agent-sanitizer 2.65.0 → 2.66.1

package/README.md

@@ -227,6 +227,11 @@ guessing if the marketplace was never added. To pull a release by hand instead:
 
 `plugin/README.md` has the managed-settings form for enabling it fleet-wide.
 
+The plugin installs from this repository's `plugin-dist` branch, which CI
+builds from each release tag; `main` carries the sources only, so a checkout
+runs `pnpm install` (and `pnpm build:redactor` for the zipapp) to get a
+runnable `plugin/`.
+
 To wire them yourself instead, one entry dispatches every mode on `--hook=`:
 
 ```jsonc

package/THREAT-MODEL.md

@@ -853,31 +853,49 @@ sanitizes (see `plugin/scripts/provision-hook-binary.sh`). That is the
 product's only path that fetches an executable over the network and later runs
 it, so what anchors its trust is worth stating exactly.
 
-- **The anchor is in the repo, not on the wire.** `plugin/dist/hooks/hook-binaries.sha256`
-  is committed, and the SessionStart provisioner refuses to install any download
-  that does not hash to the digest it pins for that platform. A compromised or
-  substituted release asset alone therefore cannot be installed: it fails the
-  comparison, is deleted, and the launcher keeps degrading loudly through node.
-- **What the digest is worth rests on the compile being reproducible.** The
-  committed digests are generated from the committed bundle, and the release
-  recompiles and byte-compares them (`build-hook-binaries.mjs --check` in
-  `release-hook-binaries.sh`), so binaries that do not reproduce the manifest are
-  never uploaded. The manifest is refreshed on the default branch by
-  `auto-version.yaml`, ahead of that release, so what it describes is the bundle
-  the release ships.
-- **A manifest that has fallen behind its bundle installs nothing.** Between a
-  merge and that refresh, the default branch pins binaries compiled from the
-  previous bundle. The provisioner compares its own bundle against the manifest's
-  `# bundle=` pin and refuses on a mismatch, so the window degrades to the node
-  path rather than running a binary that is not the code the install ships. A
-  binary provisioned before the window stays installed but loses its install
-  stamp, and the launcher runs a binary whose stamp does not name the shipped
-  manifest only on a host where no node is found — there an older sanitizer
-  still beats an unsanitized call.
-- **Not covered: an attacker who can write BOTH the repository and the release.**
-  There is no signature; the manifest is trusted because it arrives through the
-  same reviewed, gated path as the rest of the plugin. Rewriting it is rewriting
-  the plugin, which is outside this boundary.
+- **The anchor travels with the plugin, not on the wire.**
+  `plugin/dist/hooks/hook-binaries.sha256` ships in the installed plugin, and the
+  SessionStart provisioner refuses to install any download that does not hash
+  to the digest it pins for that platform. A compromised or substituted release
+  asset alone therefore cannot be installed: it fails the comparison, is
+  deleted, and the launcher keeps degrading loudly through node.
+- **The installed plugin is the `plugin-dist` branch, and no human reviews it.**
+  `.claude-plugin/marketplace.json` installs from `plugin-dist`, whose commits
+  `.github/workflows/plugin-dist.yaml` writes: it checks out a release tag (a
+  `main` commit that went through review and the required checks), builds the
+  bundle, the zipapp, the generated shell libs and the manifest, compiles the
+  binaries, uploads them only after `sha256sum --check` against that manifest
+  passes, and then pushes the build. The manifest and the binaries come from the
+  same run, so the digest proves the download is what that run built — not that
+  an independent rebuild agrees. What the user runs is therefore exactly as
+  trustworthy as whatever can write `plugin-dist`.
+- **Who can write `plugin-dist`.** The workflow pushes with
+  `TEMPLATE_SYNC_TOKEN_ORG` (the stock `GITHUB_TOKEN` where that secret is
+  unset), and the push is fast-forward only. Pushes are restricted to that
+  identity by a branch ruleset on `refs/heads/plugin-dist` blocking creation,
+  update, deletion and non-fast-forward for everyone but the repository's admin
+  bypass actors. That ruleset is repository configuration, not code in this
+  tree, so nothing here creates it; `plugin-dist-ruleset.yaml` only detects
+  its absence, failing daily and on any marketplace change while no active
+  `update` rule covers the branch. Without it, any collaborator with write
+  access can push the branch and ship code to every installed user. With it, the residual writers are the
+  admins and anything that can run a workflow holding that secret — a workflow
+  edited onto a branch of this repository can read it, so write access to the
+  repository still reaches `plugin-dist` through Actions, as it reaches `main`'s
+  release path.
