border-customs 0.5.1 → 0.7.1

package/dist/assets/exfil-src/scan.ts

@@ -0,0 +1,146 @@
+// provenance: .omo/plans/border-exfil-lens.md T1 — scan surfaces for the native
+// exfil legs: scanTreeText (blob/tree facet) and scanMessageText (commit
+// message facet). Findings carry facet+channel attribution resolved through
+// severity.ts's matrix — the ONLY emitter of severities in this package; the
+// predicates in rules.ts decide detection, the matrix decides what is emitted
+// where and how loud (plan §"分面契约").
+//
+// Native emission per the matrix:
+//   * tree facet    → MEDIUM family only (home-path, cred-location,
+//                     host-profile). The HIGH family's tree face belongs to
+//                     the twin engines (T2); the v2 native double-emission
+//                     was revoked, and a native tree rfc1918/ssh-target
+//                     finding is UNREPRESENTABLE here (emitRulesFor returns
+//                     none for those cells).
+//   * message facet → all five rules under the `exfil-*:message` id family;
+//                     attribution `source` is the commit sha, which the
+//                     pipeline passes through toRepoRelative unchanged
+//                     (exclusions.ts:20-25), enabling per-commit allow rows.
+//   * tagNote facet → never scanned by the core (engine tag-message-secret
+//                     leg owns it, tagScan.ts:26,101); there is deliberately
+//                     no scanTagNoteText export.
+//
+// G23 masking invariant: the matched value leaves this module only as
+// {valueDigest, snippet}. maskValue() mirrors redact.ts exactly (code-point
+// based, ≤12 fully masked, else first4…last4) but is re-implemented locally
+// because the import-audit pins src/exfil/** to node builtins + local files;
+// the equivalence is pinned by a guard test against the real redact().
+import { createHash } from "node:crypto";
+
+import {
+  emitRulesFor,
+  exfilFindingId,
+  EXFIL_SECRET_VALUE_RULES,
+  observedSeverity,
+  type ExfilChannel,
+  type ExfilFacet,
+  type ExfilRuleId,
+  type ExfilSeverity,
+} from "./severity.ts";
+import {
+  matchCredLocation,
+  matchHomePath,
+  matchHostProfile,
+  matchRfc1918,
+  matchSshTarget,
+  type RuleHit,
+  type RuleOptions,
+} from "./rules.ts";
+
+/** Engine label for native exfil findings (mirrors "ai-artifacts" naming style). */
+export const EXFIL_ENGINE = "border-exfil";
+
+const FULL_MASK = "\u25ae\u25ae\u25ae\u25ae";
+const ELLIPSIS = "\u2026";
+
+/** redact.ts-equivalent masking (G23): sha256 digest + code-point-safe snippet. */
+export function maskValue(value: string): { valueDigest: string; snippet: string } {
+  const valueDigest = createHash("sha256").update(value, "utf8").digest("hex");
+  const points = [...value];
+  const snippet = points.length <= 12 ? FULL_MASK : `${points.slice(0, 4).join("")}${ELLIPSIS}${points.slice(-4).join("")}`;
+  return { valueDigest, snippet };
+}
+
+export type ExfilScanInput = {
+  /** the text being audited (blob content or one commit message). */
+  readonly text: string;
+  /** attribution: file path (tree) or commit sha (message). */
+  readonly source: string;
+  /** operator's rules.hosts (config.ts:102) for the ssh-target predicate. */
+  readonly hosts?: readonly string[];
+  /**
+   * Ingest hook mirroring the redact.ts adapter contract ("every adapter
+   * registers every value it ingests"): the check pipeline passes
+   * (raw, digest) => sanitizer.register(digest, raw) so flagged literals are
+   * scrubbed from all rendered text; stays local so the import-audit holds.
