agent-sanitizer 2.67.2 → 2.69.0

package/README.md

@@ -138,9 +138,10 @@ composed against the redacted view are re-anchored onto the real bytes, and
 placeholders in new content resolve back to the real secrets — disk → tool
 input only, never into the model's view. Anything ambiguous is denied rather
 than guessed, the redactor's own map is verified against the file before any
-splice, and a write that would persist placeholder text over a real secret
-asks instead of passing through even when the hook's own machinery fails
-mid-session. The whole layer is opt-in — its denies and asks are friction, so it
+splice, and a write that would persist placeholder text over a real secret is
+refused once, even when the hook's own machinery fails mid-session, and proceeds
+with a warning when re-issued. The whole layer is opt-in — its denies and asks
+are friction, so it
 engages only when asked for: set `AGENT_SANITIZER_SECRETS_ENABLED=1` in the
 environment Claude Code runs the hooks with; unset, no redactor runs and no
 placeholders exist.
@@ -193,9 +194,10 @@ withholds a string-shaped response; the shell arm in `plugin/scripts/safe-launch
 therefore also emits a top-level `decision`/`reason` pair, honored whatever
 shape the response had, telling the model that any output still visible above
 it is unsanitized. One carve-out to the
-open default, with secrets enabled: a write-shaped call carrying `[REDACTED…]` placeholder text asks
-instead of passing through when the hook itself is broken, since letting it
-through would overwrite the real secret with the placeholder. Either way, a plugin that
+open default, with secrets enabled: a write-shaped call carrying `[REDACTED…]`
+placeholder text is refused once when the hook itself is broken, since letting
+it through would overwrite the real secret with the placeholder; the exact
+re-issue proceeds with a warning. Either way, a plugin that
 never loaded at all is invisible — Claude Code reads a crashed hook as "no
 objection" — so confirm with `/plugin` rather than reading a quiet session as a
 working one. Neither posture touches what a sanitizer that RAN decided (see

package/THREAT-MODEL.md

@@ -298,16 +298,17 @@ plugin injects the Python engine from `agent-sanitizer[secrets]`
 (`python/agent_sanitizer/secrets/engine.py`) over a local daemon;
 `plugin/scripts/provision-redactor.sh` installs it at SessionStart.
 
-**It is the one fail-closed layer.** A redactor that throws — unreachable
-daemon, engine error — is rethrown from `sanitizeValue` as `CRITICAL: secret
-redaction failed …` (`src/output.mjs`).
-With the layer opted in, the output hook's fault policy (`alwaysClosed` in
-`claude-hooks/sanitize-output.mjs`, resolved in `lib/hook-fault.mjs`) then
-suppresses the output under **either** `AGENT_SANITIZER_FAIL_OPEN` posture —
-and so does any other fault of that hook, since an output the hook failed on
-was never vetted for secrets either. One accepted gap: a launcher-level failure
-(no `node`, corrupt bundle) never runs the policy, so the launcher's own
-posture applies there, warning by default.
+**A redactor fault follows the operator's posture.** A redactor that throws —
+unreachable daemon, engine error, spent budget — is rethrown from
+`sanitizeValue` as `CRITICAL: secret redaction failed …` (`src/output.mjs`), so
+the seam never returns unvetted text as if it were vetted. The output hook then
+answers it like any other fault, under `AGENT_SANITIZER_FAIL_OPEN`
+(`lib/hook-fault.mjs`, the one posture resolver, which has no per-hook override):
+open by default — the output reaches the model with an UNSANITIZED warning, and
+the operator's terminal names the redactor failure — and withheld under `=0`.
+Accepted risk of the default: while the redactor is down, a credential in tool
+output reaches the model unredacted. The alternative blocks every tool call on
+an availability failure, which is what a deployment chooses with `=0`.
 
