border-customs 0.4.1 → 0.5.0

package/dist/index.js

@@ -13029,7 +13029,7 @@ var require_micromatch = __commonJS({
 
 // src/index.ts
 import { realpathSync } from "node:fs";
-import { fileURLToPath as fileURLToPath5, pathToFileURL } from "node:url";
+import { fileURLToPath as fileURLToPath6, pathToFileURL } from "node:url";
 
 // src/cli.ts
 import { parseArgs } from "node:util";
@@ -37940,12 +37940,12 @@ function packOnce(o) {
     throw new EngineRunError(`npm pack reported '${report.filename}' but no tarball landed in ${o.distDir}`, null);
   }
   const data = readFileSync3(tarballAbs);
-  const sha2563 = createHash3("sha256").update(data).digest("hex");
+  const sha2564 = createHash3("sha256").update(data).digest("hex");
   const sha1 = createHash3("sha1").update(data).digest("hex");
   if (sha1 !== report.shasum || data.byteLength !== report.size) {
     throw new EngineRunError(`npm pack report disagrees with the tarball bytes for ${report.filename} \u2014 corrupted or swapped artifact, failing closed`, null);
   }
-  return { filename: report.filename, sha256: sha2563, bytes: data.byteLength, tarballAbs };
+  return { filename: report.filename, sha256: sha2564, bytes: data.byteLength, tarballAbs };
 }
 function publintFinding(o, tarballAbs, identity) {
   const candidates = o.publintBinPath !== void 0 ? [o.publintBinPath] : [
@@ -38950,7 +38950,7 @@ async function runNpmArtifactStage(o) {
   const stateDir = join10(repoDir, BORDER_STATE_DIR);
   const distDir = join10(stateDir, "dist");
   mkdirSync3(distDir, { recursive: true });
-  const { filename, sha256: sha2563, bytes, tarballAbs } = packOnce({
+  const { filename, sha256: sha2564, bytes, tarballAbs } = packOnce({
     repoDir,
     distDir,
     ...o.env !== void 0 ? { env: o.env } : {},
@@ -38958,7 +38958,7 @@ async function runNpmArtifactStage(o) {
     ...o.npmTimeoutMs !== void 0 ? { npmTimeoutMs: o.npmTimeoutMs } : {}
   });
   const findings = [];
-  const extractDir = join10(stateDir, "tmp", sha2563.slice(0, 8));
+  const extractDir = join10(stateDir, "tmp", sha2564.slice(0, 8));
   rmSync3(extractDir, { recursive: true, force: true });
   mkdirSync3(extractDir, { recursive: true });
   try {
@@ -39063,7 +39063,7 @@ async function runNpmArtifactStage(o) {
   if (publint !== null) findings.push(publint);
   return {
     findings,
-    artifact: { file: `${BORDER_STATE_DIR}/dist/${filename}`, sha256: sha2563, bytes }
+    artifact: { file: `${BORDER_STATE_DIR}/dist/${filename}`, sha256: sha2564, bytes }
   };
 }
 
@@ -39707,6 +39707,7 @@ import { spawnSync as spawnSync7 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
 import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, readdirSync as readdirSync4, rmSync as rmSync5 } from "node:fs";
 import { join as join13 } from "node:path";
+import { gunzipSync as gunzipSync2 } from "node:zlib";
 
 // src/artifacts/rubygems.ts
 import { createHash as createHash6 } from "node:crypto";
@@ -40144,9 +40145,9 @@ async function runRubygemsArtifactStage(o) {
     throw new EngineRunError(`gem build produced no ${gemName} in ${relative3(repoDir, distDir)} \u2014 failing closed (was the gemspec's literal name/version re-read?)`, null);
   }
   const bytes = readFileSync7(dist);
-  const sha2563 = createHash6("sha256").update(bytes).digest("hex");
+  const sha2564 = createHash6("sha256").update(bytes).digest("hex");
   const findings = [];
-  const extractDir = join12(stateDir, "tmp", sha2563.slice(0, 8));
+  const extractDir = join12(stateDir, "tmp", sha2564.slice(0, 8));
   rmSync4(extractDir, { recursive: true, force: true });
   mkdirSync4(extractDir, { recursive: true });
   const dataDir = `${extractDir}-data`;
@@ -40224,7 +40225,7 @@ async function runRubygemsArtifactStage(o) {
   }
   return {
     findings,
-    artifact: { file: `${BORDER_STATE_DIR}/dist/${gemName}`, sha256: sha2563, bytes: bytes.length }
+    artifact: { file: `${BORDER_STATE_DIR}/dist/${gemName}`, sha256: sha2564, bytes: bytes.length }
   };
 }
 
