cpuMs, redactorMs, hostMs) {
+function attributeWait(elapsedMs, cpuMs, redactorMs, hostMs, owner) {
   // `hostMs` absent means the caller cannot measure that window, not that it was
   // empty — a caller that CAN measure passes 0 and gets the zero printed. So an
   // absent one is left out of both the sentence and the remainder, and the
@@ -569,12 +618,14 @@ function attributeWait(elapsedMs, cpuMs, redactorMs, hostMs) {
     redactorMs === largest
       ? "The largest share was spent inside the redactor round trip — the daemon's scan, the host it shares, or both; this hook was not computing it."
       : hostMs !== undefined && hostMs === largest
-        ? "The largest share was spent inside a host extension this hook called — a callback the composer injected, and a cost that composer owns; neither the sanitizer nor the redactor was computing it."
+        ? owner.composer === undefined
+          ? "The largest share was spent inside a host extension this hook called — a callback the composer injected, and a cost that composer owns; neither the sanitizer nor the redactor was computing it."
+          : `The largest share was spent inside a host extension this hook called — a callback ${owner.composer} injected, and a cost ${owner.composer} owns; neither this hook nor the redactor was computing it.`
         : cpuMs === largest
-          ? "The largest share is this hook computing — a per-call cost the sanitizer owns, repeated by every affected call."
+          ? `The largest share is this hook computing — a per-call cost ${owner.owner} owns, repeated by every affected call.`
           : hostMs === undefined
-            ? "The largest share is neither the redactor nor this hook computing: it was blocked on a loaded machine, on a host extension this caller does not measure, or on something else outside the sanitizer that it called."
-            : "The largest share is none of those three: it was blocked on a loaded machine or on something outside the sanitizer that it called without measuring.";
+            ? `The largest share is neither the redactor nor this hook computing: it was blocked on a loaded machine, on a host extension this caller does not measure, or on something else outside ${owner.owner} that it called.`
+            : `The largest share is none of those three: it was blocked on a loaded machine or on something outside ${owner.owner} that it called without measuring.`;
   const hostClause =
     hostMs === undefined
       ? ""
@@ -609,7 +660,8 @@ function attributeWait(elapsedMs, cpuMs, redactorMs, hostMs) {
  * @param {number} [thresholdMs]
  * @param {SlowHookContext} [context]  known CPU time / payload size /
  *   triggering tool, so the notice is self-diagnosing rather than requiring the
- *   next reader to reconstruct what was slow by hand
+ *   next reader to reconstruct what was slow by hand; its `reportTo` names the
+ *   composer that owns the hook, and replaces the owner, tracker and version
  * @param {string | null} [version]  the build to name in the report line;
  *   omitted asks {@link sanitizerVersion}, and the shell port passes its own,
  *   read from the plugin manifest it ships beside
@@ -632,12 +684,13 @@ export function slowHookNotice(
   // number, including when it is 0.
   const hostMs =
     typeof context?.hostMs === "number" ? context.hostMs : undefined;
+  const owner = noticeOwner(context?.reportTo, version);
   const attribution = attributed
-    ? attributeWait(elapsedMs, cpuMs, redactorMs, hostMs)
+    ? attributeWait(elapsedMs, cpuMs, redactorMs, hostMs, owner)
     : typeof cpuMs === "number"
       ? `, and used ${formatSeconds(cpuMs)}s of CPU. ` +
         "Only the CPU share is work every affected call repeats; the rest was spent waiting, on a busy machine or on something this hook called."
-      : ". Wall-clock alone cannot separate the sanitizer's own work from a busy machine.";
+      : `. Wall-clock alone cannot separate ${owner.owner}'s own work from a busy machine.`;
   const timings = attributed
     ? hostMs === undefined
       ? "all three timings"
@@ -646,9 +699,9 @@ export function slowHookNotice(
       ? "both timings"
       : "timing";
   return (
-    `agent-sanitizer PERFORMANCE: the ${hookName} hook took ` +
+    `${owner.label} PERFORMANCE: the ${hookName} hook took ` +
     `${formatSeconds(elapsedMs)}s${formatContextSuffix(context)}, over its ${formatSeconds(thresholdMs)}s budget${attribution} ` +
-    `Tell the user, and suggest they report it at ${ISSUE_URL} with ${versionClause(version)}, the hook name and ${timings}.`
+    `Tell the user, and suggest they report it at ${owner.issueUrl} with ${owner.versionClause}, the hook name and ${timings}.`
   );
 }
 

package/claude-hooks/lib/secret-annotate.mjs

@@ -27,15 +27,23 @@ import charset from "../../python/agent_sanitizer/data/invisible-charset.json" w
 // every gap are what bound the match — a `*` gap is never adjacent to another
 // gap, so there is no ambiguity to backtrack over and no ReDoS. (The class size
 // is irrelevant to that: a character class matches in O(1) whether it holds one
-// member or all 435.)
+// member or all 435.) That argument holds only while no literal is itself a
+// member of the class, so {@link envValueRegex} drops the value's own invisible
+// code points before it splices: `a<ZWSP>a` would otherwise build
+// `a[…]*<ZWSP>[…]*a`, whose two stars share the literal and backtrack
+// quadratically over a long run of ZWSP.
+const ENV_INVIS_CODEPOINTS = [
+  ...new Set([...charset.cf_codepoints, ...charset.extra_codepoints]),
+].sort((a, b) => a - b);
+const ENV_INVIS_SET = new Set(ENV_INVIS_CODEPOINTS);
 const ENV_INVIS_RUN =
   "[" +
-  [...new Set([...charset.cf_codepoints, ...charset.extra_codepoints])]
-    .sort((a, b) => a - b)
-    .map((cp) => `\\u{${cp.toString(16)}}`)
-    .join("") +
+  ENV_INVIS_CODEPOINTS.map((cp) => `\\u{${cp.toString(16)}}`).join("") +
   "]*";
 