+- **A manifest that disagrees with its bundle installs nothing.** The bake
+  refuses to stage a manifest whose `# bundle=` pin is not the bundle it built,
+  and the provisioner compares its own bundle against that pin and refuses on a
+  mismatch, so a hand-rebuilt bundle beside an older manifest degrades to the
+  node path rather than running a binary that is not the code the install ships.
+  A binary provisioned under an earlier release stays installed but loses its
+  install stamp, and the launcher runs a binary whose stamp does not name the
+  shipped manifest only on a host where no node is found — there an older
+  sanitizer still beats an unsanitized call.
+- **Not covered: an attacker who can write `plugin-dist`, or the workflow that
+  writes it.** There is no signature; the manifest is trusted because it arrives
+  in the same commit as the rest of the plugin. Rewriting it is rewriting the
+  plugin, which is outside this boundary.
 - **Not covered: re-verification at exec time.** The digest is checked once, at
   install. The launcher then execs
   `${CLAUDE_PLUGIN_DATA}/hook-binary/agent-sanitizer-hooks` on every hook
@@ -901,12 +919,12 @@ it, so what anchors its trust is worth stating exactly.
   location.** The provisioned redactor venv (`${CLAUDE_PLUGIN_DATA}/venv` and its
   `bin/`, whose daemon receives every secret-bearing payload) is handed to the
   client only when `trusted_dir` vouches for both directories; otherwise the
-  client redacts through the committed zipapp. The degraded-warning marker root
+  client redacts through the shipped zipapp. The degraded-warning marker root
   under `TMPDIR` is read only when this user owns it with owner-only write, so a
   squatted shared-temp entry cannot pre-suppress the warning that a call ran
   unsanitized.
 - **Opting out.** `AGENT_SANITIZER_HOOK_BINARY=0` never downloads and never runs
-  a binary. That leaves the node path running the committed bundle and the
+  a binary. That leaves the node path running the shipped bundle and the
   compile cache above; `AGENT_SANITIZER_COMPILE_CACHE=0` turns the cache off as
   well, and an operator's own `NODE_COMPILE_CACHE` is used unchanged.
 
@@ -1002,38 +1020,44 @@ up to the constant factors a parse pays, and one sort where findings or splice
 ranges arrive in an order the caller does not promise (`foldConfusables`,
 `mergeRanges`). The bound that matters is that nothing is _quadratic_ — a sort
 of the findings in a 1 MB paste is milliseconds, a quadratic rescan of it is
-minutes — and quadratic is what the two gates below are calibrated to catch,
+minutes — and quadratic is what the two tiers below are built to catch,
 because neither can see what the other does.
 
-**Static — every pattern.** `tests/test_redos_js_static_guard.py` drives
-regexploit over an inventory that `scripts/extract-js-regexes.mjs` extracts by
-walking the TypeScript AST of every shipped `.mjs` (not by matching regex source
-with a regex), and fails on any pattern with super-linear backtracking. A
-`RegExp(…)` built at runtime must be statically resolvable or carry a written
-exemption, so a new dynamic pattern is a red build rather than a hole.
-`tests/secrets/test_redos_static_guard.py` is the twin over the Python engine,
-and `eslint-plugin-redos` reports the same class in the editor, before CI.
-
-**Empirical — everything the static gates cannot see.** Two shapes of quadratic
-carry no backtracking at all, so no pattern analyzer will ever report them:
-
-- an **unanchored** pattern retried at every start offset, each attempt linear
-  and none of them backtracking — `(?=.*[A-Z])(?=.*[0-9])` against a long value
-  carrying neither class, or a `[^>]*$` tail rescanned from every `<`;
-- work that is not a pattern at all — a string rebuilt once per finding, a
-  prefix re-sliced inside a loop, a re-walk of an already-walked node.
