agent-sanitizer 2.63.0 → 2.63.1

package/src/severity.mjs

@@ -45,13 +45,25 @@ export const SEVERITY = Object.freeze({
  *   A single reportable outcome and how loudly to report it.
  */
 
+/**
+ * The message, refused when empty: an unreported change fails at construction
+ * instead of rendering as a blank banner line.
+ * @param {string} message
+ * @returns {string}
+ */
+function reportable(message) {
+  if (typeof message !== "string" || message === "")
+    throw new TypeError("agent-sanitizer: a finding needs a non-empty message");
+  return message;
+}
+
 /**
  * A WARNING-severity finding: injection-shaped, worth the banner.
  * @param {string} message
  * @returns {Finding}
  */
 export function warning(message) {
-  return { severity: SEVERITY.WARNING, message };
+  return { severity: SEVERITY.WARNING, message: reportable(message) };
 }
 
 /**
@@ -60,7 +72,7 @@ export function warning(message) {
  * @returns {Finding}
  */
 export function note(message) {
-  return { severity: SEVERITY.NOTE, message };
+  return { severity: SEVERITY.NOTE, message: reportable(message) };
 }
 
 /**

package/src/unicode-properties.mjs

@@ -343,6 +343,337 @@ export const SCRIPT_HANGUL = [
   [0xffd2, 0xffd7],
   [0xffda, 0xffdc],
 ];
+
+/** @type {ReadonlyArray<readonly [number, number]>} */
+export const GENERAL_CATEGORY_MARK = [
+  [0x300, 0x36f],
+  [0x483, 0x489],
+  [0x591, 0x5bd],
+  [0x5bf, 0x5bf],
+  [0x5c1, 0x5c2],
+  [0x5c4, 0x5c5],
+  [0x5c7, 0x5c7],
+  [0x610, 0x61a],
+  [0x64b, 0x65f],
+  [0x670, 0x670],
+  [0x6d6, 0x6dc],
+  [0x6df, 0x6e4],
+  [0x6e7, 0x6e8],
+  [0x6ea, 0x6ed],
+  [0x711, 0x711],
+  [0x730, 0x74a],
+  [0x7a6, 0x7b0],
+  [0x7eb, 0x7f3],
+  [0x7fd, 0x7fd],
+  [0x816, 0x819],
+  [0x81b, 0x823],
+  [0x825, 0x827],
+  [0x829, 0x82d],
+  [0x859, 0x85b],
+  [0x897, 0x89f],
+  [0x8ca, 0x8e1],
+  [0x8e3, 0x903],
+  [0x93a, 0x93c],
+  [0x93e, 0x94f],
+  [0x951, 0x957],
+  [0x962, 0x963],
+  [0x981, 0x983],
+  [0x9bc, 0x9bc],
+  [0x9be, 0x9c4],
+  [0x9c7, 0x9c8],
+  [0x9cb, 0x9cd],
+  [0x9d7, 0x9d7],
+  [0x9e2, 0x9e3],
+  [0x9fe, 0x9fe],
+  [0xa01, 0xa03],
+  [0xa3c, 0xa3c],
+  [0xa3e, 0xa42],
+  [0xa47, 0xa48],
+  [0xa4b, 0xa4d],
+  [0xa51, 0xa51],
+  [0xa70, 0xa71],
+  [0xa75, 0xa75],
+  [0xa81, 0xa83],
+  [0xabc, 0xabc],
+  [0xabe, 0xac5],
+  [0xac7, 0xac9],
+  [0xacb, 0xacd],
+  [0xae2, 0xae3],
+  [0xafa, 0xaff],
+  [0xb01, 0xb03],
+  [0xb3c, 0xb3c],
+  [0xb3e, 0xb44],
+  [0xb47, 0xb48],
+  [0xb4b, 0xb4d],
+  [0xb55, 0xb57],
+  [0xb62, 0xb63],
+  [0xb82, 0xb82],
+  [0xbbe, 0xbc2],
+  [0xbc6, 0xbc8],
+  [0xbca, 0xbcd],
+  [0xbd7, 0xbd7],
+  [0xc00, 0xc04],
+  [0xc3c, 0xc3c],
+  [0xc3e, 0xc44],
+  [0xc46, 0xc48],
+  [0xc4a, 0xc4d],
+  [0xc55, 0xc56],
+  [0xc62, 0xc63],
+  [0xc81, 0xc83],
+  [0xcbc, 0xcbc],
