alexander-turner/punctilio

punctilio (n.): precise observance of formalities.

Pretty good at making your text pretty. The most feature-complete and reliable English typography package. punctilio transforms plain ascii into typographically correct Unicode, even across html element boundaries. Try it live at turntrout.com/punctilio.

Smart quotes · Em / en dashes · Ellipses · Math symbols · Legal symbols · Arrows · Primes · Fractions · Superscripts · Ligatures · Non-breaking spaces · html-aware · Markdown support · Bri’ish, German, and French localisation support

import { transform } from "punctilio";
 
transform(`"It's a beautiful thing, the destruction of words..." -- 1984`);
// → “It’s a beautiful thing, the destruction of words…”—1984

punctilio accepts three input formats: text, Markdown, and html. Use it as a library, a CLI, a pre-commit hook, or⁠—for a zero-friction install in any project that already runs Prettier⁠—a Prettier plugin.

npm install punctilio

Read the rest on GitHub

alexander-turner/claude-guard

When handling dangerous materials, a chemist doesn’t yolo it barehanded on the open bench. They reach through a glovebox to do their work.

Right now, you’re probably barehanding AI, tossing it into a shell onto your machine with access to your credentials. At most, you’re shielded by a single prompted “auto-mode” classifier. Doing better is hard and while there are a few papers on best practices, it’s not clear how to do it properly and you have experiments to run.

After all, what’s the chance that something bad happens?

glovebox is a sealed enclosure which only give the agent what it needs to do your work. Tap-tap-tap glovebox and press Enter to spin up a hardware-isolated, allowlist-firewalled microVM, employing input / output sanitization to strip injections and tricks the AI might play on you, with an AI monitor with a red-alert ability to push-notify your phone and halt the AI until you return. The goal is a minimal-friction secure experience that gets the job done.

Disclaimer: I’m an AI professional but not a security professional. I welcome issues and PRs.

Read the rest on GitHub

alexander-turner/ci-truth-serum

Make your CI confess what it’s hiding. A pack of fast, offline pre-commit lints that catch two kinds of lie a green check can hide:

• Honesty lies: the pipeline reports success while the real work failed (exit codes masked by pipes), or a required check silently never reports and the PR hangs forever.
• Identity lies: a base image or downloaded artifact is pinned to a mutable name (a tag, a bare url), so the bytes you run aren’t provably the bytes you reviewed.

What it checks

Honesty (Tier 1, default-on)

Hook	Failure it prevents
check-workflow-pipefail	CI went green while pytest was crashing, because pytest | tee log exits with tee’s status⁠—under a runCmd: / shell: sh / custom bash that lacks pipefail.
check-exit-suppression	A teardown that left a volume pinned reported success, because cleanup || true discarded its non-zero exit while keeping its output.
check-stderr-suppression	A container launch failed with a bare non-zero and no clue why, because docker compose up 2>/dev/null threw away the only diagnostic.
check-pr-paths	A required check hung at “Expected⁠—Waiting” forever and the PR could never merge, because paths: / paths-ignore: / branches: on pull_request skipped the workflow without reporting (a stacked PR on a non-main base is the branch-filter trap).
check-pipefail-grep-pipe	A teardown check reported a still-present secret as removed, because secret_store ls | grep -q "$name" under pipefail let grep’s early exit sigpipe the producer, surfacing 141 as no-match once the listing outgrew the pipe buffer.

Identity (Tier 1, default-on)

Hook	Failure it prevents
check-pinned-base-images	The base image you reviewed and the one CI built diverged, because FROM node:22 is a mutable tag the registry can re-point. Demands a @sha256: digest.
check-pinned-downloads	A tampered release or compromised mirror swapped the binary you curled and then ran, because the download carried no checksum / signature check.

