agent-sanitizer 2.62.0 → 2.62.2

package/THREAT-MODEL.md

@@ -823,7 +823,11 @@ it, so what anchors its trust is worth stating exactly.
   merge and that refresh, the default branch pins binaries compiled from the
   previous bundle. The provisioner compares its own bundle against the manifest's
   `# bundle=` pin and refuses on a mismatch, so the window degrades to the node
-  path rather than running a binary that is not the code the install ships.
+  path rather than running a binary that is not the code the install ships. A
+  binary provisioned before the window stays installed but loses its install
+  stamp, and the launcher runs a binary whose stamp does not name the shipped
+  manifest only on a host where no node is found — there an older sanitizer
+  still beats an unsanitized call.
 - **Not covered: an attacker who can write BOTH the repository and the release.**
   There is no signature; the manifest is trusted because it arrives through the
   same reviewed, gated path as the rest of the plugin. Rewriting it is rewriting
@@ -842,11 +846,19 @@ it, so what anchors its trust is worth stating exactly.
   per install instead of once per tool call. V8 does not treat a code cache as
   untrusted input, so those files are code the session runs, exactly like the
   binary above. The launcher creates the directory mode 700 and gates it with
-  `trusted_exec_dir` — the same owner-only-write property, refused with a line on
+  `trusted_dir` — the same owner-only-write property, refused with a line on
   stderr when the directory does not hold it — so the same user-owned data
   directory is the assumption here too. It carries no digest and needs none:
   anything able to write there can already run code per the bullet above. Nothing
   is fetched for it, so it adds no supply-chain surface.
+- **The same gate covers everything else the launcher takes from a shared
+  location.** The provisioned redactor venv (`${CLAUDE_PLUGIN_DATA}/venv` and its
+  `bin/`, whose daemon receives every secret-bearing payload) is handed to the
+  client only when `trusted_dir` vouches for both directories; otherwise the
+  client redacts through the committed zipapp. The degraded-warning marker root
+  under `TMPDIR` is read only when this user owns it with owner-only write, so a
+  squatted shared-temp entry cannot pre-suppress the warning that a call ran
+  unsanitized.
 - **Opting out.** `AGENT_SANITIZER_HOOK_BINARY=0` never downloads and never runs
   a binary. That leaves the node path running the committed bundle and the
   compile cache above; `AGENT_SANITIZER_COMPILE_CACHE=0` turns the cache off as

package/claude-hooks/lib/knobs.mjs

@@ -220,6 +220,7 @@ export const KNOBS = Object.freeze({
   _AGENT_SANITIZER_TRACE_FILE: on("internal", text()),
   _AGENT_SANITIZER_REDACTOR_SOCKET: on("internal", text()),
   _AGENT_SANITIZER_REDACTOR_DAEMON: on("internal", text()),
+  _AGENT_SANITIZER_REDACTOR_PYZ: on("internal", text()),
   _AGENT_SANITIZER_REDACTOR_WAIT_MS: on("internal", milliseconds(8000)),
   _AGENT_SANITIZER_REDACTOR_REQUEST_MS: on("internal", milliseconds(20000)),
   _AGENT_SANITIZER_SANITIZE_BUDGET_MS: on("internal", milliseconds(120000)),