+   */
+  readonly onMatch?: (rawValue: string, valueDigest: string) => void;
+};
+
+export type ExfilFinding = {
+  /** severity.ts-resolved id: bare rule on tree, `exfil-*:message` on messages. */
+  readonly id: string;
+  readonly rule: ExfilRuleId;
+  readonly severity: ExfilSeverity;
+  readonly facet: ExfilFacet;
+  readonly channel: ExfilChannel;
+  /** parity with Finding.engine: string (src/findings.ts); native legs stamp EXFIL_ENGINE. */
+  readonly engine: string;
+  readonly message: string;
+  readonly source: string;
+  readonly line: number;
+  readonly valueDigest: string;
+  readonly snippet: string;
+};
+
+const PREDICATES: Readonly<Record<ExfilRuleId, (text: string, o: RuleOptions) => RuleHit[]>> = {
+  "exfil-rfc1918": matchRfc1918,
+  "exfil-ssh-target": matchSshTarget,
+  "exfil-home-path": matchHomePath,
+  "exfil-cred-location": matchCredLocation,
+  "exfil-host-profile": matchHostProfile,
+};
+
+/**
+ * One emitter for both facets: iterate exactly the rules the matrix ALLOWS for
+ * (facet × native), stamp severity from the same lookup (single source, no
+ * re-decision), and mask the evidence. Deterministic order: line, then id,
+ * then digest.
+ */
+function scanFacet(input: ExfilScanInput, facet: Extract<ExfilFacet, "tree" | "message">): ExfilFinding[] {
+  const channel: ExfilChannel = "native";
+  const options: RuleOptions = { facet, ...(input.hosts !== undefined ? { hosts: input.hosts } : {}) };
+  const findings: ExfilFinding[] = [];
+  for (const rule of emitRulesFor(facet, channel)) {
+    const severity = observedSeverity(rule, facet, channel);
+    if (severity === null) continue; // emitRulesFor excludes nulls; type narrowing kept honest.
+    for (const hit of PREDICATES[rule](input.text, options)) {
+      const { valueDigest, snippet } = maskValue(hit.matched);
+      if (EXFIL_SECRET_VALUE_RULES.includes(rule)) input.onMatch?.(hit.matched, valueDigest); // F4: location class never registers
+      findings.push({
+        id: exfilFindingId(rule, facet),
+        rule,
+        severity,
+        facet,
+        channel,
+        engine: EXFIL_ENGINE,
+        message: hit.message,
+        source: input.source,
+        line: hit.line,
+        valueDigest,
+        snippet,
+      });
+    }
+  }
+  return findings.sort((a, b) => a.line - b.line || a.id.localeCompare(b.id) || a.valueDigest.localeCompare(b.valueDigest));
+}
+
+/** Native tree/blob leg: MEDIUM-family rules only, per the matrix (HIGH family = twins). */
+export function scanTreeText(input: ExfilScanInput): ExfilFinding[] {
+  return scanFacet(input, "tree");
+}
+
+/** Commit-message leg: all five rules under the `:message` id family, sha attribution. */
+export function scanMessageText(input: ExfilScanInput): ExfilFinding[] {
+  return scanFacet(input, "message");
+}

package/dist/assets/exfil-src/severity.ts

@@ -0,0 +1,156 @@
+// provenance: .omo/plans/border-exfil-lens.md T1 — the single home of the
+// (rule × facet × channel → observed severity) matrix, plan §"分面契约" (R2).
+//
+// THE MATRIX IS THE PRODUCT DECISION and lives here and nowhere else; the
+// later README rule table (T8) and the check-pipeline stages (T2/T3) render
+// this table, they never re-decide it. Cell semantics:
+//
+//   * tree facet, twin channels — the HIGH family (exfil-rfc1918,
+//     exfil-ssh-target) rides the vendored gitleaks TOML + secretlint border
+//     patterns (T2 ships them with the ids VERBATIM equal to these rule ids).
+//     Observed severity is CRITICAL, not the table HIGH, because that is the
+//     channels' mechanical truth: gitleaks.ts:81 hardcodes severity
+//     "CRITICAL" for every finding it ingests, and secretlint.ts severityOf
+//     (299-309) maps error→CRITICAL with NO HIGH rung ("不硬掰，如实表").
+//   * tree facet, native channel — the MEDIUM family (exfil-home-path,
+//     exfil-cred-location, exfil-host-profile) only. The v2 native tree/blob
+//     double-emission of the HIGH family was REVOKED in plan REV v3
+//     ("撤销 v2 的 native 树/blob 双发 stage"): source-level elimination of
+//     triple-firing. A null cell here is a FORBIDDEN emission, and the guard
+//     tests pin it.