+  [0xcbe, 0xcc4],
+  [0xcc6, 0xcc8],
+  [0xcca, 0xccd],
+  [0xcd5, 0xcd6],
+  [0xce2, 0xce3],
+  [0xcf3, 0xcf3],
+  [0xd00, 0xd03],
+  [0xd3b, 0xd3c],
+  [0xd3e, 0xd44],
+  [0xd46, 0xd48],
+  [0xd4a, 0xd4d],
+  [0xd57, 0xd57],
+  [0xd62, 0xd63],
+  [0xd81, 0xd83],
+  [0xdca, 0xdca],
+  [0xdcf, 0xdd4],
+  [0xdd6, 0xdd6],
+  [0xdd8, 0xddf],
+  [0xdf2, 0xdf3],
+  [0xe31, 0xe31],
+  [0xe34, 0xe3a],
+  [0xe47, 0xe4e],
+  [0xeb1, 0xeb1],
+  [0xeb4, 0xebc],
+  [0xec8, 0xece],
+  [0xf18, 0xf19],
+  [0xf35, 0xf35],
+  [0xf37, 0xf37],
+  [0xf39, 0xf39],
+  [0xf3e, 0xf3f],
+  [0xf71, 0xf84],
+  [0xf86, 0xf87],
+  [0xf8d, 0xf97],
+  [0xf99, 0xfbc],
+  [0xfc6, 0xfc6],
+  [0x102b, 0x103e],
+  [0x1056, 0x1059],
+  [0x105e, 0x1060],
+  [0x1062, 0x1064],
+  [0x1067, 0x106d],
+  [0x1071, 0x1074],
+  [0x1082, 0x108d],
+  [0x108f, 0x108f],
+  [0x109a, 0x109d],
+  [0x135d, 0x135f],
+  [0x1712, 0x1715],
+  [0x1732, 0x1734],
+  [0x1752, 0x1753],
+  [0x1772, 0x1773],
+  [0x17b4, 0x17d3],
+  [0x17dd, 0x17dd],
+  [0x180b, 0x180d],
+  [0x180f, 0x180f],
+  [0x1885, 0x1886],
+  [0x18a9, 0x18a9],
+  [0x1920, 0x192b],
+  [0x1930, 0x193b],
+  [0x1a17, 0x1a1b],
+  [0x1a55, 0x1a5e],
+  [0x1a60, 0x1a7c],
+  [0x1a7f, 0x1a7f],
+  [0x1ab0, 0x1add],
+  [0x1ae0, 0x1aeb],
+  [0x1b00, 0x1b04],
+  [0x1b34, 0x1b44],
+  [0x1b6b, 0x1b73],
+  [0x1b80, 0x1b82],
+  [0x1ba1, 0x1bad],
+  [0x1be6, 0x1bf3],
+  [0x1c24, 0x1c37],
+  [0x1cd0, 0x1cd2],
+  [0x1cd4, 0x1ce8],
+  [0x1ced, 0x1ced],
+  [0x1cf4, 0x1cf4],
+  [0x1cf7, 0x1cf9],
+  [0x1dc0, 0x1dff],
+  [0x20d0, 0x20f0],
+  [0x2cef, 0x2cf1],
+  [0x2d7f, 0x2d7f],
+  [0x2de0, 0x2dff],
+  [0x302a, 0x302f],
+  [0x3099, 0x309a],
+  [0xa66f, 0xa672],
+  [0xa674, 0xa67d],
+  [0xa69e, 0xa69f],
+  [0xa6f0, 0xa6f1],
+  [0xa802, 0xa802],
+  [0xa806, 0xa806],
+  [0xa80b, 0xa80b],
+  [0xa823, 0xa827],
+  [0xa82c, 0xa82c],
+  [0xa880, 0xa881],
+  [0xa8b4, 0xa8c5],
+  [0xa8e0, 0xa8f1],
+  [0xa8ff, 0xa8ff],
+  [0xa926, 0xa92d],
+  [0xa947, 0xa953],
+  [0xa980, 0xa983],
+  [0xa9b3, 0xa9c0],
+  [0xa9e5, 0xa9e5],
+  [0xaa29, 0xaa36],
+  [0xaa43, 0xaa43],
+  [0xaa4c, 0xaa4d],
+  [0xaa7b, 0xaa7d],
+  [0xaab0, 0xaab0],
+  [0xaab2, 0xaab4],
+  [0xaab7, 0xaab8],
+  [0xaabe, 0xaabf],
+  [0xaac1, 0xaac1],
+  [0xaaeb, 0xaaef],
+  [0xaaf5, 0xaaf6],
+  [0xabe3, 0xabea],
+  [0xabec, 0xabed],
+  [0xfb1e, 0xfb1e],
+  [0xfe00, 0xfe0f],
+  [0xfe20, 0xfe2f],
+  [0x101fd, 0x101fd],
+  [0x102e0, 0x102e0],
+  [0x10376, 0x1037a],
+  [0x10a01, 0x10a03],
+  [0x10a05, 0x10a06],
+  [0x10a0c, 0x10a0f],
+  [0x10a38, 0x10a3a],
+  [0x10a3f, 0x10a3f],
+  [0x10ae5, 0x10ae6],
+  [0x10d24, 0x10d27],
+  [0x10d69, 0x10d6d],
+  [0x10eab, 0x10eac],
+  [0x10efa, 0x10eff],
+  [0x10f46, 0x10f50],
+  [0x10f82, 0x10f85],
+  [0x11000, 0x11002],
+  [0x11038, 0x11046],