-
-`test/algorithmic-complexity.test.mjs` runs an entry point over an adversarial
-input at four sizes spanning 8x and fits how its CPU cost grows — an exponent,
-classified against the one pair of thresholds every growth gate shares
-(`test/helpers/cpu-timing.mjs`, twin `tests/_growth.py`) — with a
-known-quadratic specimen as the control that proves the harness can still see
-one. Each case also asserts, at the size it measures, that
-the input still reaches the code the case is about — a length gate answering
-first is how such a case quietly degrades into timing nothing.
-`tests/secrets/test_algorithmic_complexity.py` is the twin over the Python
-engine. `test/hook-latency.test.mjs` covers the three blocking hook paths
-instead, in cost per calibration pass, with one wall-clock ceiling.
+**Deterministic — every pattern, no clock.** `tests/test_redos_js_static_guard.py`
+drives regexploit over an inventory that `scripts/extract-js-regexes.mjs`
+extracts by walking the TypeScript AST of every shipped `.mjs` (not by matching
+regex source with a regex), and fails on any pattern with super-linear
+backtracking. A `RegExp(…)` built at runtime must be statically resolvable or
+carry a written exemption, so a new dynamic pattern is a red build rather than a
+hole. `tests/secrets/test_redos_static_guard.py` is the twin over the Python
+engine. In `pnpm lint`, `eslint-plugin-redos` (recheck) and
+`eslint-plugin-regexp`'s `no-super-linear-backtracking` and
+`no-super-linear-move` read every shipped regex literal — the last of them
+reports the shape that carries no backtracking at all, an **unanchored**
+pattern retried at every start offset (`(?=.*[A-Z])(?=.*[0-9])` against a long
+value carrying neither class). `test/regex-recheck.test.mjs` hands every
+pattern a shipped module actually compiles at runtime to recheck. Every recheck
+verdict runs with its wall-clock incubation and attack timeouts off, so it
+rests on step counts alone and no machine's speed can change it.
+
+**Budgets — everything that is not a pattern.** Work that is not a regex at
+all — a string rebuilt once per finding, a prefix re-sliced inside a loop, a
+re-walk of an already-walked node, a parser's own look-back — no pattern
+analyzer will ever report. `test/algorithmic-complexity.test.mjs` runs each
+entry point ONCE, after a warm-up, over an adversarial input sized so the
+linear implementation costs tens to hundreds of milliseconds, against an
+absolute CPU ceiling at least ten times that reading (`assertUnderBudget` in
+`test/helpers/budget.mjs`, twin `tests/_budget.py`). A quadratic at that size
+overshoots the ceiling by another order of magnitude, so no runner is slow or
+busy enough to blur the two; a constant-factor slowdown passes, by design. Each
+case also asserts, at the size it measures, that the input still reaches the
+code the case is about — a length gate answering first is how such a case
+quietly degrades into timing nothing. `tests/secrets/test_algorithmic_complexity.py`
+is the twin over the Python engine. `test/hook-latency.test.mjs` holds the
+three blocking hook paths to absolute ceilings per 256 KB call, read
+uninstrumented in CI. Every test verdict in the repo that reads a clock goes
+through that one helper (`test/real-clock-thresholds.test.mjs` and its Python
+twin enforce it).
 
 **Idioms new code is held to.** Each is the fix for a defect one of the gates
 caught:

package/claude-hooks/lib/knobs.mjs

@@ -25,9 +25,9 @@
  * cannot reach (it runs its no-node arm on shell builtins alone).
  *
  * THE single source of truth for the closed set. The shell shims cannot import
- * it, so `plugin/scripts/lib/fail-open.sh` is GENERATED from it by
- * `scripts/gen-fail-open-lib.mjs` and committed; the round trip is asserted in
- * plugin/test/fail-open-parity.test.mjs. Everything else that spells the set
+ * it, so `plugin/scripts/lib/fail-open.sh` is GENERATED from it at build time
+ * by `scripts/gen-fail-open-lib.mjs`; plugin/test/fail-open-parity.test.mjs
+ * asserts the generated lib decides as failOpenEnabled(). Everything else that spells the set
  * out by hand is an implementation that must appear in the parity table in
  * tests/test_safe_launch.py.