package/claude-hooks/lib/redactor-client.mjs

@@ -60,10 +60,12 @@ export const DEFAULT_SOCKET_PATH =
  *    sets it to the provisioned venv's console script when one exists, and
  *    tests point it at dead paths to drive the fail-closed arm; a fallback
  *    from an explicit setting would turn those arms into silent passes).
- * 2. The committed self-contained zipapp shipped BESIDE this bundle
- *    (`plugin/dist/redactor/daemon.pyz`) — the guaranteed floor: it needs only
- *    a python3 on PATH, so a cold start with no venv and no network still
- *    redacts instead of failing closed on every tool call.
+ * 2. The committed self-contained zipapp (`plugin/dist/redactor/daemon.pyz`) —
+ *    the guaranteed floor: it needs only a python3 on PATH, so a cold start
+ *    with no venv and no network still redacts instead of failing closed on
+ *    every tool call. At `_AGENT_SANITIZER_REDACTOR_PYZ` when the launcher
+ *    exports it (the compiled binary's module-relative path names no file on
+ *    disk), else beside this bundle.
  * 3. The packaged console script from PATH — the un-bundled/dev case, where
  *    no sibling dist tree exists.
  * @returns {string[]}
@@ -74,7 +76,9 @@ function daemonCommand() {
   // Inside the built bundle import.meta.url is .../plugin/dist/hooks/<bundle>,
   // so the committed zipapp sits one level up; from the raw sources no such
   // sibling exists and the check falls through.
-  const pyz = fileURLToPath(new URL("../redactor/daemon.pyz", import.meta.url));
+  const pyz =
+    readKnob("_AGENT_SANITIZER_REDACTOR_PYZ") ||
+    fileURLToPath(new URL("../redactor/daemon.pyz", import.meta.url));
   if (existsSync(pyz)) return ["python3", pyz];
   return ["agent-secret-redactor-daemon"];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.62.0",
+  "version": "2.62.2",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/src/claude-context.mjs

@@ -225,9 +225,11 @@ export function isInsideDir(dir, file) {
 
 // What rendered untrusted text must never carry raw: what Layer 1 strips, C0/C1
 // controls (ESC opens a terminal escape, a newline forges a report line),
-// line/paragraph separators, lone surrogates.
+// line/paragraph separators, lone surrogates. Spelled as ranges, not runtime
+// `\p{}` lookups: Cc and Cs are immutable under Unicode's stability policy, and
+// Zl/Zp are the single code points U+2028/U+2029.
 const DISPLAY_UNSAFE = new RegExp(
-  `${STRIP.source}|[\\p{Cc}\\p{Zl}\\p{Zp}\\p{Cs}]`,
+  `${STRIP.source}|[\\u0000-\\u001F\\u007F-\\u009F\\u2028\\u2029\\uD800-\\uDFFF]`,
   "gu",
 );
 

