etymd 0.9.0 → 0.9.1

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # etymd
 
+## 0.9.1
+
+### Patch Changes
+
+- 8967d26: Content screen: skip binary files, and say how many were skipped
+
+  Compressed bytes contain any short sequence eventually, so a short pattern
+  matches inside binary assets by accident and is reported as a "line" of
+  mojibake. Every pattern added to a pattern file therefore raised the
+  false-positive rate across every repo that holds assets.
+
+  The cost of a noisy gate is not the noise. It is that the gate's answer becomes
+  "bypass again", and a trained-in `--no-verify` is what eventually waves a real
+  finding through with the rest.
+
+  Files whose first 8KB contain a NUL byte are now skipped rather than screened,
+  which closes that for every pattern at once instead of anchoring one pattern at
+  a time. The count is reported in the summary header (`· N binary skipped`), so
+  "no findings" can never quietly mean "the bytes were never looked at".
+
 ## 0.9.0
 
 ### Minor Changes

package/dist/{approve-H4UMLKRJ.js → approve-HED3NCTE.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { section, theme, print, renderBaselineDrift, glyph } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-MUNRU2LF.js';
-import { VERSION } from './chunk-E3CVCK5X.js';
+import { scanProject } from './chunk-UN7IAYM6.js';
+import { VERSION } from './chunk-AQM4GYGN.js';
 import { readBaseline, summarizeBaselineDrift, isDriftEmpty, writeBaseline, deriveProfile } from './chunk-C7LBUFNU.js';
 import { PACK_VERSION } from './chunk-6DUDIVIC.js';
 import './chunk-IV3FYVTS.js';

package/dist/{audit-22SOGKLY.js → audit-Y35XVD6Z.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-export { run } from './chunk-ZA7GVR63.js';
-import './chunk-5P7KZV4W.js';
+export { run } from './chunk-ULM25GWG.js';
+import './chunk-KGVRZ6WC.js';
 import './chunk-JSUYV26K.js';
 import './chunk-OAFYLBVG.js';
 import './chunk-D2RI3CCT.js';
 import './chunk-5BVKFJWM.js';
-import './chunk-MUNRU2LF.js';
-import './chunk-E3CVCK5X.js';
+import './chunk-UN7IAYM6.js';
+import './chunk-AQM4GYGN.js';
 import './chunk-C7LBUFNU.js';
 import './chunk-6DUDIVIC.js';
 import './chunk-IV3FYVTS.js';

package/dist/{brief-VKNKPZJF.js → brief-2CXAUDNN.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { print, theme } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-MUNRU2LF.js';
-import './chunk-E3CVCK5X.js';
+import { scanProject } from './chunk-UN7IAYM6.js';
+import './chunk-AQM4GYGN.js';
 import { ETYMD_DIR } from './chunk-C7LBUFNU.js';
 import './chunk-6DUDIVIC.js';
 import './chunk-IV3FYVTS.js';

package/dist/{chunk-E3CVCK5X.js → chunk-AQM4GYGN.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // package.json
 var package_default = {
-  version: "0.9.0"};
+  version: "0.9.1"};
 
 // src/version.ts
 var VERSION = package_default.version;

package/dist/{chunk-5P7KZV4W.js → chunk-KGVRZ6WC.js}

@@ -2,7 +2,7 @@
 import { measureContext } from './chunk-JSUYV26K.js';
 import { readLedger, reconcileLedger, writeLedger, visibleFindings } from './chunk-OAFYLBVG.js';
 import { DEFAULT_CONFIG, readConfig, CONFIG_FILE } from './chunk-D2RI3CCT.js';
-import { scanProject, expandFileGlobs } from './chunk-MUNRU2LF.js';
+import { scanProject, expandFileGlobs } from './chunk-UN7IAYM6.js';
 import { ETYMD_DIR, writeCachedFacts, readBaseline, deriveProfile, baselineCarriesMachinePath, BASELINE_FILE } from './chunk-C7LBUFNU.js';
 import { PACK_VERSION } from './chunk-6DUDIVIC.js';
 import { pathExists, readJson, readText, isDirectory, matchesAnyGlob, git, normalizeRelPath, isCiEnvironment, isExecutable } from './chunk-IV3FYVTS.js';

package/dist/{chunk-ZA7GVR63.js → chunk-ULM25GWG.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { parseFailOnTier, runAudit, meetsFailOn } from './chunk-5P7KZV4W.js';
+import { parseFailOnTier, runAudit, meetsFailOn } from './chunk-KGVRZ6WC.js';
 import { print, section, theme, renderLensCoverage, renderFindings, renderLedgerDiff } from './chunk-5BVKFJWM.js';
 
