agent-sanitizer 2.67.2 → 2.69.0

package/claude-hooks/sanitize-output.mjs

@@ -50,11 +50,7 @@ import { registerFaultPolicy, hookFaultOutcome } from "./lib/hook-fault.mjs";
 import { controlPlane, runJudgeCli } from "./lib/control-plane.mjs";
 import { hookTrace, TraceEvent } from "./lib/trace.mjs";
 import { hasEnvBoundSecret } from "./lib/secret-annotate.mjs";
-import {
-  digestFlaggingEnabled,
-  secretsEnabled,
-  SECRETS_ENABLED_ENV,
-} from "./lib/env-config.mjs";
+import { digestFlaggingEnabled, secretsEnabled } from "./lib/env-config.mjs";
 import {
   persistReveal,
   persistSpan,
@@ -120,16 +116,17 @@ const HOOK_NAME = "sanitize-output";
 // reaches the model-facing context. Exported so tests assert it by reference.
 export const REVEAL_WITHHELD_WARNING = withheldWarning("reveal sidecar");
 
-// Total wall-clock budget for one hook invocation's blocking daemon calls — the
-// Layer-4 redactor — SHARED across every string leaf of the tool output. Each
-// call is handed the budget remaining at that moment; once it is spent, a further
-// secret-shaped leaf fails CLOSED (the redactor throws → the output is
-// suppressed). The per-call timeouts already bound each call, but not their SUM:
-// a structured output with many secret-shaped leaves could otherwise pile up past
-// the PostToolUse hook kill — a killed hook is non-blocking, so the RAW output
-// would be shown (fail OPEN). The default sits comfortably above one legitimately
-// slow leaf (a cold redactor respawn + a full scan) yet far under the hook
-// timeout; env-tunable so tests can drive the exhausted-budget path fast.
+/**
+ * Total wall-clock budget for one hook invocation's blocking Layer-4 redactor
+ * calls, SHARED across every string leaf of the tool output. Each call gets the
+ * budget remaining at that moment; once it is spent, a further secret-shaped
+ * leaf throws, answered under the operator's fault posture. The per-call
+ * timeouts bound each call but not their SUM, and a structured output with many
+ * secret-shaped leaves could otherwise run past the PostToolUse hook kill,
+ * which shows the RAW output with no warning. The default sits above one slow
+ * leaf (a cold redactor respawn plus a full scan) and far under the hook
+ * timeout; env-tunable so tests can drive the exhausted-budget path fast.
+ */
 const SANITIZE_BUDGET_MS = readKnob("_AGENT_SANITIZER_SANITIZE_BUDGET_MS");
 
 // Web-ingress tools always get the Layer 2 HTML rewrite; local tools — Read,
@@ -172,11 +169,13 @@ function isUntrustedIngress(toolName) {
 
 /**
  * Redact secrets via the long-lived redactor daemon (lib/redactor-client.mjs).
- * Returns `{text, found}` or null when nothing was redacted; throws (fail closed)
- * when secret-shaped text cannot be vetted, which the caller turns into
- * suppression. The cheap pre-gate runs first so plain output never touches the
- * daemon. A transient daemon failure fails only THIS call — no session-wide
- * sentinel — and the client respawns a dead daemon on the next call.
+ * Returns `{text, found}` or null when nothing was redacted; throws when
+ * secret-shaped text cannot be vetted, which the CLI answers under the
+ * operator's fault posture. The cheap pre-gate runs first so plain output never
+ * touches the daemon. `text` is post-Layer-1, so it carries no terminal escape
+ * and the pre-gate needs no escape-stripped view. A transient daemon failure
+ * fails only THIS call — no session-wide sentinel — and the client respawns a
+ * dead daemon on the next call.
  * @param {string} text
  * @param {boolean} webIngress
  * @param {{remainingMs: () => number}} [deadline] shared wall-clock budget
@@ -288,9 +287,9 @@ export async function sanitizeText(
     // Layer 4 — OPT-IN (`secretsOn`): with the knob unset the seam gets no
     // redact callback at all, so plain output never spawns the daemon and no
     // placeholder ever enters the model's view. When it runs, the seam rethrows
-    // a redactor throw wrapped, and this hook's fault policy suppresses the
-    // output under either posture (alwaysClosed). Surface the failure to the
-    // operator's terminal here first: the suppression note rides in what only
+    // a redactor throw wrapped, and this hook's fault policy answers it under
+    // the operator's AGENT_SANITIZER_FAIL_OPEN posture. Surface the failure to
+    // the operator's terminal here first: the fault note rides in what only
     // the model sees, so a degraded redactor would otherwise be invisible to
     // the human.
     redact: !secretsOn
@@ -579,7 +578,7 @@ function failClosedParts(
  * fail-OPEN by default — a warning context and NO `updatedToolOutput`, leaving
  * the original tool output in the model's view — or the fail-closed
  * suppression of {@link emitFailClosed} when the caller set
- * AGENT_SANITIZER_FAIL_OPEN=0, or opted into Layer 4 (see the policy below).
+ * AGENT_SANITIZER_FAIL_OPEN=0.
  *
  * This is the hook where the two postures diverge the most, so state the open
  * one plainly: several of these layers throw on inputs an attacker composes (a
@@ -625,29 +624,17 @@ function suppressionMessage(cause) {
   return `[SANITIZATION FAILED — original output suppressed for safety. Hook error: ${cause}]`;
 }
 
