agent-sanitizer 2.62.1 → 2.63.0

package/THREAT-MODEL.md

@@ -823,7 +823,11 @@ it, so what anchors its trust is worth stating exactly.
   merge and that refresh, the default branch pins binaries compiled from the
   previous bundle. The provisioner compares its own bundle against the manifest's
   `# bundle=` pin and refuses on a mismatch, so the window degrades to the node
-  path rather than running a binary that is not the code the install ships.
+  path rather than running a binary that is not the code the install ships. A
+  binary provisioned before the window stays installed but loses its install
+  stamp, and the launcher runs a binary whose stamp does not name the shipped
+  manifest only on a host where no node is found — there an older sanitizer
+  still beats an unsanitized call.
 - **Not covered: an attacker who can write BOTH the repository and the release.**
   There is no signature; the manifest is trusted because it arrives through the
   same reviewed, gated path as the rest of the plugin. Rewriting it is rewriting
@@ -842,11 +846,19 @@ it, so what anchors its trust is worth stating exactly.
   per install instead of once per tool call. V8 does not treat a code cache as
   untrusted input, so those files are code the session runs, exactly like the
   binary above. The launcher creates the directory mode 700 and gates it with
-  `trusted_exec_dir` — the same owner-only-write property, refused with a line on
+  `trusted_dir` — the same owner-only-write property, refused with a line on
   stderr when the directory does not hold it — so the same user-owned data
   directory is the assumption here too. It carries no digest and needs none:
   anything able to write there can already run code per the bullet above. Nothing
   is fetched for it, so it adds no supply-chain surface.
+- **The same gate covers everything else the launcher takes from a shared
+  location.** The provisioned redactor venv (`${CLAUDE_PLUGIN_DATA}/venv` and its
+  `bin/`, whose daemon receives every secret-bearing payload) is handed to the
+  client only when `trusted_dir` vouches for both directories; otherwise the
+  client redacts through the committed zipapp. The degraded-warning marker root
+  under `TMPDIR` is read only when this user owns it with owner-only write, so a
+  squatted shared-temp entry cannot pre-suppress the warning that a call ran
+  unsanitized.
 - **Opting out.** `AGENT_SANITIZER_HOOK_BINARY=0` never downloads and never runs
   a binary. That leaves the node path running the committed bundle and the
   compile cache above; `AGENT_SANITIZER_COMPILE_CACHE=0` turns the cache off as

package/claude-hooks/lib/knobs.mjs

@@ -220,6 +220,7 @@ export const KNOBS = Object.freeze({
   _AGENT_SANITIZER_TRACE_FILE: on("internal", text()),
   _AGENT_SANITIZER_REDACTOR_SOCKET: on("internal", text()),
   _AGENT_SANITIZER_REDACTOR_DAEMON: on("internal", text()),
+  _AGENT_SANITIZER_REDACTOR_PYZ: on("internal", text()),
   _AGENT_SANITIZER_REDACTOR_WAIT_MS: on("internal", milliseconds(8000)),
   _AGENT_SANITIZER_REDACTOR_REQUEST_MS: on("internal", milliseconds(20000)),
   _AGENT_SANITIZER_SANITIZE_BUDGET_MS: on("internal", milliseconds(120000)),

