border-customs 0.5.1 → 0.7.1

package/README.md

@@ -237,6 +237,74 @@ itself keeps blocking until it stops tripping the scan.
 - Both new rules are ordinary findings: the allow-list can waive them and every waiver is
   enumerated in `allowHits` — no hidden channel.
 
+### The exfil lens (0.6.0)
+
+Exfil-shaped literals — internal IPv4s, `user@internal-host` ssh targets, home paths,
+credential-file locations, host fingerprints — are not credentials, so classic secret
+scanners stay silent on them while they still describe the private network a public repo
+lives inside. The exfil lens adds five rules over the surfaces about to become public:
+
+| Rule | What it catches |
+| --- | --- |
+| `exfil-rfc1918` | RFC1918 private-address literals (10/8, 172.16/12, 192.168/16) |
+| `exfil-ssh-target` | `user@host` where the host is a private literal, a configured `rules.hosts` entry, or one closed internal suffix set (`.internal` `.lan` `.local` `.corp` `.intra`) |
+| `exfil-home-path` | `/home/<user>` and `C:\Users\<user>` shapes |
+| `exfil-cred-location` | `~/.pypirc`, `SSHPASS`, `*.env` credential-location shapes |
+| `exfil-host-profile` | multi-signal host fingerprints (os+version / no-docker / no-passwordless-sudo co-occurrences in one paragraph) |
+
+The severity a reader **observes** is the (rule × facet × channel) matrix, and its single
+home is [src/exfil/severity.ts](src/exfil/severity.ts) — the check pipeline, the
+`border exfil` CLI and this table all render that table, never re-decide it; the
+`EXFIL-DOC` guard test fails the build if a cell is restated wrong:
+
+| Rule | Facet | Channel | Observed severity |
+| --- | --- | --- | --- |
+| `exfil-rfc1918` | tree | gitleaks-twin, secretlint-twin | CRITICAL |
+| `exfil-ssh-target` | tree | gitleaks-twin, secretlint-twin | CRITICAL |
+| `exfil-home-path` | tree | native | MEDIUM |
+| `exfil-cred-location` | tree | native | MEDIUM |
+| `exfil-host-profile` | tree | native | MEDIUM |
+| `exfil-rfc1918` | message | native | HIGH |
+| `exfil-ssh-target` | message | native | HIGH |
+| `exfil-home-path` | message | native | MEDIUM |
+| `exfil-cred-location` | message | native | MEDIUM |
+| `exfil-host-profile` | message | native | MEDIUM |
+
+Why an observed `CRITICAL` stands where the intent table says HIGH: the twin channels have
+no HIGH rung — every ingested gitleaks finding carries CRITICAL, and secretlint's `error`
+level maps to CRITICAL — so the matrix records the channel mechanics honestly
+(`不硬掰，如实表`) instead of faking a severity the engines cannot emit. The message facet
+is native-exclusive and carries the `:message` id family (`exfil-rfc1918:message`): allow
+entries match ids exactly, so waiving the tree face can never waive a commit-message hit,
+or vice versa. Tag notes are never scanned by the exfil core — the pre-existing engine leg
+owns that facet and reports hits there under its own `tag-message-secret` id.
+
+- **Exemptions.** Documented ranges never fire: loopback, the RFC5737 documentation bands
+  (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24), and RFC2606 TLDs (`.example` `.test`
+  `.invalid` `.localhost`). The **fixture band** 10.200.0.0/16 is this project's reserved
+  test range: on tree surfaces all channels stay silent on it, and the twins carry the same
+  band exemption natively (TOML allowlists / negative lookaheads) so verdicts agree across
+  channels. Commit messages are the one exception — a message describing any private-shape
+  literal still fires its `:message` rule.
+- **Fixture doctrine (for contributors).** Checked-out bytes must not contain complete
+  leak shapes outside the fixture band: no real-looking private IPv4s, no full
+  `user@host.<internal-suffix>` tokens. Tests assemble them at runtime with
+  `assembleOctet()` / `assembleHost()` (test/helpers) and assert red — which keeps
+  border's own lens green against its own corpus while the red stories stay armed.
+- **Truth lane.** `BORDER_EXFIL_TRUTH=1` opts the golden suite into its live-URL leg
+  against the external fixture repo; skipped by default in CI. Its red anchors are
+  product facts with a lifetime clause: when the upstream owner scrubs them, the lane
+  passes with an archive-backed note rather than failing — expiration by design is not
+  regression.
+
+The same rule sources feed three places: `border check` (tip tree + will-publish commit
+messages), the standalone read-only `border exfil <rev|url>` lens (tip tree by default,
+plus tag notes in local mode — which the engine leg reports under its own
+`tag-message-secret` id; `--deep` adds full-history blobs and every reachable
+commit message; `file://` and scp-shaped URLs are fetched into a temp clone that is
+destroyed on exit), and post-push landing verification. The sources are fingerprinted into
+`rulesHash` like every other rule surface — editing a rule invalidates cached PASSes.
+
 ### Release coherence (0.4.1)
 
 Founding case — **aihr**: the wheel published on PyPI under version `0.2.2` carried
@@ -341,6 +409,15 @@ never from cache:
   retried on failure because a half-published version can never be republished.
 - If one remote of several succeeded before a failure, border says so explicitly (PARTIAL)
   and exits 1; a rerun of `border push --yes` picks up only the still-PENDING targets.
+- After every git leg that moved, border **verifies the landing**: it re-observes the remote
+  tip (`git ls-remote`, then a fetch of exactly that tip when it is not local) and scans the
+  landed tree with the same exfil machinery as `border exfil`. Three honest outcomes: clean
+  appends a `t:"landing"` ledger record and preserves the push exit; a blocking hit exits 1
+  with `ALREADY PUBLIC; border detects, never erases` — the bytes are out, and border's job
+  there is detection, recording the fact, never rewriting history; an unobservable tip exits
+  2 with `landed, verification unavailable` and mints **no record** (no verification, no
+  fact). The ledger stays append-only: executed-push rows are never mutated, and a DRY-RUN
+  push never fetches or records anything landing-related.
 