-/** Why an open knob still suppressed: the secret layer's own guarantee. */
-const SECRETS_PIN_NOTE =
-  ` Secret redaction is on (${SECRETS_ENABLED_ENV}=1), so output it could ` +
-  "not vet is withheld under either AGENT_SANITIZER_FAIL_OPEN posture.";
-
 // This hook's entry in the one posture table (lib/hook-fault.mjs). OPEN is the
 // shared default (a warning context, the original output left in the model's
 // view); CLOSED replaces every string leaf of the output with the placeholder.
-// With Layer 4 opted in, a fault here means the output was never vetted for
-// secrets — a dead daemon, a spent budget, a walk that overflowed before the
-// redactor ran — so this pin is what keeps the open default from handing an
-// unredacted credential to the model.
+// Layer 4 follows the same knob: a redactor that cannot run (a dead daemon, a
+// spent budget) leaves the output unvetted and says so, rather than blocking
+// every tool call on an availability failure.
 registerFaultPolicy(HOOK_NAME, {
   event: HookEvent.POST_TOOL_USE,
   guarded: "tool output",
-  alwaysClosed: secretsEnabled,
   closed: (ctx) =>
-    failClosedParts(
-      ctx.input,
-      suppressionMessage(ctx.message) +
-        (ctx.pinnedClosed ? SECRETS_PIN_NOTE : ""),
-      ctx.remedy,
-    ),
+    failClosedParts(ctx.input, suppressionMessage(ctx.message), ctx.remedy),
 });
 
 /**

package/claude-hooks/sanitize-user-prompt.mjs

@@ -28,7 +28,6 @@ import {
 } from "./lib/hook-io.mjs";
 import {
   registerFaultPolicy,
-  KNOB_DECIDES,
   hookFaultOutcome,
   writeFaultOutcome,
 } from "./lib/hook-fault.mjs";
@@ -78,6 +77,9 @@ export const USER_PROMPT_MESSAGES = Object.freeze({
 
 const HOOK_NAME = "sanitize-user-prompt";
 
+/** The `code` of the error a payload the adapter cannot classify raises. */
+const UNKNOWN_EVENT_CODE = "UNKNOWN_EVENT";
+
 // This hook's entry in the one posture table (lib/hook-fault.mjs). OPEN is the
 // shared default (a warning context alongside the prompt); CLOSED is a
 // top-level `decision: "block"`, NOT a hookSpecificOutput verdict —
@@ -86,16 +88,18 @@ const HOOK_NAME = "sanitize-user-prompt";
 registerFaultPolicy(HOOK_NAME, {
   event: HookEvent.USER_PROMPT_SUBMIT,
   guarded: "prompt",
-  alwaysClosed: KNOB_DECIDES,
-  closed: (ctx) => ({
-    envelope: {
-      decision: "block",
-      reason: {
-        ...USER_PROMPT_MESSAGES,
-        ...ctx.messages,
-      }.hookFailed(ctx.message),
-    },
-  }),
+  closed: (ctx) => {
+    const err = /** @type {{ code?: unknown, reason?: string } | null} */ (
+      ctx.err
+    );
+    // An unclassifiable payload blocks with the host's own `unknownEvent`
+    // reason, carried on the error, rather than wrapped as a hook failure.
+    const reason =
+      err?.code === UNKNOWN_EVENT_CODE
+        ? /** @type {string} */ (err.reason)
+        : { ...USER_PROMPT_MESSAGES, ...ctx.messages }.hookFailed(ctx.message);
+    return { envelope: { decision: "block", reason } };
+  },
 });
 