package/claude-hooks/lib/redactor-client.mjs

@@ -60,10 +60,12 @@ export const DEFAULT_SOCKET_PATH =
  *    sets it to the provisioned venv's console script when one exists, and
  *    tests point it at dead paths to drive the fail-closed arm; a fallback
  *    from an explicit setting would turn those arms into silent passes).
- * 2. The committed self-contained zipapp shipped BESIDE this bundle
- *    (`plugin/dist/redactor/daemon.pyz`) — the guaranteed floor: it needs only
- *    a python3 on PATH, so a cold start with no venv and no network still
- *    redacts instead of failing closed on every tool call.
+ * 2. The committed self-contained zipapp (`plugin/dist/redactor/daemon.pyz`) —
+ *    the guaranteed floor: it needs only a python3 on PATH, so a cold start
+ *    with no venv and no network still redacts instead of failing closed on
+ *    every tool call. At `_AGENT_SANITIZER_REDACTOR_PYZ` when the launcher
+ *    exports it (the compiled binary's module-relative path names no file on
+ *    disk), else beside this bundle.
  * 3. The packaged console script from PATH — the un-bundled/dev case, where
  *    no sibling dist tree exists.
  * @returns {string[]}
@@ -74,7 +76,9 @@ function daemonCommand() {
   // Inside the built bundle import.meta.url is .../plugin/dist/hooks/<bundle>,
   // so the committed zipapp sits one level up; from the raw sources no such
   // sibling exists and the check falls through.
-  const pyz = fileURLToPath(new URL("../redactor/daemon.pyz", import.meta.url));
+  const pyz =
+    readKnob("_AGENT_SANITIZER_REDACTOR_PYZ") ||
+    fileURLToPath(new URL("../redactor/daemon.pyz", import.meta.url));
   if (existsSync(pyz)) return ["python3", pyz];
   return ["agent-secret-redactor-daemon"];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.62.1",
+  "version": "2.63.0",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/python/agent_sanitizer/secrets/data/credential-names.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "The credential-noun vocabulary: the words that make an identifier name a secret. Published so every consumer derives its own matcher from ONE list — a newly recognized noun reaches them all through a version bump instead of N hand edits. Read it from Python via agent_sanitizer.secrets (credential_name_segments / credential_field_name_patterns / non_secret_name_segments) or from JavaScript via the npm subpath export `agent-sanitizer/credential-names`. `parts` are the lowercase words of the noun; a consumer renders them for its own matcher (underscore-joined `API_KEY` and bare-joined `APIKEY` for an env-var NAME, `api[_-]?key` for a `field = value` regex). `uses` says which matcher may use the noun, because the two are not interchangeable: `env-name` matches a variable NAME and never inspects a value, so a broad noun there costs nothing, while `field-value` redacts whatever follows `noun = ` and a broad noun there mangles ordinary text — `key = <20 chars>` is a false-positive flood, so `key`, `pat`, `credential`, `credentials` and `secrets` are env-name only — `credential`/`credentials` are everyday variable names, and an attribute chain (`credentials = service_account.Credentials.from_service_account_info(info)`) escapes every value-shape skip, so a field-value rendering would redact ordinary source lines. `passphrase` is the exception among them: it is as shape-specific as `password`, and detect-secrets' own KeywordDetector DENYLIST omits it, so name-only would let `passphrase = <secret>` reach the model in cleartext. `nonSecretSuffixes` are the trailing words that make a credential-shaped name hold a NON-secret (a key's identifier, the public half of a keypair), which a consumer must not redact. Every part is restricted to a-z0-9 so it carries no regex metacharacter; the accessors enforce that and fail closed on a violation, an empty list, or an unknown `uses` value. It sits inside the Python package because a wheel can only ship data under its package directory, while npm's `files`/`exports` can name any path — so ONE physical file backs both ecosystems and there is no copy to drift.",
+  "$comment": "The credential-noun vocabulary: the words that make an identifier name a secret. Published so every consumer derives its own matcher from ONE list — a newly recognized noun reaches them all through a version bump instead of N hand edits. Read it from Python via agent_sanitizer.secrets (credential_name_segments / credential_field_name_patterns / non_secret_name_segments) or from JavaScript via the npm subpath export `agent-sanitizer/credential-names`. `parts` are the lowercase words of the noun; a consumer renders them for its own matcher (underscore-joined `API_KEY` and bare-joined `APIKEY` for an env-var NAME, `api[_-]?key` for a `field = value` regex). `uses` says which matcher may use the noun, because the two are not interchangeable: `env-name` matches a variable NAME and never inspects a value, so a broad noun there costs nothing, while `field-value` redacts whatever follows `noun = ` and a broad noun there mangles ordinary text — `key = <20 chars>` is a false-positive flood, so `key`, `pat`, `credential`, `credentials` and `secrets` are env-name only — `credential`/`credentials` are everyday variable names, and an attribute chain (`credentials = service_account.Credentials.from_service_account_info(info)`) escapes every value-shape skip, so a field-value rendering would redact ordinary source lines. `passphrase` is the exception among them: it is as shape-specific as `password`, and detect-secrets' own KeywordDetector DENYLIST omits it, so name-only would let `passphrase = <secret>` reach the model in cleartext. `nonSecretSuffixes` are the trailing words that make a credential-shaped name hold a NON-secret — a key's identifier, the public half of a keypair, or metadata ABOUT a secret (its type, display name, label, kind, or the path/file it lives at) — which a consumer must not redact. A bare `id` is deliberately absent: Vault's `secret_id` is itself a credential. Every part is restricted to a-z0-9 so it carries no regex metacharacter; the accessors enforce that and fail closed on a violation, an empty list, or an unknown `uses` value. It sits inside the Python package because a wheel can only ship data under its package directory, while npm's `files`/`exports` can name any path — so ONE physical file backs both ecosystems and there is no copy to drift.",
   "nouns": [
     { "parts": ["api", "key"], "uses": ["env-name", "field-value"] },
     { "parts": ["access", "key"], "uses": ["env-name", "field-value"] },
@@ -24,6 +24,13 @@
   ],
   "nonSecretSuffixes": [
     ["key", "id"],
-    ["public", "key"]
+    ["public", "key"],
+    ["type"],
+    ["name"],
+    ["label"],
+    ["keyword"],
+    ["kind"],
+    ["path"],
+    ["file"]
   ]
 }

