border-customs 0.5.1 → 0.7.1

package/dist/index.js

@@ -33124,8 +33124,8 @@ var createMaskValue = (value) => {
 };
 var maskWithValues = (str, maskedValues) => {
   let result = str;
-  for (const maskValue of maskedValues) {
-    result = result.replaceAll(maskValue, "*".repeat(maskValue.length));
+  for (const maskValue2 of maskedValues) {
+    result = result.replaceAll(maskValue2, "*".repeat(maskValue2.length));
   }
   return result;
 };
@@ -37387,6 +37387,158 @@ var creator4 = {
   }
 };
 
+// src/exfil/rulesPath.ts
+var HOME_POSIX_RE = /\/home\/([A-Za-z0-9._-]+)/g;
+var HOME_WINDOWS_RE = /([A-Za-z]:[\\/]+Users[\\/]+)([A-Za-z0-9._-]+)/gi;
+function matchHomePath(text, _o) {
+  const hits = [];
+  text.split("\n").forEach((body, idx) => {
+    for (const m of body.matchAll(HOME_POSIX_RE)) {
+      hits.push({ rule: "exfil-home-path", matched: m[0] ?? "", line: idx + 1, message: "Home-directory path exposing a local username (privacy leak \u2014 T5 calibration graded this rule MEDIUM per lead ruling)." });
+    }
+    for (const m of body.matchAll(HOME_WINDOWS_RE)) {
+      hits.push({ rule: "exfil-home-path", matched: m[0] ?? "", line: idx + 1, message: "Windows user-profile path exposing a local username (privacy leak \u2014 T5 calibration graded this rule MEDIUM per lead ruling)." });
+    }
+  });
+  return hits;
+}
+var PYPIRC_RE = /~\/\.pypirc/g;
+var SSHPASS_RE = /\bSSHPASS\b/g;
+var ENVFILE_RE = /[A-Za-z0-9_.~/-]*\.env(?![A-Za-z0-9_./-])/g;
+function envTokenIsLocation(tok) {
+  const stem = tok.slice(0, -".env".length);
+  if (stem === "") return true;
+  if (/[\/~]/.test(stem)) return true;
+  const parts = stem.split(".");
+  const receiver = parts[parts.length - 1] ?? "";
+  if (receiver === "process" || receiver === "os") return false;
+  return receiver.length >= 3;
+}
+function matchCredLocation(text, _o) {
+  const hits = [];
+  const push = (matched, line) => {
+    hits.push({ rule: "exfil-cred-location", matched, line, message: "Reference to a credential-bearing location (env file / pypirc / SSHPASS); the location itself, value not required to fire." });
+  };
+  text.split("\n").forEach((body, idx) => {
+    for (const m of body.matchAll(PYPIRC_RE)) push(m[0] ?? "", idx + 1);
+    for (const m of body.matchAll(SSHPASS_RE)) push(m[0] ?? "", idx + 1);
+    for (const m of body.matchAll(ENVFILE_RE)) {
+      const tok = m[0] ?? "";
+      if ((body[(m.index ?? 0) - 1] ?? "") === "?") continue;
+      if (envTokenIsLocation(tok)) push(tok, idx + 1);
+    }
+  });
+  return hits;
+}
+var PROFILE_SIGNALS = [
+  { name: "os+version", re: /\b(?:Ubuntu|Debian|Raspbian|CentOS|Rocky Linux|AlmaLinux|Amazon Linux|Red Hat Enterprise Linux|RHEL|Windows Server|SUSE Linux Enterprise|Fedora)\s+v?[0-9][0-9.]*/i },
+  { name: "no-docker", re: /\bno docker\b|\bdocker\b[^\n]{0,24}?\bnot (?:installed|present|available|running)\b|\bwithout docker\b|\bno container (?:runtime|engine)\b/i },
+  { name: "sudo-pattern", re: /\bpasswordless sudo\b|\bnopasswd\b|\bsudo\b[^\n]{0,24}?\b(?:without|needs?|requires?) (?:a )?password\b|\b(?:needs?|requires?) (?:a )?password\b[^\n]{0,12}?\bsudo\b/i }
+];
+function matchHostProfile(text, _o) {
+  const hits = [];
+  let paraLines = [];
