border-customs 0.4.2 → 0.5.0

package/dist/index.js

@@ -13029,7 +13029,7 @@ var require_micromatch = __commonJS({
 
 // src/index.ts
 import { realpathSync } from "node:fs";
-import { fileURLToPath as fileURLToPath5, pathToFileURL } from "node:url";
+import { fileURLToPath as fileURLToPath6, pathToFileURL } from "node:url";
 
 // src/cli.ts
 import { parseArgs } from "node:util";
@@ -37940,12 +37940,12 @@ function packOnce(o) {
     throw new EngineRunError(`npm pack reported '${report.filename}' but no tarball landed in ${o.distDir}`, null);
   }
   const data = readFileSync3(tarballAbs);
-  const sha2563 = createHash3("sha256").update(data).digest("hex");
+  const sha2564 = createHash3("sha256").update(data).digest("hex");
   const sha1 = createHash3("sha1").update(data).digest("hex");
   if (sha1 !== report.shasum || data.byteLength !== report.size) {
     throw new EngineRunError(`npm pack report disagrees with the tarball bytes for ${report.filename} \u2014 corrupted or swapped artifact, failing closed`, null);
   }
-  return { filename: report.filename, sha256: sha2563, bytes: data.byteLength, tarballAbs };
+  return { filename: report.filename, sha256: sha2564, bytes: data.byteLength, tarballAbs };
 }
 function publintFinding(o, tarballAbs, identity) {
   const candidates = o.publintBinPath !== void 0 ? [o.publintBinPath] : [
@@ -38950,7 +38950,7 @@ async function runNpmArtifactStage(o) {
   const stateDir = join10(repoDir, BORDER_STATE_DIR);
   const distDir = join10(stateDir, "dist");
   mkdirSync3(distDir, { recursive: true });
-  const { filename, sha256: sha2563, bytes, tarballAbs } = packOnce({
+  const { filename, sha256: sha2564, bytes, tarballAbs } = packOnce({
     repoDir,
     distDir,
     ...o.env !== void 0 ? { env: o.env } : {},
@@ -38958,7 +38958,7 @@ async function runNpmArtifactStage(o) {
     ...o.npmTimeoutMs !== void 0 ? { npmTimeoutMs: o.npmTimeoutMs } : {}
   });
   const findings = [];
-  const extractDir = join10(stateDir, "tmp", sha2563.slice(0, 8));
+  const extractDir = join10(stateDir, "tmp", sha2564.slice(0, 8));
   rmSync3(extractDir, { recursive: true, force: true });
   mkdirSync3(extractDir, { recursive: true });
   try {
@@ -39063,7 +39063,7 @@ async function runNpmArtifactStage(o) {
   if (publint !== null) findings.push(publint);
   return {
     findings,
-    artifact: { file: `${BORDER_STATE_DIR}/dist/${filename}`, sha256: sha2563, bytes }
+    artifact: { file: `${BORDER_STATE_DIR}/dist/${filename}`, sha256: sha2564, bytes }
   };
 }
 
@@ -40145,9 +40145,9 @@ async function runRubygemsArtifactStage(o) {
     throw new EngineRunError(`gem build produced no ${gemName} in ${relative3(repoDir, distDir)} \u2014 failing closed (was the gemspec's literal name/version re-read?)`, null);
   }
   const bytes = readFileSync7(dist);
-  const sha2563 = createHash6("sha256").update(bytes).digest("hex");
+  const sha2564 = createHash6("sha256").update(bytes).digest("hex");
   const findings = [];
-  const extractDir = join12(stateDir, "tmp", sha2563.slice(0, 8));
+  const extractDir = join12(stateDir, "tmp", sha2564.slice(0, 8));
   rmSync4(extractDir, { recursive: true, force: true });
   mkdirSync4(extractDir, { recursive: true });
   const dataDir = `${extractDir}-data`;
@@ -40225,7 +40225,7 @@ async function runRubygemsArtifactStage(o) {
   }
   return {
     findings,
-    artifact: { file: `${BORDER_STATE_DIR}/dist/${gemName}`, sha256: sha2563, bytes: bytes.length }
+    artifact: { file: `${BORDER_STATE_DIR}/dist/${gemName}`, sha256: sha2564, bytes: bytes.length }
   };
 }
 