 **Lone surrogates are normalized to U+FFFD before the redactor sees the text.**
 A secret split by an interposed lone surrogate renders as contiguous to the
@@ -608,9 +609,9 @@ RECONSTITUTES during stripping is judged as the sequence it becomes.
 Layer order: 1 → 2–3 → 4 → 5 → 4, the second Layer 4 a re-scan of what Layer 5's
 deletions left. Shape matters
 (a harness that gets a shape-mismatched value silently shows the raw output).
-Layer 4 (secret redaction) is an **injected** redactor and is the one
-fail-closed path: a redactor that throws makes the pipeline rethrow, so the
-caller suppresses the output rather than emit an unvetted value. That
+Layer 4 (secret redaction) is an **injected** redactor: a redactor that throws
+makes the pipeline rethrow rather than return an unvetted value, and the
+caller's posture decides whether the output is suppressed. That
 suppression (`suppressToolOutput`) replaces string leaves in place so the
 placeholder still matches the tool's shape, with one exception it must make: an
 Anthropic **content block** is collapsed whole to `{ type: "text", text: … }`
@@ -959,32 +960,39 @@ parsed, and a layer that ran and threw.
 One carve-out: when the PreToolUse hook itself fails (redactor daemon down,
 package failed to load, a layer threw) and the call is a **write-shaped tool**
 (Write/Edit/MultiEdit/NotebookEdit) whose input carries the `[REDACTED`
-placeholder prefix, the hook **asks** — fail-closed, human in the loop — instead
-of passing through. With the sanitizer down, rehydration cannot run, so the
-placeholder text would be persisted literally over the real secret on disk: a
-destructive clobber, not a missed scan. Holding these calls is safe because a
-placeholder-bearing write is never the benign availability case the open default
-protects — the model can retry once the sanitizer recovers, or ask the user. The
-check is package-free (a literal-string test on the already-parsed payload), so
+placeholder prefix, the hook **refuses it once** instead of passing it through.
+With the sanitizer down, rehydration cannot run, so the placeholder text would be
+persisted literally over the real secret on disk: a destructive clobber, not a
+missed scan. The refusal is releasable, never a loop: the exact same call
+re-issued is let through with a warning that the placeholder was written
+literally, and when the hook cannot record that confirmation (an unwritable
+`$TMPDIR`) it lets the call through at once with the warning. The same rule
+covers a write whose placeholder cannot be restored — a Layer-2 span missing
+from the store, an unreadable target, a redactor map that fails validation.
+Releasing an unhinted Edit on a file whose redactor map fails validation reopens
+the hidden-span probing oracle the rehydrator closes, at the price of one refusal
+per distinct probe, for as long as the redactor stays broken. An unhinted Write
+there skips the secret-drop guard, which reads the same broken map, so its
+refusal and warning say instead that any redacted secret it omits is removed. The check is
+package-free (a literal-string test on the already-parsed payload), so
 it holds even when the failure IS the missing package. Two accepted gaps: a
 launcher-level failure (no `node`, corrupt bundle, a provisioned hook binary
 that is missing, unexecutable or dies without a verdict) never reaches the
 check — the launcher cannot inspect the payload and always warns — and `Bash`
 is excluded even though shell redirection can also persist placeholder text,
-because command strings mention `[REDACTED` benignly far too often for the ask
-to hold precision. All other faults keep the open default, and
+because command strings mention `[REDACTED` benignly far too often for the
+refusal to hold precision. All other faults keep the open default, and
 `AGENT_SANITIZER_FAIL_OPEN=0` behavior is unchanged.
 
 **The open default is not enforceable against content.** Several of those
 failures are composable by whoever authored the payload — in the output hook
-alone, a nesting depth that overflows the sanitize walk and a redaction budget
-exhausted by many secret-shaped leaves — though with Layer 4 opted in, the
-output hook withholds on any fault whatever the knob says (see Layer 4). (A
-**key collision** — two field names that collapse to one after Layer 1 — used
-to be on that list. It no longer
-fails the hook at all: only the colliding fields are withheld, and every sibling
-field survives. Both colliding values are replaced **whole** by a marker string,
-not walked leaf-wise: a shape-preserving walk rewrites only string leaves, so a
+alone, a nesting depth that overflows the sanitize walk, a redaction budget
+exhausted by many secret-shaped leaves, and a payload large enough to blow the
+redactor daemon's scan budget. (A **key collision** — two field names that
+collapse to one after Layer 1 — does not fail the hook: only the colliding
+fields are withheld, and every sibling field survives. Both colliding values
+are replaced **whole** by a marker string, not walked leaf-wise: a
+shape-preserving walk rewrites only string leaves, so a
 colliding number or boolean would reach the model verbatim under a legitimate
 field name while the warning claimed it was withheld. That changes the field's
 JSON type, which is accepted because a duplicate name is off-schema by
@@ -1005,13 +1013,13 @@ in `claude-hooks/sanitize-output.mjs` — so a host that wires those directly (a
 `test/downstream-parity.test.mjs` shows) keeps strict failure semantics by
 construction, with no env var to remember and none an agent could set for it.
 