@@ -40235,6 +40236,64 @@ function artifactTargets() {
 function sha256File(path4) {
   return createHash7("sha256").update(readFileSync8(path4)).digest("hex");
 }
+function octalField(block, start, end) {
+  const text = block.subarray(start, end).toString("utf8").replace(/[\0 ].*$/, "");
+  if (text === "") return 0;
+  if (!/^[0-7]+$/.test(text)) return null;
+  return Number.parseInt(text, 8);
+}
+function tarEntries(buf) {
+  const magic = buf.subarray(257, 263).toString("latin1");
+  if (!magic.startsWith("ustar")) return null;
+  const out = [];
+  let off = 0;
+  while (off + 512 <= buf.length) {
+    const header = buf.subarray(off, off + 512);
+    if (header.every((b) => b === 0)) return out;
+    const size = octalField(header, 124, 136);
+    if (size === null) return null;
+    const mode = octalField(header, 100, 108);
+    if (mode === null) return null;
+    const typeFlag = header[156] ?? 48;
+    const body = off + 512;
+    if (body + size > buf.length) return null;
+    const name = header.subarray(0, 100).toString("utf8").replace(/\0.*$/, "");
+    const linkName = header.subarray(157, 257).toString("utf8").replace(/\0.*$/, "");
+    if (typeFlag !== 120 && typeFlag !== 103 && typeFlag !== 76 && typeFlag !== 75) {
+      out.push({ name, member: { content: buf.subarray(body, body + size), typeFlag, mode, linkName } });
+    }
+    off = body + Math.ceil(size / 512) * 512;
+  }
+  return out;
+}
+var GEM_METADATA_STAMP_RE = /^(rubygems_version|gem_version|date):/;
+var GEM_LEGACY_EMPTY_RE = /^(autorequire|description|email|homepage|post_install_message|signing_key):[ ]*$/;
+function sha256Hex(buf) {
+  return createHash7("sha256").update(buf).digest("hex");
+}
+function gemContentDigest(bytes) {
+  const outer = tarEntries(bytes);
+  if (outer === null) return null;
+  const meta3 = outer.find((e) => e.name === "metadata.gz")?.member;
+  const data = outer.find((e) => e.name === "data.tar.gz")?.member;
+  if (meta3 === void 0 || data === void 0) return null;
+  let metadata;
+  let inner;
+  try {
+    metadata = gunzipSync2(meta3.content).toString("utf8");
+    inner = gunzipSync2(data.content);
+  } catch {
+    return null;
+  }
+  const innerEntries = tarEntries(inner);
+  if (innerEntries === null) return null;
+  const chain = createHash7("sha256");
+  for (const { name, member: m } of innerEntries) {
+    chain.update(name).update("\0").update(String(m.typeFlag)).update("\0").update(String(m.mode & 73)).update("\0").update(m.linkName).update("\0").update(sha256Hex(m.content)).update("\0");
+  }
+  const metaStripped = metadata.split("\n").filter((line) => !GEM_METADATA_STAMP_RE.test(line) && !GEM_LEGACY_EMPTY_RE.test(line)).join("\n");
+  return createHash7("sha256").update("border-gem-content-v1\0").update(chain.digest("hex")).update("\0").update(metaStripped).digest("hex");
+}
 var packSeq = 0;
 function packNpmArtifacts(repoDir, o = {}) {
   packSeq += 1;
@@ -40292,7 +40351,10 @@ function packRubygemsArtifacts(repoDir, o = {}) {
     if (r.error !== void 0 || r.status !== 0) return null;
     const files = readdirSync4(dest).filter((f) => f.endsWith(".gem")).sort();
     if (files.length === 0) return null;
-    return files.map((f) => ({ file: f, sha256: sha256File(join13(dest, f)) }));
+    return files.map((f) => {
+      const raw = readFileSync8(join13(dest, f));
+      return { file: f, sha256: sha256Hex(raw), contentDigest: gemContentDigest(raw) };
+    });
   } finally {
     rmSync5(dest, { recursive: true, force: true });
   }
@@ -40305,11 +40367,30 @@ var REPACKERS = {
 function repackChannels() {
   return publishChannels().filter((c) => c.freshness === "repack").map((c) => c.id);
 }
-function sameArtifacts(a, b, extensions) {
-  const digests = (xs) => xs.filter((x) => extensions.some((ext) => x.file.slice(x.file.lastIndexOf("/") + 1).endsWith(ext))).map((x) => `${x.file.slice(x.file.lastIndexOf("/") + 1)}\0${x.sha256}`).sort();
+function gemParity(entry, repoDir) {
+  if (entry.contentDigest !== void 0) return entry.contentDigest;
+  try {
+    return gemContentDigest(readFileSync8(join13(repoDir, entry.file)));
+  } catch {
+    return null;
+  }
+}
+function sameArtifacts(a, b, extensions, repoDir) {
+  const digests = (xs) => {
+    const out = [];
+    for (const x of xs) {
+      const base = x.file.slice(x.file.lastIndexOf("/") + 1);
+      const ext = extensions.find((e) => base.endsWith(e));
+      if (ext === void 0) continue;
+      const parity = ext === ".gem" ? gemParity(x, repoDir) : x.sha256;
+      if (parity === null) return null;
+      out.push(`${base}\0${parity}`);
+    }
+    return out.sort();
+  };
   const ka = digests(a);
   const kb = digests(b);
-  return ka.length === kb.length && ka.every((x, i) => x === kb[i]);
+  return ka !== null && kb !== null && ka.length === kb.length && ka.every((x, i) => x === kb[i]);
 }
 function verifyArtifactFreshness(record2, ctx, repoDir, o = {}) {
   if (!record2.effectiveTargets.some((t) => artifactTargets().includes(t))) return true;
@@ -40331,7 +40412,8 @@ function verifyArtifactFreshness(record2, ctx, repoDir, o = {}) {
     needed.flatMap((id) => {
       const channel = publishChannels().find((c) => c.id === id);
       return channel?.artifactExtensions ?? [];
-    })
+    }),
+    repoDir
   );
 }
 