+  let paraStart = 1;
+  const flush = () => {
+    if (paraLines.length === 0) return;
+    const para = paraLines.join("\n");
+    const found = PROFILE_SIGNALS.filter((s) => s.re.test(para)).map((s) => s.name);
+    if (found.length >= 2) {
+      hits.push({ rule: "exfil-host-profile", matched: found.join("+"), line: paraStart, message: `Host configuration fingerprint: ${String(found.length)} profile signals (os+version / no-docker / sudo-pattern) clustered in one paragraph.` });
+    }
+    paraLines = [];
+  };
+  text.split("\n").forEach((body, idx) => {
+    if (body.trim() === "") {
+      flush();
+      return;
+    }
+    if (paraLines.length === 0) paraStart = idx + 1;
+    paraLines.push(body);
+  });
+  flush();
+  return hits;
+}
+
+// src/exfil/rules.ts
+var OCTET = "(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])";
+var IPV4_SRC = `(?<![0-9A-Za-z.\\-])${OCTET}\\.${OCTET}\\.${OCTET}\\.${OCTET}(?![0-9A-Za-z.\\-])`;
+var DEFAULT_EXEMPT_BANDS = ["127", "192.0.2", "198.51.100", "203.0.113", "10.200"];
+function bandOctets(band) {
+  return band.split(".").map(Number);
+}
+function inAnyBand(oct, bands) {
+  return bands.some((b) => {
+    const parts = bandOctets(b);
+    return parts.every((v, i) => oct[i] === v);
+  });
+}
+function inRfc1918(o) {
+  const [a = 0, b = 0] = o;
+  if (a === 10) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  return a === 192 && b === 168;
+}
+function octetsOf(ip) {
+  return ip.split(".").map(Number);
+}
+function isIpLiteral(host) {
+  return /^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$/.test(host);
+}
+var OCTET_GRP = `(?:${OCTET})`;
+var RFC1918_FULL = `10\\.${OCTET_GRP}\\.${OCTET_GRP}\\.${OCTET_GRP}|172\\.(?:1[6-9]|2[0-9]|3[01])\\.${OCTET_GRP}\\.${OCTET_GRP}|192\\.168\\.${OCTET_GRP}\\.${OCTET_GRP}`;
+var SUFFIX_HOST = `[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?)*\\.(?:internal|lan|local|corp|intra)`;
+var BAND_NEGATIVE = `(?!127\\.|10\\.200\\.|192\\.0\\.2\\.|198\\.51\\.100\\.|203\\.0\\.113\\.)`;
+var EXFIL_TWIN_PATTERNS = [
+  { name: "exfil-rfc1918", source: `(?<![0-9A-Za-z.\\-])${BAND_NEGATIVE}(?:${RFC1918_FULL})(?![0-9A-Za-z.\\-])` },
+  { name: "exfil-ssh-target", source: `(?<![A-Za-z0-9._+%-])[A-Za-z0-9._+%-]+@${BAND_NEGATIVE}(?:${RFC1918_FULL}|${SUFFIX_HOST})(?![A-Za-z0-9._-])` }
+];
+function matchRfc1918(text, o) {
+  const re = new RegExp(IPV4_SRC, "g");
+  const bands = o.exemptBands ?? DEFAULT_EXEMPT_BANDS;
+  const hits = [];
+  text.split("\n").forEach((body, idx) => {
+    for (const m of body.matchAll(re)) {
+      const ip = m[0] ?? "";
+      const oct = octetsOf(ip);
+      if (!inRfc1918(oct)) continue;
+      if (o.facet !== "message" && inAnyBand(oct, bands)) continue;
+      hits.push({ rule: "exfil-rfc1918", matched: ip, line: idx + 1, message: "RFC1918 private-network address literal on a surface about to become public." });
+    }
+  });
+  return hits;
+}
+var PRIVATE_SUFFIXES = [".internal", ".lan", ".local", ".corp", ".intra"];
+var RFC2606_SUFFIXES = [".example", ".test", ".invalid", ".localhost"];
+var SSH_TOKEN_RE = /(?<![A-Za-z0-9._+%-])[A-Za-z0-9._+%-]+@([A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?)/g;
+function hasDotSuffix(host, suffixes) {