@@ -40891,17 +40891,17 @@ function requirePassedRecord(kind, i) {
 function rehashRecordedArtifacts(kind, extensions, record2, repoDir) {
   const conventions = extensions;
   const entries = (record2.artifacts ?? []).filter((a) => conventions.some((ext) => a.file.endsWith(ext)));
-  const fail3 = (detail) => ({ ok: false, message: `artifact changed since check \u2014 ${detail}` });
+  const fail4 = (detail) => ({ ok: false, message: `artifact changed since check \u2014 ${detail}` });
   if (entries.length === 0) {
-    return fail3(`the PASSED check recorded no ${kind} artifacts (${conventions.join("/")}) to re-verify`);
+    return fail4(`the PASSED check recorded no ${kind} artifacts (${conventions.join("/")}) to re-verify`);
   }
   const files = [];
   for (const a of entries) {
     const rel = join17(DIST_DIR, basename4(a.file));
     const abs = join17(repoDir, rel);
-    if (!existsSync11(abs)) return fail3(`${rel} is missing from the working tree`);
+    if (!existsSync11(abs)) return fail4(`${rel} is missing from the working tree`);
     const digest2 = createHash10("sha256").update(readFileSync10(abs)).digest("hex");
-    if (digest2 !== a.sha256) return fail3(`${rel} no longer hashes to the digest recorded by the check`);
+    if (digest2 !== a.sha256) return fail4(`${rel} no longer hashes to the digest recorded by the check`);
     files.push(rel);
   }
   return { ok: true, files: files.sort() };
@@ -41360,7 +41360,7 @@ function npmExposureCoords(cfg, read) {
   return { name, version: version2 };
 }
 function classifyNpmVersionView(o) {
-  const fail3 = (why) => {
+  const fail4 = (why) => {
     throw new EngineRunError(
       `npm registry probe inconclusive (${why}); refusing to assume the version is absent \u2014 registry unreachable or returned unexpected output, push blocked until the probe succeeds`,
       o.status
@@ -41368,19 +41368,19 @@ function classifyNpmVersionView(o) {
   };
   if (o.status === 0) {
     const text = o.stdout.trim();
-    if (text.length === 0) return fail3("exit 0 with empty stdout");
+    if (text.length === 0) return fail4("exit 0 with empty stdout");
     let body;
     try {
       body = JSON.parse(text);
     } catch {
-      return fail3("exit 0 with malformed JSON body");
+      return fail4("exit 0 with malformed JSON body");
     }
-    if (typeof body !== "object" || body === null) return fail3("exit 0 with non-object JSON body");
+    if (typeof body !== "object" || body === null) return fail4("exit 0 with non-object JSON body");
     return "present";
   }
   if (/code E404\b/.test(o.stderr) || /\b404 Not Found\b/.test(o.stderr)) return "absent";
   const m = /code (E[A-Z0-9_]+|ERR_[A-Z0-9_]+)/.exec(o.stderr);
-  return fail3(m === null ? `exit ${String(o.status)} without a 404 marker` : `npm error ${m[1]}`);
+  return fail4(m === null ? `exit ${String(o.status)} without a 404 marker` : `npm error ${m[1]}`);
 }
 function npmNameClaimed(o) {
   if (o.status === 0) return true;
@@ -41787,9 +41787,9 @@ async function runCargoArtifactStage(o) {
     const dist = join18(distDir, crateName);
     renameSync(packed, dist);
     const bytes = readFileSync11(dist);
-    const sha2563 = createHash11("sha256").update(bytes).digest("hex");
+    const sha2564 = createHash11("sha256").update(bytes).digest("hex");
     const findings = [];
-    const extractDir = join18(stateDir, "tmp", sha2563.slice(0, 8));
+    const extractDir = join18(stateDir, "tmp", sha2564.slice(0, 8));
     rmSync8(extractDir, { recursive: true, force: true });
     mkdirSync8(extractDir, { recursive: true });
     try {
@@ -41842,7 +41842,7 @@ async function runCargoArtifactStage(o) {
     }
     return {
       findings,
-      artifact: { file: `${BORDER_STATE_DIR}/dist/${crateName}`, sha256: sha2563, bytes: bytes.length }
+      artifact: { file: `${BORDER_STATE_DIR}/dist/${crateName}`, sha256: sha2564, bytes: bytes.length }
     };
   } finally {
     rmSync8(targetDir, { recursive: true, force: true });
@@ -43700,6 +43700,193 @@ async function runLlmRequest(ctx) {
   return runLlmRequestCore(ctx);
 }
 