package/src/glob-compat.mjs

@@ -0,0 +1,84 @@
+/**
+ * Glob patterns rewritten for the Node releases whose `fs.globSync` cannot see
+ * a dot-named segment after a `**`.
+ *
+ * Before 22.22.1, 24.13.1 and 25.4.0, and on every 23.x, globSync matches
+ * NOTHING for a `**` directly followed by a dot-named segment
+ * (nodejs/node#61012): `**\/.claude/*.md` finds no file, so an instruction scan
+ * reports clean over files it never read. On those releases each such pattern
+ * is rewritten into forms the broken walker answers; on every other release
+ * patterns pass through untouched, so a fixed Node keeps its own semantics.
+ */
+
+// The first release of each affected line that carries the fix. 23.x never got
+// one; every line from 26 on was cut after it landed.
+const FIXED_IN = new Map([
+  [22, [22, 1]],
+  [24, [13, 1]],
+  [25, [4, 0]],
+]);
+const FIRST_FIXED_MAJOR = 26;
+
+// A `**` segment directly followed by a dot-named one, at the pattern start or
+// after a `/`, or opening a brace alternative.
+const DOT_AFTER_GLOBSTAR = /(?:^|[/{,])\*\*\/(?=\.)/;
+
+// A dot segment after `**/` that the rewrite cannot reach: escaped, or opening
+// an alternative of a brace set.
+const HIDDEN_DOT_AFTER_GLOBSTAR = /\*\*\/(?:\\\.|\{(?:[^{}]*,)?\.)/;
+
+/**
+ * Whether the globSync of Node `version` (`process.versions.node`'s shape)
+ * misses a dot-named segment after a `**`.
+ * @param {string} version
+ * @returns {boolean}
+ */
+export function globstarSkipsDotSegments(version) {
+  const [major, minor, patch] = version.split(".").map(Number);
+  if (major >= FIRST_FIXED_MAJOR) return false;
+  const fixed = FIXED_IN.get(major);
+  if (!fixed) return true;
+  const [fixedMinor, fixedPatch] = fixed;
+  return minor < fixedMinor || (minor === fixedMinor && patch < fixedPatch);
+}
+
+/**
+ * `pattern` as patterns the broken globSync answers.
+ *
+ * Each `**\/` before a dot segment spans zero directories or one or more:
+ * dropping it is the first case and `**\/*\/` the second, and neither puts a
+ * dot segment straight after a `**`. A `*` never matches a dot-named directory,
+ * so the halves can match less than a fixed Node does (which enters a dot
+ * directory named like the segment after `**`), never more. A dot segment the
+ * rewrite cannot reach throws rather than silently matching nothing.
+ * @param {string} pattern
+ * @returns {string[]}
+ */
+export function expandDotGlobstar(pattern) {
+  const match = DOT_AFTER_GLOBSTAR.exec(pattern);
+  if (match) {
+    const head = pattern.slice(0, match.index + match[0].indexOf("*"));
+    const tail = pattern.slice(match.index + match[0].length);
+    return [`${head}${tail}`, `${head}**/*/${tail}`].flatMap(expandDotGlobstar);
+  }
+  if (HIDDEN_DOT_AFTER_GLOBSTAR.test(pattern))
+    throw new Error(
+      `glob ${JSON.stringify(pattern)} puts a dot-named segment after "**" in a ` +
+        `form this Node's globSync matches nothing for (nodejs/node#61012); ` +
+        `spell the segment plainly or run Node >= 22.22.1, 24.13.1 or 25.4.0.`,
+    );
+  return [pattern];
+}
+
+/**
+ * `patterns` ready for this runtime's globSync: rewritten by
+ * {@link expandDotGlobstar} on an affected Node, untouched otherwise.
+ * @param {string[]} patterns
+ * @param {string} [version]  defaults to the running Node
+ * @returns {string[]}
+ */
+export function compatGlobs(patterns, version = process.versions.node) {
+  return globstarSkipsDotSegments(version)
+    ? patterns.flatMap(expandDotGlobstar)
+    : patterns;
+}

package/src/instructions.mjs

@@ -40,6 +40,7 @@ import {
   stripInvisible,
 } from "./invisible.mjs";
 import { excludeNodeModules, isInsideDir } from "./claude-context.mjs";
+import { compatGlobs } from "./glob-compat.mjs";
 
 // The library's public door onto Claude Code's context scope. The definitions
 // live in a dependency-free data module because the SessionStart hook imports
@@ -231,11 +232,20 @@ export function scanText(content) {
   let line = 1;
   let counted = 0;
   // The verdict keeps only the first run; the rest come off the payload view,
-  // which is index-aligned with `content` and masks preserved invisibles.
+  // which is index-aligned with `content` and masks preserved invisibles. The
+  // search resumes past the first run rather than matching it a second time,
+  // which on one 256 KB payload run is a regex pass over the whole file.
+  const { firstRun } = verdict;
   const runs =
-    verdict.firstRun === null
+    firstRun === null
       ? []
-      : findLongRuns(payloadInvisibleView(content));
+      : [
+          firstRun,
+          ...findLongRuns(
+            payloadInvisibleView(content),
+            firstRun.index + firstRun.text.length,
+          ),
+        ];
   for (const run of runs) {
     for (; counted < run.index; counted++)
       if (content.charCodeAt(counted) === NEWLINE) line++;
@@ -377,14 +387,35 @@ export function walkContextGlobs(globs, cwd, exclude) {
   // under a `.claude/worktrees/` checkout.
   /** @param {import("node:fs").Dirent} dirent @returns {string} */
   const absolute = (dirent) => resolve(root, dirent.parentPath, dirent.name);
-  return globSync(globs, {
-    cwd,
-    withFileTypes: true,
-    exclude: (dirent) => {
-      const entry = relative(root, absolute(dirent)).split(sep).join("/");
-      return excludeNodeModules(entry) || (exclude?.(entry) ?? false);
-    },
-  }).map(absolute);
+  /** @param {string} entry @returns {boolean} */
+  const excluded = (entry) =>
+    excludeNodeModules(entry) || (exclude?.(entry) ?? false);
+  return (
+    globSync(compatGlobs(globs), {
+      cwd,
+      withFileTypes: true,
+      exclude: (dirent) =>
+        excluded(relative(root, absolute(dirent)).split(sep).join("/")),
+    })
+      .map(absolute)
+      // Node never consults `exclude` on some literal segments (the `.claude`
+      // compatGlobs spells out on an affected Node is one), so a match under a
+      // directory the caller pruned is dropped here instead.
+      .filter((path) => !ancestorEntries(relative(root, path)).some(excluded))
+  );
+}
+
+/**
+ * Every directory above `rel` (a root-relative path), as `/`-separated
+ * entries outermost first: `a/b/c.md` gives `a` and `a/b`.
+ * @param {string} rel
+ * @returns {string[]}
+ */
+function ancestorEntries(rel) {
+  const segments = rel.split(sep);
+  return segments
+    .slice(0, -1)
+    .map((_, i) => segments.slice(0, i + 1).join("/"));
 }
 
