@soleur/opencode 0.0.0-stage → 1.0.0

package/skills/skill-security-scan/scripts/check-codeexec.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Category 1: code-execution anti-patterns.
+# Stdin = SKILL.md content. Stdout = JSON {verdict, category, findings}. Exit 0.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+. "$SCRIPT_DIR/lib.sh"
+
+YAML="$SCRIPT_DIR/../references/rules/code-exec.yaml"
+
+tmp="$(stdin_to_tempfile)"
+trap 'rm -f "$tmp" "$tmp.code"' EXIT
+
+# Extract fenced code block content only (skip prose). Format-only fences
+# (json/yaml/toml/csv/text) are skipped per regex-patterns.md carve-out.
+awk '
+  /^```/ {
+    if (in_block) { in_block=0; next }
+    lang = substr($0, 4)
+    gsub(/[[:space:]]+$/, "", lang)
+    if (lang == "json" || lang == "yaml" || lang == "yml" || \
+        lang == "toml" || lang == "csv" || lang == "text" || lang == "md") {
+      skip=1
+    } else {
+      skip=0
+    }
+    in_block=1
+    print ""  # preserve line numbers
+    next
+  }
+  in_block && !skip { print; next }
+  { print "" }  # non-code lines as empty so line numbers map to original
+' "$tmp" > "$tmp.code"
+
+findings="$(apply_yaml_rules "$YAML" "$tmp.code" || true)"
+
+verdict="$(echo "$findings" | findings_to_verdict)"
+findings_json="$(echo "$findings" | build_findings_array)"
+
+emit_result "$verdict" "code-execution" "$findings_json"

package/skills/skill-security-scan/scripts/check-filesystem-boundary.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Category 4: filesystem boundary violations.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+. "$SCRIPT_DIR/lib.sh"
+
+YAML="$SCRIPT_DIR/../references/rules/filesystem-boundary.yaml"
+
+tmp="$(stdin_to_tempfile)"
+trap 'rm -f "$tmp"' EXIT
+
+findings="$(apply_yaml_rules "$YAML" "$tmp" || true)"
+
+verdict="$(echo "$findings" | findings_to_verdict)"
+findings_json="$(echo "$findings" | build_findings_array)"
+
+emit_result "$verdict" "filesystem-boundary" "$findings_json"

package/skills/skill-security-scan/scripts/check-prompt-injection.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+# Category 2: prompt-injection.
+#
+# Frontmatter (high-precision, HIGH-RISK), body (proximity-gated, REVIEW),
+# Soleur prose allowlist (downgrade legitimate flow-control prose), zero-width
+# character detection.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+. "$SCRIPT_DIR/lib.sh"
+
+tmp="$(stdin_to_tempfile)"
+trap 'rm -f "$tmp" "$tmp.fm" "$tmp.body"' EXIT
+
+# Split frontmatter (between leading --- and second ---) from body.
+awk '
+  BEGIN { phase = "pre" }
+  phase == "pre" && /^---[[:space:]]*$/ { phase = "fm"; next }
+  phase == "fm"  && /^---[[:space:]]*$/ { phase = "body"; next }
+  phase == "fm"  { print > FM }
+  phase == "body" { print > BODY }
+  phase == "pre" { print > BODY }   # no frontmatter case → all is body
+' FM="$tmp.fm" BODY="$tmp.body" "$tmp" || true
+
+touch "$tmp.fm" "$tmp.body"
+
+# Allowlist: legitimate flow-control prose around "ignore".
+soleur_allowlist_re='ignore[[:space:]]+(the[[:space:]]+)?(step|cache|warning|error|file|test|null|undefined|empty|comment)'
+
+findings_lines=""
+
+# ---- Frontmatter rules (HIGH-RISK) ----
+# Rule specs are TAB-delimited (not '|') because regex alternation uses '|'
+# literally; pipe-delimitation truncates the regex at the first internal pipe.