+// src/commands/opencode.ts
+import { createHash as createHash15 } from "node:crypto";
+import { existsSync as existsSync17, lstatSync, mkdirSync as mkdirSync11, readFileSync as readFileSync16, rmSync as rmSync12, writeFileSync as writeFileSync7 } from "node:fs";
+import os3 from "node:os";
+import { dirname as dirname12, join as join26 } from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
+var PLUGIN_MARKER = "// border-opencode-plugin v";
+var COMMAND_MARKER = "<!-- border-opencode-command -->";
+function opencodeConfigRoot(env2) {
+  const xdg = env2["XDG_CONFIG_HOME"] ?? "";
+  if (xdg.length > 0) return xdg;
+  const home = env2["HOME"] ?? "";
+  return join26(home.length > 0 ? home : os3.homedir(), ".config");
+}
+function resolvePluginAsset(moduleUrl, fileName) {
+  const here = dirname12(fileURLToPath5(moduleUrl));
+  const candidates = [
+    join26(here, "..", "plugin", fileName),
+    // dist mode (bundled): <root>/plugin/<f>
+    join26(here, "..", "..", "plugin", fileName)
+    // src mode: <root>/plugin/<f>
+  ];
+  return candidates.find((p) => existsSync17(p)) ?? candidates[1];
+}
+function targetsFor(env2) {
+  const root = join26(opencodeConfigRoot(env2), "opencode");
+  return [
+    { fileName: "border.ts", destination: join26(root, "plugins", "border.ts"), marker: PLUGIN_MARKER },
+    { fileName: "border-command.md", destination: join26(root, "commands", "border.md"), marker: COMMAND_MARKER }
+  ];
+}
+function sha2563(bytes) {
+  return createHash15("sha256").update(bytes).digest("hex");
+}
+function firstLine(bytes) {
+  const text = bytes.toString("utf8");
+  const newline = text.indexOf("\n");
+  return newline < 0 ? text : text.slice(0, newline);
+}
+function carriesMarker(bytes, marker) {
+  return firstLine(bytes).startsWith(marker);
+}
+function fail(ctx, message) {
+  ctx.stderr(`border: opencode: ${message}`);
+  return EXIT_ERROR;
+}
+function readPackagedAsset(ctx, fileName) {
+  const source = resolvePluginAsset(import.meta.url, fileName);
+  try {
+    return readFileSync16(source);
+  } catch {
+    ctx.stderr(`border: opencode: packaged asset is missing (${source})`);
+    ctx.stderr("border: opencode: the border install looks broken \u2014 `npm i -g border-customs` or a fresh checkout should carry plugin/.");
+    return null;
+  }
+}
+function readTarget(destination) {
+  try {
+    return readFileSync16(destination);
+  } catch {
+    return null;
+  }
+}
+function requirePlainDestination(ctx, destination) {
+  let shape;
+  try {
+    shape = lstatSync(destination);
+  } catch {
+    return null;
+  }
+  if (!shape.isFile() || shape.isSymbolicLink()) {
+    return fail(
+      ctx,
+      `refusing to touch ${destination} \u2014 the path exists but is not a plain regular file (directories and symlinks are never followed, entered, or destroyed)`
+    );
+  }
+  return null;
+}
+function classify(target, current, packaged) {
+  if (current === null) return "absent";
+  if (!carriesMarker(current, target.marker)) return "foreign";
+  return current.equals(packaged) ? "up-to-date" : "outdated";
+}
+function requireNoForeign(ctx, targets) {
+  for (const target of targets) {
+    const shape = requirePlainDestination(ctx, target.destination);
+    if (shape !== null) return shape;
+    const current = readTarget(target.destination);
+    if (current !== null && !carriesMarker(current, target.marker)) {
+      return fail(
+        ctx,
+        `refusing to touch ${target.destination} \u2014 the file exists but is not ours (its first line lacks the marker '${target.marker}'); move it aside manually, nothing was written anywhere`
+      );
+    }
+  }
+  return null;
+}
+function prepareTargets(ctx, targets) {