 ### What `border push` actually runs
 
@@ -413,6 +490,7 @@ border <command> [options]
 | `llm-request` | emit the masked review bundle for LLM-authored commits |
 | `llm-ingest <findings.json>` | validate agent findings and record the combined verdict |
 | `scan <[ecosystem:]name@version>` | inspect a third-party published artifact for residue before installing it |
+| `exfil <rev\|url>` | read-only exfil lens over a local rev or a remote URL (tip tree by default) |
 | `opencode <install\|status\|uninstall>` | install/status/uninstall the official OpenCode plugin adapter |
 
 Every subcommand accepts the same global flags (verified against `border <cmd> --help`):
@@ -425,16 +503,17 @@ Every subcommand accepts the same global flags (verified against `border <cmd> -
 | `--yes` | execute mutations (push only); without it a push is always DRY-RUN |
 | `--require-engine <list>` | replaces the required-engine set from config; unknown or unprobeable names degrade the run (exit 2) |
 | `--llm` | opt this check into the LLM review layer (a plain check can never satisfy an llm-recorded skip) |
-| `--json` | machine-readable report on stdout (check, scan) |
+| `--json` | machine-readable report on stdout (check, scan, exfil) |
+| `--deep` | exfil only: also scan full-history blobs and every reachable commit message (default scans the tip tree + tag notes) |
 | `--help, -h` | usage table |
 
 ### Exit codes (the contract)
 
 | Code | Meaning |
 | --- | --- |
-| `0` | PASS (or no-op): MEDIUM / LOW / INFO findings are allowed and listed |
-| `1` | gate-blocked: HIGH or CRITICAL findings; or a push refused (BLOCKED targets); or a partial push |
-| `2` | the gate could not answer: config error, missing/degraded engine, unreachable registry, malformed input, concurrent lock holder |
+| `0` | PASS (or no-op): MEDIUM / LOW / INFO findings are allowed and listed; a clean landing verification preserves the executor's exit |
+| `1` | gate-blocked: HIGH or CRITICAL findings; or a push refused (BLOCKED targets); or a partial push; or landing verification found blocking findings on the tip that is now **already public** (border detects, never erases) |
+| `2` | the gate could not answer: config error, missing/degraded engine, unreachable registry, malformed input, concurrent lock holder; or a push landed but the remote tip could not be verified (executed-push records stand, no PASS is endorsed for the public face) |
 
 The `2` class matters as much as `1`: a tool error never exits 0, and no exit-0 run ever
 rests on a leg that silently skipped. Engine exit codes are translated against a closed
@@ -562,7 +641,7 @@ rules:
     names: [Acme CI]
     allowBots: true
   hosts: ["git.internal.acme.example"]      # turned into detection patterns
-  ips: ["10.20.30.40"]
+  ips: ["192.0.2.1"]
   pathPatterns: ["/Users/*", "*.pfx"]
   maxFileKB: 500                            # oversized-file threshold (default)
 allow:                                      # enumerated suppressions, never blanket
@@ -638,7 +717,7 @@ plugin entry ships as `exports["./server"]`):
 ```jsonc
 {
   // pin the exact version — an @latest channel hits the registry on every cold start
-  "plugin": ["border-customs@0.5.1"]
+  "plugin": ["border-customs@0.7.1"]
 }
 ```
 
@@ -659,6 +738,18 @@ exit 2 and never overwritten, uninstall removes only marker-bearing files, and i
 report `up to date`. Either route, restart opencode afterwards — tools and commands are
 scanned at startup.
 
+**OpenCode 2 (beta) compatibility (0.7.0).** The same module is dual-shaped: V1 hosts call
+`server()` (object entry form, opencode ≥ 1.18.29 required); V2 hosts (`@opencode-ai/cli@beta`,
+bin `opencode2`) call `setup(ctx)` and register the identical tool through
+`ctx.tool.transform` — hand-written `{id, setup}` (the SDK's `define()` is identity), plain
+JSON Schema input, zero V2-SDK runtime dependency. Live-verified on beta-19271 via
+project-local `.opencode/plugins/` (both single-file and package-directory shapes; directory
+discovery resolves the root `index.ts` re-export, which is why the package ships it). V2
+activates plugins lazily — listing them requires `POST /api/plugin/await-activation` first.
+The `/border` slash command stays V1-only until the V2 command-delivery API settles; the
+`border` tool is the supported V2 surface. Config keys are shared (V2 normalizes
+`plugin`→`plugins`). Global file-drop discovery under V2 is untested and not claimed.
+
 What loads is one agent tool `border` plus a `/border` slash command. The tool spawns the CLI
 argv-only (no shell; 300 s cap, 64 KiB per stream) restricted to the closed command list
 `check`, `push`, `status`, `llm-request`, `llm-ingest`, `scan`, `roundtrip`, `--help`, and
@@ -724,6 +815,64 @@ code.
 
