agent-sanitizer 2.67.2 → 2.68.0

package/THREAT-MODEL.md

@@ -298,16 +298,17 @@ plugin injects the Python engine from `agent-sanitizer[secrets]`
 (`python/agent_sanitizer/secrets/engine.py`) over a local daemon;
 `plugin/scripts/provision-redactor.sh` installs it at SessionStart.
 
-**It is the one fail-closed layer.** A redactor that throws — unreachable
-daemon, engine error — is rethrown from `sanitizeValue` as `CRITICAL: secret
-redaction failed …` (`src/output.mjs`).
-With the layer opted in, the output hook's fault policy (`alwaysClosed` in
-`claude-hooks/sanitize-output.mjs`, resolved in `lib/hook-fault.mjs`) then
-suppresses the output under **either** `AGENT_SANITIZER_FAIL_OPEN` posture —
-and so does any other fault of that hook, since an output the hook failed on
-was never vetted for secrets either. One accepted gap: a launcher-level failure
-(no `node`, corrupt bundle) never runs the policy, so the launcher's own
-posture applies there, warning by default.
+**A redactor fault follows the operator's posture.** A redactor that throws —
+unreachable daemon, engine error, spent budget — is rethrown from
+`sanitizeValue` as `CRITICAL: secret redaction failed …` (`src/output.mjs`), so
+the seam never returns unvetted text as if it were vetted. The output hook then
+answers it like any other fault, under `AGENT_SANITIZER_FAIL_OPEN`
+(`lib/hook-fault.mjs`, the one posture resolver, which has no per-hook override):
+open by default — the output reaches the model with an UNSANITIZED warning, and
+the operator's terminal names the redactor failure — and withheld under `=0`.
+Accepted risk of the default: while the redactor is down, a credential in tool
+output reaches the model unredacted. The alternative blocks every tool call on
+an availability failure, which is what a deployment chooses with `=0`.
 
 **Lone surrogates are normalized to U+FFFD before the redactor sees the text.**
 A secret split by an interposed lone surrogate renders as contiguous to the
@@ -608,9 +609,9 @@ RECONSTITUTES during stripping is judged as the sequence it becomes.
 Layer order: 1 → 2–3 → 4 → 5 → 4, the second Layer 4 a re-scan of what Layer 5's
 deletions left. Shape matters
 (a harness that gets a shape-mismatched value silently shows the raw output).
-Layer 4 (secret redaction) is an **injected** redactor and is the one
-fail-closed path: a redactor that throws makes the pipeline rethrow, so the
-caller suppresses the output rather than emit an unvetted value. That
+Layer 4 (secret redaction) is an **injected** redactor: a redactor that throws
+makes the pipeline rethrow rather than return an unvetted value, and the
+caller's posture decides whether the output is suppressed. That
 suppression (`suppressToolOutput`) replaces string leaves in place so the
 placeholder still matches the tool's shape, with one exception it must make: an
 Anthropic **content block** is collapsed whole to `{ type: "text", text: … }`
@@ -977,14 +978,13 @@ to hold precision. All other faults keep the open default, and
 
 **The open default is not enforceable against content.** Several of those
 failures are composable by whoever authored the payload — in the output hook
-alone, a nesting depth that overflows the sanitize walk and a redaction budget
-exhausted by many secret-shaped leaves — though with Layer 4 opted in, the
-output hook withholds on any fault whatever the knob says (see Layer 4). (A
-**key collision** — two field names that collapse to one after Layer 1 — used
-to be on that list. It no longer
-fails the hook at all: only the colliding fields are withheld, and every sibling
-field survives. Both colliding values are replaced **whole** by a marker string,
-not walked leaf-wise: a shape-preserving walk rewrites only string leaves, so a
+alone, a nesting depth that overflows the sanitize walk, a redaction budget
+exhausted by many secret-shaped leaves, and a payload large enough to blow the
+redactor daemon's scan budget. (A **key collision** — two field names that
+collapse to one after Layer 1 — does not fail the hook: only the colliding
+fields are withheld, and every sibling field survives. Both colliding values
+are replaced **whole** by a marker string, not walked leaf-wise: a
+shape-preserving walk rewrites only string leaves, so a
 colliding number or boolean would reach the model verbatim under a legitimate
 field name while the warning claimed it was withheld. That changes the field's
 JSON type, which is accepted because a duplicate name is off-schema by

package/claude-hooks/lib/env-config.mjs

@@ -15,7 +15,7 @@
  * esbuild inlines them into the plugin bundle (which ships with no config
  * directory beside it) and Node resolves them natively from the package when the
  * hooks run from source. Their VALIDATION stays lazy — a malformed credential
- * vocabulary throws on first use, inside the consuming hook's fail-closed catch,
+ * vocabulary throws on first use, inside the consuming hook's fault catch,
  * rather than at module load where a throw would abort before that catch installs
  * and let the harness pass the tool output through UNSANITIZED (fail OPEN).
  */
@@ -72,7 +72,7 @@ export function configureEnvConfigSource(source) {
 /**
  * The stored host source with its shape validated, or null when unconfigured.
  * Shape errors — a non-object source, a key this seam does not read — throw
- * HERE, on first use inside the consuming hook's fail-closed catch, never at
+ * HERE, on first use inside the consuming hook's fault catch, never at
  * configure time: a top-level throw in a bundle entry would kill the hook
  * before that catch installs (fail OPEN), and silently ignoring the problem
  * is worse — a typo'd `minSecretLength: 32` must not leave the helpers

package/claude-hooks/lib/hook-fault.mjs

@@ -85,41 +85,23 @@ export const FAULT_POLICY_HOOKS = Object.freeze([
  * The context a builder is handed: the caller's own inputs (whatever it passed
  * to {@link hookFaultOutcome}) plus the values every hook derived by hand
  * before — the hook name, the scrubbed error message, and the model-facing
- * open-posture warning — and `pinnedClosed`, true when the policy's
- * `alwaysClosed` overrode an open knob, so the closed arm can say why.
+ * open-posture warning.
  * @typedef {Record<string, any> & {
  *   hook: string,
  *   err: unknown,
  *   message: string,
  *   openContext: string,
- *   pinnedClosed: boolean,
  * }} FaultContext
  */
 
