agent-sanitizer 2.65.0 → 2.66.0

package/README.md

@@ -227,6 +227,11 @@ guessing if the marketplace was never added. To pull a release by hand instead:
 
 `plugin/README.md` has the managed-settings form for enabling it fleet-wide.
 
+The plugin installs from this repository's `plugin-dist` branch, which CI
+builds from each release tag; `main` carries the sources only, so a checkout
+runs `pnpm install` (and `pnpm build:redactor` for the zipapp) to get a
+runnable `plugin/`.
+
 To wire them yourself instead, one entry dispatches every mode on `--hook=`:
 
 ```jsonc

package/THREAT-MODEL.md

@@ -853,31 +853,49 @@ sanitizes (see `plugin/scripts/provision-hook-binary.sh`). That is the
 product's only path that fetches an executable over the network and later runs
 it, so what anchors its trust is worth stating exactly.
 
-- **The anchor is in the repo, not on the wire.** `plugin/dist/hooks/hook-binaries.sha256`
-  is committed, and the SessionStart provisioner refuses to install any download
-  that does not hash to the digest it pins for that platform. A compromised or
-  substituted release asset alone therefore cannot be installed: it fails the
-  comparison, is deleted, and the launcher keeps degrading loudly through node.
-- **What the digest is worth rests on the compile being reproducible.** The
-  committed digests are generated from the committed bundle, and the release
-  recompiles and byte-compares them (`build-hook-binaries.mjs --check` in
-  `release-hook-binaries.sh`), so binaries that do not reproduce the manifest are
-  never uploaded. The manifest is refreshed on the default branch by
-  `auto-version.yaml`, ahead of that release, so what it describes is the bundle
-  the release ships.
-- **A manifest that has fallen behind its bundle installs nothing.** Between a
-  merge and that refresh, the default branch pins binaries compiled from the
-  previous bundle. The provisioner compares its own bundle against the manifest's
-  `# bundle=` pin and refuses on a mismatch, so the window degrades to the node
-  path rather than running a binary that is not the code the install ships. A
-  binary provisioned before the window stays installed but loses its install
-  stamp, and the launcher runs a binary whose stamp does not name the shipped
-  manifest only on a host where no node is found — there an older sanitizer
-  still beats an unsanitized call.
-- **Not covered: an attacker who can write BOTH the repository and the release.**
-  There is no signature; the manifest is trusted because it arrives through the
-  same reviewed, gated path as the rest of the plugin. Rewriting it is rewriting
-  the plugin, which is outside this boundary.
+- **The anchor travels with the plugin, not on the wire.**
+  `plugin/dist/hooks/hook-binaries.sha256` ships in the installed plugin, and the
+  SessionStart provisioner refuses to install any download that does not hash
+  to the digest it pins for that platform. A compromised or substituted release
+  asset alone therefore cannot be installed: it fails the comparison, is
+  deleted, and the launcher keeps degrading loudly through node.
+- **The installed plugin is the `plugin-dist` branch, and no human reviews it.**
+  `.claude-plugin/marketplace.json` installs from `plugin-dist`, whose commits
+  `.github/workflows/plugin-dist.yaml` writes: it checks out a release tag (a
+  `main` commit that went through review and the required checks), builds the
+  bundle, the zipapp, the generated shell libs and the manifest, compiles the
+  binaries, uploads them only after `sha256sum --check` against that manifest
+  passes, and then pushes the build. The manifest and the binaries come from the
+  same run, so the digest proves the download is what that run built — not that
+  an independent rebuild agrees. What the user runs is therefore exactly as
+  trustworthy as whatever can write `plugin-dist`.
+- **Who can write `plugin-dist`.** The workflow pushes with
+  `TEMPLATE_SYNC_TOKEN_ORG` (the stock `GITHUB_TOKEN` where that secret is
+  unset), and the push is fast-forward only. Pushes are restricted to that
+  identity by a branch ruleset on `refs/heads/plugin-dist` blocking creation,
+  update, deletion and non-fast-forward for everyone but the repository's admin
+  bypass actors. That ruleset is repository configuration, not code in this
+  tree, so nothing here creates it; `plugin-dist-ruleset.yaml` only detects
+  its absence, failing daily and on any marketplace change while no active
+  `update` rule covers the branch. Without it, any collaborator with write
+  access can push the branch and ship code to every installed user. With it, the residual writers are the
+  admins and anything that can run a workflow holding that secret — a workflow
+  edited onto a branch of this repository can read it, so write access to the
+  repository still reaches `plugin-dist` through Actions, as it reaches `main`'s
+  release path.
+- **A manifest that disagrees with its bundle installs nothing.** The bake
+  refuses to stage a manifest whose `# bundle=` pin is not the bundle it built,
+  and the provisioner compares its own bundle against that pin and refuses on a
+  mismatch, so a hand-rebuilt bundle beside an older manifest degrades to the
+  node path rather than running a binary that is not the code the install ships.
+  A binary provisioned under an earlier release stays installed but loses its
+  install stamp, and the launcher runs a binary whose stamp does not name the
+  shipped manifest only on a host where no node is found — there an older
+  sanitizer still beats an unsanitized call.