 ## Changelog
 
+### 0.7.1 (2026-09-30)
+- Fix: **release-gate test ruler race** (`test/push.integration.test.ts` I4) — the
+  "dry-run made ZERO verdaccio requests" invariant counted lines in verdaccio's stdout
+  log, an eventually-consistent view: on a saturated CI runner the gate-leg probe lines
+  of an earlier phase land after the snapshot, inflating the dry-run delta (v0.7.0 CI
+  run 36671401844 failed `6 !== 2` while the identical bytes pass locally). The suite
+  now takes every snapshot through a FIFO drain barrier (sentinel request whose log line
+  must be visible before counting; sentinel traffic is excluded from the count). The
+  zero-network dry-run contract itself is unchanged — verified request-free on both sides
+  of the barrier; only the measuring instrument was repaired.
+
+### 0.7.0 (2026-09-28)
+- Add: **OpenCode 2 (beta) plugin compatibility** — the plugin module is dual-shaped
+  (`{id, setup}` for V2 hosts, frozen V1 `server()`), sharing the pre-spawn
+  allowlist/`--yes` gates and the 0.5.1 identity handshake across both shapes;
+  refusal/handshake/rendering byte-parity between edges is pinned by
+  `test/opencode.v2shape.test.ts` while the V1 path stays 16/16 on unmodified
+  tests. Root `index.ts` re-export shipped for V2 directory discovery (which
+  bypasses the exports map; live-proven on `@opencode-ai/cli` beta-19271).
+- Fix: the live V1 probe is anti-vacuous — opting in (`BORDER_OPENCODE_PROBE=1`)
+  without a resolvable binary or built dist now FAILS naming the remedy instead
+  of skipping green-adjacent (`BORDER_OPENCODE_BIN` override added).
+- Docs: support matrix (V1 object entry ≥ 1.18.29; V2 project-local verified;
+  `/border` command V1-only pending the V2 delivery API).
+
+### 0.6.0 (2026-09-25)
+- Add: **the exfil lens** — five rules (`exfil-rfc1918`, `exfil-ssh-target`,
+  `exfil-home-path`, `exfil-cred-location`, `exfil-host-profile`) that flag
+  exfil-shaped literals on about-to-be-public surfaces, the gap classic secret
+  scanners leave open because an internal IP is not a credential. The observed
+  severity of every (rule × facet × channel) cell lives in one machine-readable
+  home, `src/exfil/severity.ts`, rendered — never re-decided — by the check
+  pipeline, the new read-only `border exfil <rev|url>` CLI (tip tree by default,
+  `--deep` history, URL modes into a destroyed temp clone) and the README table,
+  each cell pinned by a docs guard. The tree HIGH family ships as vendored
+  twins (gitleaks TOML + secretlint patterns, ids byte-equal, verdict parity
+  tested); the commit-message facet is native-exclusive with a `:message` id
+  family so allow-list waivers can never cross facets; tag notes stay with the
+  pre-existing `tag-message-secret` engine leg. All exfil sources are
+  fingerprinted into `rulesHash`.
+- Add: **post-push landing verification** — after git legs move, the remote tip
+  is re-observed and scanned with the same machinery; clean appends an
+  append-only `t:"landing"` record and preserves the exit, a blocking hit exits
+  1 ("ALREADY PUBLIC; border detects, never erases"), an unobservable tip exits
+  2 with no record minted. Executed-push rows are never mutated; DRY-RUN lands
+  nothing.
+- Add: **fixture band + assembly doctrine** — 10.200.0.0/16 is reserved as the
+  always-exempt-on-tree test range (exemption mirrored natively in both twins,
+  message facet deliberately not exempt), and the test corpus assembles every
+  other leak shape at runtime (`assembleOctet`/`assembleHost`) so checked-out
+  bytes carry no complete leak tokens: border's own lens is green against
+  border's own corpus. Golden-suite coverage includes an opt-in truth lane
+  (`BORDER_EXFIL_TRUTH=1`) with a documented red-anchor lifetime clause.
+- Note: this release line traces to the 0.5.1 impersonation-wave audit; that
+  wave's H-3 follow-up — scrubbing this repo's own historical tip surfaces —
+  landed here as byte edits with the extracted values withheld from public
+  records by design (see the sanitized `.omo/evidence/` trail, not this log).
+
 ### 0.5.1 (2026-09-24)
 - Fix: **plugin impersonation — the `border` tool could spawn the host binary instead of the
   gate.** On Route B the 0.5.0 adapter resolved its packaged CLI as `process.execPath +
@@ -851,6 +1000,10 @@ MIT, see [LICENSE](LICENSE).
 