 /**
- * Whether a hook's faults are withheld whatever AGENT_SANITIZER_FAIL_OPEN says,
- * for the caller's environment.
- * @typedef {(
- *   env: NodeJS.ProcessEnv | Record<string, string | undefined> | undefined,
- * ) => boolean} AlwaysClosed
- */
-
-/**
- * The `alwaysClosed` of a hook whose posture the knob alone decides.
- * @type {AlwaysClosed}
- */
-export const KNOB_DECIDES = Object.freeze(() => false);
-
-/**
- * A hook's declared posture. `alwaysClosed` is REQUIRED, so every hook states
- * on the record whether the knob can open it: {@link KNOB_DECIDES}, or a
- * predicate that pins the CLOSED arm — how a guarantee the docs make
- * unconditionally (Layer 4 withholds what it could not vet) is enforced in the
- * one posture resolver rather than by a hook re-reading the knob.
+ * A hook's declared posture. There is deliberately no way for a policy to pin
+ * the CLOSED arm: AGENT_SANITIZER_FAIL_OPEN alone decides, so no hook fault can
+ * withhold a tool output or block a prompt unless the operator set the knob to
+ * `0`. A pin turns any bug in the guarded layer into every tool call failing.
  * @typedef {{
  *   event: string | null,
  *   guarded: string,
- *   alwaysClosed: AlwaysClosed,
  *   open?: (ctx: FaultContext) => FaultParts,
  *   closed: (ctx: FaultContext) => FaultParts,
  * }} FaultPolicy
@@ -143,12 +125,10 @@ export function registerFaultPolicy(hook, policy) {
     );
   // Checked here, not at fault time: a posture that is incomplete must fail the
   // import, never the one fault it was supposed to answer.
-  for (const arm of /** @type {const} */ (["alwaysClosed", "closed"]))
-    if (typeof policy[arm] !== "function")
-      throw new Error(
-        `fault policy for ${JSON.stringify(hook)} declares no \`${arm}\`; ` +
-          "every hook states it explicitly (KNOB_DECIDES for alwaysClosed)",
-      );
+  if (typeof policy.closed !== "function")
+    throw new Error(
+      `fault policy for ${JSON.stringify(hook)} declares no \`closed\` arm`,
+    );
   policies.set(hook, policy);
 }
 
@@ -190,8 +170,7 @@ export function defaultOpen(ctx) {
 /**
  * Resolve `hook`'s response to its own failure under the caller's posture. This
  * is the ONLY place {@link failOpenEnabled} is consulted on a hook fault, so the
- * knob cannot be honored in three hooks and skipped in the fourth — and the
- * only place a policy's `alwaysClosed` can override it.
+ * knob cannot be honored in three hooks and skipped in the fourth.
  * @param {string} hook
  * @param {unknown} err
  * @param {Record<string, any> & {
@@ -204,9 +183,7 @@ export function defaultOpen(ctx) {
  */
 export function hookFaultOutcome(hook, err, ctx = {}) {
   const policy = faultPolicy(hook);
-  const knobOpen = failOpenEnabled(ctx.env);
-  const pinnedClosed = knobOpen && policy.alwaysClosed(ctx.env);
-  const open = knobOpen && !pinnedClosed;
+  const open = failOpenEnabled(ctx.env);
   /** @type {FaultContext} */
   const full = {
     ...ctx,
@@ -214,7 +191,6 @@ export function hookFaultOutcome(hook, err, ctx = {}) {
     err,
     message: safeErrMessage(err),
     openContext: failOpenContext(hook, policy.guarded, err),
-    pinnedClosed,
   };
   const parts = (open ? (policy.open ?? defaultOpen) : policy.closed)(full);
   const fields = parts.fields ?? null;

package/claude-hooks/lib/hook-timing.mjs

@@ -17,8 +17,16 @@
  * EXTENSION it called ({@link chargeHostExtension}) — the redactor daemon and a
  * host callback's subprocess or socket peer are separate processes whose CPU this
  * one cannot see (see {@link processCpuMs}), so the call that waits for each is
- * the only measurable stand-in. The notice GATES on none of them: a hook wedged
- * on a dead redactor socket burns no CPU and is exactly the sanitizer's fault.
+ * the only measurable stand-in. A caller that supplies the CPU and redactor
+ * figures is reported only when the share its owner answers for — CPU plus
+ * redactor round trips plus host extensions — itself exceeds the budget; wall
+ * time past that is the machine's, and neither a notice nor a report request is
+ * the answer to it. Redactor wait counts toward that share, so a hook wedged on a
+ * dead redactor socket (no CPU, all wait) is still reported. A wait on a
+ * subprocess this package spawns itself (a `git` probe, a lock) is charged to
+ * no window, so it reads as the machine's and goes unreported — the accepted
+ * cost of never blaming the sanitizer for a loaded host. A caller that supplies
+ * no attribution is gated on wall-clock alone.
  *
  * The host-extension window is what turned "blocked on something outside the
  * sanitizer" — a verdict nobody can act on — into a named callee: a composer's
@@ -598,6 +606,11 @@ export function startHookTimer(now = Date.now, cpuNow = processCpuMs) {
  * The CPU, redactor and host shares overlap by the framing this side does
  * mid-round-trip and mid-callback, so they do not sum to the elapsed time; a
  * share that dominates despite the overlap is still the one to act on.
+ *
+ * Reached only for a run whose owned share already exceeds the budget
+ * ({@link slowHookNotice}), so the "none of them" verdict means the unmeasured
+ * remainder is larger than a share that is itself over budget — not that the
+ * hook's own cost was small.
  * @param {number} elapsedMs
  * @param {number} cpuMs
  * @param {number} redactorMs
@@ -646,10 +659,15 @@ function attributeWait(elapsedMs, cpuMs, redactorMs, hostMs, owner) {
  * sanitizer computing, and with `context.redactorMs` too it names the window the
  * time went into ({@link attributeWait}), including `context.hostMs`'s host
  * extensions — a caller that measured the first two but has no extensions to
- * charge reports that window as zero, which is a measurement and not a shrug. Without them the line says that it cannot
- * tell, rather than asserting an attribution nothing measured: a wall-clock
- * overrun on a loaded host is the common case, and blaming it on the sanitizer
- * sends the operator hunting a per-call cost that does not exist.
+ * charge reports that window as zero, which is a measurement and not a shrug.
+ * Such a caller is reported only when `cpuMs + redactorMs + hostMs` (an absent
+ * `hostMs` counting as 0) exceeds `thresholdMs`: a wall-clock overrun whose
+ * owned share is within the budget is the machine's and returns null, so the
+ * operator is never asked to report a cost the owner did not spend. Without the
+ * measurements the line says that it cannot tell, rather than asserting an
+ * attribution nothing measured: a wall-clock overrun on a loaded host is the
+ * common case, and blaming it on the sanitizer sends the operator hunting a
+ * per-call cost that does not exist.
  *
  * A CPU figure alone cannot pick a cause, so with only that the clause names
  * candidates and commits to none. A hook that blocks on a dead socket inside a
@@ -684,6 +702,8 @@ export function slowHookNotice(
   // number, including when it is 0.
   const hostMs =
     typeof context?.hostMs === "number" ? context.hostMs : undefined;
+  if (attributed && cpuMs + redactorMs + (hostMs ?? 0) <= thresholdMs)
+    return null;
   const owner = noticeOwner(context?.reportTo, version);
   const attribution = attributed
     ? attributeWait(elapsedMs, cpuMs, redactorMs, hostMs, owner)