+  return suffixes.some((s) => host.length > s.length && host.endsWith(s));
+}
+function matchSshTarget(text, o) {
+  const hosts = (o.hosts ?? []).map((h) => h.trim().toLowerCase()).filter((h) => h !== "");
+  const bands = o.exemptBands ?? DEFAULT_EXEMPT_BANDS;
+  const hits = [];
+  text.split("\n").forEach((body, idx) => {
+    for (const m of body.matchAll(SSH_TOKEN_RE)) {
+      const host = (m[1] ?? "").toLowerCase();
+      if (host === "") continue;
+      const isIp = isIpLiteral(host);
+      let fired = false;
+      if (isIp ? inRfc1918(octetsOf(host)) && !(o.facet !== "message" && inAnyBand(octetsOf(host), bands)) : false) {
+        fired = true;
+      } else if (!isIp && hosts.includes(host)) {
+        fired = true;
+      } else if (!isIp && !hasDotSuffix(host, RFC2606_SUFFIXES) && hasDotSuffix(host, PRIVATE_SUFFIXES)) {
+        fired = true;
+      }
+      if (fired) {
+        hits.push({ rule: "exfil-ssh-target", matched: `${m[0]}`, line: idx + 1, message: "SSH-style user@host naming an internal-only target (RFC1918 literal, configured host, or private suffix)." });
+      }
+    }
+  });
+  return hits;
+}
+
 // src/findings.ts
 var SEVERITIES = ["INFO", "LOW", "MEDIUM", "HIGH", "CRITICAL"];
 function isBlocking(severity) {
@@ -37491,6 +37643,7 @@ function generatePatterns(rules2) {
   for (const ip of rules2?.ips ?? []) optionPatterns.push(makePattern(`internal-ip:${ip}`, ip, true, compiled));
   for (const pp of rules2?.pathPatterns ?? []) optionPatterns.push(makePattern(`path-pattern:${pp}`, pp, true, compiled));
   for (const dflt of DEFAULT_PATH_PATTERNS) optionPatterns.push(makePattern(`path-pattern:${dflt}`, dflt, false, compiled));
+  for (const twin of EXFIL_TWIN_PATTERNS) optionPatterns.push(makePattern(twin.name, twin.source, false, compiled));
   return { optionPatterns, compiled };
 }
 var AWS_OVERRIDE = [{ id: AWS_RULE_ID, options: { enableIDScanRule: true } }];
@@ -38399,6 +38552,7 @@ var HEX64 = /^[0-9a-f]{64}$/;
 var HEX40 = /^[0-9a-f]{40}$/;
 var HEX8 = /^[0-9a-f]{8}$/;
 var PUSH_CONFIRMED_VIA = ["ls-remote", "npm-view", "pypi-json", "crates-json", "rubygems-json"];
+var LANDING_VERDICTS = ["clean", "blocked"];
 function ledgerPath(repoDir) {
   return join8(repoDir, BORDER_STATE_DIR, LEDGER_FILE);
 }
@@ -38439,6 +38593,26 @@ function buildRoundtripRecord(i) {
 function bad(msg) {
   throw new Error(msg);
 }
+function buildLandingRecord(i) {
+  if (!HEX64.test(i.key)) bad("key is not hex-shaped");
+  if (!HEX64.test(i.rulesHash)) bad("rulesHash is not hex-shaped");
+  if (!HEX40.test(i.remoteSha)) bad("remoteSha is not hex-shaped");
+  if (i.target === "") bad("target must be non-empty");
+  if (i.ref === "") bad("ref must be non-empty");
+  if (!LANDING_VERDICTS.includes(i.verdict)) bad(`verdict must be one of ${LANDING_VERDICTS.join("|")}, got '${i.verdict}'`);
+  if (!Number.isInteger(i.blocking) || i.blocking < 0) bad("blocking must be a non-negative integer");
+  return {
+    t: "landing",
+    key: i.key,
+    target: i.target,
+    ref: i.ref,
+    remoteSha: i.remoteSha,
+    verdict: i.verdict,
+    blocking: i.blocking,
+    rulesHash: i.rulesHash,
+    ts: i.ts ?? (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
