driftproof 0.11.0 → 0.11.1

package/README.md

@@ -305,7 +305,7 @@ A receipt is the unit of evidence — one JSON document conforming to
     "model_release_date": "2025-10-01",
     "provider": "anthropic",
     "surface": "claude-cli",
-    "runner_version": "0.11.0",
+    "runner_version": "0.11.1",
     "date_utc": "2026-07-27T…Z",
     "registry": "registered",
     "transcripts": "hashes-only",
@@ -384,7 +384,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: driftproofhq/driftproof@v0.11.0
+      - uses: driftproofhq/driftproof@v0.11.1
         with:
           skill-dir: skills/my-skill
           models: claude-haiku-4-5

package/config.js

@@ -9,7 +9,7 @@ const PROJECT_NAME = 'driftproof';
 // Bumped whenever the runner's behaviour or receipt-generation semantics change
 // in a way that could affect results. Recorded into every receipt as
 // run.runner_version so a receipt is reproducible against a known engine.
-const RUNNER_VERSION = '0.11.0';
+const RUNNER_VERSION = '0.11.1';
 
 // The eval format we CONSUME (we deliberately do not invent our own).
 const SUITE_FORMAT = 'agentskills.io/evals';

package/lib/hygiene.js

@@ -23,6 +23,8 @@
 // Patterns are written so a regex literal cannot match its own text: a
 // metacharacter or a character class follows each fixed prefix.
 
+const zlib = require('zlib');
+
 const dec = (b64) => JSON.parse(Buffer.from(b64, 'base64').toString('utf8'));
 
 // Build-box host + private IP, base64 so the plaintext never lands in a file.
@@ -54,7 +56,70 @@ function scanPath(rel) {
   return /(^|\/)\.env(\.|$)/.test(rel) ? [{ file: rel, kind: 'env-file' }] : [];
 }
 
+// A PNG'S TEXT-BEARING REGIONS (spec 038 A-038-5, the classification spec 027 already made for the
+// repository gate's confidentiality scan, applied here).
+//
+// THE THREAT MODEL IS ACCIDENTAL PLAINTEXT DISCLOSURE by a person or an agent writing the tree
+// (CONSTITUTION § Threat model). A PNG carries text in its tEXt, iTXt and zTXt chunks, and carries
+// pixels in IDAT, which is deflate output: nobody types into it, and a run of bytes that happens to
+// decode as an address there is a coincidence of compression, not a disclosure. Scanned as one
+// string, a 2 MB screenshot is two million chances of that coincidence, and it has fired twice on
+// this repository's own committed captures.
+//
+// So: every chunk but IDAT is scanned, chunk type names included, and IDAT is not. A name RENDERED
+// INTO a screenshot is pixels, which no byte scan sees either way - that is the gap this scan has
+// always had, and it is unchanged. Everything that is not a PNG is scanned whole, as before.
+//
+// FAIL CLOSED WHERE THE FILE STOPS BEING A PNG (spec 038 approval F-3). Bytes after IEND are no chunk
+// at all, and a chunk whose length runs past the end of the file is a truncated file: either way the
+// remainder, from where the walk lost the structure, is scanned whole, as every file was before this
+// classification. And a text chunk is read in the encoding it carries text in: a zTXt chunk's text
+// and a compressed iTXt chunk's text are inflated and scanned as well as their raw bytes. A chunk
+// that does not inflate is scanned raw, which it already was.
+const PNG_SIG = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+const INFLATE_CAP = 16 * 1024 * 1024;
+function inflated(data) {
+  try { return zlib.inflateSync(data, { maxOutputLength: INFLATE_CAP }).toString('latin1'); } catch (_e) { return null; }
+}
+function pngTextBearing(buf) {
+  const parts = [];
+  const rest = (from) => { parts.push(buf.slice(from).toString('latin1')); return parts.join('\n'); };
+  let off = 8;
+  while (off + 8 <= buf.length) {
+    const len = buf.readUInt32BE(off);
+    const type = buf.slice(off + 4, off + 8).toString('latin1');
+    const start = off + 8;
+    const end = start + len;
+    if (end + 4 > buf.length) return rest(off);   // a truncated chunk: it and all after it, whole
+    const data = buf.slice(start, end);
+    if (type !== 'IDAT') parts.push(type, data.toString('latin1'));
+    if (type === 'zTXt') parts.push(zTXtText(data));
+    if (type === 'iTXt') parts.push(iTXtText(data));
+    off = end + 4;
+    if (type === 'IEND') return rest(off);         // bytes after IEND, whole
+  }
+  return rest(off);                                // fewer than a chunk header's bytes, no IEND
+}
+// keyword \0 method data
+function zTXtText(data) {
+  const z = data.indexOf(0);
+  return (z >= 0 && inflated(data.slice(z + 2))) || '';
+}
+// keyword \0 flag method language \0 translated keyword \0 text; the text is deflated when flag is 1
+function iTXtText(data) {
+  const z = data.indexOf(0);
+  if (z < 0 || data[z + 1] !== 1) return '';
+  const lang = data.indexOf(0, z + 3);
+  const tr = lang >= 0 ? data.indexOf(0, lang + 1) : -1;
+  return (tr >= 0 && inflated(data.slice(tr + 1))) || '';
+}
+
 function scanContent(rel, content) {
+  // A reader may hand this bytes rather than text. A PNG is then read as its text-bearing regions;
+  // anything else is decoded and scanned whole.
+  if (Buffer.isBuffer(content)) {
+    return scanContent(rel, content.slice(0, 8).equals(PNG_SIG) ? pngTextBearing(content) : content.toString('utf8'));
+  }
   const hits = [];
   for (const p of PATTERNS) {
     const m = content.match(p.re);
@@ -104,10 +169,10 @@ function scanFiles(files, read, readLink) {
     }
     let c;
     try { c = read(rel); } catch (_e) { continue; }
-    if (typeof c !== 'string') continue;
+    if (typeof c !== 'string' && !Buffer.isBuffer(c)) continue;
     hits.push(...scanContent(rel, c));
   }
   return hits;
 }
 
-module.exports = { PATTERNS, EMAIL_ALLOW, HOSTIP, scanPath, scanContent, scanFiles };
+module.exports = { PATTERNS, EMAIL_ALLOW, HOSTIP, PNG_SIG, pngTextBearing, scanPath, scanContent, scanFiles };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "driftproof",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "A dated proof that this skill, this hash, this model, still helps: run a skill's eval suite with and without the skill across model versions, emit hash-verified dated receipts, and diff receipts into drift reports.",
   "license": "Apache-2.0",
   "keywords": [