+  [0x11070, 0x11070],
+  [0x11073, 0x11074],
+  [0x1107f, 0x11082],
+  [0x110b0, 0x110ba],
+  [0x110c2, 0x110c2],
+  [0x11100, 0x11102],
+  [0x11127, 0x11134],
+  [0x11145, 0x11146],
+  [0x11173, 0x11173],
+  [0x11180, 0x11182],
+  [0x111b3, 0x111c0],
+  [0x111c9, 0x111cc],
+  [0x111ce, 0x111cf],
+  [0x1122c, 0x11237],
+  [0x1123e, 0x1123e],
+  [0x11241, 0x11241],
+  [0x112df, 0x112ea],
+  [0x11300, 0x11303],
+  [0x1133b, 0x1133c],
+  [0x1133e, 0x11344],
+  [0x11347, 0x11348],
+  [0x1134b, 0x1134d],
+  [0x11357, 0x11357],
+  [0x11362, 0x11363],
+  [0x11366, 0x1136c],
+  [0x11370, 0x11374],
+  [0x113b8, 0x113c0],
+  [0x113c2, 0x113c2],
+  [0x113c5, 0x113c5],
+  [0x113c7, 0x113ca],
+  [0x113cc, 0x113d0],
+  [0x113d2, 0x113d2],
+  [0x113e1, 0x113e2],
+  [0x11435, 0x11446],
+  [0x1145e, 0x1145e],
+  [0x114b0, 0x114c3],
+  [0x115af, 0x115b5],
+  [0x115b8, 0x115c0],
+  [0x115dc, 0x115dd],
+  [0x11630, 0x11640],
+  [0x116ab, 0x116b7],
+  [0x1171d, 0x1172b],
+  [0x1182c, 0x1183a],
+  [0x11930, 0x11935],
+  [0x11937, 0x11938],
+  [0x1193b, 0x1193e],
+  [0x11940, 0x11940],
+  [0x11942, 0x11943],
+  [0x119d1, 0x119d7],
+  [0x119da, 0x119e0],
+  [0x119e4, 0x119e4],
+  [0x11a01, 0x11a0a],
+  [0x11a33, 0x11a39],
+  [0x11a3b, 0x11a3e],
+  [0x11a47, 0x11a47],
+  [0x11a51, 0x11a5b],
+  [0x11a8a, 0x11a99],
+  [0x11b60, 0x11b67],
+  [0x11c2f, 0x11c36],
+  [0x11c38, 0x11c3f],
+  [0x11c92, 0x11ca7],
+  [0x11ca9, 0x11cb6],
+  [0x11d31, 0x11d36],
+  [0x11d3a, 0x11d3a],
+  [0x11d3c, 0x11d3d],
+  [0x11d3f, 0x11d45],
+  [0x11d47, 0x11d47],
+  [0x11d8a, 0x11d8e],
+  [0x11d90, 0x11d91],
+  [0x11d93, 0x11d97],
+  [0x11ef3, 0x11ef6],
+  [0x11f00, 0x11f01],
+  [0x11f03, 0x11f03],
+  [0x11f34, 0x11f3a],
+  [0x11f3e, 0x11f42],
+  [0x11f5a, 0x11f5a],
+  [0x13440, 0x13440],
+  [0x13447, 0x13455],
+  [0x1611e, 0x1612f],
+  [0x16af0, 0x16af4],
+  [0x16b30, 0x16b36],
+  [0x16f4f, 0x16f4f],
+  [0x16f51, 0x16f87],
+  [0x16f8f, 0x16f92],
+  [0x16fe4, 0x16fe4],
+  [0x16ff0, 0x16ff1],
+  [0x1bc9d, 0x1bc9e],
+  [0x1cf00, 0x1cf2d],
+  [0x1cf30, 0x1cf46],
+  [0x1d165, 0x1d169],
+  [0x1d16d, 0x1d172],
+  [0x1d17b, 0x1d182],
+  [0x1d185, 0x1d18b],
+  [0x1d1aa, 0x1d1ad],
+  [0x1d242, 0x1d244],
+  [0x1da00, 0x1da36],
+  [0x1da3b, 0x1da6c],
+  [0x1da75, 0x1da75],
+  [0x1da84, 0x1da84],
+  [0x1da9b, 0x1da9f],
+  [0x1daa1, 0x1daaf],
+  [0x1e000, 0x1e006],
+  [0x1e008, 0x1e018],
+  [0x1e01b, 0x1e021],
+  [0x1e023, 0x1e024],
+  [0x1e026, 0x1e02a],
+  [0x1e08f, 0x1e08f],
+  [0x1e130, 0x1e136],
+  [0x1e2ae, 0x1e2ae],
+  [0x1e2ec, 0x1e2ef],
+  [0x1e4ec, 0x1e4ef],
+  [0x1e5ee, 0x1e5ef],
+  [0x1e6e3, 0x1e6e3],
+  [0x1e6e6, 0x1e6e6],
+  [0x1e6ee, 0x1e6ef],
+  [0x1e6f5, 0x1e6f5],
+  [0x1e8d0, 0x1e8d6],
+  [0x1e944, 0x1e94a],
+  [0xe0100, 0xe01ef],
+];
 // Stryker restore all
 
