agent-sanitizer 2.62.1 → 2.62.2

package/THREAT-MODEL.md

@@ -823,7 +823,11 @@ it, so what anchors its trust is worth stating exactly.
   merge and that refresh, the default branch pins binaries compiled from the
   previous bundle. The provisioner compares its own bundle against the manifest's
   `# bundle=` pin and refuses on a mismatch, so the window degrades to the node
-  path rather than running a binary that is not the code the install ships.
+  path rather than running a binary that is not the code the install ships. A
+  binary provisioned before the window stays installed but loses its install
+  stamp, and the launcher runs a binary whose stamp does not name the shipped
+  manifest only on a host where no node is found — there an older sanitizer
+  still beats an unsanitized call.
 - **Not covered: an attacker who can write BOTH the repository and the release.**
   There is no signature; the manifest is trusted because it arrives through the
   same reviewed, gated path as the rest of the plugin. Rewriting it is rewriting
@@ -842,11 +846,19 @@ it, so what anchors its trust is worth stating exactly.
   per install instead of once per tool call. V8 does not treat a code cache as
   untrusted input, so those files are code the session runs, exactly like the
   binary above. The launcher creates the directory mode 700 and gates it with
-  `trusted_exec_dir` — the same owner-only-write property, refused with a line on
+  `trusted_dir` — the same owner-only-write property, refused with a line on
   stderr when the directory does not hold it — so the same user-owned data
   directory is the assumption here too. It carries no digest and needs none:
   anything able to write there can already run code per the bullet above. Nothing
   is fetched for it, so it adds no supply-chain surface.
+- **The same gate covers everything else the launcher takes from a shared
+  location.** The provisioned redactor venv (`${CLAUDE_PLUGIN_DATA}/venv` and its
+  `bin/`, whose daemon receives every secret-bearing payload) is handed to the
+  client only when `trusted_dir` vouches for both directories; otherwise the
+  client redacts through the committed zipapp. The degraded-warning marker root
+  under `TMPDIR` is read only when this user owns it with owner-only write, so a
+  squatted shared-temp entry cannot pre-suppress the warning that a call ran
+  unsanitized.
 - **Opting out.** `AGENT_SANITIZER_HOOK_BINARY=0` never downloads and never runs
   a binary. That leaves the node path running the committed bundle and the
   compile cache above; `AGENT_SANITIZER_COMPILE_CACHE=0` turns the cache off as

package/claude-hooks/lib/knobs.mjs

@@ -220,6 +220,7 @@ export const KNOBS = Object.freeze({
   _AGENT_SANITIZER_TRACE_FILE: on("internal", text()),
   _AGENT_SANITIZER_REDACTOR_SOCKET: on("internal", text()),
   _AGENT_SANITIZER_REDACTOR_DAEMON: on("internal", text()),
+  _AGENT_SANITIZER_REDACTOR_PYZ: on("internal", text()),
   _AGENT_SANITIZER_REDACTOR_WAIT_MS: on("internal", milliseconds(8000)),
   _AGENT_SANITIZER_REDACTOR_REQUEST_MS: on("internal", milliseconds(20000)),
   _AGENT_SANITIZER_SANITIZE_BUDGET_MS: on("internal", milliseconds(120000)),

package/claude-hooks/lib/redactor-client.mjs

@@ -60,10 +60,12 @@ export const DEFAULT_SOCKET_PATH =
  *    sets it to the provisioned venv's console script when one exists, and
  *    tests point it at dead paths to drive the fail-closed arm; a fallback
  *    from an explicit setting would turn those arms into silent passes).
- * 2. The committed self-contained zipapp shipped BESIDE this bundle
- *    (`plugin/dist/redactor/daemon.pyz`) — the guaranteed floor: it needs only
- *    a python3 on PATH, so a cold start with no venv and no network still
- *    redacts instead of failing closed on every tool call.
+ * 2. The committed self-contained zipapp (`plugin/dist/redactor/daemon.pyz`) —
+ *    the guaranteed floor: it needs only a python3 on PATH, so a cold start
+ *    with no venv and no network still redacts instead of failing closed on
+ *    every tool call. At `_AGENT_SANITIZER_REDACTOR_PYZ` when the launcher
+ *    exports it (the compiled binary's module-relative path names no file on
+ *    disk), else beside this bundle.
  * 3. The packaged console script from PATH — the un-bundled/dev case, where
  *    no sibling dist tree exists.
  * @returns {string[]}
@@ -74,7 +76,9 @@ function daemonCommand() {
   // Inside the built bundle import.meta.url is .../plugin/dist/hooks/<bundle>,
   // so the committed zipapp sits one level up; from the raw sources no such
   // sibling exists and the check falls through.
-  const pyz = fileURLToPath(new URL("../redactor/daemon.pyz", import.meta.url));
+  const pyz =
+    readKnob("_AGENT_SANITIZER_REDACTOR_PYZ") ||
+    fileURLToPath(new URL("../redactor/daemon.pyz", import.meta.url));
   if (existsSync(pyz)) return ["python3", pyz];
   return ["agent-secret-redactor-daemon"];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.62.1",
+  "version": "2.62.2",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/src/instructions.mjs