@@ -40809,17 +40891,17 @@ function requirePassedRecord(kind, i) {
 function rehashRecordedArtifacts(kind, extensions, record2, repoDir) {
   const conventions = extensions;
   const entries = (record2.artifacts ?? []).filter((a) => conventions.some((ext) => a.file.endsWith(ext)));
-  const fail3 = (detail) => ({ ok: false, message: `artifact changed since check \u2014 ${detail}` });
+  const fail4 = (detail) => ({ ok: false, message: `artifact changed since check \u2014 ${detail}` });
   if (entries.length === 0) {
-    return fail3(`the PASSED check recorded no ${kind} artifacts (${conventions.join("/")}) to re-verify`);
+    return fail4(`the PASSED check recorded no ${kind} artifacts (${conventions.join("/")}) to re-verify`);
   }
   const files = [];
   for (const a of entries) {
     const rel = join17(DIST_DIR, basename4(a.file));
     const abs = join17(repoDir, rel);
-    if (!existsSync11(abs)) return fail3(`${rel} is missing from the working tree`);
+    if (!existsSync11(abs)) return fail4(`${rel} is missing from the working tree`);
     const digest2 = createHash10("sha256").update(readFileSync10(abs)).digest("hex");
-    if (digest2 !== a.sha256) return fail3(`${rel} no longer hashes to the digest recorded by the check`);
+    if (digest2 !== a.sha256) return fail4(`${rel} no longer hashes to the digest recorded by the check`);
     files.push(rel);
   }
   return { ok: true, files: files.sort() };
@@ -41278,7 +41360,7 @@ function npmExposureCoords(cfg, read) {
   return { name, version: version2 };
 }
 function classifyNpmVersionView(o) {
-  const fail3 = (why) => {
+  const fail4 = (why) => {
     throw new EngineRunError(
       `npm registry probe inconclusive (${why}); refusing to assume the version is absent \u2014 registry unreachable or returned unexpected output, push blocked until the probe succeeds`,
       o.status
@@ -41286,19 +41368,19 @@ function classifyNpmVersionView(o) {
   };
   if (o.status === 0) {
     const text = o.stdout.trim();
-    if (text.length === 0) return fail3("exit 0 with empty stdout");
+    if (text.length === 0) return fail4("exit 0 with empty stdout");
     let body;
     try {
       body = JSON.parse(text);
     } catch {
-      return fail3("exit 0 with malformed JSON body");
+      return fail4("exit 0 with malformed JSON body");
     }
-    if (typeof body !== "object" || body === null) return fail3("exit 0 with non-object JSON body");
+    if (typeof body !== "object" || body === null) return fail4("exit 0 with non-object JSON body");
     return "present";
   }
   if (/code E404\b/.test(o.stderr) || /\b404 Not Found\b/.test(o.stderr)) return "absent";
   const m = /code (E[A-Z0-9_]+|ERR_[A-Z0-9_]+)/.exec(o.stderr);
-  return fail3(m === null ? `exit ${String(o.status)} without a 404 marker` : `npm error ${m[1]}`);
+  return fail4(m === null ? `exit ${String(o.status)} without a 404 marker` : `npm error ${m[1]}`);
 }
 function npmNameClaimed(o) {
   if (o.status === 0) return true;
@@ -41705,9 +41787,9 @@ async function runCargoArtifactStage(o) {
     const dist = join18(distDir, crateName);
     renameSync(packed, dist);
     const bytes = readFileSync11(dist);
-    const sha2563 = createHash11("sha256").update(bytes).digest("hex");
+    const sha2564 = createHash11("sha256").update(bytes).digest("hex");
     const findings = [];
-    const extractDir = join18(stateDir, "tmp", sha2563.slice(0, 8));
+    const extractDir = join18(stateDir, "tmp", sha2564.slice(0, 8));
     rmSync8(extractDir, { recursive: true, force: true });
     mkdirSync8(extractDir, { recursive: true });
     try {
@@ -41760,7 +41842,7 @@ async function runCargoArtifactStage(o) {
     }
     return {
       findings,
-      artifact: { file: `${BORDER_STATE_DIR}/dist/${crateName}`, sha256: sha2563, bytes: bytes.length }
+      artifact: { file: `${BORDER_STATE_DIR}/dist/${crateName}`, sha256: sha2564, bytes: bytes.length }
     };
   } finally {
     rmSync8(targetDir, { recursive: true, force: true });
@@ -43618,6 +43700,193 @@ async function runLlmRequest(ctx) {
   return runLlmRequestCore(ctx);
 }
 
