border-customs 0.3.1 → 0.3.2

package/README.md

@@ -375,6 +375,39 @@ dropped file to stderr with the sha256 of its original bytes
 (`border scan: crates envelope normalized: <file> sha256=<hex>`); the rebuild regenerates
 them from the normalized manifest, so no scanned byte is silently lost.
 
+### Engines in consumer installs
+
+`dist/index.js` is one self-contained esbuild bundle and every runtime asset (vendored
+gitleaks rules, prompt template, the secretlint fingerprint snapshot) ships inside `dist/`,
+so after `npm i -D border-customs` (or `-g`) the engine surface is:
+
+- **publint** — installed automatically: it is an exact-pinned runtime dependency of the
+  package, invoked via bin resolution (package-local `node_modules/.bin`, the hoisted
+  project-level `node_modules/.bin`, then `PATH`, then `~/.local/bin`). The
+  `publint-fail` leg of the npm artifact stage works out of the box in a consumer install.
+- **secretlint** — no consumer action, ever: the default lint runs **in-process** with the
+  `@secretlint/*` rule modules already declared as border's own runtime dependencies
+  (`src/engines/secretlint.ts` header). The `mode: "cli"` fallback that spawns a
+  `secretlint` binary is border-internal (test transport); it is not reachable from
+  `border.yaml` or any flag, so installing `secretlint` into your project changes nothing
+  for border. If the engine probe cannot read the bundled lock snapshot
+  (`dist/assets/package-lock.json`), the run fails closed as `DEGRADED-ENGINE` exit 2 —
+  never a silent pass.
+- **gitleaks** — stays external, same posture as `git`: border vendors the 8.30.1 rule
+  config but the binary is yours (on `PATH` or `~/.local/bin/gitleaks`; see the
+  requirements paragraph at the top and `src/engines/ADAPTER-CONTRACT.md`). Missing
+  gitleaks means `border check` records a CRITICAL `DEGRADED-ENGINE` finding and exits 2,
+  and `border scan` exits 2 with `engine binary 'gitleaks' not found; border fails
+  closed`. Neither command degrades to a skip.
+- **trufflehog** — optional third engine, external binary, same posture as gitleaks once
+  enabled: `engines.trufflehog: true` puts it in the required set, and an absent binary
+  degrades the run to exit 2 exactly like a missing gitleaks.
+
+There is no "engine absent ⇒ leg silently skipped" state anywhere: missing required
+engines are exit 2 (`2` = the gate could not answer, see
+[Exit codes](#exit-codes-the-contract)), and the ledger refuses to write a PASS for a
+degraded run.
+
 ## Configuration
 
 Everything border can be told lives in `border.yaml` at the repo root. Unknown keys are
@@ -541,6 +574,19 @@ same one that wrote the commit) how to run the five subcommands, how to produce
 
 ## Changelog
 
+### 0.3.2 (2026-09-10)
+- Fix: CLI invoked through the npm `.bin` shim silently exited 0 without running
+  (entrypoint detection now realpath-canonicalizes both sides). Regression-locked by a
+  pack -> install -> shim-invocation test (`BORDER_PACK_TEST=1`, wired into CI).
+- Fix: `publint` is an exact-pinned runtime dependency, so `border scan`/npm checks work
+  out of the box in consumer installs; README documents the engine posture truthfully.
+- Add: release-coherence seed test pinning the scan User-Agent version to package.json.
+
+### 0.3.1 (2026-09-10)
+- Add: `border scan [ecosystem:]name@version` — static residue inspection of third-party
+  registry packages (npm/PyPI/crates.io/RubyGems), ledger-free by design.
+- Docs: README scan section; crates envelope normalization now logs scrubbed-file hashes.
+
 ### 0.3.0 (2026-09-09)
 
 - **Residue gate (artifact stage).** The blanket install-hook CRITICAL becomes a classified