 /* c8 ignore start — module-load boundary: the imports resolve in every real
@@ -123,8 +127,9 @@ registerFaultPolicy(HOOK_NAME, {
  * Judge a normalized prompt-submit event. Agent-agnostic: consumes the
  * control-plane ToolCallEvent and returns a Verdict, so the same prompt gate
  * renders through any agent adapter, not just Claude's. Throws (into the
- * calling hook's catch) when the sanitizer package never loaded, so a prompt it
- * cannot classify takes the hook's fault posture rather than a silent ALLOW.
+ * calling hook's catch) when the sanitizer package never loaded or the payload
+ * is no recognizable event, so a prompt it cannot classify takes the hook's
+ * fault posture rather than a silent ALLOW.
  * @param {import("agent-control-plane-core").ToolCallEvent} event
  * @param {((s: string) => string) | null} [strip]  the ANSI stripper (defaults
  *   to the package's stripAnsiFully; injectable so the fault path is testable)
@@ -144,11 +149,17 @@ export function judgeSanitizeUserPrompt(
   const messages = { ...USER_PROMPT_MESSAGES, ...overrides };
   const { Decision, EventKind } = controlPlane();
   // A payload the adapter cannot classify carries no readable prompt, so an
-  // abstain would fail OPEN on harness contract drift; this gate's posture is
-  // deny-when-blind. (runJudgeCli's renderEscalated blocks it with exit 2 and
-  // the reason on stderr, which Claude honors on UserPromptSubmit.)
+  // abstain would report a CLEAN run on harness contract drift. It is a fault:
+  // the throw lands in main()'s onError, and the registered posture decides —
+  // a warning by default, a block carrying the error's `reason` (this host's
+  // `messages.unknownEvent`) under AGENT_SANITIZER_FAIL_OPEN=0.
   if (event.event === EventKind.UNKNOWN)
-    return { decision: Decision.DENY, reason: messages.unknownEvent };
+    throw Object.assign(
+      new Error(
+        "sanitize-user-prompt: unrecognized hook payload (not UserPromptSubmit)",
+      ),
+      { code: UNKNOWN_EVENT_CODE, reason: messages.unknownEvent },
+    );
   if (event.event !== EventKind.PROMPT_SUBMIT)
     return { decision: Decision.ALLOW };
   // The module-load guard, one arm per binding. The two lazyImports are

package/claude-hooks/scan-invisible-chars.mjs

@@ -25,7 +25,7 @@ import { readFileSync } from "node:fs";
 import { relative, resolve } from "node:path";
 import {
   awaitLazyDependency,
-  emitHookResponse,
+  createEnvelopeBuffer,
   safeErrMessage,
   hookgateMarkerPath,
   HookEvent,
@@ -39,7 +39,6 @@ import {
 } from "./lib/hook-io.mjs";
 import {
   registerFaultPolicy,
-  KNOB_DECIDES,
   hookFaultOutcome,
   writeFaultOutcome,
 } from "./lib/hook-fault.mjs";
@@ -158,37 +157,76 @@ function faultLine(ctx) {
   );
 }
 