 function needString(o, field) {
   const v = o[field];
   if (typeof v !== "string" || v === "") bad(`${field} must be a non-empty string`);
@@ -38540,6 +38714,23 @@ function parseLedgerRecord(value) {
       ts: needString(o, "ts")
     };
   }
+  if (t === "landing") {
+    const verdict = needString(o, "verdict");
+    if (!LANDING_VERDICTS.includes(verdict)) bad(`verdict must be one of ${LANDING_VERDICTS.join("|")}, got '${verdict}'`);
+    const blocking = o.blocking;
+    if (typeof blocking !== "number" || !Number.isInteger(blocking) || blocking < 0) bad("blocking must be a non-negative integer");
+    return {
+      t: "landing",
+      key: needHex(o, "key", HEX64),
+      target: needString(o, "target"),
+      ref: needString(o, "ref"),
+      remoteSha: needHex(o, "remoteSha", HEX40),
+      verdict,
+      blocking,
+      rulesHash: needHex(o, "rulesHash", HEX64),
+      ts: needString(o, "ts")
+    };
+  }
   return bad(`unknown record type ${JSON.stringify(t)}`);
 }
 function codeOf2(err) {
@@ -39412,6 +39603,23 @@ function resolveReleaseFingerprintFiles(env2 = process.env) {
     return resolveAsset(import.meta.url, ["release-src", base]);
   });
 }
+var EXFIL_FINGERPRINT_SOURCES = [
+  { dir: "exfil", base: "severity.ts" },
+  { dir: "exfil", base: "rules.ts" },
+  { dir: "exfil", base: "rulesPath.ts" },
+  { dir: "exfil", base: "scan.ts" }
+];
+var EXFIL_FINGERPRINT_BASENAMES = EXFIL_FINGERPRINT_SOURCES.map((s) => s.base);
+function resolveExfilFingerprintFiles(env2 = process.env) {
+  const here = dirname6(fileURLToPath4(import.meta.url));
+  const seam = env2.BORDER_EXFIL_SRC_DIR;
+  return EXFIL_FINGERPRINT_SOURCES.map(({ dir, base }) => {
+    if (seam !== void 0) return join11(seam, base);
+    const live = join11(here, "..", dir, base);
+    if (existsSync7(live)) return live;
+    return resolveAsset(import.meta.url, ["exfil-src", base]);
+  });
+}
 function resolvePromptTemplatePath(env2 = process.env) {
   return env2.BORDER_PROMPT_TEMPLATE_PATH ?? resolveAsset(import.meta.url, ["prompts", "llm-review.md"]);
 }
@@ -39433,7 +39641,8 @@ async function computeCheckRulesHash(input2) {
     bundledRulePaths: [
       GITLEAKS_VENDORED_CONFIG,
       ...resolveResidueFingerprintFiles(input2.env ?? process.env),
-      ...resolveReleaseFingerprintFiles(input2.env ?? process.env)
+      ...resolveReleaseFingerprintFiles(input2.env ?? process.env),
+      ...resolveExfilFingerprintFiles(input2.env ?? process.env)
     ],
     configDigest: input2.configDigest,
     engineVersions: input2.engineVersions,
@@ -41389,7 +41598,7 @@ function npmNameClaimed(o) {
   return true;
 }
 function npmViewJson(args, registry2, timeoutMs, env2) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve20, reject) => {
     const child = spawn2("npm", ["view", ...args, "--registry", registry2, "--fetch-retries=0", "--json"], {
       stdio: ["ignore", "pipe", "pipe"],
       ...env2 === void 0 ? {} : { env: env2 }
@@ -41408,7 +41617,7 @@ function npmViewJson(args, registry2, timeoutMs, env2) {
     });
     child.on("close", (status) => {
       clearTimeout(timer);
-      resolve16({ status: status ?? -1, stdout, stderr });
+      resolve20({ status: status ?? -1, stdout, stderr });