+//   * message facet — native EXCLUSIVE (`exfil-*:message` id family, T3's
+//     messageScan leg): all five rules at their table severity. The twins do
+//     not scan commit messages; a (message, twin) cell is null.
+//   * tagNote facet — owned by the EXISTING engine leg: the tagScan stdin leg
+//     (tagScan.ts:26,101) rides the vendored TOML and re-labels every hit
+//     `tag-message-secret` CRITICAL (path = the tag refname). The core
+//     therefore NEVER scans tag notes and no exfil-* finding id may be
+//     observed on this facet — every tagNote cell is null, eliminating
+//     double-firing by construction. The `:message` family covers commit
+//     messages only.
+//
+// Isolation note (plan §分面契约): allow-list entries are matched EXACTLY on
+// the rule id (allow.ts:38 → matchGlob with no wildcards in a plain id), so a
+// blob-face exemption `{rule: "exfil-rfc1918"}` never pierces the
+// `exfil-rfc1918:message` id and vice versa — the ids are kept structurally
+// distinct HERE (exfilFindingId) so the two families can never collide.
+//
+// Import-audit (plan §分面契约 last bullet): this directory imports only node
+// builtins and local exfil files — hence the severity union is re-declared
+// here instead of importing src/findings.ts; T2's pipeline maps these cells
+// onto Finding verbatim, and the guard test pins ordering compatibility.
+
+/** Mirrors SEVERITIES in src/findings.ts (re-declared: exfil core stays import-free). */
+export const EXFIL_SEVERITIES = ["INFO", "LOW", "MEDIUM", "HIGH", "CRITICAL"] as const;
+export type ExfilSeverity = (typeof EXFIL_SEVERITIES)[number];
+
+/** The five exfil-lens rule ids, verbatim; twins must ship these ids byte-equal (T2 guard). */
+export const EXFIL_RULE_IDS = [
+  "exfil-rfc1918",
+  "exfil-ssh-target",
+  "exfil-home-path",
+  "exfil-cred-location",
+  "exfil-host-profile",
+] as const;
+export type ExfilRuleId = (typeof EXFIL_RULE_IDS)[number];
+
+/** Message-facet attribution id family, e.g. "exfil-rfc1918:message" (plan §分面契约 row 2). */
+export const EXFIL_MESSAGE_ID_SUFFIX = ":message";
+export type ExfilMessageRuleId = `${ExfilRuleId}:message`;
+
+export const EXFIL_FACETS = ["tree", "message", "tagNote"] as const;
+export type ExfilFacet = (typeof EXFIL_FACETS)[number];
+
+export const EXFIL_CHANNELS = ["native", "gitleaks-twin", "secretlint-twin"] as const;
+export type ExfilChannel = (typeof EXFIL_CHANNELS)[number];
+
+/** Intent severities from the plan's 规则语义表 (what the rule means, before channel mechanics). */
+export const EXFIL_TABLE_SEVERITY: Readonly<Record<ExfilRuleId, ExfilSeverity>> = {
+  "exfil-rfc1918": "HIGH",
+  "exfil-ssh-target": "HIGH",
+  "exfil-home-path": "MEDIUM",
+  "exfil-cred-location": "MEDIUM",
+  "exfil-host-profile": "MEDIUM",
+};
+
+/** HIGH family: the two identity-carrying location rules; tree face belongs to the twins. */
+export const EXFIL_HIGH_FAMILY: readonly ExfilRuleId[] = ["exfil-rfc1918", "exfil-ssh-target"];
+/**
+ * Identifier class (F4): the matched text is a secret-shaped VALUE (an
+ * internal IP, a user@internal-host) — the check legs register these with the
+ * run's TextSanitizer so the literal cannot resurface in rendered output.
+ * The MEDIUM location class must NEVER register: there the matched text is a
+ * path whose literal printing IS the finding, and registering it turns every
+ * later render of that path into a [REDACTED storm (dogfood, round 2).