-// This hook's entry in the one posture table (lib/hook-fault.mjs). It has no
-// stdout verdict channel — SessionStart cannot deny — so BOTH arms are stated
-// explicitly rather than taking the shared additionalContext default: the only
-// enforcement a SessionStart hook can reach is the cross-hook alert, which makes
-// the PreToolUse gate ask once on the next tool call.
+/**
+ * The open-posture parts for instruction files the scan could not READ, or null
+ * when the fault is anything else. Exit 0 with an envelope, not the fault arm's
+ * bare exit 1: the hook ran and is reporting what it could not check, so the
+ * user (systemMessage) and the model (additionalContext) are both told, and the
+ * launcher forwards it rather than reporting a broken bundle.
+ * @param {import("./lib/hook-fault.mjs").FaultContext} ctx
+ * @returns {import("./lib/hook-fault.mjs").FaultParts | null}
+ */
+function openGapParts(ctx) {
+  if (ctx.gapNotice === undefined) return null;
+  const warning =
+    `${ctx.gapNotice}\n${HOOK_NAME}: failing open — nothing is blocked. Set ` +
+    "AGENT_SANITIZER_FAIL_OPEN=0 to have the next tool call ask instead.";
+  return {
+    stderr: `${warning}\n`,
+    envelope: {
+      systemMessage: warning,
+      hookSpecificOutput: {
+        hookEventName: HookEvent.SESSION_START,
+        additionalContext: warning,
+      },
+    },
+  };
+}
+
+// This hook's entry in the one posture table (lib/hook-fault.mjs). SessionStart
+// cannot deny, so the only enforcement either arm can reach is the cross-hook
+// alert, which makes the PreToolUse gate ask once on the next tool call — and
+// only the CLOSED arm arms it. An unreadable instruction file (`gapNotice`) is
+// rendered here too: the scan worked, but whether a gap may stop the session is
+// the same operator choice a fault is.
 registerFaultPolicy(HOOK_NAME, {
   event: HookEvent.SESSION_START,
   guarded: "instruction files",
-  alwaysClosed: KNOB_DECIDES,
-  open: (ctx) => ({
-    stderr: `${faultLine(ctx)} Passing through unguarded; set AGENT_SANITIZER_FAIL_OPEN=0 to arm the tool-call gate instead.\n`,
-    exitCode: 1,
-  }),
-  closed: (ctx) => ({
-    stderr: `${faultLine(ctx)} Arming the tool-call gate (AGENT_SANITIZER_FAIL_OPEN=0).\n`,
-    exitCode: 1,
-    armAlert: true,
-  }),
+  open: (ctx) =>
+    openGapParts(ctx) ?? {
+      stderr: `${faultLine(ctx)} Passing through unguarded; set AGENT_SANITIZER_FAIL_OPEN=0 to arm the tool-call gate instead.\n`,
+      exitCode: 1,
+    },
+  closed: (ctx) =>
+    ctx.gapNotice === undefined
+      ? {
+          stderr: `${faultLine(ctx)} Arming the tool-call gate (AGENT_SANITIZER_FAIL_OPEN=0).\n`,
+          exitCode: 1,
+          armAlert: true,
+        }
+      : { stderr: `${ctx.gapNotice}\n`, armAlert: true },
 });
 
 /**
- * Render this hook's fault under the declared posture, and return the text (if
- * any) that must ride in the cross-hook alert so a later gate carries the
- * posture this hook cannot express itself.
+ * Render this hook's fault (or, with `gapNotice`, its unreadable-file report)
+ * under the declared posture, and return the text (if any) that must ride in
+ * the cross-hook alert so a later gate carries the posture this hook cannot
+ * express itself.
  * @param {unknown} err
+ * @param {string | undefined} gapNotice  the {@link formatSkipped} report
+ * @param {import("./lib/hook-io.mjs").EnvelopeBuffer} out  this run's one stdout
+ *   buffer
  * @returns {string[]}
  */
-function reportFault(err) {
-  const outcome = hookFaultOutcome(HOOK_NAME, err);
-  process.exitCode = writeFaultOutcome(outcome);
-  return outcome.armAlert ? [/** @type {string} */ (outcome.stderr)] : [];
+function reportFault(err, gapNotice, out) {
+  const outcome = hookFaultOutcome(HOOK_NAME, err, { gapNotice });
+  // Buffered, not written: the timing wrapper may still owe stdout a slow-hook
+  // notice, and two envelopes on one stdout are invalid hook output.
+  process.exitCode = writeFaultOutcome(outcome, (chunk) =>
+    out.add(JSON.parse(chunk)),
+  );
+  if (!outcome.armAlert) return [];
+  return [gapNotice ?? /** @type {string} */ (outcome.stderr)];
 }
 