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "border-customs",
-  "version": "0.1.0",
+  "version": "0.3.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "border",
-      "version": "0.1.0",
+      "name": "border-customs",
+      "version": "0.3.1",
       "license": "MIT",
       "dependencies": {
         "@secretlint/core": "13.0.5",
@@ -14,6 +14,7 @@
         "@secretlint/secretlint-rule-no-homedir": "13.0.5",
         "@secretlint/secretlint-rule-pattern": "13.0.5",
         "@secretlint/secretlint-rule-preset-recommend": "13.0.5",
+        "publint": "0.3.24",
         "yaml": "2.9.0",
         "zod": "4.5.4"
       },
@@ -23,7 +24,6 @@
       "devDependencies": {
         "@types/node": "22.19.0",
         "esbuild": "0.25.12",
-        "publint": "0.3.24",
         "secretlint": "13.0.5",
         "typescript": "5.9.3",
         "verdaccio": "6.10.2"
@@ -601,7 +601,6 @@
       "version": "0.1.7",
       "resolved": "https://registry.npmjs.org/@publint/pack/-/pack-0.1.7.tgz",
       "integrity": "sha512-4EDEmvxWtgsCnnVeBvtFIFZtUhPPt1+bA9JrSwU4Sa//6oKtzCSlGGXYJr44OD9aGISymbieJ4mCKHUygUDU+g==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "tinyexec": "^1.3.0"
@@ -3821,7 +3820,6 @@
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/mri/-/mri-1.2.0.tgz",
       "integrity": "sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=4"
@@ -3982,7 +3980,6 @@
       "version": "1.8.0",
       "resolved": "https://registry.npmjs.org/package-manager-detector/-/package-manager-detector-1.8.0.tgz",
       "integrity": "sha512-yQA4H19AmPEoMUeavPMDIe1higySl/gH/yaQrkT/s07Qp+7pp2hYz30N3z2l5BkjVkF9Ow6o0wjJamm2y7Sn0A==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/pako": {
@@ -4073,7 +4070,6 @@
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
       "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
-      "dev": true,
       "license": "ISC"
     },
     "node_modules/picomatch": {
@@ -4255,7 +4251,6 @@
       "version": "0.3.24",
       "resolved": "https://registry.npmjs.org/publint/-/publint-0.3.24.tgz",
       "integrity": "sha512-9zS56KrKBoqi5Qt8h92uMP8TTM9AYZSgnmCo4u2priMqkOZvQnTsziZ2p5LJ2ywbYkAjoCDp2jda9u4cgFefIw==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@publint/pack": "^0.1.7",
@@ -4551,7 +4546,6 @@
       "version": "1.8.1",
       "resolved": "https://registry.npmjs.org/sade/-/sade-1.8.1.tgz",
       "integrity": "sha512-xal3CZX1Xlo/k4ApwCFrHVACi9fBqJ7V+mwhBsuf/1IOKbBy098Fex+Wa/5QMubw09pSZ/u8EY8PWgevJsXp1A==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "mri": "^1.1.0"
@@ -5231,7 +5225,6 @@
       "version": "1.3.1",
       "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.3.1.tgz",
       "integrity": "sha512-GCvB3aoys96IuDFBMcTB46JOR6mdMtAToqwiW8JlWhsoh1mhHi/xn9ss/Dg7N555GiJyEt2qzoG/NHCwM6h1EA==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=18"

package/dist/index.js

@@ -13028,7 +13028,8 @@ var require_micromatch = __commonJS({
 });
 
 // src/index.ts
-import { pathToFileURL } from "node:url";
+import { realpathSync } from "node:fs";
+import { fileURLToPath as fileURLToPath5, pathToFileURL } from "node:url";
 