+// src/commands/opencode.ts
+import { createHash as createHash15 } from "node:crypto";
+import { existsSync as existsSync17, lstatSync, mkdirSync as mkdirSync11, readFileSync as readFileSync16, rmSync as rmSync12, writeFileSync as writeFileSync7 } from "node:fs";
+import os3 from "node:os";
+import { dirname as dirname12, join as join26 } from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
+var PLUGIN_MARKER = "// border-opencode-plugin v";
+var COMMAND_MARKER = "<!-- border-opencode-command -->";
+function opencodeConfigRoot(env2) {
+  const xdg = env2["XDG_CONFIG_HOME"] ?? "";
+  if (xdg.length > 0) return xdg;
+  const home = env2["HOME"] ?? "";
+  return join26(home.length > 0 ? home : os3.homedir(), ".config");
+}
+function resolvePluginAsset(moduleUrl, fileName) {
+  const here = dirname12(fileURLToPath5(moduleUrl));
+  const candidates = [
+    join26(here, "..", "plugin", fileName),
+    // dist mode (bundled): <root>/plugin/<f>
+    join26(here, "..", "..", "plugin", fileName)
+    // src mode: <root>/plugin/<f>
+  ];
+  return candidates.find((p) => existsSync17(p)) ?? candidates[1];
+}
+function targetsFor(env2) {
+  const root = join26(opencodeConfigRoot(env2), "opencode");
+  return [
+    { fileName: "border.ts", destination: join26(root, "plugins", "border.ts"), marker: PLUGIN_MARKER },
+    { fileName: "border-command.md", destination: join26(root, "commands", "border.md"), marker: COMMAND_MARKER }
+  ];
+}
+function sha2563(bytes) {
+  return createHash15("sha256").update(bytes).digest("hex");
+}
+function firstLine(bytes) {
+  const text = bytes.toString("utf8");
+  const newline = text.indexOf("\n");
+  return newline < 0 ? text : text.slice(0, newline);
+}
+function carriesMarker(bytes, marker) {
+  return firstLine(bytes).startsWith(marker);
+}
+function fail(ctx, message) {
+  ctx.stderr(`border: opencode: ${message}`);
+  return EXIT_ERROR;
+}
+function readPackagedAsset(ctx, fileName) {
+  const source = resolvePluginAsset(import.meta.url, fileName);
+  try {
+    return readFileSync16(source);
+  } catch {
+    ctx.stderr(`border: opencode: packaged asset is missing (${source})`);
+    ctx.stderr("border: opencode: the border install looks broken \u2014 `npm i -g border-customs` or a fresh checkout should carry plugin/.");
+    return null;
+  }
+}
+function readTarget(destination) {
+  try {
+    return readFileSync16(destination);
+  } catch {
+    return null;
+  }
+}
+function requirePlainDestination(ctx, destination) {
+  let shape;
+  try {
+    shape = lstatSync(destination);
+  } catch {
+    return null;
+  }
+  if (!shape.isFile() || shape.isSymbolicLink()) {
+    return fail(
+      ctx,
+      `refusing to touch ${destination} \u2014 the path exists but is not a plain regular file (directories and symlinks are never followed, entered, or destroyed)`
+    );
+  }
+  return null;
+}
+function classify(target, current, packaged) {
+  if (current === null) return "absent";
+  if (!carriesMarker(current, target.marker)) return "foreign";
+  return current.equals(packaged) ? "up-to-date" : "outdated";
+}
+function requireNoForeign(ctx, targets) {
+  for (const target of targets) {
+    const shape = requirePlainDestination(ctx, target.destination);
+    if (shape !== null) return shape;
+    const current = readTarget(target.destination);
+    if (current !== null && !carriesMarker(current, target.marker)) {
+      return fail(
+        ctx,
+        `refusing to touch ${target.destination} \u2014 the file exists but is not ours (its first line lacks the marker '${target.marker}'); move it aside manually, nothing was written anywhere`
+      );
+    }
+  }
+  return null;
+}
+function prepareTargets(ctx, targets) {
+  const prepared = [];
+  for (const target of targets) {
+    const packaged = readPackagedAsset(ctx, target.fileName);
+    if (packaged === null) return null;
+    prepared.push({ target, packaged });
+  }
+  return prepared;
+}
+function opencodeInstall(ctx) {
+  const targets = targetsFor(ctx.env);
+  const prepared = prepareTargets(ctx, targets);
+  if (prepared === null) return EXIT_ERROR;
+  const blocked = requireNoForeign(ctx, targets);
+  if (blocked !== null) return blocked;
+  for (const { target, packaged } of prepared) {
+    const current = readTarget(target.destination);
+    const state = classify(target, current, packaged);
+    if (state === "foreign") {
+      return fail(
+        ctx,
+        `refusing to touch ${target.destination} \u2014 the file exists but is not ours (its first line lacks the marker '${target.marker}'); move it aside manually, nothing was written anywhere`
+      );
+    }
+    if (state === "up-to-date") {
+      ctx.stdout(`${target.destination}: up to date`);
+      continue;
+    }
+    mkdirSync11(dirname12(target.destination), { recursive: true });
+    writeFileSync7(target.destination, packaged);
+    ctx.stdout(`${target.destination}: ${state === "outdated" ? "updated" : "installed"}`);
+  }
+  ctx.stdout("note: restart opencode to load the plugin \u2014 tools and commands are scanned at startup.");
+  return EXIT_PASS;
+}
+function opencodeStatus(ctx) {
+  const targets = targetsFor(ctx.env);
+  const prepared = prepareTargets(ctx, targets);
+  if (prepared === null) return EXIT_ERROR;
+  for (const { target, packaged } of prepared) {
+    const current = readTarget(target.destination);
+    const state = classify(target, current, packaged);
+    const installedSha = current === null ? "-" : sha2563(current);
+    ctx.stdout(`${target.destination}: ${state}  installed=${installedSha}  packaged=${sha2563(packaged)}`);
+  }
+  return EXIT_PASS;
+}
+function opencodeUninstall(ctx) {
+  const targets = targetsFor(ctx.env);
+  const blocked = requireNoForeign(ctx, targets);
+  if (blocked !== null) return blocked;
+  for (const target of targets) {
+    const current = readTarget(target.destination);
+    if (current === null) {
+      ctx.stdout(`${target.destination}: absent (nothing to remove)`);
+      continue;
+    }
+    if (!carriesMarker(current, target.marker)) {
+      return fail(
+        ctx,
+        `refusing to remove ${target.destination} \u2014 the file is not ours (its first line lacks the marker '${target.marker}'); nothing was removed anywhere`
+      );
+    }
+    rmSync12(target.destination);
+    ctx.stdout(`${target.destination}: removed`);
+  }
+  ctx.stdout("note: restart opencode for the tool and command to disappear.");
+  return EXIT_PASS;
+}
+function runOpencode(ctx) {
+  const [sub, ...rest] = ctx.positionals;
+  if (rest.length > 0) {
+    throw new UnknownArgError(
+      `opencode ${sub ?? "<none>"}: unexpected argument '${rest[0] ?? ""}' \u2014 usage: border opencode install | status | uninstall`
+    );
+  }
+  switch (sub) {
+    case "install":
+      return opencodeInstall(ctx);
+    case "status":
+      return opencodeStatus(ctx);
+    case "uninstall":
+      return opencodeUninstall(ctx);
+    default:
+      throw new UnknownArgError(
+        `opencode: unknown subcommand '${sub ?? "<none>"}' \u2014 usage: border opencode install | status | uninstall`
+      );
+  }
+}
+
 // src/push/git.ts
 import { spawnSync as spawnSync15 } from "node:child_process";
 var DIVERGED_MESSAGE = "history diverged; border never force-pushes; resolve manually";
@@ -43883,17 +44152,17 @@ async function executeYesPush(ctx, loaded) {
 }
 