 /**
@@ -333,9 +371,9 @@ export function scanProject(dir = PROJECT_DIR) {
 }
 
 /**
- * The report for targets the scan could not read. Rendered into the alert the
- * PreToolUse gate surfaces, so an incomplete scan reaches the operator as a
- * checkpoint rather than as silence.
+ * The report for targets the scan could not read: a SessionStart warning under
+ * the open posture, and the alert the PreToolUse gate surfaces under the closed
+ * one — either way an incomplete scan reaches the operator rather than silence.
  * @param {Array<{file: string, reason: string}>} skipped
  * @returns {string}
  */
@@ -385,12 +423,15 @@ export async function cliMain(opts = {}) {
   // reporting an overrun in band is what turned a 30-second scan from a rumor
   // into a bug report (see lib/hook-timing.mjs).
   const timer = startHookTimer();
+  // One stdout document per run: the scan's own envelope (a fault or the
+  // unreadable-file notice) and the slow-hook notice below fold into it.
+  const out = createEnvelopeBuffer();
   try {
     // Charged to provisioning when the session's setup is installing THROUGHOUT
     // this run: that install saturates the machine, and a scan that merely
     // waited it out has no per-call cost to report (see hook-timing.mjs).
     await excludeConcurrentProvisioning(
-      () => runScanCli(opts),
+      () => runScanCli(opts, out),
       () => setupRunning(hookgateMarkerPath()),
     );
   } finally {
@@ -398,7 +439,7 @@ export async function cliMain(opts = {}) {
       HOOK_NAME,
       timer.wallMs(),
       HookEvent.SESSION_START,
-      emitHookResponse,
+      out.emit,
       undefined,
       // All four windows, including the two this scan normally leaves empty: a
       // measured 0 rules a window OUT, where an omitted one leaves the notice
@@ -409,6 +450,7 @@ export async function cliMain(opts = {}) {
         hostMs: timer.hostMs(),
       },
     );
+    out.flush();
   }
 }
 
@@ -421,9 +463,10 @@ export async function cliMain(opts = {}) {
  *   scan?: () => ReturnType<typeof scanProject>,
  *   sessionId?: string,
  * }} opts  see {@link cliMain}
+ * @param {import("./lib/hook-io.mjs").EnvelopeBuffer} out  see {@link cliMain}
  * @returns {Promise<void>}
  */
-async function runScanCli({ trace: sink, scan: runScan, sessionId }) {
+async function runScanCli({ trace: sink, scan: runScan, sessionId }, out) {
   // Bound best-effort: the announcements below run BEFORE the auto-clean and
   // the alert write, with no catch above them, so a throwing host sink would
   // abort the scan silently (see hookTrace).
@@ -454,9 +497,13 @@ async function runScanCli({ trace: sink, scan: runScan, sessionId }) {
           "agent-sanitizer failed to load (node deps not installed and " +
             "session-setup did not finish in time); run `pnpm install`",
         ),
+        undefined,
+        out,
       ),
     );
     persistAlert(alertParts, sessionId);
+    // process.exit skips cliMain's `finally`, which would otherwise flush.
+    out.flush();
     process.exit(1);
   }
   /* c8 ignore stop */
@@ -482,14 +529,14 @@ async function runScanCli({ trace: sink, scan: runScan, sessionId }) {
     scan = (runScan ?? scanProject)();
   } catch (err) {
     emitTrace(TraceEvent.SCAN_INVISIBLE_CHARS_RAN, { outcome: "skipped" });
-    alertParts.push(...reportFault(err));
+    alertParts.push(...reportFault(err, undefined, out));
     persistAlert(alertParts, sessionId);
     return;
   }
   const { findings: allFindings, skipped, absent, scanned } = scan;
 