package/claude-hooks/lib/redactor-client.mjs

@@ -6,9 +6,9 @@
  * request is just a scan. detect-secrets stays the one and only detection engine
  * — this module never inspects the text itself.
  *
- * Fail-closed, per call only: a connection/protocol/scan failure throws so the
- * caller suppresses THAT output; it sets no session-wide state, so the next call
- * retries from scratch. If the socket is absent or dead we (re)spawn the daemon
+ * Per call only: a connection/protocol/scan failure throws, and the caller
+ * answers THAT output under its fault posture; it sets no session-wide state,
+ * so the next call retries from scratch. If the socket is absent or dead we (re)spawn the daemon
  * once and retry — a crashed daemon self-heals on the next redaction.
  *
  * Wire protocol: python/agent_sanitizer/secrets/data/redactor-protocol.json,
@@ -54,7 +54,7 @@ const DAEMON_REASON = /^[\x20-\x7e]{1,200}$/u;
 export { positiveMsOr } from "./knobs.mjs";
 
 // sun_path is 104 bytes on macOS (108 on Linux), NUL included; a longer path
-// makes the daemon's bind() fail and every call fail closed. The daemon binds
+// makes the daemon's bind() fail and every call fault. The daemon binds
 // "." + 16 hex digits before renaming onto "redactor.sock", so the longer
 // 17-byte name is what must fit.
 const SOCKET_PATH_MAX = 103;
@@ -100,7 +100,7 @@ export const DEFAULT_SOCKET_PATH = resolveSocketPath(process.env, currentUid());
  *
  * 1. `_AGENT_SANITIZER_REDACTOR_DAEMON` — authoritative when set (the launcher
  *    sets it to the provisioned venv's console script when one exists, and
- *    tests point it at dead paths to drive the fail-closed arm; a fallback
+ *    tests point it at dead paths to drive the fault arm; a fallback
  *    from an explicit setting would turn those arms into silent passes).
  * 2. The shipped self-contained zipapp (`plugin/dist/redactor/daemon.pyz`) —
  *    the guaranteed floor: it needs only a python3 on PATH, so a cold start
@@ -126,20 +126,20 @@ function daemonCommand() {
 }
 // How long to wait for a freshly-spawned daemon to start accepting. A cold start
 // pays the detect-secrets import + plugin prime (~1-3s), so the default leaves
-// margin; tests shorten it to exercise the give-up-and-fail-closed path quickly.
+// margin; tests shorten it to exercise the give-up path quickly.
 const WAIT_DEADLINE_MS = readKnob("_AGENT_SANITIZER_REDACTOR_WAIT_MS");
 
-// A daemon that ACCEPTS the connection but then stalls — a deadlock, a
-// pathological detect-secrets input, or a half-written length prefix that never
-// completes — emits none of the errno codes isRespawnable reacts to and never
-// closes, so without a deadline connectAndRequest's Promise never settles.
-// redactViaDaemon (the required, fail-closed Layer 4) would then hang until
-// Claude Code kills the PostToolUse hook at its own timeout, and a killed hook is
-// non-blocking — so the RAW, unredacted tool output is shown (the exact fail-open
-// this layer exists to prevent). The total per-connect deadline below makes a
-// stall reject, so the caller fails closed. It stays comfortably under the hook
-// timeout (two connects + the spawn wait must fit); tests shorten it via the env
-// override (read per call) or the deadlineMs parameter to exercise the path fast.
+/**
+ * The total per-connect deadline. A daemon that ACCEPTS and then stalls — a
+ * deadlock, a pathological detect-secrets input, a length prefix that never
+ * completes — emits no errno isRespawnable reacts to and never closes, so
+ * without it connectAndRequest never settles and the PostToolUse hook is killed
+ * at its timeout, which shows the RAW output with no warning. A stall instead
+ * rejects, and the caller's fault posture answers it, warning included. Two
+ * connects plus the spawn wait must fit under the hook timeout. Read per call,
+ * so tests shorten it through the env override (or the deadlineMs parameter).
+ * @returns {number}
+ */
 function requestDeadlineMs() {
   return readKnob("_AGENT_SANITIZER_REDACTOR_REQUEST_MS");
 }
@@ -270,9 +270,9 @@ export function classifySocket(socketPath, deps = {}) {
  * by us or by root, carrying no group/other write bit.
  *
  * This refusal is what blocks a co-tenant unlinking our socket and binding their
- * own listener that answers "nothing to redact" to every payload, which would flip
- * the fail-CLOSED redactor to fail-OPEN and leak unscrubbed secrets to the
- * transcript.
+ * own listener that answers "nothing to redact" to every payload, which would turn
+ * a loud fault into a silent "nothing to redact" and leak unscrubbed secrets to
+ * the transcript.
  *
  * Root ownership is trusted because it is strictly stronger than our own, not a
  * concession: a deployment may hand the socket dir to root after the daemon has
@@ -291,9 +291,9 @@ function isTrustedSocketDir(dir, uid) {
 /**
  * Open one connection, send `request`, resolve with the parsed response object
  * (or null). Rejects on connect failure, a malformed/oversize/short frame, or an
- * {error} response — every one of which the caller turns into a fail-closed. A
+ * {error} response — every one of which the caller treats as a fault. A
  * socket present but not owned by us, and a request the protocol does not
- * accept, fail closed WITHOUT dialing (the error carries no errno, so
+ * accept, throw WITHOUT dialing (the error carries no errno, so
  * isRespawnable is false): we never dial into a squat, and an oversize request
  * is not mistaken for a dead daemon worth respawning.
  * @param {string} socketPath
@@ -484,7 +484,7 @@ function canConnect(socketPath) {
 /**
  * Redact `text` via the daemon. Returns the response object (`{text, found}` for
  * plain, `{text, pairs, found}` / `{unmappable}` for map) or null when nothing was
- * redacted (plain mode). Throws to fail closed when the text cannot be vetted.
+ * redacted (plain mode). Throws when the text cannot be vetted.
  *
  * `connect`/`spawn`/`waitForSocket` are injectable seams (default to the real
  * implementations) so callers can stub the daemon in-process. `deadline` is the