package/src/credential-names.mjs

@@ -178,7 +178,8 @@ export function credentialNames() {
  * See this module's header for why that choice belongs to the caller.
  *
  * `declineNonSecret` applies the vocabulary's `nonSecretSuffixes`: a name ending
- * in one holds an identifier or a public key (`AWS_ACCESS_KEY_ID`), not a secret.
+ * in one holds an identifier, a public key, or metadata about a secret
+ * (`AWS_ACCESS_KEY_ID`, `SECRET_TYPE`, `TOKEN_FILE`), not the secret itself.
  * Leave it on for a redactor, where redacting an identifier out of output is a
  * visible defect; turn it off for a scrub whose failure to strip is the worse
  * error. It is applied to the name's trailing run under both scopes, because a
@@ -198,26 +199,29 @@ export function credentialNameMatcher(options = {}) {
   const vocabulary = spec ? parseCredentialNames(spec) : credentialNames();
   const nouns = new Set(vocabulary.segments);
   const nonSecret = new Set(vocabulary.nonSecretSegments);
-  // The longest noun's run length. A run longer than this can match no noun, so
-  // bounding the walk here is what keeps it linear in the name's segment count —
-  // without it a 2000-underscore name costs quadratic time.
-  const maxRun = Math.max(
-    ...vocabulary.segments.map((noun) => noun.split("_").length),
-  );
-  /** @param {string[]} words @returns {string[]} */
-  const trailingRuns = (words) =>
-    Array.from({ length: Math.min(maxRun, words.length) }, (_, i) =>
+  // Each walk is bounded by the longest entry of the set it probes: a run longer
+  // than that matches nothing there, and the bound is what keeps the walk linear
+  // in the name's segment count. The bounds are separate because a two-word
+  // non-secret suffix (`PUBLIC_KEY`) must still be seen when every noun is one word.
+  /** @param {Iterable<string>} segments */
+  const longestRun = (segments) =>
+    Math.max(...Array.from(segments, (s) => s.split("_").length));
+  const maxRun = longestRun(nouns);
+  const maxNonSecretRun = longestRun(nonSecret);
+  /** @param {string[]} words @param {number} bound @returns {string[]} */
+  const trailingRuns = (words, bound) =>
+    Array.from({ length: Math.min(bound, words.length) }, (_, i) =>
       words.slice(words.length - (i + 1)).join("_"),
     );
   return (name) => {
     const words = name.toUpperCase().split("_");
     if (
       declineNonSecret &&
-      trailingRuns(words).some((run) => nonSecret.has(run))
+      trailingRuns(words, maxNonSecretRun).some((run) => nonSecret.has(run))
     )
       return false;
     if (scope === "trailing")
-      return trailingRuns(words).some((run) => nouns.has(run));
+      return trailingRuns(words, maxRun).some((run) => nouns.has(run));
     for (let start = 0; start < words.length; start++)
       for (let span = 1; span <= maxRun && start + span <= words.length; span++)
         if (nouns.has(words.slice(start, start + span).join("_"))) return true;

package/src/instructions.mjs

@@ -232,11 +232,20 @@ export function scanText(content) {
   let line = 1;
   let counted = 0;
   // The verdict keeps only the first run; the rest come off the payload view,
-  // which is index-aligned with `content` and masks preserved invisibles.
+  // which is index-aligned with `content` and masks preserved invisibles. The
+  // search resumes past the first run rather than matching it a second time,
+  // which on one 256 KB payload run is a regex pass over the whole file.
+  const { firstRun } = verdict;
   const runs =
-    verdict.firstRun === null
+    firstRun === null
       ? []
-      : findLongRuns(payloadInvisibleView(content));
+      : [
+          firstRun,
+          ...findLongRuns(
+            payloadInvisibleView(content),
+            firstRun.index + firstRun.text.length,
+          ),
+        ];
   for (const run of runs) {
     for (; counted < run.index; counted++)
       if (content.charCodeAt(counted) === NEWLINE) line++;