 /**

package/src/invisible.mjs

@@ -218,14 +218,16 @@ const RUN_TAIL_RE = new RegExp(`(?:${STRIP.source}){1,${RUN_CHUNK}}`, "yu");
  * that hits the bound is continued by {@link RUN_TAIL_RE} until it ends, so the
  * runs reported are maximal at any length.
  * @param {string} text
+ * @param {number} [from]  UTF-16 offset to resume at: the end of a run already
+ *   taken off this text, so a caller holding the first run need not re-measure it
  * @returns {Generator<{ index: number, text: string, charCount: number }>}
  */
-export function* findLongRuns(text) {
+export function* findLongRuns(text, from = 0) {
   // Both regexes are module-level and carry `lastIndex`, and a generator can be
   // suspended anywhere — including inside another scan of another text. Every
   // exec below therefore sets its own start position first, so no scan can
   // inherit a position from one it interleaved with.
-  let pos = 0;
+  let pos = from;
   for (;;) {
     LONG_RUN_CHUNK_RE.lastIndex = pos;
     const match = LONG_RUN_CHUNK_RE.exec(text);
@@ -1231,12 +1233,11 @@ function markTagSequences(cps) {
   return keep;
 }
 
-// The range the registered sequences' selectors span: a cheap pre-filter.
-const STANDARDIZED_SELECTOR_MIN = Math.min(
-  ...STANDARDIZED_VARIANTS.map(([, selector]) => selector),
-);
-const STANDARDIZED_SELECTOR_MAX = Math.max(
-  ...STANDARDIZED_VARIANTS.map(([, selector]) => selector),
+// The selectors the registered sequences use: a cheap pre-filter. Not their
+// span — U+180B to U+FE0D also holds U+200B and most other Cf code points, so a
+// zero-width run paid the keyed sequence lookup once per character.
+const STANDARDIZED_SELECTORS = new Set(
+  STANDARDIZED_VARIANTS.map(([, selector]) => selector),
 );
 
 /**
@@ -1249,8 +1250,7 @@ const STANDARDIZED_SELECTOR_MAX = Math.max(
  */
 function isStandardizedVariationSelector(cps, i) {
   const cp = cps[i];
-  if (cp < STANDARDIZED_SELECTOR_MIN || cp > STANDARDIZED_SELECTOR_MAX)
-    return false;
+  if (!STANDARDIZED_SELECTORS.has(cp)) return false;
   return i > 0 && isStandardizedVariant(cps[i - 1], cp);
 }
 
@@ -1892,7 +1892,7 @@ function carveWalk(body, cps, analysis, build) {
  * @typedef {{ body: string, cps: Int32Array,
  *   analysis: ReturnType<typeof analyzeCarve>,
  *   strip: { cleaned: string, found: string[], removed: number } | null,
- *   removed: number | null }} CarveEntry
+ *   removed: number | null, view: string | null }} CarveEntry
  */
 