-Two things the posture does NOT reach, in either direction:
-
-- **Detection verdicts.** It speaks only to the hook FAILING; a working
-  sanitizer that found an injection blocks under both settings.
-- **An unknown `--hook=` mode**, which still exits 2. That is static wiring
-  corruption, and passing it through would mean no hook ever runs — silently,
-  for the life of the install.
+The posture does NOT reach **detection verdicts**: it speaks only to the hook
+FAILING, and a working sanitizer that found an injection blocks under both
+settings. It does reach an unknown `--hook=` mode — static wiring corruption,
+from a `hooks.json` and bundle out of step: under the open default that hook
+exits non-blocking with a stderr line naming the mode and the fix, so every
+event it fires on reports the gap loudly instead of blocking the session, and
+under `=0` it exits 2.
 
 The knob is operator configuration read from the process environment, so
 anything that can set it for a session — `.claude/settings.json`'s `env` block,
@@ -1046,8 +1054,13 @@ extracts by walking the TypeScript AST of every shipped `.mjs` (not by matching
 regex source with a regex), and fails on any pattern with super-linear
 backtracking. A `RegExp(…)` built at runtime must be statically resolvable or
 carry a written exemption, so a new dynamic pattern is a red build rather than a
-hole. `tests/secrets/test_redos_static_guard.py` is the twin over the Python
-engine. In `pnpm lint`, `eslint-plugin-redos` (recheck) and
+hole. No construction may read call-time data either — a parameter, tool
+output, `process.env` — because a pattern compiled from it is as large as that
+data, and past V8's size limit it throws on every call; the same walk covers a
+string handed to `.match`/`.matchAll`/`.search`.
+`tests/secrets/test_redos_static_guard.py` is the twin over the Python engine,
+and `tests/secrets/test_regex_size_static_guard.py` holds the Python package to
+the call-time rule. In `pnpm lint`, `eslint-plugin-redos` (recheck) and
 `eslint-plugin-regexp`'s `no-super-linear-backtracking` and
 `no-super-linear-move` read every shipped regex literal — the last of them
 reports the shape that carries no backtracking at all, an **unanchored**

package/claude-hooks/lib/env-config.mjs

@@ -15,7 +15,7 @@
  * esbuild inlines them into the plugin bundle (which ships with no config
  * directory beside it) and Node resolves them natively from the package when the
  * hooks run from source. Their VALIDATION stays lazy — a malformed credential
- * vocabulary throws on first use, inside the consuming hook's fail-closed catch,
+ * vocabulary throws on first use, inside the consuming hook's fault catch,
  * rather than at module load where a throw would abort before that catch installs
  * and let the harness pass the tool output through UNSANITIZED (fail OPEN).
  */
@@ -72,7 +72,7 @@ export function configureEnvConfigSource(source) {
 /**
  * The stored host source with its shape validated, or null when unconfigured.
  * Shape errors — a non-object source, a key this seam does not read — throw
- * HERE, on first use inside the consuming hook's fail-closed catch, never at
+ * HERE, on first use inside the consuming hook's fault catch, never at
  * configure time: a top-level throw in a bundle entry would kill the hook
  * before that catch installs (fail OPEN), and silently ignoring the problem
  * is worse — a typo'd `minSecretLength: 32` must not leave the helpers

package/claude-hooks/lib/hook-fault.mjs

@@ -85,41 +85,25 @@ export const FAULT_POLICY_HOOKS = Object.freeze([
  * The context a builder is handed: the caller's own inputs (whatever it passed
  * to {@link hookFaultOutcome}) plus the values every hook derived by hand
  * before — the hook name, the scrubbed error message, and the model-facing
- * open-posture warning — and `pinnedClosed`, true when the policy's
- * `alwaysClosed` overrode an open knob, so the closed arm can say why.
+ * open-posture warning.
  * @typedef {Record<string, any> & {
  *   hook: string,
  *   err: unknown,
  *   message: string,
  *   openContext: string,
- *   pinnedClosed: boolean,
  * }} FaultContext
  */
 