@@ -232,11 +232,20 @@ export function scanText(content) {
   let line = 1;
   let counted = 0;
   // The verdict keeps only the first run; the rest come off the payload view,
-  // which is index-aligned with `content` and masks preserved invisibles.
+  // which is index-aligned with `content` and masks preserved invisibles. The
+  // search resumes past the first run rather than matching it a second time,
+  // which on one 256 KB payload run is a regex pass over the whole file.
+  const { firstRun } = verdict;
   const runs =
-    verdict.firstRun === null
+    firstRun === null
       ? []
-      : findLongRuns(payloadInvisibleView(content));
+      : [
+          firstRun,
+          ...findLongRuns(
+            payloadInvisibleView(content),
+            firstRun.index + firstRun.text.length,
+          ),
+        ];
   for (const run of runs) {
     for (; counted < run.index; counted++)
       if (content.charCodeAt(counted) === NEWLINE) line++;

package/src/invisible.mjs

@@ -218,14 +218,16 @@ const RUN_TAIL_RE = new RegExp(`(?:${STRIP.source}){1,${RUN_CHUNK}}`, "yu");
  * that hits the bound is continued by {@link RUN_TAIL_RE} until it ends, so the
  * runs reported are maximal at any length.
  * @param {string} text
+ * @param {number} [from]  UTF-16 offset to resume at: the end of a run already
+ *   taken off this text, so a caller holding the first run need not re-measure it
  * @returns {Generator<{ index: number, text: string, charCount: number }>}
  */
-export function* findLongRuns(text) {
+export function* findLongRuns(text, from = 0) {
   // Both regexes are module-level and carry `lastIndex`, and a generator can be
   // suspended anywhere — including inside another scan of another text. Every
   // exec below therefore sets its own start position first, so no scan can
   // inherit a position from one it interleaved with.
-  let pos = 0;
+  let pos = from;
   for (;;) {
     LONG_RUN_CHUNK_RE.lastIndex = pos;
     const match = LONG_RUN_CHUNK_RE.exec(text);
@@ -1231,12 +1233,11 @@ function markTagSequences(cps) {
   return keep;
 }
 
-// The range the registered sequences' selectors span: a cheap pre-filter.
-const STANDARDIZED_SELECTOR_MIN = Math.min(
-  ...STANDARDIZED_VARIANTS.map(([, selector]) => selector),
-);
-const STANDARDIZED_SELECTOR_MAX = Math.max(
-  ...STANDARDIZED_VARIANTS.map(([, selector]) => selector),
+// The selectors the registered sequences use: a cheap pre-filter. Not their
+// span — U+180B to U+FE0D also holds U+200B and most other Cf code points, so a
+// zero-width run paid the keyed sequence lookup once per character.
+const STANDARDIZED_SELECTORS = new Set(
+  STANDARDIZED_VARIANTS.map(([, selector]) => selector),
 );
 
 /**
@@ -1249,8 +1250,7 @@ const STANDARDIZED_SELECTOR_MAX = Math.max(
  */
 function isStandardizedVariationSelector(cps, i) {
   const cp = cps[i];
-  if (cp < STANDARDIZED_SELECTOR_MIN || cp > STANDARDIZED_SELECTOR_MAX)
-    return false;
+  if (!STANDARDIZED_SELECTORS.has(cp)) return false;
   return i > 0 && isStandardizedVariant(cps[i - 1], cp);
 }
 
@@ -1892,7 +1892,7 @@ function carveWalk(body, cps, analysis, build) {
  * @typedef {{ body: string, cps: Int32Array,
  *   analysis: ReturnType<typeof analyzeCarve>,
  *   strip: { cleaned: string, found: string[], removed: number } | null,
- *   removed: number | null }} CarveEntry
+ *   removed: number | null, view: string | null }} CarveEntry
  */
 
 /** @type {CarveEntry | null} */
@@ -1900,9 +1900,9 @@ let lastCarve = null;
 