package/claude-hooks/lib/secret-annotate.mjs

@@ -17,70 +17,25 @@ import charset from "../../python/agent_sanitizer/data/invisible-charset.json" w
 // Invisible characters an attacker can splice between a value's characters to
 // break an exact-substring pre-gate while the daemon's redactor still matches
 // across them. Built from the SAME pinned charset Layer 1 strips and the daemon
-// tolerates (`invisible_run_pattern` in agent_sanitizer.secrets.invisible
-// builds the same shape from the same set), not a hand-curated subset: a subset
-// pre-gate silently under-matches whenever this gate runs on text Layer 1 has
-// not already stripped (the module is exported and callable on its own), and a
-// value spliced with a code point in the gap then never reaches the daemon at
-// all. A run of zero-or-more is allowed at each interior gap, so the plain
-// value still matches (a superset of `includes`). The required literals between
-// every gap are what bound the match — a `*` gap is never adjacent to another
-// gap, so there is no ambiguity to backtrack over and no ReDoS. (The class size
-// is irrelevant to that: a character class matches in O(1) whether it holds one
-// member or all 435.) That argument holds only while no literal is itself a
-// member of the class, so {@link envValueRegex} drops the value's own invisible
-// code points before it splices: `a<ZWSP>a` would otherwise build
-// `a[…]*<ZWSP>[…]*a`, whose two stars share the literal and backtrack
-// quadratically over a long run of ZWSP.
-const ENV_INVIS_CODEPOINTS = [
-  ...new Set([...charset.cf_codepoints, ...charset.extra_codepoints]),
-].sort((a, b) => a - b);
-const ENV_INVIS_SET = new Set(ENV_INVIS_CODEPOINTS);
-const ENV_INVIS_RUN =
+// tolerates (`_env_value_spans` in agent_sanitizer.secrets.engine), not
+// a hand-curated subset: a subset pre-gate silently under-matches whenever this
+// gate runs on text Layer 1 has not already stripped, and a value spliced with a
+// code point in the gap then never reaches the daemon at all.
+const ENV_INVIS_RE = new RegExp(
   "[" +
-  ENV_INVIS_CODEPOINTS.map((cp) => `\\u{${cp.toString(16)}}`).join("") +
-  "]*";
-
-/** @param {string} ch */
-const escapeLiteral = (ch) => ch.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    [...new Set([...charset.cf_codepoints, ...charset.extra_codepoints])]
+      .map((cp) => `\\u{${cp.toString(16)}}`)
+      .join("") +
+    "]",
+  "gu",
+);
 
 /**
- * Regex matching `value` tolerating invisible chars spliced between its
- * characters (mirrors the engine's env-value regex). Code-point split so
- * an astral character is escaped whole, not as two surrogate halves — and the
- * `u` flag, which the astral `\u{…}` class members in {@link ENV_INVIS_RUN}
- * require.
- * Memoized per distinct value: {@link ENV_INVIS_RUN} renders ~435 code points
- * as ~4 KB of source and is joined at EVERY interior gap, so a 20-char secret
- * compiles a ~75 KB pattern — and `hasEnvBoundSecret` builds one per configured
- * var on every PostToolUse output. Env values are stable for the process's
- * lifetime, so the cache is bounded by the number of distinct values. Sharing an
- * instance is safe because the regex carries no `g`/`y` flag, hence no
- * `lastIndex` state to leak between calls.
- * @param {string} value
- * @returns {RegExp}
+ * `s` with every charset invisible removed.
+ * @param {string} s
+ * @returns {string}
  */
-export function envValueRegex(value) {
-  let re = ENV_VALUE_REGEX_CACHE.get(value);
-  if (re === undefined) {
-    const visible = [...value].filter(
-      (ch) => !ENV_INVIS_SET.has(/** @type {number} */ (ch.codePointAt(0))),
-    );
-    // A value made only of invisibles has no literal to anchor a gap on: match
-    // it exactly rather than build a pattern that is nothing but gaps.
-    re = new RegExp(
-      visible.length > 0
-        ? visible.map(escapeLiteral).join(ENV_INVIS_RUN)
-        : [...value].map(escapeLiteral).join(""),
-      "u",
-    );
-    ENV_VALUE_REGEX_CACHE.set(value, re);
-  }
-  return re;
-}
-
-/** value → compiled matcher; see {@link envValueRegex}. */
-const ENV_VALUE_REGEX_CACHE = new Map();
+const stripInvisibles = (s) => s.replace(ENV_INVIS_RE, "");
 
 /**
  * True when tool output contains the literal value of a configured env-bound
@@ -88,19 +43,34 @@ const ENV_VALUE_REGEX_CACHE = new Map();
  * credential, so the pre-gate must also fire on the value itself — otherwise
  * the engine's env-bound redaction never runs. Invisible-tolerant so a
  * value with spliced Cf chars (which the daemon still redacts) trips it too.
+ *
+ * Both sides are stripped and compared as substrings, which is exactly
+ * equivalent: the value's visible characters appear contiguously in the
+ * stripped text iff they appear in the original separated only by invisibles.
+ * It is linear and independent of the value's length — a regex with an
+ * invisible class at every gap grows ~4 KB per character, and a long secret (a
+ * PEM key) overflows V8's regex size limit and throws on every output.
+ *
+ * Callers pass post-Layer-1 text: terminal escapes are already gone, so a value
+ * split by one is contiguous here. Raw text spliced with an escape is not
+ * matched.
  * @param {string} text
  * @param {NodeJS.ProcessEnv} [env]
  * @returns {boolean}
  */
 export function hasEnvBoundSecret(text, env = process.env) {
   const minLen = minEnvSecretLen();
+  /** @type {string | undefined} */
+  let strippedText;
   return envBoundSecretVars(env).some((name) => {
     const value = env[name];
-    // Code-point length to match envValueRegex's code-point split — an astral
-    // char counts once, not as two UTF-16 units, so minLen means the same thing
-    // on both sides of the gate.
-    return (
-      value && [...value].length >= minLen && envValueRegex(value).test(text)
-    );
+    // Code-point length, so an astral char counts once, not as two UTF-16 units.
+    if (!value || [...value].length < minLen) return false;
+    const needle = stripInvisibles(value);
+    // A value made only of invisibles has no visible character to anchor on:
+    // match it exactly rather than as the empty string, which matches anything.
+    if (needle === "") return text.includes(value);
+    strippedText ??= stripInvisibles(text);
+    return strippedText.includes(needle);
   });
 }