 /**
- * Whether a hook's faults are withheld whatever AGENT_SANITIZER_FAIL_OPEN says,
- * for the caller's environment.
- * @typedef {(
- *   env: NodeJS.ProcessEnv | Record<string, string | undefined> | undefined,
- * ) => boolean} AlwaysClosed
- */
-
-/**
- * The `alwaysClosed` of a hook whose posture the knob alone decides.
- * @type {AlwaysClosed}
- */
-export const KNOB_DECIDES = Object.freeze(() => false);
-
-/**
- * A hook's declared posture. `alwaysClosed` is REQUIRED, so every hook states
- * on the record whether the knob can open it: {@link KNOB_DECIDES}, or a
- * predicate that pins the CLOSED arm — how a guarantee the docs make
- * unconditionally (Layer 4 withholds what it could not vet) is enforced in the
- * one posture resolver rather than by a hook re-reading the knob.
+ * A hook's declared posture. There is deliberately no way for a policy to pin
+ * the CLOSED arm: AGENT_SANITIZER_FAIL_OPEN alone decides, so no hook fault can
+ * withhold a tool output, block a prompt, or hold a tool call for good unless the
+ * operator set the knob to `0` (an open arm may refuse a call once, releasing the
+ * exact re-issue). A pin turns any bug in the guarded layer into every tool call
+ * failing.
  * @typedef {{
  *   event: string | null,
  *   guarded: string,
- *   alwaysClosed: AlwaysClosed,
  *   open?: (ctx: FaultContext) => FaultParts,
  *   closed: (ctx: FaultContext) => FaultParts,
  * }} FaultPolicy
@@ -143,12 +127,10 @@ export function registerFaultPolicy(hook, policy) {
     );
   // Checked here, not at fault time: a posture that is incomplete must fail the
   // import, never the one fault it was supposed to answer.
-  for (const arm of /** @type {const} */ (["alwaysClosed", "closed"]))
-    if (typeof policy[arm] !== "function")
-      throw new Error(
-        `fault policy for ${JSON.stringify(hook)} declares no \`${arm}\`; ` +
-          "every hook states it explicitly (KNOB_DECIDES for alwaysClosed)",
-      );
+  if (typeof policy.closed !== "function")
+    throw new Error(
+      `fault policy for ${JSON.stringify(hook)} declares no \`closed\` arm`,
+    );
   policies.set(hook, policy);
 }
 
@@ -190,8 +172,7 @@ export function defaultOpen(ctx) {
 /**
  * Resolve `hook`'s response to its own failure under the caller's posture. This
  * is the ONLY place {@link failOpenEnabled} is consulted on a hook fault, so the
- * knob cannot be honored in three hooks and skipped in the fourth — and the
- * only place a policy's `alwaysClosed` can override it.
+ * knob cannot be honored in three hooks and skipped in the fourth.
  * @param {string} hook
  * @param {unknown} err
  * @param {Record<string, any> & {
@@ -204,9 +185,7 @@ export function defaultOpen(ctx) {
  */
 export function hookFaultOutcome(hook, err, ctx = {}) {
   const policy = faultPolicy(hook);
-  const knobOpen = failOpenEnabled(ctx.env);
-  const pinnedClosed = knobOpen && policy.alwaysClosed(ctx.env);
-  const open = knobOpen && !pinnedClosed;
+  const open = failOpenEnabled(ctx.env);
   /** @type {FaultContext} */
   const full = {
     ...ctx,
@@ -214,7 +193,6 @@ export function hookFaultOutcome(hook, err, ctx = {}) {
     err,
     message: safeErrMessage(err),
     openContext: failOpenContext(hook, policy.guarded, err),
-    pinnedClosed,
   };
   const parts = (open ? (policy.open ?? defaultOpen) : policy.closed)(full);
   const fields = parts.fields ?? null;

package/claude-hooks/lib/hook-io.mjs

@@ -680,6 +680,77 @@ export function emitHookResponse(hookEventName, fields) {
   );
 }
 