 /**
  * The carve analysis of `body`, with the most recent one remembered — and its
- * strip, or removal count, once asked for. One hook call often carves one
- * document several times (the payload view, the effective count, then
- * {@link isIncidentalInvisible}); every reading is a pure function of `body`,
+ * strip, removal count or payload view, once asked for. One hook call often
+ * carves one document several times (the payload view, the effective count,
+ * then {@link isIncidentalInvisible}); every reading is a pure function of `body`,
  * so the cache changes what a verdict costs, never the verdict. One entry,
  * recorded only after the analysis returns.
  * @param {string} body
@@ -1912,7 +1912,7 @@ function carveOf(body) {
   if (lastCarve !== null && lastCarve.body === body) return lastCarve;
   const cps = codePointArray(body);
   const analysis = analyzeCarve(cps);
-  lastCarve = { body, cps, analysis, strip: null, removed: null };
+  lastCarve = { body, cps, analysis, strip: null, removed: null, view: null };
   return lastCarve;
 }
 
@@ -1952,10 +1952,13 @@ function needsCarveOut(body) {
  * @returns {string}
  */
 export function payloadInvisibleView(text) {
+  const entry = carveOf(text);
+  // The verdict's run search and a caller listing every run both read it.
+  if (entry.view !== null) return entry.view;
   const {
     cps,
     analysis: { codes, kind },
-  } = carveOf(text);
+  } = entry;
   const offsets = u16Offsets(cps);
   /** @param {number} i */
   const isPayload = (i) => codes[i] !== CODE_VISIBLE && kind[i] === KIND_NONE;
@@ -1974,7 +1977,8 @@ export function payloadInvisibleView(text) {
     while (i < cps.length && isPayload(i)) i++;
     if (i > keepFrom) parts.push(text.slice(offsets[keepFrom], offsets[i]));
   }
-  return parts.join("");
+  entry.view = parts.join("");
+  return entry.view;
 }
 
 /**
@@ -2065,6 +2069,17 @@ export function countEffectiveInvisible(text) {
   // Otherwise both terms read ONE carve analysis (see carveOf).
   const entry = carveOf(text);
   const payload = entry.analysis.payloadInvis;
+  // When every invisible is payload, nothing is preservable, so either strip
+  // removes exactly the invisibles and the surplus is zero — unless a removal
+  // closes a lone high surrogate against a lone low one, which the code-point
+  // gap counts too (see carveWalk's `removed`) and which needs a lone low one.
+  // A hidden run or a scatter of soft hyphens lands here, and answering off the
+  // analysis spares it a whole-text strip it would only measure.
+  if (
+    payload === entry.analysis.invisible.length &&
+    !LONE_LOW_SURROGATE_RE.test(text)
+  )
+    return payload;
   if (!needsCarveOut(text))
     return surplusOver(
       payload,

package/types/claude-hooks/lib/knobs.d.mts

@@ -93,6 +93,9 @@ export const KNOBS: Readonly<{
     _AGENT_SANITIZER_REDACTOR_DAEMON: Readonly<Knob<string | undefined> & {
         surface: Surface;
     }>;
+    _AGENT_SANITIZER_REDACTOR_PYZ: Readonly<Knob<string | undefined> & {
+        surface: Surface;
+    }>;
     _AGENT_SANITIZER_REDACTOR_WAIT_MS: Readonly<Knob<number> & {
         surface: Surface;
     }>;

package/types/invisible.d.mts

@@ -28,9 +28,11 @@ export function isSgrOnly(text: string): boolean;
  * that hits the bound is continued by {@link RUN_TAIL_RE} until it ends, so the
  * runs reported are maximal at any length.
  * @param {string} text
+ * @param {number} [from]  UTF-16 offset to resume at: the end of a run already
+ *   taken off this text, so a caller holding the first run need not re-measure it
  * @returns {Generator<{ index: number, text: string, charCount: number }>}
  */
-export function findLongRuns(text: string): Generator<{
+export function findLongRuns(text: string, from?: number): Generator<{
     index: number;
     text: string;
     charCount: number;
@@ -252,6 +254,7 @@ export type CarveEntry = {
         removed: number;
     } | null;
     removed: number | null;
+    view: string | null;
 };
 /**
  * Per-invisible carve-out analysis, shared by carveStrip and

package/types/src/invisible.d.mts

@@ -28,9 +28,11 @@ export function isSgrOnly(text: string): boolean;
  * that hits the bound is continued by {@link RUN_TAIL_RE} until it ends, so the
  * runs reported are maximal at any length.
  * @param {string} text
+ * @param {number} [from]  UTF-16 offset to resume at: the end of a run already
+ *   taken off this text, so a caller holding the first run need not re-measure it
  * @returns {Generator<{ index: number, text: string, charCount: number }>}
  */
-export function findLongRuns(text: string): Generator<{
+export function findLongRuns(text: string, from?: number): Generator<{
     index: number;
     text: string;
     charCount: number;
@@ -252,6 +254,7 @@ export type CarveEntry = {
         removed: number;
     } | null;
     removed: number | null;
+    view: string | null;
 };
 /**
  * Per-invisible carve-out analysis, shared by carveStrip and