   // The three buckets of classifyReadFailure, rendered: only `skipped` may
-  // withhold "clean" and arm the gate.
+  // withhold "clean", and it arms the gate only under the closed posture.
   if (skipped.length > 0) {
     emitTrace(TraceEvent.SCAN_INVISIBLE_CHARS_RAN, {
       outcome: "partial",
@@ -498,9 +545,13 @@ async function runScanCli({ trace: sink, scan: runScan, sessionId }) {
       absent: absent.length,
       files: allFindings.length,
     });
-    const notice = formatSkipped(skipped);
-    process.stderr.write(notice + "\n");
-    alertParts.push(notice);
+    alertParts.push(
+      ...reportFault(
+        new Error(`${skipped.length} instruction file(s) could not be read`),
+        formatSkipped(skipped),
+        out,
+      ),
+    );
   } else if (allFindings.length === 0) {
     emitTrace(TraceEvent.SCAN_INVISIBLE_CHARS_RAN, {
       outcome: "clean",

package/claude-hooks/scan-loaded-instructions.mjs

@@ -19,7 +19,7 @@
  */
 import { readFileSync } from "node:fs";
 import {
-  emitHookResponse,
+  createEnvelopeBuffer,
   EmptyStdinError,
   hookgateMarkerPath,
   HookEvent,
@@ -32,7 +32,6 @@ import {
 } from "./lib/hook-io.mjs";
 import {
   registerFaultPolicy,
-  KNOB_DECIDES,
   hookFaultOutcome,
   writeFaultOutcome,
 } from "./lib/hook-fault.mjs";
@@ -123,7 +122,6 @@ function emptyPayloadParts(ctx) {
 registerFaultPolicy(HOOK_NAME, {
   event: HookEvent.INSTRUCTIONS_LOADED,
   guarded: "a loaded instruction file",
-  alwaysClosed: KNOB_DECIDES,
   open: (ctx) =>
     emptyPayloadParts(ctx) ?? {
       stderr: `${faultLine(ctx)} Passing through unguarded; set AGENT_SANITIZER_FAIL_OPEN=0 to arm the tool-call gate instead.\n`,
@@ -270,12 +268,15 @@ export { HOOK_NAME };
 export async function cliMain({ trace: sink } = {}) {
   const timer = startHookTimer();
   const emitTrace = hookTrace(sink);
+  // One stdout document per run: the finding/fault envelope and the slow-hook
+  // notice below fold into it, never written as two.
+  const out = createEnvelopeBuffer();
   try {
     // Charged to provisioning when the session's setup is installing THROUGHOUT
     // this run: that install saturates the machine, and a scan that merely
     // waited it out has no per-call cost to report (see hook-timing.mjs).
     await excludeConcurrentProvisioning(
-      () => runLoadedScanCli(emitTrace),
+      () => runLoadedScanCli(emitTrace, out),
       () => setupRunning(hookgateMarkerPath()),
     );
   } finally {
@@ -283,7 +284,7 @@ export async function cliMain({ trace: sink } = {}) {
       HOOK_NAME,
       timer.wallMs(),
       HookEvent.INSTRUCTIONS_LOADED,
-      emitHookResponse,
+      out.emit,
       undefined,
       // All four windows, including the two this scan normally leaves empty: a
       // measured 0 rules a window OUT, where an omitted one leaves the notice
@@ -294,6 +295,7 @@ export async function cliMain({ trace: sink } = {}) {
         hostMs: timer.hostMs(),
       },
     );
+    out.flush();
   }
 }
 
@@ -302,9 +304,11 @@ export async function cliMain({ trace: sink } = {}) {
  * single call to bracket — every early return here is an exit that wrapper must
  * still measure.
  * @param {import("./lib/trace.mjs").TraceFn} emitTrace
+ * @param {import("./lib/hook-io.mjs").EnvelopeBuffer} out  this run's one stdout
+ *   buffer
  * @returns {Promise<void>}
  */
-async function runLoadedScanCli(emitTrace) {
+async function runLoadedScanCli(emitTrace, out) {
   /** @type {string | undefined} */
   let sessionId;
   try {
@@ -342,19 +346,19 @@ async function runLoadedScanCli(emitTrace) {
     // systemMessage reaches the user, additionalContext the model. Both, because
     // this hook cannot block and the file is already loaded: the user is the one
     // who can act on it, and the model is the one currently reading it.
-    process.stdout.write(
-      JSON.stringify({
-        systemMessage: message,
-        hookSpecificOutput: {
-          hookEventName: HookEvent.INSTRUCTIONS_LOADED,
-          additionalContext: message,
-        },
-      }),
-    );
+    out.add({
+      systemMessage: message,
+      hookSpecificOutput: {
+        hookEventName: HookEvent.INSTRUCTIONS_LOADED,
+        additionalContext: message,
+      },
+    });
   } catch (err) {
     emitTrace(TraceEvent.SCAN_LOADED_INSTRUCTIONS_RAN, { outcome: "skipped" });
     const outcome = hookFaultOutcome(HOOK_NAME, err);
-    process.exitCode = writeFaultOutcome(outcome);
+    process.exitCode = writeFaultOutcome(outcome, (chunk) =>
+      out.add(JSON.parse(chunk)),
+    );
     // `sessionId`, captured before the throw: a payload read that itself failed
     // leaves it undefined, and the fault then lands in the shared fallback store
     // rather than in no store at all.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.67.2",
+  "version": "2.69.0",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/src/html.mjs