 // src/commands/audit.ts

package/dist/{chunk-MUNRU2LF.js → chunk-UN7IAYM6.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-E3CVCK5X.js';
+import { VERSION } from './chunk-AQM4GYGN.js';
 import { PACK_VERSION } from './chunk-6DUDIVIC.js';
 import { normalizeRelPath, isDirectory, readJson, git, matchesAnyGlob, pathExists, readText } from './chunk-IV3FYVTS.js';
 import path from 'node:path';

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-E3CVCK5X.js';
+import { VERSION } from './chunk-AQM4GYGN.js';
 import path from 'node:path';
 import { Command } from 'commander';
 import pc from 'picocolors';
@@ -31,7 +31,7 @@ program.command("audit").description("Verify every instruction claim against the
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./audit-22SOGKLY.js');
+    const { run } = await import('./audit-Y35XVD6Z.js');
     await run({
       cwd: resolveCwd(cmd),
       json: opts.json,
@@ -44,7 +44,7 @@ program.command("audit").description("Verify every instruction claim against the
 );
 program.command("init").description("Onboard the truth guard: approve the baseline; scaffold AGENTS.md only if missing").option("-y, --yes", "accept defaults without prompting (never overwrites)").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./init-ROJ6LQX3.js');
+    const { run } = await import('./init-RC35RS5J.js');
     await run({ cwd: resolveCwd(cmd), yes: opts.yes });
   })
 );
@@ -52,19 +52,19 @@ program.command("approve").description(
   "Re-approve the committed baseline after intentional structural changes (non-interactive)"
 ).action(
   (_opts, cmd) => action(async () => {
-    const { run } = await import('./approve-H4UMLKRJ.js');
+    const { run } = await import('./approve-HED3NCTE.js');
     await run({ cwd: resolveCwd(cmd) });
   })
 );
 program.command("scan").description("Deterministically reckon the project into a facts index").option("--json", "print the raw facts as JSON").option("--no-save", "do not write the .etymd cache").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./scan-2ODW52EK.js');
+    const { run } = await import('./scan-MBXSD5RO.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json, save: opts.save });
   })
 );
 program.command("doctor").description('Alias for `audit --truth` \u2014 "are the recorded instructions still true?"').option("--json", "print findings as JSON").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./doctor-ITR74ZUE.js');
+    const { run } = await import('./doctor-DXXQJ2L3.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
@@ -76,7 +76,7 @@ program.command("context").description("Measure the always-loaded context footpr
 );
 program.command("brief").description("Emit a grounded briefing for the in-repo agent to complete the semantic layer").option("--human", "write a human onboarding brief instead of the agent briefing").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./brief-VKNKPZJF.js');
+    const { run } = await import('./brief-2CXAUDNN.js');
     await run({ cwd: resolveCwd(cmd), human: opts.human });
   })
 );
@@ -111,7 +111,7 @@ var fleet = program.command("fleet").description(
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { sweep } = await import('./fleet-CTBMXRHV.js');
+    const { sweep } = await import('./fleet-DPJSZDEY.js');
     await sweep({
       cwd: resolveCwd(cmd),
       manifest: opts.manifest,
@@ -126,7 +126,7 @@ var fleet = program.command("fleet").description(
 );
 fleet.command("check").description("Validate the manifest pair only \u2014 no lenses: dangling mappings, duplicates, leaks").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").option("--json", "print the findings as JSON (EXPERIMENTAL through 0.2.x)").action(
   (_opts, cmd) => action(async () => {
-    const { check } = await import('./fleet-CTBMXRHV.js');
+    const { check } = await import('./fleet-DPJSZDEY.js');
     const opts = cmd.optsWithGlobals();