 /** @type {CarveEntry | null} */
@@ -1900,9 +1900,9 @@ let lastCarve = null;
 
 /**
  * The carve analysis of `body`, with the most recent one remembered — and its
- * strip, or removal count, once asked for. One hook call often carves one
- * document several times (the payload view, the effective count, then
- * {@link isIncidentalInvisible}); every reading is a pure function of `body`,
+ * strip, removal count or payload view, once asked for. One hook call often
+ * carves one document several times (the payload view, the effective count,
+ * then {@link isIncidentalInvisible}); every reading is a pure function of `body`,
  * so the cache changes what a verdict costs, never the verdict. One entry,
  * recorded only after the analysis returns.
  * @param {string} body
@@ -1912,7 +1912,7 @@ function carveOf(body) {
   if (lastCarve !== null && lastCarve.body === body) return lastCarve;
   const cps = codePointArray(body);
   const analysis = analyzeCarve(cps);
-  lastCarve = { body, cps, analysis, strip: null, removed: null };
+  lastCarve = { body, cps, analysis, strip: null, removed: null, view: null };
   return lastCarve;
 }
 
@@ -1952,10 +1952,13 @@ function needsCarveOut(body) {
  * @returns {string}
  */
 export function payloadInvisibleView(text) {
+  const entry = carveOf(text);
+  // The verdict's run search and a caller listing every run both read it.
+  if (entry.view !== null) return entry.view;
   const {
     cps,
     analysis: { codes, kind },
-  } = carveOf(text);
+  } = entry;
   const offsets = u16Offsets(cps);
   /** @param {number} i */
   const isPayload = (i) => codes[i] !== CODE_VISIBLE && kind[i] === KIND_NONE;
@@ -1974,7 +1977,8 @@ export function payloadInvisibleView(text) {
     while (i < cps.length && isPayload(i)) i++;
     if (i > keepFrom) parts.push(text.slice(offsets[keepFrom], offsets[i]));
   }
-  return parts.join("");
+  entry.view = parts.join("");
+  return entry.view;
 }
 
 /**
@@ -2065,6 +2069,17 @@ export function countEffectiveInvisible(text) {
   // Otherwise both terms read ONE carve analysis (see carveOf).
   const entry = carveOf(text);
   const payload = entry.analysis.payloadInvis;
+  // When every invisible is payload, nothing is preservable, so either strip
+  // removes exactly the invisibles and the surplus is zero — unless a removal
+  // closes a lone high surrogate against a lone low one, which the code-point
+  // gap counts too (see carveWalk's `removed`) and which needs a lone low one.
+  // A hidden run or a scatter of soft hyphens lands here, and answering off the
+  // analysis spares it a whole-text strip it would only measure.
+  if (
+    payload === entry.analysis.invisible.length &&
+    !LONE_LOW_SURROGATE_RE.test(text)
+  )
+    return payload;
   if (!needsCarveOut(text))
     return surplusOver(
       payload,

package/types/claude-hooks/lib/knobs.d.mts

@@ -93,6 +93,9 @@ export const KNOBS: Readonly<{
     _AGENT_SANITIZER_REDACTOR_DAEMON: Readonly<Knob<string | undefined> & {
         surface: Surface;
     }>;
+    _AGENT_SANITIZER_REDACTOR_PYZ: Readonly<Knob<string | undefined> & {
+        surface: Surface;
+    }>;
     _AGENT_SANITIZER_REDACTOR_WAIT_MS: Readonly<Knob<number> & {
         surface: Surface;
     }>;