 // src/roundtrip/orchestrate.ts
-import { mkdtempSync as mkdtempSync5, rmSync as rmSync12, writeFileSync as writeFileSync7 } from "node:fs";
+import { mkdtempSync as mkdtempSync5, rmSync as rmSync13, writeFileSync as writeFileSync8 } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 
 // src/scan/fetch.ts
-import { createHash as createHash15 } from "node:crypto";
+import { createHash as createHash16 } from "node:crypto";
 import { basename as basename5 } from "node:path";
 var SCAN_MAX_ARTIFACT_BYTES = 200 * 1024 * 1024;
 var SCAN_REQUEST_TIMEOUT_MS = 6e4;
-var SCAN_USER_AGENT = "border-customs/0.4.1 (+https://github.com/sumteclab/border; border scan)";
+var SCAN_USER_AGENT = "border-customs/0.5.0 (+https://github.com/sumteclab/border; border scan)";
 var CRATES_DOWNLOAD_HOST = "https://static.crates.io";
 var defaultScanFetcher = async (url2, init) => {
   if (!/^https?:\/\//.test(url2)) throw new EngineRunError(`border scan refuses non-http(s) URL: ${url2}`, null);
@@ -43918,19 +44187,19 @@ var defaultScanFetcher = async (url2, init) => {
     }
   };
 };
-var fail = (why) => {
+var fail2 = (why) => {
   throw new EngineRunError(`border scan could not fetch the artifact (${why}) \u2014 refusing to scan a partial or absent download (fail-closed)`, null);
 };
 async function readCapped(res, url2, cap = SCAN_MAX_ARTIFACT_BYTES) {
-  if (res.status !== 200) fail(`HTTP ${String(res.status)} for ${url2}`);
+  if (res.status !== 200) fail2(`HTTP ${String(res.status)} for ${url2}`);
   if (res.contentLength !== null && res.contentLength > cap) {
-    fail(`${url2} announces ${String(res.contentLength)} bytes, over the 200 MiB scan size cap`);
+    fail2(`${url2} announces ${String(res.contentLength)} bytes, over the 200 MiB scan size cap`);
   }
   const parts = [];
   let total = 0;
   for await (const chunk of res.chunks()) {
     total += chunk.byteLength;
-    if (total > cap) fail(`${url2} streams past the 200 MiB scan size cap after ${String(total)} bytes`);
+    if (total > cap) fail2(`${url2} streams past the 200 MiB scan size cap after ${String(total)} bytes`);
     parts.push(Buffer.from(chunk));
   }
   return Buffer.concat(parts);
@@ -43944,7 +44213,7 @@ async function fetchJson(fetcher, url2, timeoutMs) {
   try {
     return JSON.parse(body.toString("utf8"));
   } catch {
-    fail(`metadata response from ${url2} is not valid JSON`);
+    fail2(`metadata response from ${url2} is not valid JSON`);
   }
 }
 var isRecord2 = (v) => typeof v === "object" && v !== null;
@@ -43980,11 +44249,11 @@ async function fetchArtifact(spec, o) {
       const meta3 = await fetchJson(o.fetcher, npmMetadataUrl(spec.name, spec.version), timeoutMs);
       const dist = isRecord2(meta3) && isRecord2(meta3["dist"]) ? meta3["dist"] : {};
       const tarball = dist["tarball"];
-      if (typeof tarball !== "string" || tarball.length === 0) fail(`npm metadata for ${label} has no dist.tarball`);
-      if (!/^https?:\/\//.test(tarball)) fail(`npm dist.tarball for ${label} is not an http(s) URL`);
+      if (typeof tarball !== "string" || tarball.length === 0) fail2(`npm metadata for ${label} has no dist.tarball`);
+      if (!/^https?:\/\//.test(tarball)) fail2(`npm dist.tarball for ${label} is not an http(s) URL`);
       const bytes = await fetchBytes(o.fetcher, tarball, timeoutMs);
       const filename = safeArtifactName(tarball, `${spec.name.replace("@", "").replace("/", "-")}-${spec.version}.tgz`);
-      if (!filename.endsWith(".tgz") && !filename.endsWith(".tar.gz")) fail(`npm tarball ${filename} is not a .tgz/.tar.gz`);
+      if (!filename.endsWith(".tgz") && !filename.endsWith(".tar.gz")) fail2(`npm tarball ${filename} is not a .tgz/.tar.gz`);
       return { bytes, filename };
     }
     case "pypi": {
@@ -43994,11 +44263,11 @@ async function fetchArtifact(spec, o) {
       const sdists = files.filter((f) => f["packagetype"] === "sdist");
       const sdist = sdists.find((f) => typeof f["filename"] === "string" && f["filename"].endsWith(".tar.gz"));
       if (sdist === void 0) {
-        fail(`no .tar.gz sdist published for ${label} \u2014 wheels are pre-built artifacts and out of scan scope (setup code lives in the sdist)`);
+        fail2(`no .tar.gz sdist published for ${label} \u2014 wheels are pre-built artifacts and out of scan scope (setup code lives in the sdist)`);
       }
       const url2 = sdist["url"];
       const name = sdist["filename"];
-      if (typeof url2 !== "string" || typeof name !== "string") fail(`PyPI sdist entry for ${label} is malformed`);
+      if (typeof url2 !== "string" || typeof name !== "string") fail2(`PyPI sdist entry for ${label} is malformed`);
       const bytes = await fetchBytes(o.fetcher, url2, timeoutMs);
       return { bytes, filename: safeArtifactName(url2, name) };
     }
@@ -44018,8 +44287,8 @@ async function fetchArtifact(spec, o) {
     }
   }
 }
-function sha256Hex(data) {
-  return createHash15("sha256").update(data).digest("hex");
+function sha256Hex2(data) {
+  return createHash16("sha256").update(data).digest("hex");
 }
 