 ## 中文概要
 
+**0.7.1（2026-09-30）发布门禁尺伤修复**：I4 集成测试的"dry-run 对 registry 零请求"断言按 verdaccio stdout 日志行计数，而日志是最终一致视图——CI 满载 runner 上更早阶段的合法 probe 行晚于快照落盘，把差额错记到 dry-run 头上（v0.7.0 run 36671401844 红 `6 !== 2`，同字节本机绿）。修复=尺子不松语义：所有快照前后加 FIFO drain 屏障（哨兵请求行可见⇒先前请求行必已落盘；哨兵流量不计入计数）。dry-run 零网络契约本身未动，两侧实测请求为零。
+
+**0.7.0（2026-09-28）OpenCode 2（beta）兼容**：插件模块双形状——V1 宿主调 `server()`（对象入口需 ≥1.18.29），V2 宿主（`opencode2`）调 `setup(ctx)` 经 `ctx.tool.transform` 注册同一个工具；spawn 前门（allowlist/`--yes`）与 0.5.1 身份握手两形状共享，双边渲染逐字 parity 由测试钉死。V2 懒激活（断言前须 `POST /api/plugin/await-activation`）；`/border` 命令暂仅 V1（V2 投递 API 未定形）；已在 beta-19271 项目本地两形态活体验证。V1 活体探针反真空化：opt-in 缺前提即 FAIL 点名补救。
+
 border 是一个 fail-closed(失败即拦截)的推送前门禁 CLI:`npm install -g border-customs` 安装,在仓库里跑 `border check`。它扫描 git 历史、工作区(未跟踪文件同样是一等输入)、归档、tag 注释和将要发布的 npm/PyPI/crates/RubyGems 字节,检出密钥与供应链风险;只有当"当前状态指纹"存在新鲜且完整的 PASS 记录时才允许 `border push --yes` 放行。指纹是 sha256(head、porcelain 摘要、规则哈希、暴露面、ref 集合、有效目标)六元组,任何一处变动,旧的 PASS 立即失效,必须重查。流水线:gitleaks(历史+工作区+tag,内置 8.30.1 规则,仓库自带的 ignore 文件直接判 CRITICAL)+ secretlint(进程内,AWS Key 规则强制开启)+ 原生规则(AI 会话产物闭集、提交身份白名单含传输对象检查)+ 注册表预检(版本已存在=必须 bump,名称被外人占有=拒绝;空响应/超时/解析失败一律 exit 2,沉默绝不等于不存在)。构件只构建一次进 `.border/dist/`,扫描的就是发布的字节,发布时再哈希比对,不一致直接拒发。跳过台账让重复检查不到 1 秒,但回放前先重算指纹并重新 pack 验证新鲜度。报告只输出掩码片段(sha256 摘要 + 前4…后4)。push 是多目标状态机,多 remote 先做全有或全无的 fast-forward 预检,永不 force-push;npm/twine/cargo/gem 的凭据经 stdio 透传,border 从不触碰。0.2.0 新增 crates.io 与 RubyGems 通道(公开 crates.io 固定、rubygems 可用 host 覆盖私有镜像),既有配置行为不变。0.3.0 新增残留扫描(residue gate):发布字节里的安装期钩子按 T0-T4 闭集签名表分类(闭集 T1 树内钩子降为 MEDIUM,未知形态原样保留 CRITICAL),外加跨包管理器写入、配对标记缺失(`# BEGIN` 块只检测不豁免)与 gem 不可解析扩展共七条 `residue-*` 规则;`residue.enabled` 是唯一豁免开关且改动指纹使旧 PASS 失效,规则表与分类器源码进入 rulesHash,改一个签名即强制重查。静态分析只证明"能力"不证明"事实",border 不是恶意软件沙箱,从不执行被读代码。0.4.0 新增证明阀
 `residue.requireProof`(默认关,strict):开启后,发布构件若触发阻断级 `residue-*` 发现,通道 PASS
 还要求账本里存在按其 sha256 索引且 rulesHash 新鲜的 `border roundtrip` 实测记录——check 自身从不
@@ -883,3 +1036,5 @@ border 是一个 fail-closed(失败即拦截)的推送前门禁 CLI:`npm install
 发布一致性(0.4.1):起因是 aihr 事故——PyPI 上标为 0.2.2 的 wheel 里 `__init__.__version__` 却写着 0.2.1,构件名、元数据与实际模块行为三者不一致,所有 `==0.2.2` 的用户静默装上了旧行为;同类漂移在本仓库也出现过两次(npm tarball 的 User-Agent 停在 0.3.0 而 package.json 是 0.3.1;package-lock.json 根版本两个 release 一直躺在 0.1.0)。发布阶段扫描器因此在构件内部逐源交叉核对版本号:`release-coherence-version-drift` 为 CRITICAL(package.json 与被强制打包的 package-lock、wheel 文件名对 dist-info 目录对 METADATA `Version:` 对 `__init__` 字面量、sdist 的 pyproject 对 PKG-INFO/setup 系字面量、Cargo.toml 对已打包的 Cargo.lock、.gemspec 对 metadata.gz、dist 文件名对 sdist 内 PKG-INFO);版本源存在但无法静态解析(动态 `__version__`、`attr:`、`dynamic = ["version"]`、坏 lockfile)判 MEDIUM `release-coherence-unverifiable-source`——不可核查绝不静默算干净;第二版本源根本没被打包时不发现在内,缺源不是漂移,这条边界是承重的,误报的门禁会把用户训练成 `--force`。唯一可静态强制的跨包管理器声明是 opt-in `release.twin`(`{pypi, npm}` 严格 zod 对列表,未知键 exit 2):同一 run 的 dist 里孪生版本不等 ⇒ CRITICAL `release-coherence-twin-drift`,消息点名两个构件。规则源文件与 residue 指纹表一样并入 rulesHash,改一个匹配器即令全部缓存 PASS 失效。
 