+fm_rules=(
+  $'role-hijack-fm\tHIGH-RISK\t(ignore|disregard|forget)[[:space:]]+(all[[:space:]]+)?(previous|prior|above|the[[:space:]]+(system|prior))'
+  $'mode-jailbreak-fm\tHIGH-RISK\t\\b(DAN|developer[[:space:]]+mode|jailbreak)\\b'
+  $'sysprompt-exfil-fm\tHIGH-RISK\t(reveal|print|show|output|leak)[[:space:]]+([a-z]+[[:space:]]+){0,3}(system[[:space:]]+prompt|the[[:space:]]+system)'
+  $'delim-breakout-fm\tHIGH-RISK\t(</system>|<\\|im_(start|end)\\|>|^system:)'
+)
+for spec in "${fm_rules[@]}"; do
+  IFS=$'\t' read -r rule_id severity regex <<<"$spec"
+  while IFS=':' read -r line rest; do
+    [ -z "$line" ] && continue
+    snippet="${rest:0:200}"
+    snippet="${snippet//$'\t'/ }"
+    # Apply allowlist downgrade
+    if grep -qiE "$soleur_allowlist_re" <<<"$rest"; then
+      continue
+    fi
+    findings_lines+="$rule_id"$'\t'"$severity"$'\t'"$line"$'\t'"$snippet"$'\n'
+  done < <(grep -niE -- "$regex" "$tmp.fm" 2>/dev/null || true)
+done
+
+# ---- Body rules (REVIEW with proximity gate) ----
+body_proximity_re='(you[[:space:]]+(must|should)|base64|[A-Za-z0-9+/]{40,})'
+body_rules=(
+  $'role-hijack-body\tREVIEW\t(ignore|disregard|forget)[[:space:]]+(all[[:space:]]+)?(previous|prior|above)'
+  $'sysprompt-exfil-body\tREVIEW\t(reveal|print|show|leak)[[:space:]]+([a-z]+[[:space:]]+){0,3}(system[[:space:]]+prompt)'
+  $'delim-breakout-body\tREVIEW\t(</system>|<\\|im_(start|end)\\|>)'
+)
+for spec in "${body_rules[@]}"; do
+  IFS=$'\t' read -r rule_id severity regex <<<"$spec"
+  while IFS=':' read -r line rest; do
+    [ -z "$line" ] && continue
+    snippet="${rest:0:200}"
+    snippet="${snippet//$'\t'/ }"
+    if grep -qiE "$soleur_allowlist_re" <<<"$rest"; then
+      continue
+    fi
+    # Proximity gate: require either you-must phrasing OR base64 nearby.
+    # Approximate: search ±3 lines for proximity terms.
+    start=$((line - 3 < 1 ? 1 : line - 3))
+    end=$((line + 3))
+    window="$(sed -n "${start},${end}p" "$tmp.body" 2>/dev/null || true)"
+    if grep -qiE -- "$body_proximity_re" <<<"$window"; then
+      findings_lines+="$rule_id"$'\t'"$severity"$'\t'"$line"$'\t'"$snippet"$'\n'
+    fi
+  done < <(grep -niE -- "$regex" "$tmp.body" 2>/dev/null || true)
+done
+
+# ---- Zero-width characters anywhere → REVIEW ----
+# U+200B U+200C U+200D U+FEFF
+if grep -nP -- '[\x{200B}\x{200C}\x{200D}\x{FEFF}]' "$tmp" >/dev/null 2>&1; then
+  while IFS=':' read -r line rest; do
+    [ -z "$line" ] && continue
+    findings_lines+="zero-width-char"$'\t'"REVIEW"$'\t'"$line"$'\t'"<zero-width-char>"$'\n'
+  done < <(grep -nP -- '[\x{200B}\x{200C}\x{200D}\x{FEFF}]' "$tmp" 2>/dev/null || true)
+fi
+
+verdict="$(printf '%s' "$findings_lines" | findings_to_verdict)"
+findings_json="$(printf '%s' "$findings_lines" | build_findings_array)"
+
+emit_result "$verdict" "prompt-injection" "$findings_json"

package/skills/skill-security-scan/scripts/check-supply-chain.sh

@@ -0,0 +1,219 @@
+#!/usr/bin/env bash
+# Category 3: supply-chain risk via OSV.dev batch API.