     await check({ cwd: resolveCwd(cmd), manifest: opts.manifest, json: opts.json });
   })
@@ -136,7 +136,7 @@ fleet.command("add").argument("<dir>", "directory of the project to register").d
   "public-repo | public-bound | private \u2014 mandatory for personal entries"
 ).option("-y, --yes", "skip prompts; every mandatory value must be passed as a flag").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (dir, opts, cmd) => action(async () => {
-    const { add } = await import('./fleet-CTBMXRHV.js');
+    const { add } = await import('./fleet-DPJSZDEY.js');
     const shared = cmd.optsWithGlobals();
     await add({
       cwd: resolveCwd(cmd),
@@ -159,7 +159,7 @@ fleet.command("dismiss").argument("<name>", "the registered project name").argum
   "Dismiss a project's finding from any cwd \u2014 corp ledgers persist beside the manifest"
 ).requiredOption("--reason <text>", "why it is dismissed \u2014 recorded so the decision survives").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { dismiss } = await import('./fleet-CTBMXRHV.js');
+    const { dismiss } = await import('./fleet-DPJSZDEY.js');
     const opts = cmd.optsWithGlobals();
     await dismiss({
       cwd: resolveCwd(cmd),
@@ -174,7 +174,7 @@ fleet.command("accept").argument("<name>", "the registered project name").argume
   "Accept a project's finding as a known trade-off \u2014 corp ledgers persist beside the manifest"
 ).option("--reason <text>", "optional note on why the trade-off is accepted").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { accept } = await import('./fleet-CTBMXRHV.js');
+    const { accept } = await import('./fleet-DPJSZDEY.js');
     const opts = cmd.optsWithGlobals();
     await accept({ cwd: resolveCwd(cmd), manifest: opts.manifest, name, id, reason: opts.reason });
   })
@@ -183,7 +183,7 @@ program.command("screen").description(
   "Content screen: check for text that must never be published. Bring your own patterns \u2014 etymd ships none."
 ).option("--staged", "screen what a commit is about to add (default)").option("--tree", "screen every tracked file \u2014 what is about to leave the machine").option("--message <file>", "screen a commit message (the commit-msg hook's $1)").option("--dir <dir>", "screen an unpacked build artifact \u2014 what actually ships").option("--patterns <file>", "pattern file (default: ~/.config/etymd/screen-patterns)").option("--advisory", "report without failing").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./screen-6R6NXDSY.js');
+    const { run } = await import('./screen-EHNK6ANK.js');
     const scope = opts.message ? "message" : opts.dir ? "dir" : opts.tree ? "tree" : "staged";
     await run({
       cwd: resolveCwd(cmd),
@@ -196,7 +196,7 @@ program.command("screen").description(
 );
 program.command("gates").description("Install the local git-hook gates (process \u2192 pre-commit, correctness \u2192 pre-push)").option("--ci", "note about the CI review gate (ships later; local gates install now)").option("-y, --yes", "skip prompts; never overwrites a hand-edited hook").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./gates-X7WY7IRK.js');
+    const { run } = await import('./gates-RR3V4PII.js');
     await run({ cwd: resolveCwd(cmd), ci: opts.ci, yes: opts.yes });
   })
 );

package/dist/{doctor-ITR74ZUE.js → doctor-DXXQJ2L3.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { run } from './chunk-ZA7GVR63.js';
-import './chunk-5P7KZV4W.js';
+import { run } from './chunk-ULM25GWG.js';
+import './chunk-KGVRZ6WC.js';
 import './chunk-JSUYV26K.js';
 import './chunk-OAFYLBVG.js';
 import './chunk-D2RI3CCT.js';
 import './chunk-5BVKFJWM.js';
-import './chunk-MUNRU2LF.js';
-import './chunk-E3CVCK5X.js';
+import './chunk-UN7IAYM6.js';
+import './chunk-AQM4GYGN.js';
 import './chunk-C7LBUFNU.js';
 import './chunk-6DUDIVIC.js';
 import './chunk-IV3FYVTS.js';