 /**

package/src/view-map.mjs

@@ -220,6 +220,8 @@ export function overlapAwareCount(haystack, needle) {
  * The character runs Layer 1 deleted, located by greedy subsequence alignment
  * (stripping only deletes, so `cleaned` is always a subsequence of `content`).
  * Throws if the subsequence property does not hold — the caller fails closed.
+ * Aligned per CODE POINT (Layer 1 deletes whole ones): a code-unit walk matches
+ * U+1D173's high surrogate against U+1D11E's and splits both. Offsets stay UTF-16.
  * @param {string} content disk bytes
  * @param {string} cleaned Layer-1 view of the same bytes
  * @returns {{start: number, deleted: string}[]}
@@ -228,15 +230,15 @@ export function alignDeletions(content, cleaned) {
   const deletions = [];
   let run = "";
   let ci = 0;
-  for (let di = 0; di < content.length; di++) {
-    if (ci < cleaned.length && content[di] === cleaned[ci]) {
+  for (const ch of content) {
+    if (ci < cleaned.length && cleaned.startsWith(ch, ci)) {
       if (run) {
         deletions.push({ start: ci, deleted: run });
         run = "";
       }
-      ci++;
+      ci += ch.length;
     } else {
-      run += content[di];
+      run += ch;
     }
   }
   if (ci !== cleaned.length)

package/src/warnings.mjs

@@ -68,6 +68,13 @@ export function describeHtmlSanitized(removed) {
 export const HTML_UNPARSEABLE_WARNING =
   "HTML unparseable — the entire output was withheld behind a placeholder; nothing was spliced";
 