package/types/glob-compat.d.mts

@@ -0,0 +1,28 @@
+/**
+ * Whether the globSync of Node `version` (`process.versions.node`'s shape)
+ * misses a dot-named segment after a `**`.
+ * @param {string} version
+ * @returns {boolean}
+ */
+export function globstarSkipsDotSegments(version: string): boolean;
+/**
+ * `pattern` as patterns the broken globSync answers.
+ *
+ * Each `**\/` before a dot segment spans zero directories or one or more:
+ * dropping it is the first case and `**\/*\/` the second, and neither puts a
+ * dot segment straight after a `**`. A `*` never matches a dot-named directory,
+ * so the halves can match less than a fixed Node does (which enters a dot
+ * directory named like the segment after `**`), never more. A dot segment the
+ * rewrite cannot reach throws rather than silently matching nothing.
+ * @param {string} pattern
+ * @returns {string[]}
+ */
+export function expandDotGlobstar(pattern: string): string[];
+/**
+ * `patterns` ready for this runtime's globSync: rewritten by
+ * {@link expandDotGlobstar} on an affected Node, untouched otherwise.
+ * @param {string[]} patterns
+ * @param {string} [version]  defaults to the running Node
+ * @returns {string[]}
+ */
+export function compatGlobs(patterns: string[], version?: string): string[];

package/types/invisible.d.mts

@@ -28,9 +28,11 @@ export function isSgrOnly(text: string): boolean;
  * that hits the bound is continued by {@link RUN_TAIL_RE} until it ends, so the
  * runs reported are maximal at any length.
  * @param {string} text
+ * @param {number} [from]  UTF-16 offset to resume at: the end of a run already
+ *   taken off this text, so a caller holding the first run need not re-measure it
  * @returns {Generator<{ index: number, text: string, charCount: number }>}
  */
-export function findLongRuns(text: string): Generator<{
+export function findLongRuns(text: string, from?: number): Generator<{
     index: number;
     text: string;
     charCount: number;
@@ -252,6 +254,7 @@ export type CarveEntry = {
         removed: number;
     } | null;
     removed: number | null;
+    view: string | null;
 };
 /**
  * Per-invisible carve-out analysis, shared by carveStrip and

package/types/src/glob-compat.d.mts

@@ -0,0 +1,28 @@
+/**
+ * Whether the globSync of Node `version` (`process.versions.node`'s shape)
+ * misses a dot-named segment after a `**`.
+ * @param {string} version
+ * @returns {boolean}
+ */
+export function globstarSkipsDotSegments(version: string): boolean;
+/**
+ * `pattern` as patterns the broken globSync answers.
+ *
+ * Each `**\/` before a dot segment spans zero directories or one or more:
+ * dropping it is the first case and `**\/*\/` the second, and neither puts a
+ * dot segment straight after a `**`. A `*` never matches a dot-named directory,
+ * so the halves can match less than a fixed Node does (which enters a dot
+ * directory named like the segment after `**`), never more. A dot segment the
+ * rewrite cannot reach throws rather than silently matching nothing.
+ * @param {string} pattern
+ * @returns {string[]}
+ */
+export function expandDotGlobstar(pattern: string): string[];
+/**
+ * `patterns` ready for this runtime's globSync: rewritten by
+ * {@link expandDotGlobstar} on an affected Node, untouched otherwise.
+ * @param {string[]} patterns
+ * @param {string} [version]  defaults to the running Node
+ * @returns {string[]}
+ */
+export function compatGlobs(patterns: string[], version?: string): string[];

package/types/src/invisible.d.mts

@@ -28,9 +28,11 @@ export function isSgrOnly(text: string): boolean;
  * that hits the bound is continued by {@link RUN_TAIL_RE} until it ends, so the
  * runs reported are maximal at any length.
  * @param {string} text
+ * @param {number} [from]  UTF-16 offset to resume at: the end of a run already
+ *   taken off this text, so a caller holding the first run need not re-measure it
  * @returns {Generator<{ index: number, text: string, charCount: number }>}
  */
-export function findLongRuns(text: string): Generator<{
+export function findLongRuns(text: string, from?: number): Generator<{
     index: number;
     text: string;
     charCount: number;
@@ -252,6 +254,7 @@ export type CarveEntry = {
         removed: number;
     } | null;
     removed: number | null;
+    view: string | null;
 };
 /**
  * Per-invisible carve-out analysis, shared by carveStrip and