+/**
+ * Fold several hook envelopes into the ONE that may reach stdout: `systemMessage`
+ * and `additionalContext` are joined (a later part is appended, never allowed to
+ * displace an earlier one); any other field takes the last value written.
+ * @param {Array<Record<string, any>>} envelopes  non-empty
+ * @returns {Record<string, any>}
+ */
+function mergeEnvelopes(envelopes) {
+  /** @type {Record<string, any>} */
+  const merged = {};
+  /** @type {Record<string, any>} */
+  const specific = {};
+  /** @type {string[]} */
+  const systemMessages = [];
+  /** @type {string[]} */
+  const contexts = [];
+  for (const { hookSpecificOutput, systemMessage, ...rest } of envelopes) {
+    Object.assign(merged, rest);
+    if (systemMessage) systemMessages.push(systemMessage);
+    if (!hookSpecificOutput) continue;
+    const { additionalContext, ...fields } = hookSpecificOutput;
+    Object.assign(specific, fields);
+    if (additionalContext) contexts.push(additionalContext);
+  }
+  if (systemMessages.length > 0)
+    merged.systemMessage = systemMessages.join("\n");
+  if (contexts.length > 0) specific.additionalContext = contexts.join("\n");
+  if (Object.keys(specific).length > 0) merged.hookSpecificOutput = specific;
+  return merged;
+}
+
+/**
+ * @typedef {{
+ *   add: (envelope: Record<string, any>) => void,
+ *   emit: (hookEventName: string, fields: Record<string, unknown>) => void,
+ *   flush: () => void,
+ * }} EnvelopeBuffer
+ */
+
+/**
+ * Collect everything a hook run wants to say on stdout and write it as exactly
+ * ONE JSON object on `flush`. Claude Code parses a hook's stdout as a single
+ * document, so two envelopes written by two reporters (a fault notice, then the
+ * slow-hook notice from the timing wrapper's `finally`) concatenate into invalid
+ * output and the host DROPS the whole response — the model never sees either
+ * warning. Every reporter in a run therefore adds here instead of writing, and
+ * the entry point flushes once, last.
+ * @param {(chunk: string) => void} [write]  injectable stdout sink, for tests
+ * @returns {EnvelopeBuffer}
+ */
+export function createEnvelopeBuffer(
+  write = (chunk) => process.stdout.write(chunk),
+) {
+  /** @type {Array<Record<string, any>>} */
+  const pending = [];
+  /** @param {Record<string, any>} envelope */
+  const add = (envelope) => {
+    pending.push(envelope);
+  };
+  return {
+    add,
+    emit: (hookEventName, fields) =>
+      add({ hookSpecificOutput: { hookEventName, ...fields } }),
+    flush() {
+      if (pending.length === 0) return;
+      write(JSON.stringify(mergeEnvelopes(pending)));
+      pending.length = 0;
+    },
+  };
+}
+
 /**
  * The project the hooks are guarding. Every per-project $TMPDIR store is keyed to
  * it, so it lives here — beside the other shared identity these hooks agree on —
@@ -799,7 +870,7 @@ export function hookgateMarkerPath(
   // Prefer the per-user, mode-0700 runtime dir when the harness gives an
   // absolute one; else the world-writable /tmp, where markerIsTrusted() — not
   // the path — defends against a squatted marker.
-  const base = runtimeDir && runtimeDir.startsWith("/") ? runtimeDir : "/tmp";
+  const base = runtimeDir && isAbsolute(runtimeDir) ? runtimeDir : "/tmp";
   // The flattened dir is for a human reading `ls /tmp`; the digest of the RAW
   // dir is the identity. Flattening alone is lossy — /work/a-b, /work/a_b and
   // "/work/a b" all collapse to one name — and two such projects on one machine
@@ -811,7 +882,7 @@ export function hookgateMarkerPath(
     .digest("hex")
     .slice(0, 8);
   const flattened = projectDir.replace(/[^A-Za-z0-9]/g, "_");
-  return `${base}/${HOOKGATE_MARKER_STEM}${flattened}-${digest}`;
+  return join(base, `${HOOKGATE_MARKER_STEM}${flattened}-${digest}`);
 }
 