+/**
+ * The Layer-3 warning when the URL scan overflowed the stack. It names no URL
+ * (none was found), yet stays a warning: unread is not vetted.
+ */
+export const UNSCANNABLE_WARNING =
+  "Input too deeply nested to scan for exfil URLs or look-alike hosts — any URL in it is unvetted; do not fetch, relay, or embed it";
+
 /**
  * Full warning for Layer 2's preserved-but-reported content (scripting and
  * resource tags, data: URIs), or "" when there is nothing to report. Callers

package/types/claude-hooks/lib/redactor-client.d.mts

@@ -1,3 +1,21 @@
+/**
+ * The redactor socket path: one per user, shared by every session of that user
+ * (the daemon redacts each REQUESTER's env secrets). The daemon binds it 0600
+ * under a 0700 dir AFTER priming, so its existence means "ready". In order:
+ *
+ * 1. `_AGENT_SANITIZER_REDACTOR_SOCKET` — explicit override.
+ * 2. `$XDG_RUNTIME_DIR`, then `$CLAUDE_PLUGIN_DATA` — per-user directories no
+ *    other uid can write, so a co-tenant cannot pre-create the socket dir under
+ *    them. Taken only if isPrivateRoot passes and the path fits sun_path.
+ * 3. `<tmpdir>/agent-sanitizer-redactor-<uid>` — on a shared /tmp a co-tenant
+ *    can still pre-create it; the daemon then refuses to serve and the client
+ *    refuses to connect (classifySocket), costing availability, never a secret.
+ * @param {NodeJS.ProcessEnv} env
+ * @param {number | null} uid  null where the platform has no uid model, which
+ *   trusts no root (see {@link isPrivateDir})
+ * @returns {string}
+ */
+export function resolveSocketPath(env: NodeJS.ProcessEnv, uid: number | null): string;
 /**
  * The shape the redactor returns: plain mode `{text, found}`, map mode
  * `{text, pairs, found}` or `{unmappable}`. All fields optional so a consumer