package/src/invisible.mjs

@@ -218,14 +218,16 @@ const RUN_TAIL_RE = new RegExp(`(?:${STRIP.source}){1,${RUN_CHUNK}}`, "yu");
  * that hits the bound is continued by {@link RUN_TAIL_RE} until it ends, so the
  * runs reported are maximal at any length.
  * @param {string} text
+ * @param {number} [from]  UTF-16 offset to resume at: the end of a run already
+ *   taken off this text, so a caller holding the first run need not re-measure it
  * @returns {Generator<{ index: number, text: string, charCount: number }>}
  */
-export function* findLongRuns(text) {
+export function* findLongRuns(text, from = 0) {
   // Both regexes are module-level and carry `lastIndex`, and a generator can be
   // suspended anywhere — including inside another scan of another text. Every
   // exec below therefore sets its own start position first, so no scan can
   // inherit a position from one it interleaved with.
-  let pos = 0;
+  let pos = from;
   for (;;) {
     LONG_RUN_CHUNK_RE.lastIndex = pos;
     const match = LONG_RUN_CHUNK_RE.exec(text);
@@ -1231,12 +1233,11 @@ function markTagSequences(cps) {
   return keep;
 }
 
-// The range the registered sequences' selectors span: a cheap pre-filter.
-const STANDARDIZED_SELECTOR_MIN = Math.min(
-  ...STANDARDIZED_VARIANTS.map(([, selector]) => selector),
-);
-const STANDARDIZED_SELECTOR_MAX = Math.max(
-  ...STANDARDIZED_VARIANTS.map(([, selector]) => selector),
+// The selectors the registered sequences use: a cheap pre-filter. Not their
+// span — U+180B to U+FE0D also holds U+200B and most other Cf code points, so a
+// zero-width run paid the keyed sequence lookup once per character.
+const STANDARDIZED_SELECTORS = new Set(
+  STANDARDIZED_VARIANTS.map(([, selector]) => selector),
 );
 
 /**
@@ -1249,8 +1250,7 @@ const STANDARDIZED_SELECTOR_MAX = Math.max(
  */
 function isStandardizedVariationSelector(cps, i) {
   const cp = cps[i];
-  if (cp < STANDARDIZED_SELECTOR_MIN || cp > STANDARDIZED_SELECTOR_MAX)
-    return false;
+  if (!STANDARDIZED_SELECTORS.has(cp)) return false;
   return i > 0 && isStandardizedVariant(cps[i - 1], cp);
 }
 
@@ -1892,7 +1892,7 @@ function carveWalk(body, cps, analysis, build) {
  * @typedef {{ body: string, cps: Int32Array,
  *   analysis: ReturnType<typeof analyzeCarve>,
  *   strip: { cleaned: string, found: string[], removed: number } | null,
- *   removed: number | null }} CarveEntry
+ *   removed: number | null, view: string | null }} CarveEntry
  */
 
 /** @type {CarveEntry | null} */
@@ -1900,9 +1900,9 @@ let lastCarve = null;
 
 /**
  * The carve analysis of `body`, with the most recent one remembered — and its
- * strip, or removal count, once asked for. One hook call often carves one
- * document several times (the payload view, the effective count, then
- * {@link isIncidentalInvisible}); every reading is a pure function of `body`,
+ * strip, removal count or payload view, once asked for. One hook call often
+ * carves one document several times (the payload view, the effective count,
+ * then {@link isIncidentalInvisible}); every reading is a pure function of `body`,
  * so the cache changes what a verdict costs, never the verdict. One entry,
  * recorded only after the analysis returns.
  * @param {string} body
@@ -1912,7 +1912,7 @@ function carveOf(body) {
   if (lastCarve !== null && lastCarve.body === body) return lastCarve;
   const cps = codePointArray(body);
   const analysis = analyzeCarve(cps);
-  lastCarve = { body, cps, analysis, strip: null, removed: null };
+  lastCarve = { body, cps, analysis, strip: null, removed: null, view: null };
   return lastCarve;
 }
 