+ */
+export const EXFIL_SECRET_VALUE_RULES: readonly ExfilRuleId[] = EXFIL_HIGH_FAMILY;
+/** MEDIUM family: privacy-shape rules; native carries them on both scanned facets. */
+export const EXFIL_MEDIUM_FAMILY: readonly ExfilRuleId[] = ["exfil-home-path", "exfil-cred-location", "exfil-host-profile"];
+
+/** null = FORBIDDEN cell: that channel must never emit that rule on that facet. */
+export type ObservedSeverity = ExfilSeverity | null;
+
+const TWIN_HIGH: Readonly<Record<ExfilRuleId, ObservedSeverity>> = {
+  "exfil-rfc1918": "CRITICAL",
+  "exfil-ssh-target": "CRITICAL",
+  "exfil-home-path": null,
+  "exfil-cred-location": null,
+  "exfil-host-profile": null,
+};
+const NULL_ROW: Readonly<Record<ExfilRuleId, ObservedSeverity>> = {
+  "exfil-rfc1918": null,
+  "exfil-ssh-target": null,
+  "exfil-home-path": null,
+  "exfil-cred-location": null,
+  "exfil-host-profile": null,
+};
+
+/** The full (facet × channel × rule) truth table — the plan's 分面契约, machine-readable. */
+export const EXFIL_MATRIX: Readonly<Record<ExfilFacet, Readonly<Record<ExfilChannel, Readonly<Record<ExfilRuleId, ObservedSeverity>>>>>> = {
+  tree: {
+    // native tree leg = MEDIUM family补发 only (v2 double-emission revoked).
+    native: { ...NULL_ROW, "exfil-home-path": "MEDIUM", "exfil-cred-location": "MEDIUM", "exfil-host-profile": "MEDIUM" },
+    // gitleaks.ts:81 hardcodes CRITICAL for every ingested finding.
+    "gitleaks-twin": TWIN_HIGH,
+    // secretlint.ts:299-309 has no HIGH rung — error maps to CRITICAL as-is.
+    "secretlint-twin": TWIN_HIGH,
+  },
+  message: {
+    // native-exclusive `:message` family at table severity.
+    native: { ...EXFIL_TABLE_SEVERITY },
+    "gitleaks-twin": NULL_ROW,
+    "secretlint-twin": NULL_ROW,
+  },
+  tagNote: {
+    // engine既有腿 owns this facet as `tag-message-secret` (a non-exfil id);
+    // NO exfil-* emission is legal on tag notes through ANY channel.
+    native: NULL_ROW,
+    "gitleaks-twin": NULL_ROW,
+    "secretlint-twin": NULL_ROW,
+  },
+};
+
+/** Observed severity for one (rule × facet × channel) cell; null = that emission is forbidden. */
+export function observedSeverity(rule: ExfilRuleId, facet: ExfilFacet, channel: ExfilChannel): ObservedSeverity {
+  return EXFIL_MATRIX[facet][channel][rule];
+}
+
+/** Every rule a (facet × channel) combination is ALLOWED to emit, in EXFIL_RULE_IDS order. */
+export function emitRulesFor(facet: ExfilFacet, channel: ExfilChannel): readonly ExfilRuleId[] {
+  return EXFIL_RULE_IDS.filter((rule) => observedSeverity(rule, facet, channel) !== null);
+}
+
+/**
+ * The finding id for a (rule × facet) pair: the `:message` family ONLY on the
+ * message facet; tree/tagNote carry the bare rule id (the id must stay
+ * exactly "exfil-*" for the twin-id-equality and blob-face allow-list match).