 /**
@@ -1199,26 +1270,30 @@ export function touchLiveState(path) {
  * file the hook's user owns. Unlink any existing entry first (removing a squatted
  * symlink), then create exclusively (O_EXCL) so a symlink re-planted in the race
  * window fails the open rather than being dereferenced. Content is irrelevant —
- * callers test only for existence — so the file is left empty. Best-effort: a
- * missing/read-only $TMPDIR or a lost race just leaves the sentinel absent, and
- * every caller treats "absent" as "not yet done" (a repeated ask, never a crash),
- * so all failures are swallowed.
+ * callers test only for existence — so the file is left empty. Never throws: a
+ * missing/read-only $TMPDIR or a lost race leaves the sentinel absent, and the
+ * return value says so. A caller whose refusal is released only by a later read
+ * of this sentinel must branch on it, because a refusal that records nothing can
+ * never be released.
  * @param {string} path
- * @returns {void}
+ * @returns {boolean}  whether a sentinel this uid owns now exists at `path`
+ *   (the same test {@link markerIsTrusted} applies when a reader looks for it)
  */
 export function writeSentinelFile(path) {
   try {
     unlinkSync(path);
   } catch {
     // No existing entry (the common case), or an unremovable one — either way the
-    // exclusive create below is the real guard, and its own failure is swallowed.
+    // exclusive create below is the real guard, and its own failure is returned.
   }
   try {
     closeSync(openSync(path, "wx"));
   } catch {
     // A symlink re-planted in the unlink→open window, an unwritable dir, or a
-    // leftover entry: skip silently — the caller simply re-asks next time.
+    // leftover entry.
+    return false;
   }
+  return markerIsTrusted(path);
 }
 
 /**

package/claude-hooks/lib/hook-timing.mjs

@@ -17,8 +17,16 @@
  * EXTENSION it called ({@link chargeHostExtension}) — the redactor daemon and a
  * host callback's subprocess or socket peer are separate processes whose CPU this
  * one cannot see (see {@link processCpuMs}), so the call that waits for each is
- * the only measurable stand-in. The notice GATES on none of them: a hook wedged
- * on a dead redactor socket burns no CPU and is exactly the sanitizer's fault.
+ * the only measurable stand-in. A caller that supplies the CPU and redactor
+ * figures is reported only when the share its owner answers for — CPU plus
+ * redactor round trips plus host extensions — itself exceeds the budget; wall
+ * time past that is the machine's, and neither a notice nor a report request is
+ * the answer to it. Redactor wait counts toward that share, so a hook wedged on a
+ * dead redactor socket (no CPU, all wait) is still reported. A wait on a
+ * subprocess this package spawns itself (a `git` probe, a lock) is charged to
+ * no window, so it reads as the machine's and goes unreported — the accepted
+ * cost of never blaming the sanitizer for a loaded host. A caller that supplies
+ * no attribution is gated on wall-clock alone.
  *
  * The host-extension window is what turned "blocked on something outside the
  * sanitizer" — a verdict nobody can act on — into a named callee: a composer's
@@ -598,6 +606,11 @@ export function startHookTimer(now = Date.now, cpuNow = processCpuMs) {
  * The CPU, redactor and host shares overlap by the framing this side does
  * mid-round-trip and mid-callback, so they do not sum to the elapsed time; a
  * share that dominates despite the overlap is still the one to act on.
+ *
+ * Reached only for a run whose owned share already exceeds the budget
+ * ({@link slowHookNotice}), so the "none of them" verdict means the unmeasured
+ * remainder is larger than a share that is itself over budget — not that the
+ * hook's own cost was small.
  * @param {number} elapsedMs
  * @param {number} cpuMs
  * @param {number} redactorMs
@@ -646,10 +659,15 @@ function attributeWait(elapsedMs, cpuMs, redactorMs, hostMs, owner) {
  * sanitizer computing, and with `context.redactorMs` too it names the window the
  * time went into ({@link attributeWait}), including `context.hostMs`'s host
  * extensions — a caller that measured the first two but has no extensions to
- * charge reports that window as zero, which is a measurement and not a shrug. Without them the line says that it cannot
- * tell, rather than asserting an attribution nothing measured: a wall-clock
- * overrun on a loaded host is the common case, and blaming it on the sanitizer
- * sends the operator hunting a per-call cost that does not exist.
+ * charge reports that window as zero, which is a measurement and not a shrug.
+ * Such a caller is reported only when `cpuMs + redactorMs + hostMs` (an absent
+ * `hostMs` counting as 0) exceeds `thresholdMs`: a wall-clock overrun whose
+ * owned share is within the budget is the machine's and returns null, so the
+ * operator is never asked to report a cost the owner did not spend. Without the
+ * measurements the line says that it cannot tell, rather than asserting an
+ * attribution nothing measured: a wall-clock overrun on a loaded host is the
+ * common case, and blaming it on the sanitizer sends the operator hunting a
+ * per-call cost that does not exist.
  *
  * A CPU figure alone cannot pick a cause, so with only that the clause names
  * candidates and commits to none. A hook that blocks on a dead socket inside a
@@ -684,6 +702,8 @@ export function slowHookNotice(
   // number, including when it is 0.
   const hostMs =
     typeof context?.hostMs === "number" ? context.hostMs : undefined;
+  if (attributed && cpuMs + redactorMs + (hostMs ?? 0) <= thresholdMs)
+    return null;
   const owner = noticeOwner(context?.reportTo, version);
   const attribution = attributed
     ? attributeWait(elapsedMs, cpuMs, redactorMs, hostMs, owner)