+#
+# Self-defense (CPO Decision 11):
+# - Schema-validate response shape (require results array; reject malformed)
+# - Cap response body size at 32 MiB
+# - Ecosystem allowlist; unknown → REVIEW (never LOW-RISK)
+# - Network/5xx → REVIEW (never silent LOW-RISK)
+# - Hardcoded endpoint (no user-controllable redirection)
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+. "$SCRIPT_DIR/lib.sh"
+
+CONFIG="$SCRIPT_DIR/../references/rules/supply-chain.yaml"
+TYPOSQUAT_FILE="$SCRIPT_DIR/../references/typosquat-targets.yaml"
+
+tmp="$(stdin_to_tempfile)"
+trap 'rm -f "$tmp" "$tmp.req"' EXIT
+
+# yaml_list shared helper lives in lib.sh.
+mapfile -t ecosystems < <(yaml_list "$CONFIG" "ecosystem_allowlist")
+
+is_known_ecosystem() {
+  local eco="$1" entry
+  for entry in "${ecosystems[@]}"; do
+    [ -z "$entry" ] && continue
+    [ "$eco" = "$entry" ] && return 0
+  done
+  return 1
+}
+
+findings_lines=""
+queries='[]'
+
+# Detect references to manifest files / deps in body. Heuristic patterns:
+# - `pip install <pkg>` / `npm install <pkg>` / `cargo add <pkg>` / `go get <pkg>`
+# - inline package.json, requirements.txt, pyproject.toml lines
+#
+# `seen` is a dedup hash; `ordered_keys` preserves insertion order so we can
+# attribute OSV results (which are returned in submission order) to packages.
+# Bash associative-array iteration order is NOT insertion order — using `seen`
+# alone produced silent rule_id-to-package misattribution in OSV findings.
+declare -A seen=()
+declare -a ordered_keys=()
+
+add_query() {
+  local pkg="$1" eco="$2" key="$eco:$pkg"
+  [ -n "${seen[$key]:-}" ] && return
+  seen[$key]=1
+  ordered_keys+=("$key")
+  queries="$(echo "$queries" | jq --arg n "$pkg" --arg e "$eco" '. + [{package: {name: $n, ecosystem: $e}}]')"
+}
+
+# pip install <pkg>
+while read -r pkg; do
+  [ -z "$pkg" ] && continue
+  pkg="${pkg%%[<>=!~]*}"  # strip version specifier
+  pkg="${pkg// /}"
+  [ -z "$pkg" ] && continue
+  add_query "$pkg" "PyPI"
+done < <(grep -oE 'pip[[:space:]]+install[[:space:]]+[A-Za-z0-9_.-]+' "$tmp" | awk '{print $NF}')
+
+# npm install <pkg>
+while read -r pkg; do
+  [ -z "$pkg" ] && continue
+  pkg="${pkg// /}"
+  [ -z "$pkg" ] && continue
+  add_query "$pkg" "npm"
+done < <(grep -oE 'npm[[:space:]]+(install|i)[[:space:]]+[@A-Za-z0-9/_.-]+' "$tmp" | awk '{print $NF}' | grep -v '^-' || true)
+
+# cargo add <pkg>
+while read -r pkg; do
+  [ -z "$pkg" ] && continue
+  pkg="${pkg// /}"
+  [ -z "$pkg" ] && continue
+  add_query "$pkg" "crates.io"
+done < <(grep -oE 'cargo[[:space:]]+add[[:space:]]+[A-Za-z0-9_.-]+' "$tmp" | awk '{print $NF}')
+
+# go get <pkg>
+while read -r pkg; do
+  [ -z "$pkg" ] && continue
+  pkg="${pkg// /}"
+  [ -z "$pkg" ] && continue
+  add_query "$pkg" "Go"
+done < <(grep -oE 'go[[:space:]]+get[[:space:]]+[A-Za-z0-9./_-]+' "$tmp" | awk '{print $NF}')
+
+# Typosquat detection (Levenshtein distance ≤ 2 against vendored top-N seed)
+levenshtein() {
+  awk -v a="$1" -v b="$2" 'BEGIN {