package/types/claude-hooks/sanitize-output.d.mts

@@ -77,35 +77,25 @@ export function sanitizeText(text: string, toolName: string, deadline?: {
     }>;
 }>;
 /**
- * Sanitize every string leaf of a tool-output value, preserving its shape.
- * Built-in tools return structured objects (Bash: `{stdout, stderr, interrupted,
- * isImage}`), and the harness ignores an `updatedToolOutput` whose shape does not
- * match the tool's schema — showing the raw output instead. So a single flat
- * string handed back for an object-shaped tool would leak the unsanitized output;
- * rewriting leaves in place keeps the shape intact. Object KEYS are sanitized
- * too (a connector can hide a secret in a field name); non-string leaves
- * (booleans, numbers, null) pass through untouched, and `warnings` accumulates
- * across leaves.
- * `sgrNote` is the OR across leaves: true when some leaf came back note-only.
- * `reveals` accumulates each leaf's pre-Layer-2 text (when the HTML splice
- * removed something) for the orchestrator to persist, and `notes` the leaves'
- * NOTE-severity findings — same mutated-accumulator shape as `warnings`.
- * `splices` accumulates each leaf's Layer-2 placeholder→original pairs (the
- * per-key twin of `reveals`, already vetted by the seam) for the orchestrator's
- * span persistence — same mutated-accumulator shape again.
+ * Sanitize every string leaf AND object key of a tool-output value under this
+ * hook's per-tool policy, preserving its shape. Built-in tools return
+ * structured objects (Bash: `{stdout, stderr, interrupted, isImage}`), and the
+ * harness ignores an `updatedToolOutput` whose shape does not match the tool's
+ * schema — showing the raw output instead. The walk, its key-collision
+ * withholding and its depth/cycle guards are the engine's sanitizeValueWith,
+ * so this hook and the library cannot disagree about a value's strings.
+ * `warnings`, `reveals`, `notes` and `splices` accumulate across strings.
  * @param {any} value
  * @param {string} toolName
  * @param {string[]} warnings
  * @param {string[]} [reveals]
  * @param {{remainingMs: () => number}} [deadline] shared wall-clock budget across
- *   every leaf of this value (created once by the top-level caller)
+ *   every string of this value (created once by the top-level caller)
  * @param {SanitizeExtensions} [ext]
  * @param {string[]} [notes]  appended last so an existing caller's positional
  *   arguments keep their meaning
  * @param {Array<{ placeholder: string, original: string }>} [splices]  appended
  *   after `notes` for the same positional-compatibility reason
- * @param {string} [path]  dotted location of `value` within the tool output,
- *   used only to name a key collision's location in its warning
  * @param {boolean} [secretsOn]  the secret opt-in (see {@link sanitizeText})
  * @returns {Promise<{ value: any, modified: boolean, sgrNote: boolean }>}
  */
@@ -114,19 +104,11 @@ export function sanitizeValue(value: any, toolName: string, warnings: string[],
 }, ext?: SanitizeExtensions, notes?: string[], splices?: Array<{
     placeholder: string;
     original: string;
-}>, path?: string, secretsOn?: boolean): Promise<{
+}>, secretsOn?: boolean): Promise<{
     value: any;
     modified: boolean;
     sgrNote: boolean;
 }>;
-/**
- * The warning for a post-sanitization key collision, naming where it sits.
- * Exported so tests assert by reference rather than re-typing the prose.
- * @param {string} name  the collapsed-to name
- * @param {string} path  dotted location of the owning object ("" = top level)
- * @returns {string}
- */
-export function collisionWarning(name: string, path: string): string;
 /**
  * Compose the model-facing additionalContext line for a sanitized/flagged tool
  * output. The seam (composeContextSeam) owns the prefix + warning join; this
@@ -139,9 +121,10 @@ export function collisionWarning(name: string, path: string): string;
  * @param {boolean} modified  output bytes were changed (vs. flagged only)
  * @param {string[]} warnings
  * @param {string} toolName
+ * @param {string[]} [notes]  appended after the warnings (see composeContextSeam)
  * @returns {string}
  */
-export function composeContext(modified: boolean, warnings: string[], toolName: string): string;
+export function composeContext(modified: boolean, warnings: string[], toolName: string, notes?: string[]): string;
 /**
  * Fail-closed replacement: a shape-matching placeholder for the parsed tool
  * output, or the bare `message` when stdin never parsed or carried no
@@ -276,8 +259,9 @@ export const SECRET_HINT_EXT: RegExp;
 export const describeRemoved: typeof import("agent-sanitizer/output").describeRemoved;
 export const describeWarned: typeof import("agent-sanitizer/output").describeWarned;
 export const suppressToolOutput: typeof import("agent-sanitizer/output").suppressToolOutput;
+export const COLLISION_WITHHELD_MESSAGE: "[WITHHELD — this field's name collided with another after sanitization]";
+export const collisionWarning: typeof import("agent-sanitizer/output").collisionWarning;
 export const REVEAL_WITHHELD_WARNING: string;
-export const COLLISION_WITHHELD_MESSAGE: "[WITHHELD \u2014 this field's name collided with another after sanitization]";
 export const ON_DISK_PLACEHOLDER_WARNING: string;
 /**
  * Host-supplied extensions to this hook, threaded from {@link cliMain} down to

package/types/confusable-host.d.mts

@@ -6,12 +6,13 @@
  * The two tiers are evidential strength, not attack class:
  *
  * WARNING — the WHOLE label skeletons to ASCII, so it reads as an ASCII name
- * outright, and no glyph in it survives as evidence of a real foreign word.
- * NOTE — the label carries a cross-script confusable but keeps an unmapped
- * glyph, so it does not read as any ASCII name. That is the "unmapped glyph
- * spliced in to suppress the strong rule" shape, and it is also what an ordinary
- * word with one look-alike letter produces, so the evidence is thin and the
- * finding stays quiet.
+ * outright, no glyph in it survives as evidence of a real foreign word, and at
+ * least one glyph is a genuine pretender (see isAsciiPretender).
+ * NOTE — the label skeletons to ASCII only through letters of a real Latin
+ * orthography (Turkish `altın` is a word, not a disguise), or it carries a
+ * cross-script confusable but keeps an unmapped glyph, so it reads as no ASCII
+ * name — the "unmapped glyph spliced in" shape, and also what an ordinary word
+ * with one look-alike letter produces. Thin evidence, so the finding is quiet.
  * @param {string} label a single DNS label, already decoded from punycode
  * @returns {string | null} the label's severity, or null when it is not pretending
  */