 OpenCode 插件适配层(0.5.0):零手工装载两条路线——主路是在 `opencode.jsonc` 声明 `"plugin": ["border-customs@0.5.0"]`(建议钉具体版本,@latest 每次冷启动都打注册表),opencode 自行下载构件,插件入口走 `exports["./server"]`;插件自带 CLI 解析,顺序为 `BORDER_BIN` 覆盖(独占,坏了就报错、绝不静默回退)> 包内同侧 `dist/index.js`(shebang 直接执行,不可执行则回退 PATH 上的 `node` 承载)> PATH 上的 `border`,免全局安装、免 PATH 配置;0.5.1 起任何候选都必须先过**身份握手**(以 `--help` 应答出 border 横幅与 `usage: border` 才算数),通过之前绝不投递用户 argv,握手不过即 cannot-answer exit 2、不运行任何其他二进制——0.5.0 曾用 `process.execPath` 承载包内 dist,而在插件宿主里 execPath 是 opencode 本体,边检门被静默冒充为宿主(2026-09-22 事故,见 0.5.1 变更日志)。备路是 `border opencode install|status|uninstall` 文件投递,落盘 `$XDG_CONFIG_HOME/opencode` 下的 `plugins/border.ts` 与 `commands/border.md`(无 XDG 回退 HOME/.config):受管文件凭 marker 行识别身份,同名外人文件 exit 2 拒绝、绝不覆盖,卸载只删自己带 marker 的文件,字节相同即 `up to date`。装载面只有一个 `border` 工具(argv-only 生成、无 shell、300 秒与每流 64 KiB 上限,命令闭集 check/push/status/llm-request/llm-ingest/scan/roundtrip/--help)与一条 `/border` 斜杠命令(config 钩子以 `??=` 自注册,用户同名文件命令保持权威)。边界如实说:allowlist 是 UX/防呆而非安全边界——插件进程与 opencode 进程同权,门禁的牙齿在 CLI 与账本,不在适配层;`push --yes` 按设计留在终端人审,工具端机械拒绝,会话内裸 push 本就是 CLI 合同的 DRY-RUN。装载验证走 opt-in 探针 `BORDER_OPENCODE_PROBE=1`(临时 HOME/XDG 起 `opencode serve` 对照组,断言 `border` 工具 id 与恰好一条 border 命令,重复即 FAIL;插件加载失败是静默的,只认 HTTP 响应不认退出码)。两条路线装载后都需重启 opencode:工具与命令在启动时扫描。
+
+外泄透镜(0.6.0):经典密钥扫描器看不见内网 IP、`user@内网主机`、家目录、凭据文件位置、主机画像这类"外泄形状"字面量——它们不是密钥,却如实描述公网仓库身后的私网。0.6.0 加五条规则 `exfil-rfc1918/exfil-ssh-target/exfil-home-path/exfil-cred-location/exfil-host-profile`,每个(规则×分面×通道)格子的**观察严重度**只有单一事实源 `src/exfil/severity.ts`:树面 HIGH 族走双生规则(gitleaks TOML + secretlint pattern,id 逐字节相等、三通道判决对等性有测试钉死),因两引擎都没有 HIGH 档而如实记为 CRITICAL(不硬掰,如实表);树面 MEDIUM 族走原生腿;提交消息面原生独占、id 带 `:message` 后缀,allow 条目按 id 精确匹配、跨面豁免在结构上不可能;tag note 分面归既有引擎腿 `tag-message-secret`,核心绝不重复发。规则源文件并入 rulesHash,改一个匹配器即令全部缓存 PASS 失效。独立只读入口 `border exfil <rev|url>`(默认树尖,`--deep` 补全史 blob 与全部可达提交消息;URL 模式落临时克隆、退出即销毁)。push 之后新增**落地核验**:ls-remote 复读远端尖、必要时精确 fetch 该对象,用同一套机制扫已公开树——干净则追加 `t:"landing"` 账本行并保留原退出码;有阻断发现则 exit 1 并明说 ALREADY PUBLIC;border 只检测、从不抹除;远端不可观测则 exit 2、一条记录都不造(没核验就没事实),已执行的 push 记录原样矗立——账本 append-only,任何情况下不改写历史。测试语料遵守夹具纪律:10.200.0.0/16 为预留夹具段(树面全通道静默、双生规则原生镜像该豁免,消息面例外照红),其余泄漏形状一律由 `assembleOctet`/`assembleHost` 运行时拼装,签出字节里没有完整泄漏 token——border 的透镜对自己的仓库绿,红故事照常武装。真值通道 `BORDER_EXFIL_TRUTH=1` 为 opt-in,红锚点带生命周期条款:上游作者清理后按设计转绿、留档不判败。