+- **Not covered: an attacker who can write `plugin-dist`, or the workflow that
+  writes it.** There is no signature; the manifest is trusted because it arrives
+  in the same commit as the rest of the plugin. Rewriting it is rewriting the
+  plugin, which is outside this boundary.
 - **Not covered: re-verification at exec time.** The digest is checked once, at
   install. The launcher then execs
   `${CLAUDE_PLUGIN_DATA}/hook-binary/agent-sanitizer-hooks` on every hook
@@ -901,12 +919,12 @@ it, so what anchors its trust is worth stating exactly.
   location.** The provisioned redactor venv (`${CLAUDE_PLUGIN_DATA}/venv` and its
   `bin/`, whose daemon receives every secret-bearing payload) is handed to the
   client only when `trusted_dir` vouches for both directories; otherwise the
-  client redacts through the committed zipapp. The degraded-warning marker root
+  client redacts through the shipped zipapp. The degraded-warning marker root
   under `TMPDIR` is read only when this user owns it with owner-only write, so a
   squatted shared-temp entry cannot pre-suppress the warning that a call ran
   unsanitized.
 - **Opting out.** `AGENT_SANITIZER_HOOK_BINARY=0` never downloads and never runs
-  a binary. That leaves the node path running the committed bundle and the
+  a binary. That leaves the node path running the shipped bundle and the
   compile cache above; `AGENT_SANITIZER_COMPILE_CACHE=0` turns the cache off as
   well, and an operator's own `NODE_COMPILE_CACHE` is used unchanged.
 

package/claude-hooks/lib/knobs.mjs

@@ -25,9 +25,9 @@
  * cannot reach (it runs its no-node arm on shell builtins alone).
  *
  * THE single source of truth for the closed set. The shell shims cannot import
- * it, so `plugin/scripts/lib/fail-open.sh` is GENERATED from it by
- * `scripts/gen-fail-open-lib.mjs` and committed; the round trip is asserted in
- * plugin/test/fail-open-parity.test.mjs. Everything else that spells the set
+ * it, so `plugin/scripts/lib/fail-open.sh` is GENERATED from it at build time
+ * by `scripts/gen-fail-open-lib.mjs`; plugin/test/fail-open-parity.test.mjs
+ * asserts the generated lib decides as failOpenEnabled(). Everything else that spells the set
  * out by hand is an implementation that must appear in the parity table in
  * tests/test_safe_launch.py.
  */

package/claude-hooks/lib/redactor-client.mjs

@@ -115,7 +115,7 @@ export const DEFAULT_SOCKET_PATH = resolveSocketPath(process.env, currentUid());
  *    sets it to the provisioned venv's console script when one exists, and
  *    tests point it at dead paths to drive the fail-closed arm; a fallback
  *    from an explicit setting would turn those arms into silent passes).
- * 2. The committed self-contained zipapp (`plugin/dist/redactor/daemon.pyz`) —
+ * 2. The shipped self-contained zipapp (`plugin/dist/redactor/daemon.pyz`) —
  *    the guaranteed floor: it needs only a python3 on PATH, so a cold start
  *    with no venv and no network still redacts instead of failing closed on
  *    every tool call. At `_AGENT_SANITIZER_REDACTOR_PYZ` when the launcher
@@ -129,7 +129,7 @@ function daemonCommand() {
   const configured = readKnob("_AGENT_SANITIZER_REDACTOR_DAEMON");
   if (configured) return [configured];
   // Inside the built bundle import.meta.url is .../plugin/dist/hooks/<bundle>,
-  // so the committed zipapp sits one level up; from the raw sources no such
+  // so the shipped zipapp sits one level up; from the raw sources no such
   // sibling exists and the check falls through.
   const pyz =
     readKnob("_AGENT_SANITIZER_REDACTOR_PYZ") ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.65.0",
+  "version": "2.66.0",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {
@@ -249,12 +249,13 @@
     "check": "tsc --noEmit && tsc -p tsconfig.hooks.json --noEmit",
     "typecheck": "tsc --noEmit && tsc -p tsconfig.hooks.json --noEmit",
     "build:types": "tsc -p tsconfig.build.json && tsc -p tsconfig.build-hooks.json",
+    "build": "pnpm build:plugin && node plugin/scripts/build-redactor-pyz.mjs --if-missing",
+    "build:plugin": "node plugin/scripts/build-plugin.mjs",
+    "build:redactor": "node plugin/scripts/build-redactor-pyz.mjs",
     "gen:joining-type": "node scripts/gen-joining-type.mjs",
     "gen:unicode": "node scripts/gen-unicode.mjs",
     "gen:gfm-autolink": "node scripts/gen-gfm-autolink.mjs",
     "gen:unicode-properties": "node scripts/gen-unicode-properties.mjs",
-    "gen:fail-open-lib": "node scripts/gen-fail-open-lib.mjs",
-    "gen:node-floor-lib": "node scripts/gen-node-floor-lib.mjs",
     "gen:hook-binaries": "node plugin/scripts/build-hook-binaries.mjs",
     "lint": "eslint .",
     "test:mutation": "node scripts/mutate.mjs",

package/types/claude-hooks/lib/knobs.d.mts

@@ -45,9 +45,9 @@ export function readKnob<K extends keyof Knobs>(name: K, env?: NodeJS.ProcessEnv
  * cannot reach (it runs its no-node arm on shell builtins alone).
  *
  * THE single source of truth for the closed set. The shell shims cannot import
- * it, so `plugin/scripts/lib/fail-open.sh` is GENERATED from it by
- * `scripts/gen-fail-open-lib.mjs` and committed; the round trip is asserted in
- * plugin/test/fail-open-parity.test.mjs. Everything else that spells the set
+ * it, so `plugin/scripts/lib/fail-open.sh` is GENERATED from it at build time
+ * by `scripts/gen-fail-open-lib.mjs`; plugin/test/fail-open-parity.test.mjs
+ * asserts the generated lib decides as failOpenEnabled(). Everything else that spells the set
  * out by hand is an implementation that must appear in the parity table in
  * tests/test_safe_launch.py.
  */