package/claude-hooks/plugin-hooks.mjs

@@ -26,7 +26,6 @@ import {
 } from "./lib/hook-io.mjs";
 import {
   registerFaultPolicy,
-  KNOB_DECIDES,
   hookFaultOutcome,
   writeFaultOutcome,
 } from "./lib/hook-fault.mjs";
@@ -55,7 +54,6 @@ const unknownMode = (/** @type {{ message: string }} */ ctx) => ({
 registerFaultPolicy(HOOK_NAME, {
   event: null,
   guarded: "hook payload",
-  alwaysClosed: KNOB_DECIDES,
   open: unknownMode,
   closed: unknownMode,
 });
@@ -90,7 +88,7 @@ const LAZY_LOADERS = {
  * as a non-blocking hook error and shows the raw tool output. That is a
  * fail-OPEN on the very hook that withholds secrets. Registering what resolves
  * and leaving the rest absent hands the gap to each hook's own lazyImport
- * guard, whose posture is to block.
+ * guard, which answers it loudly under the operator's fault posture.
  * @returns {Promise<void>}
  */
 async function registerAvailableModules() {

package/claude-hooks/pretooluse-sanitize.mjs

@@ -44,7 +44,6 @@ import {
 } from "./lib/hook-io.mjs";
 import {
   registerFaultPolicy,
-  KNOB_DECIDES,
   hookFaultOutcome,
   defaultOpen,
 } from "./lib/hook-fault.mjs";
@@ -845,7 +844,6 @@ export function hookFailureFields(parsedOk, err, opts = {}) {
 registerFaultPolicy(HOOK_NAME, {
   event: HookEvent.PRE_TOOL_USE,
   guarded: "tool input",
-  alwaysClosed: KNOB_DECIDES,
   open: (ctx) => {
     // Non-carve-out faults take the SHARED open rendering, not a copy of it —
     // hook-fault.mjs owns that body, and a restated one would silently drift.

package/claude-hooks/sanitize-output.mjs

@@ -50,11 +50,7 @@ import { registerFaultPolicy, hookFaultOutcome } from "./lib/hook-fault.mjs";
 import { controlPlane, runJudgeCli } from "./lib/control-plane.mjs";
 import { hookTrace, TraceEvent } from "./lib/trace.mjs";
 import { hasEnvBoundSecret } from "./lib/secret-annotate.mjs";
-import {
-  digestFlaggingEnabled,
-  secretsEnabled,
-  SECRETS_ENABLED_ENV,
-} from "./lib/env-config.mjs";
+import { digestFlaggingEnabled, secretsEnabled } from "./lib/env-config.mjs";
 import {
   persistReveal,
   persistSpan,
@@ -120,16 +116,17 @@ const HOOK_NAME = "sanitize-output";
 // reaches the model-facing context. Exported so tests assert it by reference.
 export const REVEAL_WITHHELD_WARNING = withheldWarning("reveal sidecar");
 
-// Total wall-clock budget for one hook invocation's blocking daemon calls — the
-// Layer-4 redactor — SHARED across every string leaf of the tool output. Each
-// call is handed the budget remaining at that moment; once it is spent, a further
-// secret-shaped leaf fails CLOSED (the redactor throws → the output is
-// suppressed). The per-call timeouts already bound each call, but not their SUM:
-// a structured output with many secret-shaped leaves could otherwise pile up past
-// the PostToolUse hook kill — a killed hook is non-blocking, so the RAW output
-// would be shown (fail OPEN). The default sits comfortably above one legitimately
-// slow leaf (a cold redactor respawn + a full scan) yet far under the hook
-// timeout; env-tunable so tests can drive the exhausted-budget path fast.
+/**
+ * Total wall-clock budget for one hook invocation's blocking Layer-4 redactor
+ * calls, SHARED across every string leaf of the tool output. Each call gets the
+ * budget remaining at that moment; once it is spent, a further secret-shaped
+ * leaf throws, answered under the operator's fault posture. The per-call
+ * timeouts bound each call but not their SUM, and a structured output with many
+ * secret-shaped leaves could otherwise run past the PostToolUse hook kill,
+ * which shows the RAW output with no warning. The default sits above one slow
+ * leaf (a cold redactor respawn plus a full scan) and far under the hook
+ * timeout; env-tunable so tests can drive the exhausted-budget path fast.
+ */
 const SANITIZE_BUDGET_MS = readKnob("_AGENT_SANITIZER_SANITIZE_BUDGET_MS");
 
 // Web-ingress tools always get the Layer 2 HTML rewrite; local tools — Read,
@@ -172,11 +169,13 @@ function isUntrustedIngress(toolName) {
 
 /**
  * Redact secrets via the long-lived redactor daemon (lib/redactor-client.mjs).
- * Returns `{text, found}` or null when nothing was redacted; throws (fail closed)
- * when secret-shaped text cannot be vetted, which the caller turns into
- * suppression. The cheap pre-gate runs first so plain output never touches the
- * daemon. A transient daemon failure fails only THIS call — no session-wide
- * sentinel — and the client respawns a dead daemon on the next call.
+ * Returns `{text, found}` or null when nothing was redacted; throws when
+ * secret-shaped text cannot be vetted, which the CLI answers under the
+ * operator's fault posture. The cheap pre-gate runs first so plain output never
+ * touches the daemon. `text` is post-Layer-1, so it carries no terminal escape
+ * and the pre-gate needs no escape-stripped view. A transient daemon failure
+ * fails only THIS call — no session-wide sentinel — and the client respawns a
+ * dead daemon on the next call.
  * @param {string} text
  * @param {boolean} webIngress
  * @param {{remainingMs: () => number}} [deadline] shared wall-clock budget
@@ -288,9 +287,9 @@ export async function sanitizeText(
     // Layer 4 — OPT-IN (`secretsOn`): with the knob unset the seam gets no
     // redact callback at all, so plain output never spawns the daemon and no
     // placeholder ever enters the model's view. When it runs, the seam rethrows
-    // a redactor throw wrapped, and this hook's fault policy suppresses the
-    // output under either posture (alwaysClosed). Surface the failure to the
-    // operator's terminal here first: the suppression note rides in what only
+    // a redactor throw wrapped, and this hook's fault policy answers it under
+    // the operator's AGENT_SANITIZER_FAIL_OPEN posture. Surface the failure to
+    // the operator's terminal here first: the fault note rides in what only
     // the model sees, so a degraded redactor would otherwise be invisible to
     // the human.
     redact: !secretsOn
@@ -579,7 +578,7 @@ function failClosedParts(
  * fail-OPEN by default — a warning context and NO `updatedToolOutput`, leaving
  * the original tool output in the model's view — or the fail-closed
  * suppression of {@link emitFailClosed} when the caller set
- * AGENT_SANITIZER_FAIL_OPEN=0, or opted into Layer 4 (see the policy below).
+ * AGENT_SANITIZER_FAIL_OPEN=0.
  *
  * This is the hook where the two postures diverge the most, so state the open
  * one plainly: several of these layers throw on inputs an attacker composes (a
@@ -625,29 +624,17 @@ function suppressionMessage(cause) {
   return `[SANITIZATION FAILED — original output suppressed for safety. Hook error: ${cause}]`;
 }
 
