agent-sanitizer 2.62.0 → 2.62.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.62.0",
+  "version": "2.62.1",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/src/claude-context.mjs

@@ -225,9 +225,11 @@ export function isInsideDir(dir, file) {
 
 // What rendered untrusted text must never carry raw: what Layer 1 strips, C0/C1
 // controls (ESC opens a terminal escape, a newline forges a report line),
-// line/paragraph separators, lone surrogates.
+// line/paragraph separators, lone surrogates. Spelled as ranges, not runtime
+// `\p{}` lookups: Cc and Cs are immutable under Unicode's stability policy, and
+// Zl/Zp are the single code points U+2028/U+2029.
 const DISPLAY_UNSAFE = new RegExp(
-  `${STRIP.source}|[\\p{Cc}\\p{Zl}\\p{Zp}\\p{Cs}]`,
+  `${STRIP.source}|[\\u0000-\\u001F\\u007F-\\u009F\\u2028\\u2029\\uD800-\\uDFFF]`,
   "gu",
 );
 

package/src/glob-compat.mjs

@@ -0,0 +1,84 @@
+/**
+ * Glob patterns rewritten for the Node releases whose `fs.globSync` cannot see
+ * a dot-named segment after a `**`.
+ *
+ * Before 22.22.1, 24.13.1 and 25.4.0, and on every 23.x, globSync matches
+ * NOTHING for a `**` directly followed by a dot-named segment
+ * (nodejs/node#61012): `**\/.claude/*.md` finds no file, so an instruction scan
+ * reports clean over files it never read. On those releases each such pattern
+ * is rewritten into forms the broken walker answers; on every other release
+ * patterns pass through untouched, so a fixed Node keeps its own semantics.
+ */
+
+// The first release of each affected line that carries the fix. 23.x never got
+// one; every line from 26 on was cut after it landed.
+const FIXED_IN = new Map([
+  [22, [22, 1]],
+  [24, [13, 1]],
+  [25, [4, 0]],
+]);
+const FIRST_FIXED_MAJOR = 26;
+
+// A `**` segment directly followed by a dot-named one, at the pattern start or
+// after a `/`, or opening a brace alternative.
+const DOT_AFTER_GLOBSTAR = /(?:^|[/{,])\*\*\/(?=\.)/;
+
+// A dot segment after `**/` that the rewrite cannot reach: escaped, or opening
+// an alternative of a brace set.
+const HIDDEN_DOT_AFTER_GLOBSTAR = /\*\*\/(?:\\\.|\{(?:[^{}]*,)?\.)/;
+
+/**
+ * Whether the globSync of Node `version` (`process.versions.node`'s shape)
+ * misses a dot-named segment after a `**`.
+ * @param {string} version
+ * @returns {boolean}
+ */
+export function globstarSkipsDotSegments(version) {
+  const [major, minor, patch] = version.split(".").map(Number);
+  if (major >= FIRST_FIXED_MAJOR) return false;
+  const fixed = FIXED_IN.get(major);
+  if (!fixed) return true;
+  const [fixedMinor, fixedPatch] = fixed;
+  return minor < fixedMinor || (minor === fixedMinor && patch < fixedPatch);
+}
+
+/**
+ * `pattern` as patterns the broken globSync answers.
+ *
+ * Each `**\/` before a dot segment spans zero directories or one or more:
+ * dropping it is the first case and `**\/*\/` the second, and neither puts a
+ * dot segment straight after a `**`. A `*` never matches a dot-named directory,
+ * so the halves can match less than a fixed Node does (which enters a dot
+ * directory named like the segment after `**`), never more. A dot segment the
+ * rewrite cannot reach throws rather than silently matching nothing.
+ * @param {string} pattern
+ * @returns {string[]}
+ */
+export function expandDotGlobstar(pattern) {
+  const match = DOT_AFTER_GLOBSTAR.exec(pattern);
+  if (match) {
+    const head = pattern.slice(0, match.index + match[0].indexOf("*"));
+    const tail = pattern.slice(match.index + match[0].length);
+    return [`${head}${tail}`, `${head}**/*/${tail}`].flatMap(expandDotGlobstar);
+  }
+  if (HIDDEN_DOT_AFTER_GLOBSTAR.test(pattern))
+    throw new Error(
+      `glob ${JSON.stringify(pattern)} puts a dot-named segment after "**" in a ` +
+        `form this Node's globSync matches nothing for (nodejs/node#61012); ` +
+        `spell the segment plainly or run Node >= 22.22.1, 24.13.1 or 25.4.0.`,
+    );
+  return [pattern];
+}
+
+/**
+ * `patterns` ready for this runtime's globSync: rewritten by
+ * {@link expandDotGlobstar} on an affected Node, untouched otherwise.
+ * @param {string[]} patterns
+ * @param {string} [version]  defaults to the running Node
+ * @returns {string[]}
+ */
+export function compatGlobs(patterns, version = process.versions.node) {
+  return globstarSkipsDotSegments(version)
+    ? patterns.flatMap(expandDotGlobstar)
+    : patterns;
+}

package/src/instructions.mjs

@@ -40,6 +40,7 @@ import {
   stripInvisible,
 } from "./invisible.mjs";
 import { excludeNodeModules, isInsideDir } from "./claude-context.mjs";
+import { compatGlobs } from "./glob-compat.mjs";
 