package/claude-hooks/lib/invisible-alert.mjs

@@ -706,14 +706,17 @@ export function alertAcknowledged(sessionId) {
 /**
  * Record that the gate has surfaced its blocking ask, so later tool calls get a
  * passive reminder instead of an ask on every call. Session-keyed, so the next
- * session re-asks once without anything having to clear this.
+ * session re-asks once without anything having to clear this. Returns false
+ * when the ack could not be recorded, so the caller knows the next call will
+ * ask again: under the fail-open posture it surfaces the finding as a warning
+ * rather than asking on every tool call for the rest of the session.
  * @param {string} [sessionId]
- * @returns {void}
+ * @returns {boolean}
  */
 export function acknowledgeAlert(sessionId) {
   // Symlink-safe presence write: the ack sits at a predictable STATE_ROOT path
   // a co-tenant could pre-plant a symlink at (see writeSentinelFile).
-  writeSentinelFile(alertAckFile(sessionId));
+  return writeSentinelFile(alertAckFile(sessionId));
 }
 
 // What the operator can actually DO — one bullet per kind of report the alert

package/claude-hooks/lib/redactor-client.mjs

@@ -6,9 +6,9 @@
  * request is just a scan. detect-secrets stays the one and only detection engine
  * — this module never inspects the text itself.
  *
- * Fail-closed, per call only: a connection/protocol/scan failure throws so the
- * caller suppresses THAT output; it sets no session-wide state, so the next call
- * retries from scratch. If the socket is absent or dead we (re)spawn the daemon
+ * Per call only: a connection/protocol/scan failure throws, and the caller
+ * answers THAT output under its fault posture; it sets no session-wide state,
+ * so the next call retries from scratch. If the socket is absent or dead we (re)spawn the daemon
  * once and retry — a crashed daemon self-heals on the next redaction.
  *
  * Wire protocol: python/agent_sanitizer/secrets/data/redactor-protocol.json,
@@ -54,7 +54,7 @@ const DAEMON_REASON = /^[\x20-\x7e]{1,200}$/u;
 export { positiveMsOr } from "./knobs.mjs";
 
 // sun_path is 104 bytes on macOS (108 on Linux), NUL included; a longer path
-// makes the daemon's bind() fail and every call fail closed. The daemon binds
+// makes the daemon's bind() fail and every call fault. The daemon binds
 // "." + 16 hex digits before renaming onto "redactor.sock", so the longer
 // 17-byte name is what must fit.
 const SOCKET_PATH_MAX = 103;
@@ -100,7 +100,7 @@ export const DEFAULT_SOCKET_PATH = resolveSocketPath(process.env, currentUid());
  *
  * 1. `_AGENT_SANITIZER_REDACTOR_DAEMON` — authoritative when set (the launcher
  *    sets it to the provisioned venv's console script when one exists, and
- *    tests point it at dead paths to drive the fail-closed arm; a fallback
+ *    tests point it at dead paths to drive the fault arm; a fallback
  *    from an explicit setting would turn those arms into silent passes).
  * 2. The shipped self-contained zipapp (`plugin/dist/redactor/daemon.pyz`) —
  *    the guaranteed floor: it needs only a python3 on PATH, so a cold start
@@ -126,20 +126,20 @@ function daemonCommand() {
 }
 // How long to wait for a freshly-spawned daemon to start accepting. A cold start
 // pays the detect-secrets import + plugin prime (~1-3s), so the default leaves
-// margin; tests shorten it to exercise the give-up-and-fail-closed path quickly.
+// margin; tests shorten it to exercise the give-up path quickly.
 const WAIT_DEADLINE_MS = readKnob("_AGENT_SANITIZER_REDACTOR_WAIT_MS");
 