+  const prepared = [];
+  for (const target of targets) {
+    const packaged = readPackagedAsset(ctx, target.fileName);
+    if (packaged === null) return null;
+    prepared.push({ target, packaged });
+  }
+  return prepared;
+}
+function opencodeInstall(ctx) {
+  const targets = targetsFor(ctx.env);
+  const prepared = prepareTargets(ctx, targets);
+  if (prepared === null) return EXIT_ERROR;
+  const blocked = requireNoForeign(ctx, targets);
+  if (blocked !== null) return blocked;
+  for (const { target, packaged } of prepared) {
+    const current = readTarget(target.destination);
+    const state = classify(target, current, packaged);
+    if (state === "foreign") {
+      return fail(
+        ctx,
+        `refusing to touch ${target.destination} \u2014 the file exists but is not ours (its first line lacks the marker '${target.marker}'); move it aside manually, nothing was written anywhere`
+      );
+    }
+    if (state === "up-to-date") {
+      ctx.stdout(`${target.destination}: up to date`);
+      continue;
+    }
+    mkdirSync11(dirname12(target.destination), { recursive: true });
+    writeFileSync7(target.destination, packaged);
+    ctx.stdout(`${target.destination}: ${state === "outdated" ? "updated" : "installed"}`);
+  }
+  ctx.stdout("note: restart opencode to load the plugin \u2014 tools and commands are scanned at startup.");
+  return EXIT_PASS;
+}
+function opencodeStatus(ctx) {
+  const targets = targetsFor(ctx.env);
+  const prepared = prepareTargets(ctx, targets);
+  if (prepared === null) return EXIT_ERROR;
+  for (const { target, packaged } of prepared) {
+    const current = readTarget(target.destination);
+    const state = classify(target, current, packaged);
+    const installedSha = current === null ? "-" : sha2563(current);
+    ctx.stdout(`${target.destination}: ${state}  installed=${installedSha}  packaged=${sha2563(packaged)}`);
+  }
+  return EXIT_PASS;
+}
+function opencodeUninstall(ctx) {
+  const targets = targetsFor(ctx.env);
+  const blocked = requireNoForeign(ctx, targets);
+  if (blocked !== null) return blocked;
+  for (const target of targets) {
+    const current = readTarget(target.destination);
+    if (current === null) {
+      ctx.stdout(`${target.destination}: absent (nothing to remove)`);
+      continue;
+    }
+    if (!carriesMarker(current, target.marker)) {
+      return fail(
+        ctx,
+        `refusing to remove ${target.destination} \u2014 the file is not ours (its first line lacks the marker '${target.marker}'); nothing was removed anywhere`
+      );
+    }
+    rmSync12(target.destination);
+    ctx.stdout(`${target.destination}: removed`);
+  }
+  ctx.stdout("note: restart opencode for the tool and command to disappear.");
+  return EXIT_PASS;
+}
+function runOpencode(ctx) {
+  const [sub, ...rest] = ctx.positionals;
+  if (rest.length > 0) {
+    throw new UnknownArgError(
+      `opencode ${sub ?? "<none>"}: unexpected argument '${rest[0] ?? ""}' \u2014 usage: border opencode install | status | uninstall`
+    );
+  }
+  switch (sub) {
+    case "install":
+      return opencodeInstall(ctx);
+    case "status":
+      return opencodeStatus(ctx);
+    case "uninstall":
+      return opencodeUninstall(ctx);
+    default:
+      throw new UnknownArgError(
+        `opencode: unknown subcommand '${sub ?? "<none>"}' \u2014 usage: border opencode install | status | uninstall`
+      );
+  }
+}
+
 // src/push/git.ts
 import { spawnSync as spawnSync15 } from "node:child_process";
 var DIVERGED_MESSAGE = "history diverged; border never force-pushes; resolve manually";
@@ -43965,17 +44152,17 @@ async function executeYesPush(ctx, loaded) {
 }
 