     });
   });
 }
@@ -42546,6 +42755,22 @@ function headFile4(toplevel, rel) {
   }
   return r.stdout;
 }
+function remoteTrackingDrift(cwd) {
+  const configured = parseRemoteV(runGit3(cwd, ["remote", "-v"]).stdout).map((r) => r.name).filter((n) => n !== void 0).sort();
+  const refs = runGit3(cwd, ["for-each-ref", "--format=%(refname:lstrip=2)", "refs/remotes"]);
+  const refNames = /* @__PURE__ */ new Set();
+  if (refs.ok) {
+    for (const line of refs.stdout.split("\n")) {
+      const first = line.trim().split("/")[0];
+      if (first !== void 0 && first !== "") {
+        refNames.add(first);
+      }
+    }
+  }
+  const configuredSet = new Set(configured);
+  const orphans = [...refNames].filter((n) => !configuredSet.has(n)).sort();
+  return { configured, orphans };
+}
 function hasTargets(cfg) {
   return cfg.targets.git.remotes.length > 0 || publishChannels().some((c) => c.configured(cfg));
 }
@@ -42641,7 +42866,7 @@ function exposureSet(cfg, options = {}) {
 }
 
 // src/check.ts
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 
 // src/rules/aiArtifacts.ts
 import { spawnSync as spawnSync12 } from "node:child_process";
@@ -42884,6 +43109,301 @@ function applyAllowList(findings, allow, repoDir) {
   return { kept, allowHits: [...hits.values()] };
 }
 
+// src/check/exfilTreeScan.ts
+import { readFileSync as readFileSync14, statSync as statSync2 } from "node:fs";
+import { join as join21, resolve as resolve12 } from "node:path";
+
+// src/exfil/scan.ts
+import { createHash as createHash13 } from "node:crypto";
+
+// src/exfil/severity.ts
+var EXFIL_RULE_IDS = [
+  "exfil-rfc1918",
+  "exfil-ssh-target",
+  "exfil-home-path",
+  "exfil-cred-location",
+  "exfil-host-profile"
+];
+var EXFIL_MESSAGE_ID_SUFFIX = ":message";
+var EXFIL_TABLE_SEVERITY = {
+  "exfil-rfc1918": "HIGH",
+  "exfil-ssh-target": "HIGH",
+  "exfil-home-path": "MEDIUM",
+  "exfil-cred-location": "MEDIUM",
+  "exfil-host-profile": "MEDIUM"
+};
+var EXFIL_HIGH_FAMILY = ["exfil-rfc1918", "exfil-ssh-target"];
+var EXFIL_SECRET_VALUE_RULES = EXFIL_HIGH_FAMILY;
+var TWIN_HIGH = {
+  "exfil-rfc1918": "CRITICAL",
+  "exfil-ssh-target": "CRITICAL",
+  "exfil-home-path": null,
+  "exfil-cred-location": null,
+  "exfil-host-profile": null
+};
+var NULL_ROW = {
+  "exfil-rfc1918": null,
+  "exfil-ssh-target": null,
+  "exfil-home-path": null,
+  "exfil-cred-location": null,
+  "exfil-host-profile": null
+};
+var EXFIL_MATRIX = {
+  tree: {
+    // native tree leg = MEDIUM family补发 only (v2 double-emission revoked).
+    native: { ...NULL_ROW, "exfil-home-path": "MEDIUM", "exfil-cred-location": "MEDIUM", "exfil-host-profile": "MEDIUM" },
+    // gitleaks.ts:81 hardcodes CRITICAL for every ingested finding.
+    "gitleaks-twin": TWIN_HIGH,
+    // secretlint.ts:299-309 has no HIGH rung — error maps to CRITICAL as-is.
+    "secretlint-twin": TWIN_HIGH
+  },
+  message: {
+    // native-exclusive `:message` family at table severity.
+    native: { ...EXFIL_TABLE_SEVERITY },
+    "gitleaks-twin": NULL_ROW,
+    "secretlint-twin": NULL_ROW
+  },
+  tagNote: {
+    // engine既有腿 owns this facet as `tag-message-secret` (a non-exfil id);
+    // NO exfil-* emission is legal on tag notes through ANY channel.