 // src/scan/spec.ts
@@ -44062,8 +44331,8 @@ function parseScanSpec(raw) {
 }
 
 // src/roundtrip/localArtifact.ts
-import { createReadStream, existsSync as existsSync17, statSync as statSync2 } from "node:fs";
-import { createHash as createHash16 } from "node:crypto";
+import { createReadStream, existsSync as existsSync18, statSync as statSync2 } from "node:fs";
+import { createHash as createHash17 } from "node:crypto";
 import { basename as basename6, resolve as resolve15 } from "node:path";
 var EXT_TABLE = /* @__PURE__ */ new Map([
   [".whl", "pypi"],
@@ -44111,7 +44380,7 @@ var GRAMMAR_HINT = {
 };
 function classifyLocalInput(raw, cwd, parsesAsRegistrySpec) {
   const abs = resolve15(cwd, raw);
-  if (existsSync17(abs)) {
+  if (existsSync18(abs)) {
     const st = statSync2(abs);
     if (st.isDirectory()) {
       bad3(`'${raw}' resolves to a directory (${abs}) \u2014 local mode needs a single artifact FILE, not a directory`);
@@ -44146,7 +44415,7 @@ function classifyLocalInput(raw, cwd, parsesAsRegistrySpec) {
   return null;
 }
 async function readLocalArtifact(absPath, cap = SCAN_MAX_ARTIFACT_BYTES) {
-  const hash2 = createHash16("sha256");
+  const hash2 = createHash17("sha256");
   const parts = [];
   let total = 0;
   for await (const chunk of createReadStream(absPath)) {
@@ -44372,7 +44641,7 @@ var CLAIM_SCANNER_PY = [
 ].join("\n");
 
 // src/roundtrip/manifest.ts
-import { createHash as createHash17 } from "node:crypto";
+import { createHash as createHash18 } from "node:crypto";
 var RT_ENGINE = "roundtrip";
 var RT_RESIDUE_RULE = "roundtrip-residue-file";
 var RT_MODIFY_RULE = "roundtrip-modified-file";
@@ -44423,7 +44692,7 @@ var PERSISTENCE_PATTERNS = [
 function isPersistenceSurface(path4) {
   return PERSISTENCE_PATTERNS.some((re) => re.test(path4));
 }
-var digestOf = (what) => createHash17("sha256").update(what).digest("hex");
+var digestOf = (what) => createHash18("sha256").update(what).digest("hex");
 function classifyResidue(label, diff, attribution = null) {
   const findings = [];
   for (const e of diff.added) {
@@ -44470,7 +44739,7 @@ function classifyResidue(label, diff, attribution = null) {
 