package/dist/assets/exfil-src/rules.ts

@@ -0,0 +1,179 @@
+// provenance: .omo/plans/border-exfil-lens.md T1 — pure predicates for the five
+// exfil rules, plan §"规则语义表" (intent level; observed severity is resolved
+// through severity.ts, NEVER here).
+//
+// Purity contract: every predicate is (text, options) → hits. No fs, no git,
+// no config-module import — rules.hosts arrives as a parameter (T3's message
+// leg and the later CLI pass cfg.rules.hosts in). Line numbers are 1-based.
+// Hit.message is generic finding text and NEVER embeds the matched value;
+// scan.ts carries the value only as sha256 digest + mask (G23 invariant).
+//
+// SELF-STEALTH (dogfood lesson from 0.5.1, where the identity regex tripped
+// border's own drive-letter rule): this directory writes NO literal 4-octet
+// dotted-quad IP strings and no absolute home paths — CIDR bands live as
+// NUMBER tuples and IPv4 sources are assembled from octet character classes,
+// so border's own detectors (vendored TOML generic-path rule, no-homedir,
+// the repo's path-pattern rules) can never pattern-match our rule sources.
+import type { ExfilFacet, ExfilRuleId } from "./severity.ts";
+
+export type RuleHit = {
+  readonly rule: ExfilRuleId;
+  /** the matched raw value — digested/masked by scan.ts, never rendered. */
+  readonly matched: string;
+  readonly line: number;
+  readonly message: string;
+};
+
+export type RuleOptions = {
+  /** drives the band-exemption split (tree exempts DEFAULT_EXEMPT_BANDS, message fires everything); never selects severity. */
+  readonly facet: ExfilFacet;
+  /** operator's rules.hosts (config.ts:102) — exact-match ssh targets, closed set. */
+  readonly hosts?: readonly string[];
+  /** exemption-band override (production default DEFAULT_EXEMPT_BANDS; [] forces in-range arms red in unit tests). */
+  readonly exemptBands?: readonly string[];
+};
+
+// ---------------------------------------------------------------- IPv4 machinery
+
+const OCTET = "(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])";
+/** Full IPv4 with strict token boundaries (won't fire inside 5-dotted versions/urls). */
+const IPV4_SRC = `(?<![0-9A-Za-z.\\-])${OCTET}\\.${OCTET}\\.${OCTET}\\.${OCTET}(?![0-9A-Za-z.\\-])`;
+
+/**
+ * The production closed exemption bands (F2 twin-parity + F3 fixture doctrine):
+ * loopback, each RFC 5737 documentation /24, and the 10.200/16 SYNTHETIC-FIXTURE
+ * band. Dotted PREFIX strings (never full quads — self-stealth); a hit is
+ * exempt when its leading octets equal a band. ALL channels — native tree
+ * policy and both twins — exempt exactly these; the message facet alone stays
+ * band-fired (it is native-exclusive and carries the golden red anchors).
+ * Unit tests may pass options.exemptBands = [] to force in-range arms red with
+ * assembled (never checked-in-as-quad) literals.
+ */
+export const DEFAULT_EXEMPT_BANDS: readonly string[] = ["127", "192.0.2", "198.51.100", "203.0.113", "10.200"];
+
+function bandOctets(band: string): number[] {
+  return band.split(".").map(Number);
+}
+function inAnyBand(oct: readonly number[], bands: readonly string[]): boolean {
+  return bands.some((b) => {
+    const parts = bandOctets(b);
+    return parts.every((v, i) => oct[i] === v);
+  });
+}
+/** 10/8 ∪ 172.16/12 ∪ 192.168/16 — the plan's exfil-rfc1918 range set (loopback & RFC5737 are OUT of range by construction). */
+function inRfc1918(o: readonly number[]): boolean {
+  const [a = 0, b = 0] = o;
+  if (a === 10) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  return a === 192 && b === 168;
+}
+function octetsOf(ip: string): number[] {
+  return ip.split(".").map(Number);
+}
+function isIpLiteral(host: string): boolean {
+  return /^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$/.test(host);
+}
+
+/** Octet + boundary pieces shared by the JS twins (secretlint) — single source. */
+const OCTET_GRP = `(?:${OCTET})`;
+// Each branch is FULLY expanded (three or four octets as the prefix demands):
+// an alternation branch would otherwise swallow a shared suffix only into its
+// LAST arm — the precedence trap this exact line replaces.
+const RFC1918_FULL = `10\\.${OCTET_GRP}\\.${OCTET_GRP}\\.${OCTET_GRP}|172\\.(?:1[6-9]|2[0-9]|3[01])\\.${OCTET_GRP}\\.${OCTET_GRP}|192\\.168\\.${OCTET_GRP}\\.${OCTET_GRP}`;
+const SUFFIX_HOST = `[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?)*\\.(?:internal|lan|local|corp|intra)`;
+
+/**
+ * The secretlint-twin pattern sources for the HIGH family (plan §分面契约 row
+ * 1: emission id = pattern name, ids VERBATIM equal to the rule ids). Negative
+ * classes at the IP/head position exempt exactly DEFAULT_EXEMPT_BANDS (loopback
+ * / RFC5737 / 10.200/16 fixture band) — F2 verdict parity: the same bytes must
+ * read the same on every channel at the tree facet; the corpus test