package/types/confusables.d.mts

@@ -26,6 +26,18 @@ export function scopeFor(tool: string, fields?: Record<string, string[]>): {
  * @returns {boolean}
  */
 export function hasNonAscii(value: string): boolean;
+/**
+ * True when `glyph` holds a non-ASCII code point that is neither a combining
+ * mark nor a letter of a real Latin-script orthography. THE predicate both the
+ * host rule's WARNING tier and the input fold gate on, so they cannot disagree.
+ * Turkish `ı`, Spanish `í`, Polish `ł` are a word's own letters (`altın.com`,
+ * `día.txt`), and flagging them is the worse failure; a cross-script glyph
+ * (Cyrillic `а`), an IPA/small-capital one (`ɡ`, `ᴀ`) or anything NFKC folds
+ * to ASCII (`ａ`, `fi`) stays a pretender.
+ * @param {string} glyph one or more code points
+ * @returns {boolean}
+ */
+export function isAsciiPretender(glyph: string): boolean;
 /**
  * Model-facing note naming the fields whose confusables were folded.
  * @param {string[]} normalized

package/types/gates.d.mts

@@ -20,9 +20,20 @@ export function needsMarkdownPipeline(text: string): boolean;
  */
 export function needsUrlScan(text: string): boolean;
 /**
- * True when either pre-gate alternation shape-matches `text`. Split into two
- * literals (see SECRET_HINT) and OR'd so neither grows into a
- * polynomial-backtracking shape.
+ * POLICY, not a gate: true when `text` reads as HTML rather than data that
+ * merely holds a `<` (a comment open, or a tag open with a `>` after it). The
+ * output hook uses it to decide whether an MCP result earns the Layer-2 splice,
+ * so `a<b` stays verbatim; kept apart from {@link HTML_TAG_PRESENT} so widening
+ * the gate never widens the policy. Linear, unlike a `<…[^>]*>` regex.
+ * @param {string} text
+ * @returns {boolean}
+ */
+export function isHtmlShaped(text: string): boolean;
+/**
+ * True when either pre-gate alternation shape-matches `text`, or the same text
+ * with every `\n` removed (the view the engine's `_redact_cross_line` scans, so
+ * this stays a superset of the redactor). Two literals OR'd so neither grows
+ * into a polynomial-backtracking shape (see SECRET_HINT).
  * @param {string} text
  * @returns {boolean}
  */
@@ -36,29 +47,31 @@ export function matchesSecretHint(text: string): boolean;
  * `export … from "./html.mjs"` would eagerly evaluate that ~200ms module on
  * every root import, defeating the lazy-load design. This module imports
  * nothing, so re-exporting it is free.
+ *
+ * INVARIANT: every gate is a SUPERSET of its parser (a narrower one silently
+ * turns its layer off; a needless fire only costs a parse), checked by
+ * test/gates-superset.test.mjs.
  */
 /**
- * Matches any HTML tag-like construct: opening tags, closing tags (`</`),
- * comments and bogus declarations (`<!`), and processing instructions / bogus
- * comments (`<?…?>`, which the HTML tokenizer hides exactly like a comment).
- * The `<!`/`<?` arms carry a comment-only document into the pipeline at all:
- * without them it would skip both Layer 2's splice of the comment and Layer 3's
- * exfil scan over the comment interior.
- * Gate for Layer 2 (HTML sanitization) and the HTML img/a exfil path in
- * Layer 3.
+ * Matches every point where the HTML tokenizer leaves the data state: `<` then
+ * an ASCII letter, `/`, `!` or `?`. No closing `>` on purpose: a comment holding
+ * `1 < 2`, or left unterminated, still hides everything after it. Gate for
+ * Layer 2 and the HTML img/a exfil path in Layer 3.
  */
 export const HTML_TAG_PRESENT: RegExp;
 /**
  * Matches markdown link/image syntax (`](`, `![`) and reference link
- * definitions (`[label]: url` at line start). Gate for Layer 3 (markdown
- * exfiltration detection).
+ * definitions (`[label]: url` at a line start, also nested in a blockquote or
+ * list item). The label admits backslash escapes and line endings, as
+ * CommonMark labels do, but no unescaped `[`, which also keeps the scan linear.
+ * Gate for Layer 3 (markdown exfiltration detection).
  */
 export const MD_LINK_HINT: RegExp;
 /**
- * Matches an absolute http(s) URL anywhere in the text. Gate for the Layer-3
- * URL detectors, which read the URLs a GFM autolink literal yields and so find
- * a look-alike host or an exfil-shaped query in bare prose — no tag and no
- * link syntax required.
+ * Matches the start of every URL a GFM autolink literal yields (`http://`,
+ * `https://`, scheme-less `www.`). Gate for the Layer-3 URL detectors, which
+ * find a look-alike host or exfil-shaped query in bare prose. (A bare e-mail
+ * becomes a host-less `mailto:` URL that neither detector can flag.)
  */
 export const URL_PRESENT: RegExp;
 /** @type {RegExp} */