 // src/roundtrip/orchestrate.ts
-import { mkdtempSync as mkdtempSync5, rmSync as rmSync12, writeFileSync as writeFileSync7 } from "node:fs";
+import { mkdtempSync as mkdtempSync5, rmSync as rmSync13, writeFileSync as writeFileSync8 } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 
 // src/scan/fetch.ts
-import { createHash as createHash15 } from "node:crypto";
+import { createHash as createHash16 } from "node:crypto";
 import { basename as basename5 } from "node:path";
 var SCAN_MAX_ARTIFACT_BYTES = 200 * 1024 * 1024;
 var SCAN_REQUEST_TIMEOUT_MS = 6e4;
-var SCAN_USER_AGENT = "border-customs/0.4.2 (+https://github.com/sumteclab/border; border scan)";
+var SCAN_USER_AGENT = "border-customs/0.5.0 (+https://github.com/sumteclab/border; border scan)";
 var CRATES_DOWNLOAD_HOST = "https://static.crates.io";
 var defaultScanFetcher = async (url2, init) => {
   if (!/^https?:\/\//.test(url2)) throw new EngineRunError(`border scan refuses non-http(s) URL: ${url2}`, null);
@@ -44000,19 +44187,19 @@ var defaultScanFetcher = async (url2, init) => {
     }
   };
 };
-var fail = (why) => {
+var fail2 = (why) => {
   throw new EngineRunError(`border scan could not fetch the artifact (${why}) \u2014 refusing to scan a partial or absent download (fail-closed)`, null);
 };
 async function readCapped(res, url2, cap = SCAN_MAX_ARTIFACT_BYTES) {
-  if (res.status !== 200) fail(`HTTP ${String(res.status)} for ${url2}`);
+  if (res.status !== 200) fail2(`HTTP ${String(res.status)} for ${url2}`);
   if (res.contentLength !== null && res.contentLength > cap) {
-    fail(`${url2} announces ${String(res.contentLength)} bytes, over the 200 MiB scan size cap`);
+    fail2(`${url2} announces ${String(res.contentLength)} bytes, over the 200 MiB scan size cap`);
   }
   const parts = [];
   let total = 0;
   for await (const chunk of res.chunks()) {
     total += chunk.byteLength;
-    if (total > cap) fail(`${url2} streams past the 200 MiB scan size cap after ${String(total)} bytes`);
+    if (total > cap) fail2(`${url2} streams past the 200 MiB scan size cap after ${String(total)} bytes`);
     parts.push(Buffer.from(chunk));
   }
   return Buffer.concat(parts);
@@ -44026,7 +44213,7 @@ async function fetchJson(fetcher, url2, timeoutMs) {
   try {
     return JSON.parse(body.toString("utf8"));
   } catch {
-    fail(`metadata response from ${url2} is not valid JSON`);
+    fail2(`metadata response from ${url2} is not valid JSON`);
   }
 }
 var isRecord2 = (v) => typeof v === "object" && v !== null;
@@ -44062,11 +44249,11 @@ async function fetchArtifact(spec, o) {
       const meta3 = await fetchJson(o.fetcher, npmMetadataUrl(spec.name, spec.version), timeoutMs);
       const dist = isRecord2(meta3) && isRecord2(meta3["dist"]) ? meta3["dist"] : {};
       const tarball = dist["tarball"];
-      if (typeof tarball !== "string" || tarball.length === 0) fail(`npm metadata for ${label} has no dist.tarball`);
-      if (!/^https?:\/\//.test(tarball)) fail(`npm dist.tarball for ${label} is not an http(s) URL`);
+      if (typeof tarball !== "string" || tarball.length === 0) fail2(`npm metadata for ${label} has no dist.tarball`);
+      if (!/^https?:\/\//.test(tarball)) fail2(`npm dist.tarball for ${label} is not an http(s) URL`);
       const bytes = await fetchBytes(o.fetcher, tarball, timeoutMs);
       const filename = safeArtifactName(tarball, `${spec.name.replace("@", "").replace("/", "-")}-${spec.version}.tgz`);
-      if (!filename.endsWith(".tgz") && !filename.endsWith(".tar.gz")) fail(`npm tarball ${filename} is not a .tgz/.tar.gz`);
+      if (!filename.endsWith(".tgz") && !filename.endsWith(".tar.gz")) fail2(`npm tarball ${filename} is not a .tgz/.tar.gz`);
       return { bytes, filename };
     }
     case "pypi": {
@@ -44076,11 +44263,11 @@ async function fetchArtifact(spec, o) {
       const sdists = files.filter((f) => f["packagetype"] === "sdist");
       const sdist = sdists.find((f) => typeof f["filename"] === "string" && f["filename"].endsWith(".tar.gz"));
       if (sdist === void 0) {
-        fail(`no .tar.gz sdist published for ${label} \u2014 wheels are pre-built artifacts and out of scan scope (setup code lives in the sdist)`);
+        fail2(`no .tar.gz sdist published for ${label} \u2014 wheels are pre-built artifacts and out of scan scope (setup code lives in the sdist)`);
       }
       const url2 = sdist["url"];
       const name = sdist["filename"];
-      if (typeof url2 !== "string" || typeof name !== "string") fail(`PyPI sdist entry for ${label} is malformed`);
+      if (typeof url2 !== "string" || typeof name !== "string") fail2(`PyPI sdist entry for ${label} is malformed`);
       const bytes = await fetchBytes(o.fetcher, url2, timeoutMs);
       return { bytes, filename: safeArtifactName(url2, name) };
     }
@@ -44101,7 +44288,7 @@ async function fetchArtifact(spec, o) {
   }
 }
 function sha256Hex2(data) {
-  return createHash15("sha256").update(data).digest("hex");
+  return createHash16("sha256").update(data).digest("hex");
 }
 