-// A daemon that ACCEPTS the connection but then stalls — a deadlock, a
-// pathological detect-secrets input, or a half-written length prefix that never
-// completes — emits none of the errno codes isRespawnable reacts to and never
-// closes, so without a deadline connectAndRequest's Promise never settles.
-// redactViaDaemon (the required, fail-closed Layer 4) would then hang until
-// Claude Code kills the PostToolUse hook at its own timeout, and a killed hook is
-// non-blocking — so the RAW, unredacted tool output is shown (the exact fail-open
-// this layer exists to prevent). The total per-connect deadline below makes a
-// stall reject, so the caller fails closed. It stays comfortably under the hook
-// timeout (two connects + the spawn wait must fit); tests shorten it via the env
-// override (read per call) or the deadlineMs parameter to exercise the path fast.
+/**
+ * The total per-connect deadline. A daemon that ACCEPTS and then stalls — a
+ * deadlock, a pathological detect-secrets input, a length prefix that never
+ * completes — emits no errno isRespawnable reacts to and never closes, so
+ * without it connectAndRequest never settles and the PostToolUse hook is killed
+ * at its timeout, which shows the RAW output with no warning. A stall instead
+ * rejects, and the caller's fault posture answers it, warning included. Two
+ * connects plus the spawn wait must fit under the hook timeout. Read per call,
+ * so tests shorten it through the env override (or the deadlineMs parameter).
+ * @returns {number}
+ */
 function requestDeadlineMs() {
   return readKnob("_AGENT_SANITIZER_REDACTOR_REQUEST_MS");
 }
@@ -270,9 +270,9 @@ export function classifySocket(socketPath, deps = {}) {
  * by us or by root, carrying no group/other write bit.
  *
  * This refusal is what blocks a co-tenant unlinking our socket and binding their
- * own listener that answers "nothing to redact" to every payload, which would flip
- * the fail-CLOSED redactor to fail-OPEN and leak unscrubbed secrets to the
- * transcript.
+ * own listener that answers "nothing to redact" to every payload, which would turn
+ * a loud fault into a silent "nothing to redact" and leak unscrubbed secrets to
+ * the transcript.
  *
  * Root ownership is trusted because it is strictly stronger than our own, not a
  * concession: a deployment may hand the socket dir to root after the daemon has
@@ -291,9 +291,9 @@ function isTrustedSocketDir(dir, uid) {
 /**
  * Open one connection, send `request`, resolve with the parsed response object
  * (or null). Rejects on connect failure, a malformed/oversize/short frame, or an
- * {error} response — every one of which the caller turns into a fail-closed. A
+ * {error} response — every one of which the caller treats as a fault. A
  * socket present but not owned by us, and a request the protocol does not
- * accept, fail closed WITHOUT dialing (the error carries no errno, so
+ * accept, throw WITHOUT dialing (the error carries no errno, so
  * isRespawnable is false): we never dial into a squat, and an oversize request
  * is not mistaken for a dead daemon worth respawning.
  * @param {string} socketPath
@@ -484,7 +484,7 @@ function canConnect(socketPath) {
 /**
  * Redact `text` via the daemon. Returns the response object (`{text, found}` for
  * plain, `{text, pairs, found}` / `{unmappable}` for map) or null when nothing was
- * redacted (plain mode). Throws to fail closed when the text cannot be vetted.
+ * redacted (plain mode). Throws when the text cannot be vetted.
  *
  * `connect`/`spawn`/`waitForSocket` are injectable seams (default to the real
  * implementations) so callers can stub the daemon in-process. `deadline` is the