  */

package/claude-hooks/lib/redactor-client.mjs

@@ -115,7 +115,7 @@ export const DEFAULT_SOCKET_PATH = resolveSocketPath(process.env, currentUid());
  *    sets it to the provisioned venv's console script when one exists, and
  *    tests point it at dead paths to drive the fail-closed arm; a fallback
  *    from an explicit setting would turn those arms into silent passes).
- * 2. The committed self-contained zipapp (`plugin/dist/redactor/daemon.pyz`) —
+ * 2. The shipped self-contained zipapp (`plugin/dist/redactor/daemon.pyz`) —
  *    the guaranteed floor: it needs only a python3 on PATH, so a cold start
  *    with no venv and no network still redacts instead of failing closed on
  *    every tool call. At `_AGENT_SANITIZER_REDACTOR_PYZ` when the launcher
@@ -129,7 +129,7 @@ function daemonCommand() {
   const configured = readKnob("_AGENT_SANITIZER_REDACTOR_DAEMON");
   if (configured) return [configured];
   // Inside the built bundle import.meta.url is .../plugin/dist/hooks/<bundle>,
-  // so the committed zipapp sits one level up; from the raw sources no such
+  // so the shipped zipapp sits one level up; from the raw sources no such
   // sibling exists and the check falls through.
   const pyz =
     readKnob("_AGENT_SANITIZER_REDACTOR_PYZ") ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.65.0",
+  "version": "2.66.1",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {
@@ -62,11 +62,13 @@
     "esbuild": "0.28.1",
     "eslint": "10.4.0",
     "eslint-plugin-redos": "4.5.0",
+    "eslint-plugin-regexp": "3.3.1",
     "fast-check": "4.8.0",
     "globals": "17.6.0",
     "lint-staged": "^17.0.5",
     "micromark-extension-gfm-autolink-literal": "2.1.0",
     "prettier": "^3.0.0",
+    "recheck": "4.5.0",
     "rehype-parse": "9.0.1",
     "remark-gfm": "4.0.1",
     "smol-toml": "^1.7.1",
@@ -249,12 +251,13 @@
     "check": "tsc --noEmit && tsc -p tsconfig.hooks.json --noEmit",
     "typecheck": "tsc --noEmit && tsc -p tsconfig.hooks.json --noEmit",
     "build:types": "tsc -p tsconfig.build.json && tsc -p tsconfig.build-hooks.json",
+    "build": "pnpm build:plugin && node plugin/scripts/build-redactor-pyz.mjs --if-missing",
+    "build:plugin": "node plugin/scripts/build-plugin.mjs",
+    "build:redactor": "node plugin/scripts/build-redactor-pyz.mjs",
     "gen:joining-type": "node scripts/gen-joining-type.mjs",
     "gen:unicode": "node scripts/gen-unicode.mjs",
     "gen:gfm-autolink": "node scripts/gen-gfm-autolink.mjs",
     "gen:unicode-properties": "node scripts/gen-unicode-properties.mjs",
-    "gen:fail-open-lib": "node scripts/gen-fail-open-lib.mjs",
-    "gen:node-floor-lib": "node scripts/gen-node-floor-lib.mjs",
     "gen:hook-binaries": "node plugin/scripts/build-hook-binaries.mjs",
     "lint": "eslint .",
     "test:mutation": "node scripts/mutate.mjs",

package/types/claude-hooks/lib/knobs.d.mts

@@ -45,9 +45,9 @@ export function readKnob<K extends keyof Knobs>(name: K, env?: NodeJS.ProcessEnv
  * cannot reach (it runs its no-node arm on shell builtins alone).
  *
  * THE single source of truth for the closed set. The shell shims cannot import
- * it, so `plugin/scripts/lib/fail-open.sh` is GENERATED from it by
- * `scripts/gen-fail-open-lib.mjs` and committed; the round trip is asserted in
- * plugin/test/fail-open-parity.test.mjs. Everything else that spells the set
+ * it, so `plugin/scripts/lib/fail-open.sh` is GENERATED from it at build time
+ * by `scripts/gen-fail-open-lib.mjs`; plugin/test/fail-open-parity.test.mjs
+ * asserts the generated lib decides as failOpenEnabled(). Everything else that spells the set
  * out by hand is an implementation that must appear in the parity table in
  * tests/test_safe_launch.py.
  */