 // src/scan/spec.ts
@@ -44144,8 +44331,8 @@ function parseScanSpec(raw) {
 }
 
 // src/roundtrip/localArtifact.ts
-import { createReadStream, existsSync as existsSync17, statSync as statSync2 } from "node:fs";
-import { createHash as createHash16 } from "node:crypto";
+import { createReadStream, existsSync as existsSync18, statSync as statSync2 } from "node:fs";
+import { createHash as createHash17 } from "node:crypto";
 import { basename as basename6, resolve as resolve15 } from "node:path";
 var EXT_TABLE = /* @__PURE__ */ new Map([
   [".whl", "pypi"],
@@ -44193,7 +44380,7 @@ var GRAMMAR_HINT = {
 };
 function classifyLocalInput(raw, cwd, parsesAsRegistrySpec) {
   const abs = resolve15(cwd, raw);
-  if (existsSync17(abs)) {
+  if (existsSync18(abs)) {
     const st = statSync2(abs);
     if (st.isDirectory()) {
       bad3(`'${raw}' resolves to a directory (${abs}) \u2014 local mode needs a single artifact FILE, not a directory`);
@@ -44228,7 +44415,7 @@ function classifyLocalInput(raw, cwd, parsesAsRegistrySpec) {
   return null;
 }
 async function readLocalArtifact(absPath, cap = SCAN_MAX_ARTIFACT_BYTES) {
-  const hash2 = createHash16("sha256");
+  const hash2 = createHash17("sha256");
   const parts = [];
   let total = 0;
   for await (const chunk of createReadStream(absPath)) {
@@ -44454,7 +44641,7 @@ var CLAIM_SCANNER_PY = [
 ].join("\n");
 
 // src/roundtrip/manifest.ts
-import { createHash as createHash17 } from "node:crypto";
+import { createHash as createHash18 } from "node:crypto";
 var RT_ENGINE = "roundtrip";
 var RT_RESIDUE_RULE = "roundtrip-residue-file";
 var RT_MODIFY_RULE = "roundtrip-modified-file";
@@ -44505,7 +44692,7 @@ var PERSISTENCE_PATTERNS = [
 function isPersistenceSurface(path4) {
   return PERSISTENCE_PATTERNS.some((re) => re.test(path4));
 }
-var digestOf = (what) => createHash17("sha256").update(what).digest("hex");
+var digestOf = (what) => createHash18("sha256").update(what).digest("hex");
 function classifyResidue(label, diff, attribution = null) {
   const findings = [];
   for (const e of diff.added) {
@@ -44707,13 +44894,13 @@ async function runRoundtripCore(ctx, deps = {}) {
     ctx.stderr("roundtrip: docker unavailable \u2014 cannot verify");
     return EXIT_ERROR;
   }
-  const baseDir = mkdtempSync5(join26(tmpdir3(), "border-roundtrip-"));
+  const baseDir = mkdtempSync5(join27(tmpdir3(), "border-roundtrip-"));
   try {
     const localRead = local !== null ? await readLocalArtifact(local.absPath) : null;
     const bytes = localRead?.bytes ?? (await fetchArtifact(spec, { fetcher: deps.fetcher ?? defaultScanFetcher })).bytes;
     const artifactSha256 = localRead !== null ? localRead.sha256 : sha256Hex2(bytes);
-    const hostPath = join26(baseDir, "artifact");
-    writeFileSync7(hostPath, bytes);
+    const hostPath = join27(baseDir, "artifact");
+    writeFileSync8(hostPath, bytes);
     const container = containerNameFor(label);
     const closure = spec.ecosystem === "pypi" ? resolvePipClosure(exec, profile, hostPath, label, spec) : null;
     const { findings, installDelta, baselineDigest } = runPipeline2(exec, profile, spec, label, hostPath, container, closure, (msg) => ctx.stderr(msg));
@@ -44757,7 +44944,7 @@ async function runRoundtripCore(ctx, deps = {}) {
     }
     return exitCodeFromVerdict(verdict);
   } finally {
-    rmSync12(baseDir, { recursive: true, force: true });
+    rmSync13(baseDir, { recursive: true, force: true });
   }
 }
 function parsesRegistrySpec(raw) {
@@ -44815,7 +45002,7 @@ var runRoundtrip = (ctx) => runRoundtripCore(ctx);
 // src/scan/scan.ts
 import { mkdtempSync as mkdtempSync6 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 
 // src/scan/config.ts
 function buildScanConfigYaml(eco) {
@@ -44842,10 +45029,10 @@ function synthesizeScanConfig(eco) {
 }
 