-/** Why an open knob still suppressed: the secret layer's own guarantee. */
-const SECRETS_PIN_NOTE =
-  ` Secret redaction is on (${SECRETS_ENABLED_ENV}=1), so output it could ` +
-  "not vet is withheld under either AGENT_SANITIZER_FAIL_OPEN posture.";
-
 // This hook's entry in the one posture table (lib/hook-fault.mjs). OPEN is the
 // shared default (a warning context, the original output left in the model's
 // view); CLOSED replaces every string leaf of the output with the placeholder.
-// With Layer 4 opted in, a fault here means the output was never vetted for
-// secrets — a dead daemon, a spent budget, a walk that overflowed before the
-// redactor ran — so this pin is what keeps the open default from handing an
-// unredacted credential to the model.
+// Layer 4 follows the same knob: a redactor that cannot run (a dead daemon, a
+// spent budget) leaves the output unvetted and says so, rather than blocking
+// every tool call on an availability failure.
 registerFaultPolicy(HOOK_NAME, {
   event: HookEvent.POST_TOOL_USE,
   guarded: "tool output",
-  alwaysClosed: secretsEnabled,
   closed: (ctx) =>
-    failClosedParts(
-      ctx.input,
-      suppressionMessage(ctx.message) +
-        (ctx.pinnedClosed ? SECRETS_PIN_NOTE : ""),
-      ctx.remedy,
-    ),
+    failClosedParts(ctx.input, suppressionMessage(ctx.message), ctx.remedy),
 });
 
 /**

package/claude-hooks/sanitize-user-prompt.mjs

@@ -28,7 +28,6 @@ import {
 } from "./lib/hook-io.mjs";
 import {
   registerFaultPolicy,
-  KNOB_DECIDES,
   hookFaultOutcome,
   writeFaultOutcome,
 } from "./lib/hook-fault.mjs";
@@ -86,7 +85,6 @@ const HOOK_NAME = "sanitize-user-prompt";
 registerFaultPolicy(HOOK_NAME, {
   event: HookEvent.USER_PROMPT_SUBMIT,
   guarded: "prompt",
-  alwaysClosed: KNOB_DECIDES,
   closed: (ctx) => ({
     envelope: {
       decision: "block",

package/claude-hooks/scan-invisible-chars.mjs

@@ -39,7 +39,6 @@ import {
 } from "./lib/hook-io.mjs";
 import {
   registerFaultPolicy,
-  KNOB_DECIDES,
   hookFaultOutcome,
   writeFaultOutcome,
 } from "./lib/hook-fault.mjs";
@@ -166,7 +165,6 @@ function faultLine(ctx) {
 registerFaultPolicy(HOOK_NAME, {
   event: HookEvent.SESSION_START,
   guarded: "instruction files",
-  alwaysClosed: KNOB_DECIDES,
   open: (ctx) => ({
     stderr: `${faultLine(ctx)} Passing through unguarded; set AGENT_SANITIZER_FAIL_OPEN=0 to arm the tool-call gate instead.\n`,
     exitCode: 1,

package/claude-hooks/scan-loaded-instructions.mjs

@@ -32,7 +32,6 @@ import {
 } from "./lib/hook-io.mjs";
 import {
   registerFaultPolicy,
-  KNOB_DECIDES,
   hookFaultOutcome,
   writeFaultOutcome,
 } from "./lib/hook-fault.mjs";
@@ -123,7 +122,6 @@ function emptyPayloadParts(ctx) {
 registerFaultPolicy(HOOK_NAME, {
   event: HookEvent.INSTRUCTIONS_LOADED,
   guarded: "a loaded instruction file",
-  alwaysClosed: KNOB_DECIDES,
   open: (ctx) =>
     emptyPayloadParts(ctx) ?? {
       stderr: `${faultLine(ctx)} Passing through unguarded; set AGENT_SANITIZER_FAIL_OPEN=0 to arm the tool-call gate instead.\n`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.67.2",
+  "version": "2.68.0",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/src/output.mjs

@@ -174,18 +174,19 @@ function mutate(state, text, report) {
  * Run Layer 4 (`options.redact`, when set) over the state's current text and
  * fold any finding back in. The single Layer-4 invocation site FOR THE PIPELINE
  * STATE: the first pass and the re-run after a span deletion are the same call,
- * so they share one fail-closed handling, warning prose and invariants.
+ * so they share one throw-on-fault handling, warning prose and invariants.
  *
  * One other site runs Layer 4 deliberately: {@link vetStageValue}, which vets a
  * stage value on its way out and has no `PipelineState` to fold a finding into.
  * It shares the post-redaction invariant (normalize what the redactor's own
- * output may have stranded) but NOT the fail-closed policy — it withholds the
- * one field rather than suppressing the whole output. Adding a third site means
+ * output may have stranded) but NOT the fault handling — it withholds the one
+ * field instead of throwing. Adding a third site means
  * re-deciding both halves, so route through one of these two instead.
  *
- * Fails CLOSED: a redactor we could not run might have let a secret through, so
- * the throw is rethrown wrapped and the caller suppresses the output rather than
- * emitting an unvetted value with a warning.
+ * Throws rather than returning unvetted text: a redactor we could not run might
+ * have let a secret through, so the seam never hands back a value as if it were
+ * vetted. The throw is rethrown wrapped and the CALLER's fault posture decides
+ * what reaches the model (the Claude Code hooks: AGENT_SANITIZER_FAIL_OPEN).
  * @param {PipelineState} state
  * @param {SanitizeTextOptions} options
  * @returns {Promise<void>}
@@ -200,7 +201,7 @@ async function runRedact(state, options) {
   } catch (l4err) {
     throw new Error(
       `CRITICAL: secret redaction failed (${errMessage(l4err)}). ` +
-        "Failing closed — tool output suppressed.",
+        "This text was not vetted for secrets.",
       { cause: l4err },
     );
   }
@@ -599,8 +600,8 @@ async function vetStageValue(text, redact, findings, label) {
     return secrets ? normalizeLoneSurrogates(secrets.text) : text;
   } catch {
     // A WARNING: the caller asked for this field and is not getting it, and the
-    // reason is an unrunnable redactor — the same fault that fails `cleaned`
-    // closed, just with a survivable remedy here.
+    // reason is an unrunnable redactor — the same fault that makes `cleaned`
+    // throw, just with a survivable remedy here.
     findings.push(warning(withheldWarning(label)));
     return undefined;
   }
@@ -629,11 +630,10 @@ async function vetStageValue(text, redact, findings, label) {
 