package/dist/{fleet-CTBMXRHV.js → fleet-DPJSZDEY.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { dismiss, accept } from './chunk-V2SOHPXF.js';
-import { parseFailOnTier, meetsFailOn, runAudit } from './chunk-5P7KZV4W.js';
+import { parseFailOnTier, meetsFailOn, runAudit } from './chunk-KGVRZ6WC.js';
 import './chunk-JSUYV26K.js';
 import { readLedger } from './chunk-OAFYLBVG.js';
 import { DEFAULT_CONFIG } from './chunk-D2RI3CCT.js';
 import { print, theme, section, renderFleetRows, renderFleetNotes, renderFindings, TIER_BADGE, glyph } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-MUNRU2LF.js';
-import './chunk-E3CVCK5X.js';
+import { scanProject } from './chunk-UN7IAYM6.js';
+import './chunk-AQM4GYGN.js';
 import { ETYMD_DIR } from './chunk-C7LBUFNU.js';
 import './chunk-6DUDIVIC.js';
 import { readText, pathExists, git, isDirectory } from './chunk-IV3FYVTS.js';
@@ -688,7 +688,7 @@ async function checkCorpEmails(manifest, findings, disclosures) {
 }
 async function checkGateDrift(manifest, findings, disclosures) {
   const { planWorkflow } = await import('./generate-IPY5QIR5.js');
-  const { scanProject: scanProject2 } = await import('./scan-VL4DW5ZT.js');
+  const { scanProject: scanProject2 } = await import('./scan-KX522VKV.js');
   const { readConfig } = await import('./config-7WCVZCM6.js');
   for (const entry of manifest.entries) {
     const root = entry.resolvedRoot;

package/dist/{gates-X7WY7IRK.js → gates-RR3V4PII.js}

@@ -3,8 +3,8 @@ import { applyFiles } from './chunk-EF6BPBG6.js';
 import { deriveFailOn, derivedCommands, planWorkflow, runPrefix, isSafeGateCommand } from './chunk-WENIJMVV.js';
 import { readConfig, CONFIG_FILE, configPath } from './chunk-D2RI3CCT.js';
 import { section, print, glyph, theme, renderPlan } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-MUNRU2LF.js';
-import './chunk-E3CVCK5X.js';
+import { scanProject } from './chunk-UN7IAYM6.js';
+import './chunk-AQM4GYGN.js';
 import './chunk-C7LBUFNU.js';
 import './chunk-6DUDIVIC.js';
 import { readText, git } from './chunk-IV3FYVTS.js';

package/dist/index.js

@@ -30,7 +30,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "etymd",
-      version: "0.9.0",
+      version: "0.9.1",
       description: "Keep your agent instructions true \u2014 verify AGENTS.md, CLAUDE.md, rules & skills against the actual repo, with drift caught over time and a regression ledger.",
       keywords: [
         "cli",

package/dist/{init-ROJ6LQX3.js → init-RC35RS5J.js}

@@ -3,8 +3,8 @@ import { applyFiles } from './chunk-EF6BPBG6.js';
 import { planWorkflow } from './chunk-WENIJMVV.js';
 import './chunk-D2RI3CCT.js';
 import { theme, renderFacts, print, renderPlan, section, glyph } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-MUNRU2LF.js';
-import { VERSION } from './chunk-E3CVCK5X.js';
+import { scanProject } from './chunk-UN7IAYM6.js';
+import { VERSION } from './chunk-AQM4GYGN.js';
 import { writeCachedFacts, deriveProfile, writeBaseline, CACHE_DIR } from './chunk-C7LBUFNU.js';
 import { PACK_VERSION } from './chunk-6DUDIVIC.js';
 import { git, readText } from './chunk-IV3FYVTS.js';

package/dist/scan-KX522VKV.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+export { scanProject } from './chunk-UN7IAYM6.js';
+import './chunk-AQM4GYGN.js';
+import './chunk-6DUDIVIC.js';
+import './chunk-IV3FYVTS.js';