 // src/scan/materialize.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync11, readdirSync as readdirSync10, readFileSync as readFileSync16, rmSync as rmSync13, writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join27 } from "node:path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync12, readdirSync as readdirSync10, readFileSync as readFileSync17, rmSync as rmSync14, writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join28 } from "node:path";
 var CRATES_ENVELOPE_FILES = ["Cargo.toml.orig", ".cargo-ok", ".cargo_vcs_info.json"];
-var fail2 = (why) => {
+var fail3 = (why) => {
   throw new Error(`border scan cannot materialize the artifact (${why}) \u2014 refusing to stage an unusable tree (fail-closed)`);
 };
 var oneLine = (err) => (err instanceof Error ? err.message : String(err)).replace(/\s+/g, " ").trim();
@@ -44853,20 +45040,20 @@ function extractFlat(archive, destDir) {
   try {
     extractArchive(archive, destDir);
   } catch (err) {
-    fail2(`extraction of ${archive} failed: ${oneLine(err)}`);
+    fail3(`extraction of ${archive} failed: ${oneLine(err)}`);
   }
 }
 function unwrapSingleDir(dir) {
   const entries = readdirSync10(dir, { withFileTypes: true });
   const dirs = entries.filter((e) => e.isDirectory());
   if (entries.length === 1 && dirs.length === 1 && dirs[0] !== void 0) {
-    return join27(dir, dirs[0].name);
+    return join28(dir, dirs[0].name);
   }
   return dir;
 }
 function requireManifest(repoDir, ecosystem, candidates) {
-  if (!candidates.some((rel) => existsSync18(join27(repoDir, rel)))) {
-    fail2(`${ecosystem} package tree has none of [${candidates.join(", ")}] at its root`);
+  if (!candidates.some((rel) => existsSync19(join28(repoDir, rel)))) {
+    fail3(`${ecosystem} package tree has none of [${candidates.join(", ")}] at its root`);
   }
 }
 function materializePackage(o) {
@@ -44875,19 +45062,19 @@ function materializePackage(o) {
 `);
   });
   const safe = safeArtifactName(o.filename, `${o.ecosystem}-artifact`);
-  const archive = join27(o.baseDir, safe);
-  writeFileSync8(archive, o.bytes);
-  const extractDir = join27(o.baseDir, "extract");
-  mkdirSync11(extractDir, { recursive: true });
+  const archive = join28(o.baseDir, safe);
+  writeFileSync9(archive, o.bytes);
+  const extractDir = join28(o.baseDir, "extract");
+  mkdirSync12(extractDir, { recursive: true });
   extractFlat(archive, extractDir);
   let repoDir = unwrapSingleDir(extractDir);
   if (o.ecosystem === "rubygems") {
     const outer = repoDir;
     const dataCandidates = findNativeMissArchives(outer).filter((f) => f.endsWith("data.tar.gz"));
-    const inner = dataCandidates[0] ?? join27(outer, "data.tar.gz");
-    if (!existsSync18(inner)) fail2(".gem archive contains no data.tar.gz");
-    const gemTree = join27(o.baseDir, "gem-tree");
-    mkdirSync11(gemTree, { recursive: true });
+    const inner = dataCandidates[0] ?? join28(outer, "data.tar.gz");
+    if (!existsSync19(inner)) fail3(".gem archive contains no data.tar.gz");
+    const gemTree = join28(o.baseDir, "gem-tree");
+    mkdirSync12(gemTree, { recursive: true });
     extractFlat(inner, gemTree);
     repoDir = unwrapSingleDir(gemTree);
   } else if (o.ecosystem === "npm") {
@@ -44897,10 +45084,10 @@ function materializePackage(o) {
   } else {
     requireManifest(repoDir, o.ecosystem, ["Cargo.toml"]);
     for (const file2 of CRATES_ENVELOPE_FILES) {
-      const path4 = join27(repoDir, file2);
-      if (!existsSync18(path4)) continue;
-      const original = readFileSync16(path4);
-      rmSync13(path4, { force: true });
+      const path4 = join28(repoDir, file2);
+      if (!existsSync19(path4)) continue;
+      const original = readFileSync17(path4);
+      rmSync14(path4, { force: true });
       note(`border scan: crates envelope normalized: ${file2} sha256=${sha256Hex2(original)}`);
     }
   }
@@ -44927,7 +45114,7 @@ async function runScanCore(ctx, deps = {}) {
   }
   const cfg = synthesizeScanConfig(spec.ecosystem);
   const fetcher = deps.fetcher ?? defaultScanFetcher;
-  const baseDir = mkdtempSync6(join28(tmpdir4(), "border-scan-"));
+  const baseDir = mkdtempSync6(join29(tmpdir4(), "border-scan-"));
   try {
     const { bytes, filename } = await fetchArtifact(spec, { fetcher });
     const env2 = { ...ctx.env };
@@ -45052,11 +45239,12 @@ var handlers = {
   "llm-request": runLlmRequest,
   "llm-ingest": runLlmIngest,
   scan: runScan2,
-  roundtrip: runRoundtrip
+  roundtrip: runRoundtrip,
+  opencode: runOpencode
 };
 