+ */
+export function exfilFindingId(rule: ExfilRuleId, facet: ExfilFacet): string {
+  switch (facet) {
+    case "message":
+      return `${rule}${EXFIL_MESSAGE_ID_SUFFIX}`;
+    case "tree":
+    case "tagNote":
+      return rule;
+  }
+}

package/dist/assets/gitleaks-defaults-v8.30.1.toml

@@ -3207,3 +3207,53 @@ description = "Detected a Zendesk Secret Key, risking unauthorized access to cus
 regex = '''(?i)[\w.-]{0,50}?(?:zendesk)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9]{40})(?:[\x60'"\s;]|\\[nr]|$)'''
 keywords = ["zendesk"]
 
+# ---------------------------------------------------------------------------
+# border vendored additions (NOT upstream-generated; plan
+# .omo/plans/border-exfil-lens.md T2 — exfil lens tree-facet HIGH family, the
+# "gitleaks-twin" channel). Ids must stay VERBATIM equal to src/exfil rule ids
+# (EXFIL_HIGH_FAMILY); the twin guard parses this file. Go RE2 has no
+# lookaround, so boundaries use NON-CAPTURING character classes and the token
+# itself rides (?P<secret>…): that is what gitleaks 8.30.1 digests as Secret
+# (border's adapter hashes Secret over Match) and what per-rule allowlists are
+# matched against by default. The adjacent-IP edge (second IP on one line
+# shadowed by the consumed separator) is covered by the secretlint twin's JS
+# lookarounds. No literal dotted quads appear here — octet classes only
+# (self-stealth).
+# F2 VERDICT PARITY: the per-rule allowlists cancel findings whose secret is
+# an exempt-band address — loopback, each RFC5737 /24, and the 10.200/16
+# synthetic-fixture band (mirrors src/exfil DEFAULT_EXEMPT_BANDS; corpus-pinned
+# by the VERDICT-PARITY test in test/exfil.pipeline.test.ts). Anchored ^ on the
+# secret; ssh secrets are "user@host", so their patterns anchor at the @.
+# ---------------------------------------------------------------------------
+
+[[rules]]
+id = "exfil-rfc1918"
+description = "RFC1918 private-network address literal on a surface about to become public (border exfil lens)."
+regex = '''(?:^|[^0-9A-Za-z.])(?P<secret>10\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){2}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])|172\.(?:1[6-9]|2[0-9]|3[01])\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.)(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])|192\.168\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.)(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9]))(?:[^0-9A-Za-z.]|$)'''
+keywords = ["10.", "172.", "192."]
+severity = "critical"
+[[rules.allowlists]]
+description = "border exfil F2 parity: exempt bands (127/8, RFC5737 /24s, 10.200/16 synthetic-fixture band)"
+regexes = [
+    '''^127\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){2}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$''',
+    '''^192\.0\.2\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$''',
+    '''^198\.51\.100\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$''',
+    '''^203\.0\.113\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$''',
+    '''^10\.200\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.)(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$''',
+]
+
+[[rules]]
+id = "exfil-ssh-target"
+description = "SSH-style user@host naming an internal-only target: RFC1918 literal or private suffix (.internal/.lan/.local/.corp/.intra; RFC2606 shapes cannot match a suffix at word end)."
+regex = '''(?:^|[^0-9A-Za-z._+%-])(?P<secret>[0-9A-Za-z._+%-]+@(?:10\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){2}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])|172\.(?:1[6-9]|2[0-9]|3[01])\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.)(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])|192\.168\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.)(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])|[0-9A-Za-z](?:[0-9A-Za-z-]*[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:[0-9A-Za-z-]*[0-9A-Za-z])?)*\.(?:internal|lan|local|corp|intra)))(?:[^0-9A-Za-z._-]|$)'''
+keywords = [".internal", ".lan", ".local", ".corp", ".intra", "10.", "172.", "192."]
+severity = "critical"
+[[rules.allowlists]]
+description = "border exfil F2 parity: exempt-band IP hosts never count as internal ssh targets on the tree facet (10.200/16 fixture band et al.)"
+regexes = [
+    '''^[0-9A-Za-z._+%-]+@127\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){2}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$''',
+    '''^[0-9A-Za-z._+%-]+@192\.0\.2\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$''',
+    '''^[0-9A-Za-z._+%-]+@198\.51\.100\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$''',
+    '''^[0-9A-Za-z._+%-]+@203\.0\.113\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$''',
+    '''^[0-9A-Za-z._+%-]+@10\.200\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.)(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$''',
+]

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "border-customs",
-  "version": "0.5.1",
+  "version": "0.7.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "border-customs",
-      "version": "0.5.1",
+      "version": "0.7.1",
       "license": "MIT",
       "dependencies": {
         "@opencode-ai/plugin": "^1.17.4",