package/types/html.d.mts

@@ -130,7 +130,7 @@ export function urlHost(url: string): string;
  * how loudly (see the exfil tier in ./output.mjs).
  * @param {string} text
  * @param {{ flagDigestValues?: boolean }} [options] see {@link checkExfilUrl}
- * @returns {Array<{ isImage: boolean, autoFetched: boolean, reason: string, target: string }> | null}
+ * @returns {Array<{ isImage: boolean, autoFetched: boolean, reason: string, target: string, unscannable?: true }> | null}
  */
 export function detectExfil(text: string, options?: {
     flagDigestValues?: boolean;
@@ -139,6 +139,7 @@ export function detectExfil(text: string, options?: {
     autoFetched: boolean;
     reason: string;
     target: string;
+    unscannable?: true;
 }> | null;
 /**
  * Layer 3, second detector: report URLs whose HOST is a confusable of an ASCII
@@ -149,11 +150,12 @@ export function detectExfil(text: string, options?: {
  *
  * Fails CLOSED on a parse blow-up for the same reason detectExfil does.
  * @param {string} text
- * @returns {Array<{ severity: string, description: string }> | null}
+ * @returns {Array<{ severity: string, description: string, unscannable?: true }> | null}
  */
 export function detectConfusableHosts(text: string): Array<{
     severity: string;
     description: string;
+    unscannable?: true;
 }> | null;
 export const REPORTED_TAGS: Set<string>;
 export const HIDDEN_PLACEHOLDER: "[hidden HTML removed";

package/types/index.d.mts

@@ -60,4 +60,4 @@ export function sanitize(text: string, options?: {
 }>;
 export { applyLayer1, applyLayer1WellFormed, escapesPreservable, isBenignAnsi, isBenignAnsiKinds, normalizeLoneSurrogates, stripAnsiFully, stripTerminalFully, sgrCarriesPayload, SGR_RUN_THRESHOLD, LONE_SURROGATE_RE } from "./layer1.mjs";
 export { stripInvisible, stripInvisibleWithReport, isSgrOnly, STRIP, SGR_RE, CHECKS, CATEGORY, CATEGORY_LABELS, LINGUISTIC_SCRIPTS, VS, BLANK_NON_CF, LONG_RUN_RE, LONG_RUN_THRESHOLD, SCATTERED_THRESHOLD, findLongRuns, hasLongRun } from "./invisible.mjs";
-export { HTML_TAG_PRESENT, MD_LINK_HINT, SECRET_HINT, SECRET_HINT_EXT, matchesSecretHint } from "./gates.mjs";
+export { HTML_TAG_PRESENT, isHtmlShaped, MD_LINK_HINT, SECRET_HINT, SECRET_HINT_EXT, matchesSecretHint } from "./gates.mjs";