 // src/cli/types.ts
-var SUBCOMMANDS = ["check", "push", "status", "llm-request", "llm-ingest", "scan", "roundtrip"];
+var SUBCOMMANDS = ["check", "push", "status", "llm-request", "llm-ingest", "scan", "roundtrip", "opencode"];
 
 // src/cli.ts
 var VALID_TARGETS = targetIds();
@@ -45074,6 +45262,7 @@ function usage() {
     "  llm-ingest     record provenance captured by the harness",
     "  scan           inspect a third-party package ([ecosystem:]name@version) for residue",
     "  roundtrip      install+uninstall a package (registry spec or local artifact file) in a throwaway container, report uninstall residue",
+    "  opencode       install|status|uninstall the official opencode plugin adapter (files under $XDG_CONFIG_HOME/opencode)",
     "",
     "flags:",
     "  --config <path>             config file (default: ./border.yaml, then git-remote fallback)",
@@ -45088,7 +45277,7 @@ function usage() {
     "",
     "exit codes: 0 pass (MEDIUM/INFO/LOW allowed) | 1 gate-blocked (CRITICAL/HIGH) or partial push | 2 config/tool error",
     "",
-    "subcommands: check, push, status, llm-request, llm-ingest, scan, roundtrip"
+    "subcommands: check, push, status, llm-request, llm-ingest, scan, roundtrip, opencode"
   ].join("\n");
 }
 function isSubcommand(value) {
@@ -45212,7 +45401,7 @@ function isMainModule({ argv1, moduleUrl, realpath }) {
       return p;
     }
   };
-  return pathToFileURL(canonical(argv1)).href === pathToFileURL(canonical(fileURLToPath5(moduleUrl))).href;
+  return pathToFileURL(canonical(argv1)).href === pathToFileURL(canonical(fileURLToPath6(moduleUrl))).href;
 }
 if (isMainModule({ argv1: process.argv[1], moduleUrl: import.meta.url, realpath: realpathSync.native })) {
   const outcome = run(process.argv.slice(2));

package/package.json

@@ -1,14 +1,20 @@
 {
   "name": "border-customs",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "//": "publint is a runtime dep (exact pin): the npm-stage engine is invoked via bin resolution against the installed layout, so consumers get the publint-fail leg out of the box; the dev suite resolves the same node_modules/.bin/publint — no devDependencies entry is needed for it to stay green.",
   "description": "Fail-closed git push gate: secret scanning + supply-chain checks before any remote leaves the machine",
   "type": "module",
   "bin": {
     "border": "dist/index.js"
   },
+  "exports": {
+    ".": "./dist/index.js",
+    "./server": "./plugin/border.ts",
+    "./package.json": "./package.json"
+  },
   "files": [
-    "dist"
+    "dist",
+    "plugin"
   ],
   "engines": {
     "node": ">=22.0.0"
@@ -26,6 +32,7 @@
     "test": "node --import ./tools/register-ts.mjs --test --test-reporter=tap test/*.test.ts"
   },
   "dependencies": {
+    "@opencode-ai/plugin": "^1.17.4",
     "@secretlint/core": "13.0.5",
     "@secretlint/secretlint-rule-no-dotenv": "13.0.5",
     "@secretlint/secretlint-rule-no-homedir": "13.0.5",