 // src/cli.ts
 import { parseArgs } from "node:util";
@@ -37896,10 +37897,14 @@ var NPM_TARGET_LABEL = "artifact";
 var DEFAULT_TOOL_TIMEOUT_MS = 12e4;
 var MESSAGE_TAIL_CHARS = 600;
 var HERE = dirname3(fileURLToPath3(import.meta.url));
-var PUBLINT_LOCAL_BINS = [
-  join6(HERE, "..", "node_modules", ".bin", "publint"),
-  join6(HERE, "..", "..", "node_modules", ".bin", "publint")
-];
+function publintLocalBins(here) {
+  return [
+    join6(here, "..", "node_modules", ".bin", "publint"),
+    join6(here, "..", "..", "node_modules", ".bin", "publint"),
+    join6(here, "..", "..", ".bin", "publint")
+  ];
+}
+var PUBLINT_LOCAL_BINS = publintLocalBins(HERE);
 function tail(text) {
   const trimmed = text.trim();
   return trimmed.length > MESSAGE_TAIL_CHARS ? `${trimmed.slice(-MESSAGE_TAIL_CHARS)}\u2026` : trimmed;
@@ -43465,7 +43470,7 @@ import { createHash as createHash15 } from "node:crypto";
 import { basename as basename4 } from "node:path";
 var SCAN_MAX_ARTIFACT_BYTES = 200 * 1024 * 1024;
 var SCAN_REQUEST_TIMEOUT_MS = 6e4;
-var SCAN_USER_AGENT = "border-customs/0.3.0 (+https://github.com/sumteclab/border; border scan)";
+var SCAN_USER_AGENT = "border-customs/0.3.2 (+https://github.com/sumteclab/border; border scan)";
 var CRATES_DOWNLOAD_HOST = "https://static.crates.io";
 var defaultScanFetcher = async (url2, init) => {
   if (!/^https?:\/\//.test(url2)) throw new EngineRunError(`border scan refuses non-http(s) URL: ${url2}`, null);
@@ -43986,11 +43991,18 @@ function run(argv, stdout = (line) => {
 }
 
 // src/index.ts
-function isMainModule() {
-  const entry = process.argv[1];
-  return entry !== void 0 && import.meta.url === pathToFileURL(entry).href;
+function isMainModule({ argv1, moduleUrl, realpath }) {
+  if (argv1 === void 0) return false;
+  const canonical = (p) => {
+    try {
+      return realpath(p);
+    } catch {
+      return p;
+    }
+  };
+  return pathToFileURL(canonical(argv1)).href === pathToFileURL(canonical(fileURLToPath5(moduleUrl))).href;
 }
-if (isMainModule()) {
+if (isMainModule({ argv1: process.argv[1], moduleUrl: import.meta.url, realpath: realpathSync.native })) {
   const outcome = run(process.argv.slice(2));
   process.exitCode = outcome instanceof Promise ? await outcome : outcome;
 }
@@ -43999,6 +44011,7 @@ export {
   EXIT_ERROR,
   EXIT_PASS,
   SUBCOMMANDS,
+  isMainModule,
   run,
   translateError,
   usage

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "border-customs",
-  "version": "0.3.1",
+  "version": "0.3.2",
+  "//": "publint is a runtime dep (exact pin): the npm-stage engine is invoked via bin resolution against the installed layout, so consumers get the publint-fail leg out of the box; the dev suite resolves the same node_modules/.bin/publint — no devDependencies entry is needed for it to stay green.",
   "description": "Fail-closed git push gate: secret scanning + supply-chain checks before any remote leaves the machine",
   "type": "module",
   "bin": {
@@ -30,13 +31,13 @@
     "@secretlint/secretlint-rule-no-homedir": "13.0.5",
     "@secretlint/secretlint-rule-pattern": "13.0.5",
     "@secretlint/secretlint-rule-preset-recommend": "13.0.5",
+    "publint": "0.3.24",
     "yaml": "2.9.0",
     "zod": "4.5.4"
   },
   "devDependencies": {
     "@types/node": "22.19.0",
     "esbuild": "0.25.12",
-    "publint": "0.3.24",
     "secretlint": "13.0.5",
     "typescript": "5.9.3",
     "verdaccio": "6.10.2"