+    native: NULL_ROW,
+    "gitleaks-twin": NULL_ROW,
+    "secretlint-twin": NULL_ROW
+  }
+};
+function observedSeverity(rule, facet, channel) {
+  return EXFIL_MATRIX[facet][channel][rule];
+}
+function emitRulesFor(facet, channel) {
+  return EXFIL_RULE_IDS.filter((rule) => observedSeverity(rule, facet, channel) !== null);
+}
+function exfilFindingId(rule, facet) {
+  switch (facet) {
+    case "message":
+      return `${rule}${EXFIL_MESSAGE_ID_SUFFIX}`;
+    case "tree":
+    case "tagNote":
+      return rule;
+  }
+}
+
+// src/exfil/scan.ts
+var EXFIL_ENGINE = "border-exfil";
+var FULL_MASK2 = "\u25AE\u25AE\u25AE\u25AE";
+var ELLIPSIS2 = "\u2026";
+function maskValue(value) {
+  const valueDigest = createHash13("sha256").update(value, "utf8").digest("hex");
+  const points = [...value];
+  const snippet = points.length <= 12 ? FULL_MASK2 : `${points.slice(0, 4).join("")}${ELLIPSIS2}${points.slice(-4).join("")}`;
+  return { valueDigest, snippet };
+}
+var PREDICATES = {
+  "exfil-rfc1918": matchRfc1918,
+  "exfil-ssh-target": matchSshTarget,
+  "exfil-home-path": matchHomePath,
+  "exfil-cred-location": matchCredLocation,
+  "exfil-host-profile": matchHostProfile
+};
+function scanFacet(input2, facet) {
+  const channel = "native";
+  const options = { facet, ...input2.hosts !== void 0 ? { hosts: input2.hosts } : {} };
+  const findings = [];
+  for (const rule of emitRulesFor(facet, channel)) {
+    const severity = observedSeverity(rule, facet, channel);
+    if (severity === null) continue;
+    for (const hit of PREDICATES[rule](input2.text, options)) {
+      const { valueDigest, snippet } = maskValue(hit.matched);
+      if (EXFIL_SECRET_VALUE_RULES.includes(rule)) input2.onMatch?.(hit.matched, valueDigest);
+      findings.push({
+        id: exfilFindingId(rule, facet),
+        rule,
+        severity,
+        facet,
+        channel,
+        engine: EXFIL_ENGINE,
+        message: hit.message,
+        source: input2.source,
+        line: hit.line,
+        valueDigest,
+        snippet
+      });
+    }
+  }
+  return findings.sort((a, b) => a.line - b.line || a.id.localeCompare(b.id) || a.valueDigest.localeCompare(b.valueDigest));
+}
+function scanTreeText(input2) {
+  return scanFacet(input2, "tree");
+}
+function scanMessageText(input2) {
+  return scanFacet(input2, "message");
+}
+
+// src/check/exfilTreeScan.ts
+var BORDER_SEGMENT = ".border";
+var MAX_SCAN_BYTES = 2 * 1024 * 1024;
+function toFinding3(f, target) {
+  return {
+    rule: f.id,
+    severity: f.severity,
+    target,
+    path: f.source,
+    line: f.line,
+    engine: f.engine,
+    message: f.message,
+    valueDigest: f.valueDigest,
+    snippet: f.snippet
+  };
+}
+function scanExfilTree(o) {
+  const repoDir = resolve12(o.repoDir);
+  const gitOpts = { ...o.env !== void 0 ? { env: o.env } : {} };
+  const files = runGitChecked(repoDir, ["ls-files", "-z"], gitOpts).split("\0").filter((rel) => rel !== "" && !rel.split("/").includes(BORDER_SEGMENT));
+  const findings = [];
+  for (const rel of files) {
+    const abs = join21(repoDir, rel);
+    let size = 0;
+    try {
+      size = statSync2(abs).size;
+    } catch {
+      continue;
+    }
+    if (size > MAX_SCAN_BYTES) continue;
+    let text = "";
+    try {
+      text = readFileSync14(abs, "utf8");
+    } catch {
+      continue;
+    }
+    if (text.includes("\0")) continue;
+    for (const f of scanTreeText({