+ * (test/exfil.pipeline.test.ts) is the real contract, id-equality alone was a
+ * hole. The gitleaks TOML carries Go-RE2 variants (no lookaround) of these
+ * same bodies + equivalent per-rule allowlists.
+ */
+const BAND_NEGATIVE = `(?!127\\.|10\\.200\\.|192\\.0\\.2\\.|198\\.51\\.100\\.|203\\.0\\.113\\.)`;
+export const EXFIL_TWIN_PATTERNS: ReadonlyArray<{ readonly name: ExfilRuleId; readonly source: string }> = [
+  { name: "exfil-rfc1918", source: `(?<![0-9A-Za-z.\\-])${BAND_NEGATIVE}(?:${RFC1918_FULL})(?![0-9A-Za-z.\\-])` },
+  { name: "exfil-ssh-target", source: `(?<![A-Za-z0-9._+%-])[A-Za-z0-9._+%-]+@${BAND_NEGATIVE}(?:${RFC1918_FULL}|${SUFFIX_HOST})(?![A-Za-z0-9._-])` },
+];
+
+// ---------------------------------------------------------------- exfil-rfc1918
+
+/**
+ * RFC1918 literals. Closed exemptions: DEFAULT_EXEMPT_BANDS (loopback + each
+ * RFC5737 /24 are OUT of range by construction; the 10.200/16 fixture band is
+ * in-range and exempted on every facet EXCEPT message — commit messages are
+ * the public-exposure surface with no fixture excuse, so the band FIRES there
+ * ("message 面带合成 IP 树干净 ⇒ 必红" stays mechanically true, and the twins,
+ * which never scan messages, match the tree-side policy exactly: F2 parity).
+ */
+export function matchRfc1918(text: string, o: RuleOptions): RuleHit[] {
+  const re = new RegExp(IPV4_SRC, "g");
+  const bands = o.exemptBands ?? DEFAULT_EXEMPT_BANDS;
+  const hits: RuleHit[] = [];
+  text.split("\n").forEach((body, idx) => {
+    for (const m of body.matchAll(re)) {
+      const ip = m[0] ?? "";
+      const oct = octetsOf(ip);
+      if (!inRfc1918(oct)) continue;
+      if (o.facet !== "message" && inAnyBand(oct, bands)) continue;
+      hits.push({ rule: "exfil-rfc1918", matched: ip, line: idx + 1, message: "RFC1918 private-network address literal on a surface about to become public." });
+    }
+  });
+  return hits;
+}
+
+// ---------------------------------------------------------------- exfil-ssh-target
+
+/** Closed private-suffix set (plan table): internal hostname shapes, not public domains. */
+const PRIVATE_SUFFIXES: readonly string[] = [".internal", ".lan", ".local", ".corp", ".intra"];
+/** RFC 2606 reserved TLDs — documentation/exemption shapes, never real targets. */
+const RFC2606_SUFFIXES: readonly string[] = [".example", ".test", ".invalid", ".localhost"];
+const SSH_TOKEN_RE = /(?<![A-Za-z0-9._+%-])[A-Za-z0-9._+%-]+@([A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?)/g;
+
+function hasDotSuffix(host: string, suffixes: readonly string[]): boolean {
+  return suffixes.some((s) => host.length > s.length && host.endsWith(s));
+}
+
+/**
+ * `user@host` where host ∈ {RFC1918 literal, operator's rules.hosts (exact,
+ * case-insensitive), closed suffix set {.internal,.lan,.local,.corp,.intra}}.
+ * Closed exemption: RFC 2606 (bare public domains like user@example.com are
+ * out of the hit set by construction — they match nothing). An explicitly
+ * operator-configured host wins over the RFC2606 shape exemption (listing it
+ * IS the operator declaring it internal). IP hosts: DEFAULT_EXEMPT_BANDS
+ * exempt on the tree facet (twin parity, F2); the message facet still fires
+ * `synthuser@` + fixture-band address — the T6 golden red anchor rides :message.
+ */
+export function matchSshTarget(text: string, o: RuleOptions): RuleHit[] {
+  const hosts = (o.hosts ?? []).map((h) => h.trim().toLowerCase()).filter((h) => h !== "");
+  const bands = o.exemptBands ?? DEFAULT_EXEMPT_BANDS;
+  const hits: RuleHit[] = [];
+  text.split("\n").forEach((body, idx) => {
+    for (const m of body.matchAll(SSH_TOKEN_RE)) {
+      const host = (m[1] ?? "").toLowerCase();
+      if (host === "") continue;
+      const isIp = isIpLiteral(host);
+      let fired = false;
+      if (isIp ? inRfc1918(octetsOf(host)) && !(o.facet !== "message" && inAnyBand(octetsOf(host), bands)) : false) {
+        fired = true;
+      } else if (!isIp && hosts.includes(host)) {
+        fired = true;
+      } else if (!isIp && !hasDotSuffix(host, RFC2606_SUFFIXES) && hasDotSuffix(host, PRIVATE_SUFFIXES)) {
+        fired = true;
+      }
+      if (fired) {
+        hits.push({ rule: "exfil-ssh-target", matched: `${m[0]}`, line: idx + 1, message: "SSH-style user@host naming an internal-only target (RFC1918 literal, configured host, or private suffix)." });
+      }
+    }
+  });
+  return hits;
+}
+
+// ---------------------------------------------------------------- path & profile rules (250-LOC ceiling split)
+//
+// matchHomePath / matchCredLocation / matchHostProfile live in rulesPath.ts
+// and are re-exported here so every consumer keeps importing the five
+// predicates from one module. Type-only imports keep that pair acyclic.
+export { matchCredLocation, matchHomePath, matchHostProfile } from "./rulesPath.ts";