 // The library's public door onto Claude Code's context scope. The definitions
 // live in a dependency-free data module because the SessionStart hook imports
@@ -377,14 +378,35 @@ export function walkContextGlobs(globs, cwd, exclude) {
   // under a `.claude/worktrees/` checkout.
   /** @param {import("node:fs").Dirent} dirent @returns {string} */
   const absolute = (dirent) => resolve(root, dirent.parentPath, dirent.name);
-  return globSync(globs, {
-    cwd,
-    withFileTypes: true,
-    exclude: (dirent) => {
-      const entry = relative(root, absolute(dirent)).split(sep).join("/");
-      return excludeNodeModules(entry) || (exclude?.(entry) ?? false);
-    },
-  }).map(absolute);
+  /** @param {string} entry @returns {boolean} */
+  const excluded = (entry) =>
+    excludeNodeModules(entry) || (exclude?.(entry) ?? false);
+  return (
+    globSync(compatGlobs(globs), {
+      cwd,
+      withFileTypes: true,
+      exclude: (dirent) =>
+        excluded(relative(root, absolute(dirent)).split(sep).join("/")),
+    })
+      .map(absolute)
+      // Node never consults `exclude` on some literal segments (the `.claude`
+      // compatGlobs spells out on an affected Node is one), so a match under a
+      // directory the caller pruned is dropped here instead.
+      .filter((path) => !ancestorEntries(relative(root, path)).some(excluded))
+  );
+}
+
+/**
+ * Every directory above `rel` (a root-relative path), as `/`-separated
+ * entries outermost first: `a/b/c.md` gives `a` and `a/b`.
+ * @param {string} rel
+ * @returns {string[]}
+ */
+function ancestorEntries(rel) {
+  const segments = rel.split(sep);
+  return segments
+    .slice(0, -1)
+    .map((_, i) => segments.slice(0, i + 1).join("/"));
 }
 
 /**

package/types/glob-compat.d.mts

@@ -0,0 +1,28 @@
+/**
+ * Whether the globSync of Node `version` (`process.versions.node`'s shape)
+ * misses a dot-named segment after a `**`.
+ * @param {string} version
+ * @returns {boolean}
+ */
+export function globstarSkipsDotSegments(version: string): boolean;
+/**
+ * `pattern` as patterns the broken globSync answers.
+ *
+ * Each `**\/` before a dot segment spans zero directories or one or more:
+ * dropping it is the first case and `**\/*\/` the second, and neither puts a
+ * dot segment straight after a `**`. A `*` never matches a dot-named directory,
+ * so the halves can match less than a fixed Node does (which enters a dot
+ * directory named like the segment after `**`), never more. A dot segment the
+ * rewrite cannot reach throws rather than silently matching nothing.
+ * @param {string} pattern
+ * @returns {string[]}
+ */
+export function expandDotGlobstar(pattern: string): string[];
+/**
+ * `patterns` ready for this runtime's globSync: rewritten by
+ * {@link expandDotGlobstar} on an affected Node, untouched otherwise.
+ * @param {string[]} patterns
+ * @param {string} [version]  defaults to the running Node
+ * @returns {string[]}
+ */
+export function compatGlobs(patterns: string[], version?: string): string[];

package/types/src/glob-compat.d.mts

@@ -0,0 +1,28 @@
+/**
+ * Whether the globSync of Node `version` (`process.versions.node`'s shape)
+ * misses a dot-named segment after a `**`.
+ * @param {string} version
+ * @returns {boolean}
+ */
+export function globstarSkipsDotSegments(version: string): boolean;
+/**
+ * `pattern` as patterns the broken globSync answers.
+ *
+ * Each `**\/` before a dot segment spans zero directories or one or more:
+ * dropping it is the first case and `**\/*\/` the second, and neither puts a
+ * dot segment straight after a `**`. A `*` never matches a dot-named directory,
+ * so the halves can match less than a fixed Node does (which enters a dot
+ * directory named like the segment after `**`), never more. A dot segment the
+ * rewrite cannot reach throws rather than silently matching nothing.
+ * @param {string} pattern
+ * @returns {string[]}
+ */
+export function expandDotGlobstar(pattern: string): string[];
+/**
+ * `patterns` ready for this runtime's globSync: rewritten by
+ * {@link expandDotGlobstar} on an affected Node, untouched otherwise.
+ * @param {string[]} patterns
+ * @param {string} [version]  defaults to the running Node
+ * @returns {string[]}
+ */
+export function compatGlobs(patterns: string[], version?: string): string[];