+      text,
+      source: rel,
+      ...o.hosts !== void 0 ? { hosts: o.hosts } : {},
+      ...o.sanitizer !== void 0 ? { onMatch: (raw, digest2) => o.sanitizer?.register(digest2, raw) } : {}
+    })) {
+      findings.push(toFinding3(f, o.target ?? "tree"));
+    }
+  }
+  return findings;
+}
+
+// src/check/messageScan.ts
+import { spawnSync as spawnSync13 } from "node:child_process";
+import { dirname as dirname10, resolve as resolve13 } from "node:path";
+var MESSAGE_REV_BATCH = 200;
+var MESSAGE_GIT_TIMEOUT_MS = 55e3;
+function defaultRunner(o) {
+  const repoDir = resolve13(o.repoDir);
+  const env2 = {};
+  for (const [name, value] of Object.entries(o.env ?? process.env)) {
+    if (!name.startsWith("GIT_")) env2[name] = value;
+  }
+  env2.GIT_CEILING_DIRECTORIES = dirname10(repoDir);
+  env2.GIT_OPTIONAL_LOCKS = "0";
+  return (args) => {
+    const r = spawnSync13("git", ["-C", repoDir, ...args], {
+      encoding: "utf8",
+      env: env2,
+      timeout: o.timeoutMs ?? MESSAGE_GIT_TIMEOUT_MS,
+      maxBuffer: o.maxBufferBytes ?? 32 * 1024 * 1024
+    });
+    if (r.error !== void 0) {
+      throw new ConfigError("git-failed", `git ${args.slice(0, 2).join(" ")} in ${repoDir}: ${r.error.message}`);
+    }
+    if (r.status === null) {
+      throw new ConfigError("git-failed", `git ${args.slice(0, 2).join(" ")} in ${repoDir} killed by ${String(r.signal)} (timeout ${String(o.timeoutMs ?? MESSAGE_GIT_TIMEOUT_MS)}ms) \u2014 fail closed, never a silent clean`);
+    }
+    if (r.status !== 0) {
+      throw new ConfigError("git-failed", `git ${args.slice(0, 2).join(" ")} in ${repoDir} exited ${String(r.status)}: ${(r.stderr ?? "").trim().slice(0, 200)}`);
+    }
+    return r.stdout ?? "";
+  };
+}
+function revExists2(run2, rev) {
+  try {
+    run2(["rev-parse", "--verify", "--quiet", rev]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function trackingEndpoint2(run2, remoteName, ref) {
+  const candidates = [`refs/remotes/${remoteName}/${ref}`];
+  const short = ref.replace(/^refs\/(?:heads|tags)\//, "");
+  if (short !== ref) candidates.push(`refs/remotes/${remoteName}/${short}`);
+  return candidates.find((c) => revExists2(run2, c)) ?? null;
+}
+function willPublishShas(run2, refSet, remotes) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const collect = (revs) => {
+    for (const sha of run2(["rev-list", ...revs]).split("\n")) {
+      if (sha !== "" && !seen.has(sha)) {
+        seen.add(sha);
+        out.push(sha);
+      }
+    }
+  };
+  for (const ref of refSet) {
+    if (!revExists2(run2, ref)) continue;
+    const ranges = [];
+    for (const remote of remotes) {
+      const name = remote.name;
+      if (name === void 0) continue;
+      const endpoint = trackingEndpoint2(run2, name, ref);
+      if (endpoint !== null) ranges.push(`${endpoint}..${ref}`);
+    }
+    if (ranges.length === 0) collect([ref]);
+    else collect(ranges);
+  }
+  return out;
+}
+var MESSAGE_LOG_FORMAT = "--format=%x1e%H%x00%B";
+function scanOneRecord(record2, o, findings) {
+  const trimmed = record2.replace(/^\n/, "");
+  if (trimmed === "") return;
+  const nul = trimmed.indexOf("\0");
+  if (nul === -1) {
+    throw new ConfigError("git-failed", "git log message record malformed (no NUL separator) \u2014 fail closed");
+  }
+  const sha = trimmed.slice(0, nul);
+  const body = trimmed.slice(nul + 1).replace(/\n$/, "");
+  for (const f of scanMessageText({