 /**
  * Run the configured layers over a single text blob. Layer 1 always runs; the
- * rest are opt-in via `options`. Layer 4 (`redact`) is the fail-closed path: a
- * redactor that throws is rethrown wrapped, so the caller suppresses the
- * output rather than emitting an unvetted value. That fail-closed behavior
- * also applies to Layer 4's re-scan after a Layer-5 span deletion (see Layer
- * 5, below) — a redactor failure there fails the whole call closed too.
+ * rest are opt-in via `options`. A Layer 4 (`redact`) redactor that throws is
+ * rethrown wrapped, so the caller answers it under its fault posture rather
+ * than receiving unvetted text as vetted. The same holds for Layer 4's re-scan
+ * after a Layer-5 span deletion (see Layer 5, below).
  * `reveal` is the pre-Layer-2 text, present only when the HTML splice removed
  * bytes, so a caller can persist what was hidden for later inspection (see
  * {@link applyMarkdownPipeline}); the field is omitted otherwise, and also when
@@ -677,7 +677,7 @@ export async function sanitizeText(text, options = {}) {
   const { reveal: revealText, splices: stageSplices } =
     await applyMarkdownPipeline(state, options);
 
-  // Layer 4 — fail closed (see runRedact).
+  // Layer 4 — throws on a redactor fault (see runRedact).
   await runRedact(state, options);
 
   // Layer 5 — secure span-deletion slot (see module doc). A warning-only result

package/types/claude-hooks/lib/hook-fault.d.mts

@@ -32,8 +32,7 @@ export function defaultOpen(ctx: FaultContext): FaultParts;
 /**
  * Resolve `hook`'s response to its own failure under the caller's posture. This
  * is the ONLY place {@link failOpenEnabled} is consulted on a hook fault, so the
- * knob cannot be honored in three hooks and skipped in the fourth — and the
- * only place a policy's `alwaysClosed` can override it.
+ * knob cannot be honored in three hooks and skipped in the fourth.
  * @param {string} hook
  * @param {unknown} err
  * @param {Record<string, any> & {
@@ -65,63 +64,6 @@ export function writeFaultOutcome(outcome: FaultOutcome, write?: (chunk: string)
  * @type {readonly string[]}
  */
 export const FAULT_POLICY_HOOKS: readonly string[];
-/**
- * What a hook's fault renders to. `fields`/`envelope` are the stdout response
- * (`fields` is the `hookSpecificOutput` body, wrapped with the policy's event;
- * `envelope` is a hook that answers with a top-level shape instead, like
- * UserPromptSubmit's `{decision:"block"}`); `stderr` and `exitCode` are the
- * process-level halves a hook with no stdout channel uses; `armAlert` asks the
- * caller to persist its cross-hook alert so a LATER gate carries the closed
- * posture the faulting hook could not express itself.
- * @typedef {{
- *   posture: "open" | "closed",
- *   fields: Record<string, unknown> | null,
- *   fallbackFields: Record<string, unknown> | null,
- *   envelope: object | null,
- *   stderr: string | null,
- *   exitCode: number,
- *   armAlert: boolean,
- * }} FaultOutcome
- */
-/**
- * What a policy's `open`/`closed` builder returns: any subset of a
- * {@link FaultOutcome}'s renderable slots. Everything omitted takes its default
- * (no output, exit 0, no alert).
- * @typedef {{
- *   fields?: Record<string, unknown>,
- *   fallbackFields?: Record<string, unknown>,
- *   envelope?: object,
- *   stderr?: string,
- *   exitCode?: number,
- *   armAlert?: boolean,
- * }} FaultParts
- */
-/**
- * The context a builder is handed: the caller's own inputs (whatever it passed
- * to {@link hookFaultOutcome}) plus the values every hook derived by hand
- * before — the hook name, the scrubbed error message, and the model-facing
- * open-posture warning — and `pinnedClosed`, true when the policy's
- * `alwaysClosed` overrode an open knob, so the closed arm can say why.
- * @typedef {Record<string, any> & {
- *   hook: string,
- *   err: unknown,
- *   message: string,
- *   openContext: string,
- *   pinnedClosed: boolean,
- * }} FaultContext
- */
-/**
- * Whether a hook's faults are withheld whatever AGENT_SANITIZER_FAIL_OPEN says,
- * for the caller's environment.
- * @typedef {(
- *   env: NodeJS.ProcessEnv | Record<string, string | undefined> | undefined,
- * ) => boolean} AlwaysClosed
- */
-/**
- * The `alwaysClosed` of a hook whose posture the knob alone decides.
- * @type {AlwaysClosed}
- */
-export const KNOB_DECIDES: AlwaysClosed;
 /**
  * What a hook's fault renders to. `fields`/`envelope` are the stdout response
  * (`fields` is the `hookSpecificOutput` body, wrapped with the policy's event;
@@ -157,32 +99,23 @@ export type FaultParts = {
  * The context a builder is handed: the caller's own inputs (whatever it passed
  * to {@link hookFaultOutcome}) plus the values every hook derived by hand
  * before — the hook name, the scrubbed error message, and the model-facing
- * open-posture warning — and `pinnedClosed`, true when the policy's
- * `alwaysClosed` overrode an open knob, so the closed arm can say why.
+ * open-posture warning.
  */
 export type FaultContext = Record<string, any> & {
     hook: string;
     err: unknown;
     message: string;
     openContext: string;
-    pinnedClosed: boolean;
 };
 /**
- * Whether a hook's faults are withheld whatever AGENT_SANITIZER_FAIL_OPEN says,
- * for the caller's environment.
- */
-export type AlwaysClosed = (env: NodeJS.ProcessEnv | Record<string, string | undefined> | undefined) => boolean;
-/**
- * A hook's declared posture. `alwaysClosed` is REQUIRED, so every hook states
- * on the record whether the knob can open it: {@link KNOB_DECIDES}, or a
- * predicate that pins the CLOSED arm — how a guarantee the docs make
- * unconditionally (Layer 4 withholds what it could not vet) is enforced in the
- * one posture resolver rather than by a hook re-reading the knob.
+ * A hook's declared posture. There is deliberately no way for a policy to pin
+ * the CLOSED arm: AGENT_SANITIZER_FAIL_OPEN alone decides, so no hook fault can
+ * withhold a tool output or block a prompt unless the operator set the knob to
+ * `0`. A pin turns any bug in the guarded layer into every tool call failing.
  */
 export type FaultPolicy = {
     event: string | null;
     guarded: string;
-    alwaysClosed: AlwaysClosed;
     open?: (ctx: FaultContext) => FaultParts;
     closed: (ctx: FaultContext) => FaultParts;
 };