 // src/roundtrip/orchestrate.ts
 function containerNameFor(label, rand = randomBytes(3).toString("hex")) {
-  return `rt-${sha256Hex(label).slice(0, 8)}-${rand}`;
+  return `rt-${sha256Hex2(label).slice(0, 8)}-${rand}`;
 }
 var shArgv = (name) => {
   if (!/^[A-Za-z0-9@._+/-]+$/.test(name)) {
@@ -44591,7 +44860,7 @@ function runPipeline2(exec, profile, spec, label, hostPath, container, closure,
     return {
       findings: classifyResidue(label, diffManifests(m1, m3), attribution),
       installDelta,
-      baselineDigest: sha256Hex([...m1.keys()].join("\n"))
+      baselineDigest: sha256Hex2([...m1.keys()].join("\n"))
     };
   } finally {
     try {
@@ -44625,25 +44894,25 @@ async function runRoundtripCore(ctx, deps = {}) {
     ctx.stderr("roundtrip: docker unavailable \u2014 cannot verify");
     return EXIT_ERROR;
   }
-  const baseDir = mkdtempSync5(join26(tmpdir3(), "border-roundtrip-"));
+  const baseDir = mkdtempSync5(join27(tmpdir3(), "border-roundtrip-"));
   try {
     const localRead = local !== null ? await readLocalArtifact(local.absPath) : null;
     const bytes = localRead?.bytes ?? (await fetchArtifact(spec, { fetcher: deps.fetcher ?? defaultScanFetcher })).bytes;
-    const artifactSha256 = localRead !== null ? localRead.sha256 : sha256Hex(bytes);
-    const hostPath = join26(baseDir, "artifact");
-    writeFileSync7(hostPath, bytes);
+    const artifactSha256 = localRead !== null ? localRead.sha256 : sha256Hex2(bytes);
+    const hostPath = join27(baseDir, "artifact");
+    writeFileSync8(hostPath, bytes);
     const container = containerNameFor(label);
     const closure = spec.ecosystem === "pypi" ? resolvePipClosure(exec, profile, hostPath, label, spec) : null;
     const { findings, installDelta, baselineDigest } = runPipeline2(exec, profile, spec, label, hostPath, container, closure, (msg) => ctx.stderr(msg));
     const verdict = computeVerdict(findings);
     const report = {
       schemaVersion: 1,
-      key: sha256Hex(`roundtrip:${label}:${baselineDigest}:${verdict}`),
+      key: sha256Hex2(`roundtrip:${label}:${baselineDigest}:${verdict}`),
       head: baselineDigest.slice(0, 40),
       dirty: false,
       exposureSet: [label],
       refSet: [],
-      rulesHash: sha256Hex(`${profile.image}|${profile.install(profile.artifactPath, spec).join(" ")}|${profile.uninstall(spec).join(" ")}`),
+      rulesHash: sha256Hex2(`${profile.image}|${profile.install(profile.artifactPath, spec).join(" ")}|${profile.uninstall(spec).join(" ")}`),
       verdict,
       counts: countFindings(findings),
       findings,
@@ -44675,7 +44944,7 @@ async function runRoundtripCore(ctx, deps = {}) {
     }
     return exitCodeFromVerdict(verdict);
   } finally {
-    rmSync12(baseDir, { recursive: true, force: true });
+    rmSync13(baseDir, { recursive: true, force: true });
   }
 }
 function parsesRegistrySpec(raw) {
@@ -44733,7 +45002,7 @@ var runRoundtrip = (ctx) => runRoundtripCore(ctx);
 // src/scan/scan.ts
 import { mkdtempSync as mkdtempSync6 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 
 // src/scan/config.ts
 function buildScanConfigYaml(eco) {
@@ -44760,10 +45029,10 @@ function synthesizeScanConfig(eco) {
 }
 