@@ -1952,10 +1952,13 @@ function needsCarveOut(body) {
  * @returns {string}
  */
 export function payloadInvisibleView(text) {
+  const entry = carveOf(text);
+  // The verdict's run search and a caller listing every run both read it.
+  if (entry.view !== null) return entry.view;
   const {
     cps,
     analysis: { codes, kind },
-  } = carveOf(text);
+  } = entry;
   const offsets = u16Offsets(cps);
   /** @param {number} i */
   const isPayload = (i) => codes[i] !== CODE_VISIBLE && kind[i] === KIND_NONE;
@@ -1974,7 +1977,8 @@ export function payloadInvisibleView(text) {
     while (i < cps.length && isPayload(i)) i++;
     if (i > keepFrom) parts.push(text.slice(offsets[keepFrom], offsets[i]));
   }
-  return parts.join("");
+  entry.view = parts.join("");
+  return entry.view;
 }
 
 /**
@@ -2065,6 +2069,17 @@ export function countEffectiveInvisible(text) {
   // Otherwise both terms read ONE carve analysis (see carveOf).
   const entry = carveOf(text);
   const payload = entry.analysis.payloadInvis;
+  // When every invisible is payload, nothing is preservable, so either strip
+  // removes exactly the invisibles and the surplus is zero — unless a removal
+  // closes a lone high surrogate against a lone low one, which the code-point
+  // gap counts too (see carveWalk's `removed`) and which needs a lone low one.
+  // A hidden run or a scatter of soft hyphens lands here, and answering off the
+  // analysis spares it a whole-text strip it would only measure.
+  if (
+    payload === entry.analysis.invisible.length &&
+    !LONE_LOW_SURROGATE_RE.test(text)
+  )
+    return payload;
   if (!needsCarveOut(text))
     return surplusOver(
       payload,

package/types/claude-hooks/lib/knobs.d.mts

@@ -93,6 +93,9 @@ export const KNOBS: Readonly<{
     _AGENT_SANITIZER_REDACTOR_DAEMON: Readonly<Knob<string | undefined> & {
         surface: Surface;
     }>;
+    _AGENT_SANITIZER_REDACTOR_PYZ: Readonly<Knob<string | undefined> & {
+        surface: Surface;
+    }>;
     _AGENT_SANITIZER_REDACTOR_WAIT_MS: Readonly<Knob<number> & {
         surface: Surface;
     }>;

package/types/credential-names.d.mts

@@ -24,7 +24,8 @@ export function credentialNames(): CredentialNames;
  * See this module's header for why that choice belongs to the caller.
  *
  * `declineNonSecret` applies the vocabulary's `nonSecretSuffixes`: a name ending
- * in one holds an identifier or a public key (`AWS_ACCESS_KEY_ID`), not a secret.
+ * in one holds an identifier, a public key, or metadata about a secret
+ * (`AWS_ACCESS_KEY_ID`, `SECRET_TYPE`, `TOKEN_FILE`), not the secret itself.
  * Leave it on for a redactor, where redacting an identifier out of output is a
  * visible defect; turn it off for a scrub whose failure to strip is the worse
  * error. It is applied to the name's trailing run under both scopes, because a

package/types/invisible.d.mts

@@ -28,9 +28,11 @@ export function isSgrOnly(text: string): boolean;
  * that hits the bound is continued by {@link RUN_TAIL_RE} until it ends, so the
  * runs reported are maximal at any length.
  * @param {string} text
+ * @param {number} [from]  UTF-16 offset to resume at: the end of a run already
+ *   taken off this text, so a caller holding the first run need not re-measure it
  * @returns {Generator<{ index: number, text: string, charCount: number }>}
  */
-export function findLongRuns(text: string): Generator<{
+export function findLongRuns(text: string, from?: number): Generator<{
     index: number;
     text: string;
     charCount: number;
@@ -252,6 +254,7 @@ export type CarveEntry = {
         removed: number;
     } | null;
     removed: number | null;
+    view: string | null;
 };
 /**
  * Per-invisible carve-out analysis, shared by carveStrip and

package/types/src/invisible.d.mts

@@ -28,9 +28,11 @@ export function isSgrOnly(text: string): boolean;
  * that hits the bound is continued by {@link RUN_TAIL_RE} until it ends, so the
  * runs reported are maximal at any length.
  * @param {string} text
+ * @param {number} [from]  UTF-16 offset to resume at: the end of a run already
+ *   taken off this text, so a caller holding the first run need not re-measure it
  * @returns {Generator<{ index: number, text: string, charCount: number }>}
  */
-export function findLongRuns(text: string): Generator<{
+export function findLongRuns(text: string, from?: number): Generator<{
     index: number;
     text: string;
     charCount: number;
@@ -252,6 +254,7 @@ export type CarveEntry = {
         removed: number;
     } | null;
     removed: number | null;
+    view: string | null;
 };
 /**
  * Per-invisible carve-out analysis, shared by carveStrip and