package/dist/assets/exfil-src/rulesPath.ts

@@ -0,0 +1,112 @@
+// provenance: .omo/plans/border-exfil-lens.md T1/T2 — path-shape rules split out
+// of rules.ts at the 250-LOC ceiling (home-path, cred-location, host-profile).
+// Type-only import back into rules.ts keeps the pair runtime-acyclic.
+// Self-stealth: no absolute workspace paths and no dotted quads in this file
+// (see rules.ts header for the 0.5.1 dogfood lesson this obeys).
+import type { RuleHit, RuleOptions } from "./rules.ts";
+
+// ---------------------------------------------------------------- exfil-home-path
+
+/** /home/<user> — class-gated so "/homebrew" or a lone "/home/" never fires. */
+const HOME_POSIX_RE = /\/home\/([A-Za-z0-9._-]+)/g;
+/** C:\Users\<user> (any drive letter, either slash), case-insensitive. */
+const HOME_WINDOWS_RE = /([A-Za-z]:[\\/]+Users[\\/]+)([A-Za-z0-9._-]+)/gi;
+
+export function matchHomePath(text: string, _o: RuleOptions): RuleHit[] {
+  const hits: RuleHit[] = [];
+  text.split("\n").forEach((body, idx) => {
+    for (const m of body.matchAll(HOME_POSIX_RE)) {
+      hits.push({ rule: "exfil-home-path", matched: m[0] ?? "", line: idx + 1, message: "Home-directory path exposing a local username (privacy leak — T5 calibration graded this rule MEDIUM per lead ruling)." });
+    }
+    for (const m of body.matchAll(HOME_WINDOWS_RE)) {
+      hits.push({ rule: "exfil-home-path", matched: m[0] ?? "", line: idx + 1, message: "Windows user-profile path exposing a local username (privacy leak — T5 calibration graded this rule MEDIUM per lead ruling)." });
+    }
+  });
+  return hits;
+}
+
+// ---------------------------------------------------------------- exfil-cred-location
+
+const PYPIRC_RE = /~\/\.pypirc/g;
+const SSHPASS_RE = /\bSSHPASS\b/g;
+/** *.env token: path chars then ".env" ending the token (prod.env.example stays green). */
+const ENVFILE_RE = /[A-Za-z0-9_.~/-]*\.env(?![A-Za-z0-9_./-])/g;
+
+/** *.env location-shape gate (see matchCredLocation header for the calibration evidence). */
+function envTokenIsLocation(tok: string): boolean {
+  const stem = tok.slice(0, -".env".length);
+  if (stem === "") return true;
+  if (/[\/~]/.test(stem)) return true;
+  const parts = stem.split(".");
+  const receiver = parts[parts.length - 1] ?? "";
+  if (receiver === "process" || receiver === "os") return false;
+  return receiver.length >= 3;
+}
+
+/**
+ * Credential-BEARING LOCATIONS referenced by the outgoing text — position, not
+ * value (plan: "位置 ≠ 值"): ~/.pypirc, SSHPASS (env var name), *.env files.
+ * T5-calibrated (2026-09-25 self-scan: 186/354 raw tree matches were JS
+ * property access like process.env / o.env / x?.env, not disk locations):
+ * a *.env token counts only when it names the file itself, carries a path
+ * prefix, or has a real file-stem receiver (≥3 chars, never the process/os
+ * API names); the JS optional-chain read `x?.env` never counts.
+ */
+export function matchCredLocation(text: string, _o: RuleOptions): RuleHit[] {
+  const hits: RuleHit[] = [];
+  const push = (matched: string, line: number): void => {
+    hits.push({ rule: "exfil-cred-location", matched, line, message: "Reference to a credential-bearing location (env file / pypirc / SSHPASS); the location itself, value not required to fire." });
+  };
+  text.split("\n").forEach((body, idx) => {
+    for (const m of body.matchAll(PYPIRC_RE)) push(m[0] ?? "", idx + 1);
+    for (const m of body.matchAll(SSHPASS_RE)) push(m[0] ?? "", idx + 1);
+    for (const m of body.matchAll(ENVFILE_RE)) {
+      const tok = m[0] ?? "";
+      if ((body[(m.index ?? 0) - 1] ?? "") === "?") continue;
+      if (envTokenIsLocation(tok)) push(tok, idx + 1);
+    }
+  });
+  return hits;
+}
+
+// ---------------------------------------------------------------- exfil-host-profile
+
+/** Conservative multi-signal table (plan: 要素 ≥2 同段, closed regex set). */
+const PROFILE_SIGNALS: ReadonlyArray<{ readonly name: string; readonly re: RegExp }> = [
+  { name: "os+version", re: /\b(?:Ubuntu|Debian|Raspbian|CentOS|Rocky Linux|AlmaLinux|Amazon Linux|Red Hat Enterprise Linux|RHEL|Windows Server|SUSE Linux Enterprise|Fedora)\s+v?[0-9][0-9.]*/i },
+  { name: "no-docker", re: /\bno docker\b|\bdocker\b[^\n]{0,24}?\bnot (?:installed|present|available|running)\b|\bwithout docker\b|\bno container (?:runtime|engine)\b/i },
+  { name: "sudo-pattern", re: /\bpasswordless sudo\b|\bnopasswd\b|\bsudo\b[^\n]{0,24}?\b(?:without|needs?|requires?) (?:a )?password\b|\b(?:needs?|requires?) (?:a )?password\b[^\n]{0,12}?\bsudo\b/i },
+];
+
+/**
+ * Host-fingerprint disclosure: ≥2 DISTINCT signal groups (os+version /
+ * no-docker / sudo pattern) inside the SAME paragraph (blank-line-split
+ * block). Deliberately conservative: one signal never fires. The matched
+ * value is the SIGNAL-NAME CLUSTER, never the paragraph text (privacy +
+ * nothing raw on the Finding). Phase-2 note (plan): bare user@hostname and
+ * semantic combos ride ledger rows later — this predicate stays silent there.
+ */
+export function matchHostProfile(text: string, _o: RuleOptions): RuleHit[] {
+  const hits: RuleHit[] = [];
+  let paraLines: string[] = [];
+  let paraStart = 1;
+  const flush = (): void => {
+    if (paraLines.length === 0) return;
+    const para = paraLines.join("\n");
+    const found = PROFILE_SIGNALS.filter((s) => s.re.test(para)).map((s) => s.name);
+    if (found.length >= 2) {
+      hits.push({ rule: "exfil-host-profile", matched: found.join("+"), line: paraStart, message: `Host configuration fingerprint: ${String(found.length)} profile signals (os+version / no-docker / sudo-pattern) clustered in one paragraph.` });
+    }
+    paraLines = [];
+  };
+  text.split("\n").forEach((body, idx) => {
+    if (body.trim() === "") {
+      flush();
+      return;
+    }
+    if (paraLines.length === 0) paraStart = idx + 1;
+    paraLines.push(body);
+  });
+  flush();
+  return hits;
+}