+    la=length(a); lb=length(b)
+    if (la == 0) { print lb; exit }
+    if (lb == 0) { print la; exit }
+    for (i=0; i<=la; i++) d[i,0]=i
+    for (j=0; j<=lb; j++) d[0,j]=j
+    for (i=1; i<=la; i++) {
+      for (j=1; j<=lb; j++) {
+        cost = (substr(a,i,1) == substr(b,j,1)) ? 0 : 1
+        v1 = d[i-1,j] + 1
+        v2 = d[i,j-1] + 1
+        v3 = d[i-1,j-1] + cost
+        m = v1; if (v2 < m) m = v2; if (v3 < m) m = v3
+        d[i,j] = m
+      }
+    }
+    print d[la,lb]
+  }'
+}
+
+mapfile -t pypi_targets < <(yaml_list "$TYPOSQUAT_FILE" "PyPI")
+mapfile -t npm_targets < <(yaml_list "$TYPOSQUAT_FILE" "npm")
+
+check_typosquat() {
+  local pkg="$1" eco="$2"
+  local arr
+  case "$eco" in
+    PyPI) arr=("${pypi_targets[@]}") ;;
+    npm)  arr=("${npm_targets[@]}") ;;
+    *)    return 1 ;;
+  esac
+  for target in "${arr[@]}"; do
+    [ -z "$target" ] && continue
+    [ "$pkg" = "$target" ] && return 1   # exact match → not typosquat
+    local dist
+    dist="$(levenshtein "$pkg" "$target")"
+    if [ "$dist" -le 2 ] && [ "$dist" -gt 0 ]; then
+      echo "$target"
+      return 0
+    fi
+  done
+  return 1
+}
+
+# Run typosquat check on each parsed package (iterate insertion-ordered keys
+# so attribution lines stay deterministic — bash hash order is not stable).
+for key in "${ordered_keys[@]}"; do
+  eco="${key%%:*}"
+  pkg="${key#*:}"
+  if target="$(check_typosquat "$pkg" "$eco")"; then
+    findings_lines+="typosquat-suspect"$'\t'"REVIEW"$'\t'"0"$'\t'"$pkg ~ $target ($eco)"$'\n'
+  fi
+  if ! is_known_ecosystem "$eco"; then
+    findings_lines+="unknown-ecosystem"$'\t'"REVIEW"$'\t'"0"$'\t'"$pkg ($eco not in OSV allowlist)"$'\n'
+  fi
+done
+
+# Skip OSV query if no packages or if SKILL_SECURITY_SCAN_OFFLINE=1.
+n_queries="$(echo "$queries" | jq 'length')"
+if [ "$n_queries" -gt 0 ] && [ "${SKILL_SECURITY_SCAN_OFFLINE:-0}" != "1" ]; then
+  request_body="$(jq -cn --argjson q "$queries" '{queries: $q}')"
+  echo "$request_body" > "$tmp.req"
+  # 8s timeout; capture body and HTTP status via -w. Cap body via head -c.
+  http_status="$(curl -sS -X POST \
+    --max-time 8 \
+    --max-filesize 33554432 \
+    -H 'Content-Type: application/json' \
+    -d @"$tmp.req" \
+    -o "$tmp.resp" \
+    -w '%{http_code}' \
+    "https://api.osv.dev/v1/querybatch" 2>/dev/null || echo "000")"
+
+  case "$http_status" in
+    200)
+      # Validate response shape: must have .results array
+      if ! jq -e '.results | type == "array"' "$tmp.resp" >/dev/null 2>&1; then
+        findings_lines+="osv-response-malformed"$'\t'"REVIEW"$'\t'"0"$'\t'"OSV response shape invalid"$'\n'
+      else
+        # Inspect each results[i].vulns
+        n_results="$(jq '.results | length' "$tmp.resp")"
+        # OSV.dev returns results in submission order; iterate insertion-
+        # ordered keys to preserve attribution. Reject mismatched-length
+        # response (per security review P2: MITM 200-with-empty-results).