package/dist/{scan-2ODW52EK.js → scan-MBXSD5RO.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { print, renderFacts, theme } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-MUNRU2LF.js';
-import './chunk-E3CVCK5X.js';
+import { scanProject } from './chunk-UN7IAYM6.js';
+import './chunk-AQM4GYGN.js';
 import { writeCachedFacts } from './chunk-C7LBUFNU.js';
 import './chunk-6DUDIVIC.js';
 import './chunk-IV3FYVTS.js';

package/dist/{screen-6R6NXDSY.js → screen-EHNK6ANK.js}

@@ -58,6 +58,17 @@ async function walk(dir, out, depth = 0) {
     else out.push(abs);
   }
 }
+var BINARY_SNIFF_BYTES = 8192;
+async function readScreenable(p) {
+  let buf;
+  try {
+    buf = await promises.readFile(p);
+  } catch {
+    return null;
+  }
+  if (buf.subarray(0, BINARY_SNIFF_BYTES).includes(0)) return "binary";
+  return buf.toString("utf8");
+}
 async function run(opts) {
   const patternPath = opts.patterns ?? process.env.ETYMD_SCREEN_PATTERNS ?? process.env.PUBLIC_REPO_PATTERNS ?? path.join(process.env.HOME ?? "", ".config", "etymd", "screen-patterns");
   const rawPatterns = await readText(patternPath);
@@ -83,6 +94,7 @@ async function run(opts) {
   const active = self ? patterns.filter((re) => !isSelfName(re, self)) : patterns;
   const hits = [];
   let scanned = 0;
+  let skippedBinary = 0;
   if (opts.scope === "message") {
     const file = opts.target;
     if (!file) throw new Error("--message needs the message file path (the commit-msg hook's $1)");
@@ -97,8 +109,12 @@ async function run(opts) {
     const files = [];
     await walk(dir, files);
     for (const f of files) {
-      const raw = await readText(f);
+      const raw = await readScreenable(f);
       if (raw === null) continue;
+      if (raw === "binary") {
+        skippedBinary++;
+        continue;
+      }
       scanned++;
       hits.push(...screenText(raw, path.relative(dir, f), active, allow));
     }
@@ -109,14 +125,22 @@ async function run(opts) {
       if (rel === ALLOW_FILE || rel === LEGACY_ALLOW_FILE) continue;
       const abs = path.join(opts.cwd, rel);
       if (!await pathExists(abs)) continue;
-      const raw = await readText(abs);
+      const raw = await readScreenable(abs);
       if (raw === null) continue;
+      if (raw === "binary") {
+        skippedBinary++;
+        continue;
+      }
       scanned++;
       hits.push(...screenText(raw, rel, active, allow));
     }
   }
   if (!hits.length) return;
-  section(`Content screen ${theme.dim(`\xB7 ${opts.scope} \xB7 ${scanned} file(s)`)}`);
+  section(
+    `Content screen ${theme.dim(
+      `\xB7 ${opts.scope} \xB7 ${scanned} file(s)${skippedBinary ? ` \xB7 ${skippedBinary} binary skipped` : ""}`
+    )}`
+  );
   for (const h of hits) {
     print(`  ${theme.warn(h.file)}${theme.dim(`:${h.line}`)}  ${theme.dim(`(${h.reason})`)}`);
     print(`    ${h.text}`);
@@ -131,4 +155,4 @@ async function run(opts) {
   if (!opts.advisory) process.exitCode = 1;
 }
 
-export { isSelfName, run, screenText };
+export { isSelfName, readScreenable, run, screenText };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "etymd",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Keep your agent instructions true — verify AGENTS.md, CLAUDE.md, rules & skills against the actual repo, with drift caught over time and a regression ledger.",
   "keywords": [
     "cli",

package/dist/scan-VL4DW5ZT.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-export { scanProject } from './chunk-MUNRU2LF.js';
-import './chunk-E3CVCK5X.js';
-import './chunk-6DUDIVIC.js';
-import './chunk-IV3FYVTS.js';