package/types/claude-hooks/lib/hook-timing.d.mts

@@ -170,10 +170,15 @@ export function startHookTimer(now?: () => number, cpuNow?: () => number): {
  * sanitizer computing, and with `context.redactorMs` too it names the window the
  * time went into ({@link attributeWait}), including `context.hostMs`'s host
  * extensions — a caller that measured the first two but has no extensions to
- * charge reports that window as zero, which is a measurement and not a shrug. Without them the line says that it cannot
- * tell, rather than asserting an attribution nothing measured: a wall-clock
- * overrun on a loaded host is the common case, and blaming it on the sanitizer
- * sends the operator hunting a per-call cost that does not exist.
+ * charge reports that window as zero, which is a measurement and not a shrug.
+ * Such a caller is reported only when `cpuMs + redactorMs + hostMs` (an absent
+ * `hostMs` counting as 0) exceeds `thresholdMs`: a wall-clock overrun whose
+ * owned share is within the budget is the machine's and returns null, so the
+ * operator is never asked to report a cost the owner did not spend. Without the
+ * measurements the line says that it cannot tell, rather than asserting an
+ * attribution nothing measured: a wall-clock overrun on a loaded host is the
+ * common case, and blaming it on the sanitizer sends the operator hunting a
+ * per-call cost that does not exist.
  *
  * A CPU figure alone cannot pick a cause, so with only that the clause names
  * candidates and commits to none. A hook that blocks on a dead socket inside a

package/types/claude-hooks/lib/redactor-client.d.mts

@@ -55,9 +55,9 @@ export function classifySocket(socketPath: string, deps?: {
 /**
  * Open one connection, send `request`, resolve with the parsed response object
  * (or null). Rejects on connect failure, a malformed/oversize/short frame, or an
- * {error} response — every one of which the caller turns into a fail-closed. A
+ * {error} response — every one of which the caller treats as a fault. A
  * socket present but not owned by us, and a request the protocol does not
- * accept, fail closed WITHOUT dialing (the error carries no errno, so
+ * accept, throw WITHOUT dialing (the error carries no errno, so
  * isRespawnable is false): we never dial into a squat, and an oversize request
  * is not mistaken for a dead daemon worth respawning.
  * @param {string} socketPath
@@ -105,7 +105,7 @@ export function waitForSocket(socketPath: string, { deadlineMs, stepMs, abandon
 /**
  * Redact `text` via the daemon. Returns the response object (`{text, found}` for
  * plain, `{text, pairs, found}` / `{unmappable}` for map) or null when nothing was
- * redacted (plain mode). Throws to fail closed when the text cannot be vetted.
+ * redacted (plain mode). Throws when the text cannot be vetted.
  *
  * `connect`/`spawn`/`waitForSocket` are injectable seams (default to the real
  * implementations) so callers can stub the daemon in-process. `deadline` is the

package/types/claude-hooks/lib/secret-annotate.d.mts

@@ -1,26 +1,20 @@
-/**
- * Regex matching `value` tolerating invisible chars spliced between its
- * characters (mirrors the engine's env-value regex). Code-point split so
- * an astral character is escaped whole, not as two surrogate halves — and the
- * `u` flag, which the astral `\u{…}` class members in {@link ENV_INVIS_RUN}
- * require.
- * Memoized per distinct value: {@link ENV_INVIS_RUN} renders ~435 code points
- * as ~4 KB of source and is joined at EVERY interior gap, so a 20-char secret
- * compiles a ~75 KB pattern — and `hasEnvBoundSecret` builds one per configured
- * var on every PostToolUse output. Env values are stable for the process's
- * lifetime, so the cache is bounded by the number of distinct values. Sharing an
- * instance is safe because the regex carries no `g`/`y` flag, hence no
- * `lastIndex` state to leak between calls.
- * @param {string} value
- * @returns {RegExp}
- */
-export function envValueRegex(value: string): RegExp;
 /**
  * True when tool output contains the literal value of a configured env-bound
  * secret. The shape-based secret hint can't match a prefix-less key or a host
  * credential, so the pre-gate must also fire on the value itself — otherwise
  * the engine's env-bound redaction never runs. Invisible-tolerant so a
  * value with spliced Cf chars (which the daemon still redacts) trips it too.
+ *
+ * Both sides are stripped and compared as substrings, which is exactly
+ * equivalent: the value's visible characters appear contiguously in the
+ * stripped text iff they appear in the original separated only by invisibles.
+ * It is linear and independent of the value's length — a regex with an
+ * invisible class at every gap grows ~4 KB per character, and a long secret (a
+ * PEM key) overflows V8's regex size limit and throws on every output.
+ *
+ * Callers pass post-Layer-1 text: terminal escapes are already gone, so a value
+ * split by one is contiguous here. Raw text spliced with an escape is not
+ * matched.
  * @param {string} text
  * @param {NodeJS.ProcessEnv} [env]
  * @returns {boolean}

package/types/claude-hooks/sanitize-output.d.mts

@@ -177,7 +177,7 @@ export function emitFailClosed(input: any, message: string, emit?: (fields: Reco
  * fail-OPEN by default — a warning context and NO `updatedToolOutput`, leaving
  * the original tool output in the model's view — or the fail-closed
  * suppression of {@link emitFailClosed} when the caller set
- * AGENT_SANITIZER_FAIL_OPEN=0, or opted into Layer 4 (see the policy below).
+ * AGENT_SANITIZER_FAIL_OPEN=0.
  *
  * This is the hook where the two postures diverge the most, so state the open
  * one plainly: several of these layers throw on inputs an attacker composes (a

package/types/output.d.mts

@@ -55,11 +55,10 @@ export function deleteVerbatimSpans(text: string, spans: string[]): {
  */
 /**
  * Run the configured layers over a single text blob. Layer 1 always runs; the
- * rest are opt-in via `options`. Layer 4 (`redact`) is the fail-closed path: a
- * redactor that throws is rethrown wrapped, so the caller suppresses the
- * output rather than emitting an unvetted value. That fail-closed behavior
- * also applies to Layer 4's re-scan after a Layer-5 span deletion (see Layer
- * 5, below) — a redactor failure there fails the whole call closed too.
+ * rest are opt-in via `options`. A Layer 4 (`redact`) redactor that throws is
+ * rethrown wrapped, so the caller answers it under its fault posture rather
+ * than receiving unvetted text as vetted. The same holds for Layer 4's re-scan
+ * after a Layer-5 span deletion (see Layer 5, below).
  * `reveal` is the pre-Layer-2 text, present only when the HTML splice removed
  * bytes, so a caller can persist what was hidden for later inspection (see
  * {@link applyMarkdownPipeline}); the field is omitted otherwise, and also when