Drift v0.2.2 — Production-Readiness Audit

Fixed

• AST parser no longer rejects valid code with regex literals — a regex containing { / } / / (e.g. const re = /}/) previously broke the brace-balance check and aborted the commit with ParseError: Unexpected } (exit 2). Regex literals are now masked like strings and comments (escapes and [...] classes handled), and / used for division is not mistaken for a regex.
• drift log / drift context no longer crash on non-finite --limit (Infinity, NaN, --limit 1e999): limits are clamped to a safe positive integer instead of being interpolated into SQL LIMIT Infinity.
• drift version reads the real version from package.json instead of a hardcoded string.
• GitHub App (@drift/app) hardening:
  • PR commits are paginated — pull requests with more than 100 commits are now fully scanned (cap 5000).
  • Intent-object fetching stops as soon as every referenced intent is loaded.
  • Webhook requests get a 30-second timeout.
  • Oversized request bodies are rejected with 413 up to an 8 MB cap (was 1 MB / 500), so GitHub stops redelivering instead of retrying forever.
  • PORT is validated (0–65535).
  • Summary-table cells escape | so untrusted paths/summaries cannot break the PR comment's markdown.
  • The response writer is guarded against ERR_HTTP_HEADERS_SENT when a request is terminated mid-handling.
• config.toml inline # comments are now honored (outside strings).
• SECURITY.md documents the trust boundary of drift verify / --verify-cmd (shell execution).

Tests

77 passing tests (was 69): +8 — regex-literal masking (braces, char classes, escapes, division vs regex), non-finite --limit clamping in log/context/store (Infinity, NaN, negative, fractional), config.toml inline comments, and the app-server 413 path for oversized webhook bodies.

Removed

• GitHub Actions removed from the repository: .github/workflows/ci.yml and release.yml deleted, all workflow runs deleted — no CI, no failing checks.