+/** @param {string} ch */
+const escapeLiteral = (ch) => ch.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
 /**
  * Regex matching `value` tolerating invisible chars spliced between its
  * characters (mirrors the engine's env-value regex). Code-point split so
@@ -55,10 +63,15 @@ const ENV_INVIS_RUN =
 export function envValueRegex(value) {
   let re = ENV_VALUE_REGEX_CACHE.get(value);
   if (re === undefined) {
+    const visible = [...value].filter(
+      (ch) => !ENV_INVIS_SET.has(/** @type {number} */ (ch.codePointAt(0))),
+    );
+    // A value made only of invisibles has no literal to anchor a gap on: match
+    // it exactly rather than build a pattern that is nothing but gaps.
     re = new RegExp(
-      [...value]
-        .map((ch) => ch.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
-        .join(ENV_INVIS_RUN),
+      visible.length > 0
+        ? visible.map(escapeLiteral).join(ENV_INVIS_RUN)
+        : [...value].map(escapeLiteral).join(""),
       "u",
     );
     ENV_VALUE_REGEX_CACHE.set(value, re);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.59.0",
+  "version": "2.60.1",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/types/claude-hooks/lib/control-plane.d.mts

@@ -57,11 +57,15 @@ export function nativeStdout(response: {
  * @param {(input: unknown) => unknown} [opts.transformInput]  raw-payload normalization before adapter.parse
  * @param {() => Promise<unknown>} [opts.readInput]  injectable stdin reader
  * @param {(chunk: string) => void} [opts.write]  injectable stdout writer
+ * @param {import("./hook-timing.mjs").ReportTo} [opts.reportTo]  the composer
+ *   that owns this hook, which a slow-run notice names and sends the report to;
+ *   omitted, the notice names this package
  * @returns {Promise<void>}
  */
-export function runJudgeCli(hookName: string, judge: (event: import("agent-control-plane-core").ToolCallEvent) => import("agent-control-plane-core").Verdict | Promise<import("agent-control-plane-core").Verdict>, { onError, transformInput, readInput, write, }: {
+export function runJudgeCli(hookName: string, judge: (event: import("agent-control-plane-core").ToolCallEvent) => import("agent-control-plane-core").Verdict | Promise<import("agent-control-plane-core").Verdict>, { onError, transformInput, readInput, write, reportTo, }: {
     onError: (err: unknown, input: unknown) => void;
     transformInput?: ((input: unknown) => unknown) | undefined;
     readInput?: (() => Promise<unknown>) | undefined;
     write?: ((chunk: string) => void) | undefined;
+    reportTo?: import("./hook-timing.mjs").ReportTo | undefined;
 }): Promise<void>;

package/types/claude-hooks/lib/hook-timing.d.mts

@@ -184,7 +184,8 @@ export function startHookTimer(now?: () => number, cpuNow?: () => number): {
  * @param {number} [thresholdMs]
  * @param {SlowHookContext} [context]  known CPU time / payload size /
  *   triggering tool, so the notice is self-diagnosing rather than requiring the
- *   next reader to reconstruct what was slow by hand
+ *   next reader to reconstruct what was slow by hand; its `reportTo` names the
+ *   composer that owns the hook, and replaces the owner, tracker and version
  * @param {string | null} [version]  the build to name in the report line;
  *   omitted asks {@link sanitizerVersion}, and the shell port passes its own,
  *   read from the plugin manifest it ships beside
@@ -303,6 +304,16 @@ export const SLOW_PROVISION_THRESHOLD_MS: 60000;
  * alongside it must not be what buys that silence.
  */
 export const CONCURRENT_PROVISION_CEILING_MS: number;
+/**
+ * A composer that bundles this hook runtime into hooks of its own names itself
+ * here, so a slow notice from one of ITS hooks charges the cost to it and sends
+ * the report to its tracker rather than this package's.
+ */
+export type ReportTo = {
+    name: string;
+    issueUrl: string;
+    version?: string | null;
+};
 /**
  * Debugging context a caller may already have in hand when a hook overruns its
  * budget, so the notice names WHAT was slow instead of just HOW slow — the gap
@@ -320,6 +331,7 @@ export type SlowHookContext = {
     cpuMs?: number | null;
     redactorMs?: number | null;
     hostMs?: number | null;
+    reportTo?: ReportTo;
 };
 /**
  * This process's own user+system processor time so far, in milliseconds.