@@ -1592,16 +1592,17 @@ function isSelfClosedForeign(tagName, value) {
 // under fragment parsing (scripting disabled) parse5 parses its content as
 // normal markup, so scanning it is correct. Once `plaintext` opens it runs to
 // EOF and never closes.
-const RAW_TEXT_ELEMENTS = new Set([
-  "script",
-  "style",
-  "textarea",
-  "title",
-  "xmp",
-  "iframe",
-  "noembed",
-  "noframes",
-  "plaintext",
+// Each end-tag matcher is spelled per tag, so none compiles a document's text.
+const RAW_TEXT_END_TAGS = new Map([
+  ["script", /<\/script(?![a-z0-9-])/i],
+  ["style", /<\/style(?![a-z0-9-])/i],
+  ["textarea", /<\/textarea(?![a-z0-9-])/i],
+  ["title", /<\/title(?![a-z0-9-])/i],
+  ["xmp", /<\/xmp(?![a-z0-9-])/i],
+  ["iframe", /<\/iframe(?![a-z0-9-])/i],
+  ["noembed", /<\/noembed(?![a-z0-9-])/i],
+  ["noframes", /<\/noframes(?![a-z0-9-])/i],
+  ["plaintext", /<\/plaintext(?![a-z0-9-])/i],
 ]);
 
 // Keywords that take the parent's value of an inherited property: `revert`
@@ -2608,9 +2609,9 @@ function scanInlineChildren(node, text, ranges, warned) {
   // "Inside an unterminated tag / bogus comment" — parse5 absorbs following
   // markup into it until the next `>`.
   let absorbing = false;
-  // Non-null while inside a raw-text element (its lowercased tag name); content
-  // is opaque until the matching end tag.
-  let rawText = /** @type {string | null} */ (null);
+  // Non-null while inside a raw-text element (the matcher for its end tag);
+  // content is opaque until that end tag.
+  let rawTextEnd = /** @type {RegExp | null} */ (null);
   // End offset of the last html node processed; the raw slice from here to the
   // next html node is what parse5 tokenizes between them.
   let prevEnd = node.position.start.offset;
@@ -2622,10 +2623,9 @@ function scanInlineChildren(node, text, ranges, warned) {
     // into the absorb state before deciding what to do with this html node.
     absorbing = foldAbsorb(absorbing, text.slice(prevEnd, base));
 
-    if (rawText) {
+    if (rawTextEnd) {
       // Raw-text content is opaque; only the matching end tag ends the region.
-      if (new RegExp(`</${rawText}(?![a-z0-9-])`, "i").test(value))
-        rawText = null;
+      if (rawTextEnd.test(value)) rawTextEnd = null;
     } else if (state.depth > 0) {
       updateHiddenState(state, value, end, ranges);
     } else if (!absorbing) {
@@ -2655,7 +2655,7 @@ function scanInlineChildren(node, text, ranges, warned) {
         if (el) {
           // A raw-text open tag starts an opaque region (a self-closing `/>`
           // does not apply to these in HTML — they always open).
-          if (RAW_TEXT_ELEMENTS.has(el.tagName)) rawText = el.tagName;
+          rawTextEnd = RAW_TEXT_END_TAGS.get(el.tagName) ?? null;
           // `el` is one tag parsed alone, so a `<template>` inside an inline
           // `<svg>`/`<math>` reads as HTML here and is reported, where the
           // source branch, which sees the namespace, does not: this errs toward