Opinionated (Tier 2, opt-in)

Hook	Failure it prevents
check-always-reporter	A gated workflow stranded a required check at “Expected⁠—Waiting” when the decide gate skipped every work job. Assumes a decide-job + always() reporter pattern.
check-required-reporter	A new always() reporter shipped as a green-but-never-required check because nothing tied a workflow’s reporters to the branch-protection required-set. Assumes the required-set is mirrored from these annotations.
check-inline-run-length	A long inline run: block shipped unchecked (unquoted expansions, missing pipefail) because shellcheck / shfmt / shellharden only see standalone .sh files.
check-concurrency	New pushes queued behind stale runs instead of cancelling, because a concurrency: block omitted cancel-in-progress and it silently defaulted to false.
check-static-concurrency	A required check hung at “Expected⁠—Waiting” forever, because a static workflow-level concurrency.group (no github.ref / head_ref key) let a sibling ref’s run cancel this one’s pending run wholesale before any job⁠—and its always() reporter⁠—ever started.
check-requires-concurrency	A pull_request(_target) workflow shipped with no concurrency: block at all, so every push to a PR started a second full run instead of cancelling the superseded one⁠—stacking runs on a capped, shared runner pool. (check-concurrency only validates a block that exists; this one requires it to exist.) Satisfied by a block at the workflow level or on any job. Opt out with # concurrency-not-required.
check-externalized-markers	A workflow guard that scans inline run: for a policy marker (e.g. a history-rewrite command that demands fetch-depth: 0) went blind and passed vacuously the moment that command moved into .github/scripts/*.sh or a composite action. Flags any job where the marker is reachable only through that indirection.
check-path-gate-deps	A gated job silently skipped⁠—and its always() reporter went green⁠—on the exact PR that changed a file the job depends on, because the decide job’s path filters omitted a composite action or .github/scripts/ helper. Verifies every gated job’s static dependencies (composites, run scripts one source hop deep, and # gate-deps:-declared paths) are covered by the decide filters; suppress one dep with # path-gate-ok: <dep> <reason>.
check-failure-notifier-coverage	A new push / schedule workflow failed silently forever because ci-failure-notify.yaml’s on.workflow_run.workflows list (necessarily a hand-copied list⁠—workflow_run has no wildcard) was never updated. Round-trip freshness check: the list must equal the tree’s push / schedule workflow names; prints the corrected block on mismatch. Pass --require-notifier to fail when the notifier workflow itself is missing.

Unrelated bonus checks (Extras)

Hook	Failure it prevents
check-symlinks	A tracked symlink with an absolute target (/Users/you/...) broke on every machine but the author’s.
check-unnamed-regex-groups	A RegEx’s match handling went positional and brittle because a re.* literal used an unnamed ( ) group.
check-global-stdio-swap	Concurrent calls clobbered each other’s output because code reassigned the process-global sys.stdout to capture I / O.
check-claude-model	A claude-code-action step billed Opus silently because it omitted --model and rode the action’s expensive default tier.

Read the rest on GitHub

alexander-turner/agent-input-sanitizer

Most prompt-injection tools run a classifier over the text and hope it generalizes. This library targets a narrower, verifiable claim: the specific byte-level channels⁠—invisible Unicode, ansi escapes, human-hidden Html, confusable glyphs, exfil-shaped urls⁠—that let an attacker smuggle a payload the operator can’t see but the model still reads. Every layer is a deterministic transform you can unit-test with equality assertions.

npm install agent-input-sanitizer

Quick start

import { sanitize } from "agent-input-sanitizer";
 
// Layer 1 (invisible chars + ANSI), zero heavy deps:
const { cleaned, found, warnings } = await sanitize(untrustedText);
 
// Opt into the HTML layers for web ingress (lazy-loads ~200 ms of deps):
const result = await sanitize(pageSource, { html: true });

sanitize never throws and never silently drops content⁠—any change comes with at least one warnings entry. found names the neutralized category codes (e.g. ["cf-format", "hidden-html"]); cleaned is the safe text, with placeholders where hidden html was spliced out.

Read the rest on GitHub