+        if [ "$n_results" -ne "${#ordered_keys[@]}" ]; then
+          findings_lines+="osv-response-length-mismatch"$'\t'"REVIEW"$'\t'"0"$'\t'"OSV results length $n_results != queries ${#ordered_keys[@]}"$'\n'
+        fi
+        i=0
+        for key in "${ordered_keys[@]}"; do
+          if [ "$i" -ge "$n_results" ]; then break; fi
+          n_vulns="$(jq ".results[$i].vulns // [] | length" "$tmp.resp")"
+          if [ "$n_vulns" -gt 0 ]; then
+            sev="REVIEW"
+            if [ "$n_vulns" -ge 3 ]; then
+              sev="HIGH-RISK"
+            elif jq -e ".results[$i].vulns[] | select(.severity[]?.score | test(\"HIGH|CRITICAL\"; \"i\"))" "$tmp.resp" >/dev/null 2>&1; then
+              sev="HIGH-RISK"
+            fi
+            findings_lines+="osv-advisory"$'\t'"$sev"$'\t'"0"$'\t'"$key has $n_vulns advisory(ies)"$'\n'
+          fi
+          i=$((i + 1))
+        done
+      fi
+      ;;
+    5*)
+      # Retry once on 5xx
+      sleep 1
+      http_status_retry="$(curl -sS -X POST \
+        --max-time 8 \
+        --max-filesize 33554432 \
+        -H 'Content-Type: application/json' \
+        -d @"$tmp.req" \
+        -o "$tmp.resp" \
+        -w '%{http_code}' \
+        "https://api.osv.dev/v1/querybatch" 2>/dev/null || echo "000")"
+      if [ "$http_status_retry" != "200" ]; then
+        findings_lines+="osv-network-failure"$'\t'"REVIEW"$'\t'"0"$'\t'"OSV query failed (HTTP $http_status_retry after retry)"$'\n'
+      fi
+      ;;
+    *)
+      findings_lines+="osv-network-failure"$'\t'"REVIEW"$'\t'"0"$'\t'"OSV query failed (HTTP $http_status)"$'\n'
+      ;;
+  esac
+  rm -f "$tmp.resp" 2>/dev/null || true
+fi
+
+verdict="$(printf '%s' "$findings_lines" | findings_to_verdict)"
+findings_json="$(printf '%s' "$findings_lines" | build_findings_array)"
+
+emit_result "$verdict" "supply-chain" "$findings_json"

package/skills/skill-security-scan/scripts/check-telemetry-surface.sh

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# Category 5: third-party telemetry surface.
+#
+# URL host-aware allowlist (R14): adversarial https://attacker.com/?ref=soleur.ai
+# is detected as host=attacker.com, NOT allowlisted as raw substring.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+. "$SCRIPT_DIR/lib.sh"
+
+ALLOWLIST_FILE="$SCRIPT_DIR/../references/first-party-allowlist.yaml"
+REDIRECT_FILE="$SCRIPT_DIR/../references/redirect-domains.yaml"
+
+tmp="$(stdin_to_tempfile)"
+trap 'rm -f "$tmp"' EXIT
+
+# Load allowlisted domains via the shared yaml_list helper from lib.sh.
+# Strip wildcard prefix `*.` for suffix-matching at use-time.
+mapfile -t allowlist_hosts < <(yaml_list "$ALLOWLIST_FILE" "domains" | sed 's/^\*\.//')
+mapfile -t allowlist_campaigns < <(yaml_list "$ALLOWLIST_FILE" "utm_campaigns")
+mapfile -t redirect_hosts < <(yaml_list "$REDIRECT_FILE" "redirect_hosts")
+mapfile -t tracking_prefixes < <(yaml_list "$REDIRECT_FILE" "tracking_host_prefixes")
+
+# Domain-suffix match. Returns 0 if host is on allowlist (or its subdomain).
+is_allowlisted_host() {
+  local host="$1" entry
+  for entry in "${allowlist_hosts[@]}"; do
+    [ -z "$entry" ] && continue
+    if [ "$host" = "$entry" ] || [[ "$host" == *.${entry} ]]; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+is_redirect_host() {
+  local host="$1" entry
+  for entry in "${redirect_hosts[@]}"; do
+    [ -z "$entry" ] && continue
+    [ "$host" = "$entry" ] && return 0
+    [[ "$host" == *.${entry} ]] && return 0
+  done
+  for entry in "${tracking_prefixes[@]}"; do
+    [ -z "$entry" ] && continue
+    [[ "$host" == ${entry}* ]] && return 0
+  done
+  return 1
+}
+
+is_allowed_campaign() {
+  local camp="$1" entry
+  for entry in "${allowlist_campaigns[@]}"; do
+    [ -z "$entry" ] && continue
+    [ "$camp" = "$entry" ] && return 0
+  done
+  return 1
+}
+
+findings_lines=""
+
+# Extract URLs (http/https) and process each.
