Skip to content

Drift v0.2.0 — Encryption at Rest + GitHub App

Choose a tag to compare

View all tags
@lilcipherx lilcipherx released this 05 Aug 09:30
· 64 commits to main since this release
v0.2.0
40d4951

Drift v0.2.0 — Encryption at Rest + GitHub App

Added

  • AES-256-GCM encryption at rest (PRD §7.4, §17.1–17.2): with [encryption] enabled = true in .drift/config.toml, intent prompt and agentState are encrypted before storage (encv1: marker, random 12-byte IV per value, AAD bound to the intent id). Key comes from DRIFT_MASTER_KEY (64-hex verbatim, otherwise SHA-256 passphrase).
  • E_KEY (exit 4) when encryption is enabled but the key is missing, and when replaying encrypted state without it; drift log/blame degrade to a [encrypted] placeholder so history stays readable.
  • drift doctor gains an encryption-key check when encryption is on.
  • @drift/app GitHub App (PRD §16): pull_request webhook handler that reads Drift-Intent trailers from PR commits, hydrates intent objects from .drift/objects/ at the PR head, and posts a semantic intent summary comment plus a check run. HMAC webhook signature verification, GitHub App JWT → installation-token auth, optional prompt decryption with DRIFT_MASTER_KEY, drift-app start / drift-app dev <payload> [--dry-run], mock payload fixture and smee.io webhook proxy script.
  • Backward compatible: legacy plaintext intents pass through untouched; the Ed25519 signature covers the stored (encrypted) canonical form, so signature verification never needs the master key.

Fixed

  • Signature verification now uses the object file (source of truth) instead of DB rows, so row order can never invalidate a signature.
  • if/for/while are no longer misreported as added "methods" by the parser.
  • drift-app GitHub client sends a User-Agent (GitHub rejects token requests without one) and caches installation tokens per installation (multi-tenant safe); client-side webhook errors are acked with 200 so GitHub stops redelivering.

Tests

54 passing tests: unit (encryption roundtrip/tamper/AAD, redaction, AST, config), integration (encrypted objects on disk, no plaintext leaks, E_KEY paths, legacy passthrough), MCP JSON-RPC e2e, and 13 drift-app tests (trailers, HMAC, JWT, handler with a fake GitHub client, HTTP server e2e).

Assets 2
Loading