 // src/scan/materialize.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync11, readdirSync as readdirSync10, readFileSync as readFileSync16, rmSync as rmSync13, writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join27 } from "node:path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync12, readdirSync as readdirSync10, readFileSync as readFileSync17, rmSync as rmSync14, writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join28 } from "node:path";
 var CRATES_ENVELOPE_FILES = ["Cargo.toml.orig", ".cargo-ok", ".cargo_vcs_info.json"];
-var fail2 = (why) => {
+var fail3 = (why) => {
   throw new Error(`border scan cannot materialize the artifact (${why}) \u2014 refusing to stage an unusable tree (fail-closed)`);
 };
 var oneLine = (err) => (err instanceof Error ? err.message : String(err)).replace(/\s+/g, " ").trim();
@@ -44771,20 +45040,20 @@ function extractFlat(archive, destDir) {
   try {
     extractArchive(archive, destDir);
   } catch (err) {
-    fail2(`extraction of ${archive} failed: ${oneLine(err)}`);
+    fail3(`extraction of ${archive} failed: ${oneLine(err)}`);
   }
 }
 function unwrapSingleDir(dir) {
   const entries = readdirSync10(dir, { withFileTypes: true });
   const dirs = entries.filter((e) => e.isDirectory());
   if (entries.length === 1 && dirs.length === 1 && dirs[0] !== void 0) {
-    return join27(dir, dirs[0].name);
+    return join28(dir, dirs[0].name);
   }
   return dir;
 }
 function requireManifest(repoDir, ecosystem, candidates) {
-  if (!candidates.some((rel) => existsSync18(join27(repoDir, rel)))) {
-    fail2(`${ecosystem} package tree has none of [${candidates.join(", ")}] at its root`);
+  if (!candidates.some((rel) => existsSync19(join28(repoDir, rel)))) {
+    fail3(`${ecosystem} package tree has none of [${candidates.join(", ")}] at its root`);
   }
 }
 function materializePackage(o) {
@@ -44793,19 +45062,19 @@ function materializePackage(o) {
 `);
   });
   const safe = safeArtifactName(o.filename, `${o.ecosystem}-artifact`);
-  const archive = join27(o.baseDir, safe);
-  writeFileSync8(archive, o.bytes);
-  const extractDir = join27(o.baseDir, "extract");
-  mkdirSync11(extractDir, { recursive: true });
+  const archive = join28(o.baseDir, safe);
+  writeFileSync9(archive, o.bytes);
+  const extractDir = join28(o.baseDir, "extract");
+  mkdirSync12(extractDir, { recursive: true });
   extractFlat(archive, extractDir);
   let repoDir = unwrapSingleDir(extractDir);
   if (o.ecosystem === "rubygems") {
     const outer = repoDir;
     const dataCandidates = findNativeMissArchives(outer).filter((f) => f.endsWith("data.tar.gz"));
-    const inner = dataCandidates[0] ?? join27(outer, "data.tar.gz");
-    if (!existsSync18(inner)) fail2(".gem archive contains no data.tar.gz");
-    const gemTree = join27(o.baseDir, "gem-tree");
-    mkdirSync11(gemTree, { recursive: true });
+    const inner = dataCandidates[0] ?? join28(outer, "data.tar.gz");
+    if (!existsSync19(inner)) fail3(".gem archive contains no data.tar.gz");
+    const gemTree = join28(o.baseDir, "gem-tree");
+    mkdirSync12(gemTree, { recursive: true });
     extractFlat(inner, gemTree);
     repoDir = unwrapSingleDir(gemTree);
   } else if (o.ecosystem === "npm") {
@@ -44815,11 +45084,11 @@ function materializePackage(o) {
   } else {
     requireManifest(repoDir, o.ecosystem, ["Cargo.toml"]);
     for (const file2 of CRATES_ENVELOPE_FILES) {
-      const path4 = join27(repoDir, file2);
-      if (!existsSync18(path4)) continue;
-      const original = readFileSync16(path4);
-      rmSync13(path4, { force: true });
-      note(`border scan: crates envelope normalized: ${file2} sha256=${sha256Hex(original)}`);
+      const path4 = join28(repoDir, file2);
+      if (!existsSync19(path4)) continue;
+      const original = readFileSync17(path4);
+      rmSync14(path4, { force: true });
+      note(`border scan: crates envelope normalized: ${file2} sha256=${sha256Hex2(original)}`);
     }
   }
   const env2 = o.env;
@@ -44845,7 +45114,7 @@ async function runScanCore(ctx, deps = {}) {
   }
   const cfg = synthesizeScanConfig(spec.ecosystem);
   const fetcher = deps.fetcher ?? defaultScanFetcher;
-  const baseDir = mkdtempSync6(join28(tmpdir4(), "border-scan-"));
+  const baseDir = mkdtempSync6(join29(tmpdir4(), "border-scan-"));
   try {
     const { bytes, filename } = await fetchArtifact(spec, { fetcher });
     const env2 = { ...ctx.env };
@@ -44856,12 +45125,12 @@ async function runScanCore(ctx, deps = {}) {
     const verdict = computeVerdict(findings);
     const report = {
       schemaVersion: 1,
-      key: sha256Hex(`scan:${spec.ecosystem}:${spec.name}@${spec.version}:${head}`),
+      key: sha256Hex2(`scan:${spec.ecosystem}:${spec.name}@${spec.version}:${head}`),
       head,
       dirty: false,
       exposureSet: [`${spec.ecosystem}:${spec.name}@${spec.version}`],
       refSet: [],
-      rulesHash: sha256Hex(buildScanConfigYaml(spec.ecosystem)),
+      rulesHash: sha256Hex2(buildScanConfigYaml(spec.ecosystem)),
       verdict,
       counts: countFindings(findings),
       findings,
@@ -44970,11 +45239,12 @@ var handlers = {
   "llm-request": runLlmRequest,
   "llm-ingest": runLlmIngest,
   scan: runScan2,
-  roundtrip: runRoundtrip
+  roundtrip: runRoundtrip,
+  opencode: runOpencode
 };
 
 // src/cli/types.ts
-var SUBCOMMANDS = ["check", "push", "status", "llm-request", "llm-ingest", "scan", "roundtrip"];
+var SUBCOMMANDS = ["check", "push", "status", "llm-request", "llm-ingest", "scan", "roundtrip", "opencode"];
 
 // src/cli.ts
 var VALID_TARGETS = targetIds();
@@ -44992,6 +45262,7 @@ function usage() {
     "  llm-ingest     record provenance captured by the harness",
     "  scan           inspect a third-party package ([ecosystem:]name@version) for residue",
     "  roundtrip      install+uninstall a package (registry spec or local artifact file) in a throwaway container, report uninstall residue",
+    "  opencode       install|status|uninstall the official opencode plugin adapter (files under $XDG_CONFIG_HOME/opencode)",
     "",
     "flags:",
     "  --config <path>             config file (default: ./border.yaml, then git-remote fallback)",
@@ -45006,7 +45277,7 @@ function usage() {
     "",
     "exit codes: 0 pass (MEDIUM/INFO/LOW allowed) | 1 gate-blocked (CRITICAL/HIGH) or partial push | 2 config/tool error",
     "",
-    "subcommands: check, push, status, llm-request, llm-ingest, scan, roundtrip"
+    "subcommands: check, push, status, llm-request, llm-ingest, scan, roundtrip, opencode"
   ].join("\n");
 }
 function isSubcommand(value) {
@@ -45130,7 +45401,7 @@ function isMainModule({ argv1, moduleUrl, realpath }) {
       return p;
     }
   };
-  return pathToFileURL(canonical(argv1)).href === pathToFileURL(canonical(fileURLToPath5(moduleUrl))).href;
+  return pathToFileURL(canonical(argv1)).href === pathToFileURL(canonical(fileURLToPath6(moduleUrl))).href;
 }
 if (isMainModule({ argv1: process.argv[1], moduleUrl: import.meta.url, realpath: realpathSync.native })) {
   const outcome = run(process.argv.slice(2));