+url_re='https?://[^[:space:]<>")]+\>?'
+while IFS=':' read -r line rest; do
+  [ -z "$line" ] && continue
+  # Extract first URL on the line via grep -oE
+  while read -r url; do
+    [ -z "$url" ] && continue
+    # Parse host: strip scheme, then take up to first / or ?
+    nh="${url#http://}"
+    nh="${nh#https://}"
+    host="${nh%%[/?#]*}"
+    host="${host,,}"  # lowercase
+    # Detect utm tag
+    if grep -qE 'utm_(source|medium|campaign|term|content)=' <<<"$url"; then
+      camp="$(echo "$url" | grep -oE 'utm_campaign=[^&[:space:]]+' | head -1 | cut -d'=' -f2)"
+      if is_allowlisted_host "$host"; then
+        # First-party + allowlisted campaign → LOW-RISK; non-allowlisted campaign on first-party host still REVIEW
+        if [ -n "$camp" ] && ! is_allowed_campaign "$camp"; then
+          findings_lines+="utm-non-allowlisted-campaign"$'\t'"REVIEW"$'\t'"$line"$'\t'"host=$host campaign=$camp"$'\n'
+        fi
+      else
+        findings_lines+="utm-non-allowlisted-host"$'\t'"REVIEW"$'\t'"$line"$'\t'"host=$host"$'\n'
+      fi
+    fi
+    # Redirect / tracking host?
+    if is_redirect_host "$host"; then
+      findings_lines+="redirect-tracking-host"$'\t'"HIGH-RISK"$'\t'"$line"$'\t'"host=$host"$'\n'
+    fi
+  done < <(echo "$rest" | grep -oE "$url_re" 2>/dev/null || true)
+done < <(grep -nE -- "$url_re" "$tmp" 2>/dev/null || true)
+
+# Branding-only patterns → finding-level WARN (script reports as REVIEW per Phase 3 mapping).
+# Scope to lines that ALSO contain a URL, markdown link, or image tag —
+# legitimate Soleur prose mentioning the detection itself (e.g., brainstorm.md
+# discussing "'powered by' footers") would otherwise trip the calibration AC.
+brand_re='(powered by|brought to you by|sponsored by)'
+brand_context_re='(https?://|\]\(|<img|!\[)'
+while IFS=':' read -r line rest; do
+  [ -z "$line" ] && continue
+  # Require the branding phrase to co-occur with a URL or markdown link/image
+  # on the same line; bare prose mentions are skipped (FP suppression).
+  if ! grep -qE -- "$brand_context_re" <<<"$rest"; then
+    continue
+  fi
+  snippet="${rest:0:200}"
+  snippet="${snippet//$'\t'/ }"
+  findings_lines+="branding-footer"$'\t'"REVIEW"$'\t'"$line"$'\t'"$snippet"$'\n'
+done < <(grep -niE -- "$brand_re" "$tmp" 2>/dev/null || true)
+
+# Outbound beacon: fetch/axios.post/curl POST in code blocks targeting non-allowlisted hosts.
+# Simplified: any `fetch(...)` or `axios.post(...)` whose URL host is not allowlisted → HIGH-RISK.
+fetch_re='\b(fetch|axios\.post|axios\.put|http\.post)[[:space:]]*\([[:space:]]*["'"'"'`](https?://[^"'"'"'`)[:space:]]+)'
+while IFS= read -r match; do
+  url="$(echo "$match" | grep -oE "$url_re" | head -1)"
+  [ -z "$url" ] && continue
+  nh="${url#http://}"; nh="${nh#https://}"; host="${nh%%[/?#]*}"; host="${host,,}"
+  if ! is_allowlisted_host "$host"; then
+    findings_lines+="outbound-beacon"$'\t'"HIGH-RISK"$'\t'"0"$'\t'"host=$host url=$url"$'\n'
+  fi
+done < <(grep -niE -- "$fetch_re" "$tmp" 2>/dev/null || true)
+
+verdict="$(printf '%s' "$findings_lines" | findings_to_verdict)"
+findings_json="$(printf '%s' "$findings_lines" | build_findings_array)"
+
+emit_result "$verdict" "telemetry-surface" "$findings_json"