+    text: body,
+    source: sha,
+    ...o.hosts !== void 0 ? { hosts: o.hosts } : {},
+    ...o.sanitizer !== void 0 ? { onMatch: (raw, digest2) => o.sanitizer?.register(digest2, raw) } : {}
+  })) {
+    findings.push(toMessageFinding(f, sha));
+  }
+}
+function toMessageFinding(f, sha) {
+  return {
+    rule: f.id,
+    severity: f.severity,
+    target: "git",
+    path: f.source,
+    // = sha: toRepoRelative passes it through unchanged (exclusions.ts:20-25) ⇒ per-commit allow rows
+    commit: sha,
+    line: f.line,
+    engine: f.engine,
+    message: f.message,
+    valueDigest: f.valueDigest,
+    snippet: f.snippet
+  };
+}
+function scanCommitMessages(o) {
+  const run2 = o.runGit ?? defaultRunner(o);
+  const shas = willPublishShas(run2, o.refSet, o.remotes);
+  const findings = [];
+  for (let i = 0; i < shas.length; i += MESSAGE_REV_BATCH) {
+    const batch = shas.slice(i, i + MESSAGE_REV_BATCH);
+    const out = run2(["log", "--no-walk", MESSAGE_LOG_FORMAT, ...batch]);
+    for (const record2 of out.split("")) scanOneRecord(record2, o, findings);
+  }
+  return findings;
+}
+
 // src/check/proofValve.ts
 var ROUNDTRIP_PROOF_MISSING_RULE = "roundtrip-proof-missing";
 var ROUNDTRIP_PROOF_STALE_RULE = "roundtrip-proof-stale";
@@ -42923,10 +43443,10 @@ function proofFindings(o) {
 }
 
 // src/check/tagScan.ts
-import { spawnSync as spawnSync13 } from "node:child_process";
+import { spawnSync as spawnSync14 } from "node:child_process";
 import { mkdtempSync as mkdtempSync3, rmSync as rmSync10, writeFileSync as writeFileSync4 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join21, resolve as resolve12 } from "node:path";
+import { join as join22, resolve as resolve14 } from "node:path";
 var TAG_MESSAGE_RULE = "tag-message-secret";
 function isEnoent2(error61) {
   return typeof error61 === "object" && error61 !== null && error61.code === "ENOENT";
@@ -42946,7 +43466,7 @@ function stdinFindings(text, ignorePath, o) {
   ];
   let lastError;
   for (const bin of binaryCandidates("gitleaks", o)) {
-    const r = spawnSync13(bin, args, {
+    const r = spawnSync14(bin, args, {
       encoding: "utf8",
       input: text,
       timeout: o.timeoutMs ?? 3e5,
@@ -43013,12 +43533,12 @@ function dereferenceTagCommit(repoDir, ref, o) {
   }
 }
 function scanTagMessages(o) {
-  const repoDir = resolve12(o.repoDir);
+  const repoDir = resolve14(o.repoDir);
   const gitOpts = { ...o.env !== void 0 ? { env: o.env } : {} };
   const refs = runGitChecked(repoDir, ["for-each-ref", "--format=%(refname)", "refs/tags"], gitOpts).split("\n").filter((ref) => ref !== "");
   if (refs.length === 0) return [];
-  const ignoreDir = mkdtempSync3(join21(tmpdir2(), "border-gitleaks-ignore-"));
-  const ignorePath = join21(ignoreDir, ".gitleaksignore");
+  const ignoreDir = mkdtempSync3(join22(tmpdir2(), "border-gitleaks-ignore-"));
+  const ignorePath = join22(ignoreDir, ".gitleaksignore");
   writeFileSync4(ignorePath, "");
   try {
     const findings = [];
@@ -43094,7 +43614,7 @@ async function runPipeline(o, ctx, lockWarning) {
   if (!broken.has("gitleaks")) {
     const eng = legOptions(o, sanitizer);
     findings.push(...filterBorderStateFindings(scanGitHistory({ repoDir, refRange: historyRefRange(ctx), target: "git", ...eng }), repoDir));
-    findings.push(...filterBorderStateFindings(scanTree({ dir: repoDir, stateDir: join22(repoDir, BORDER_STATE_DIR), target: "tree", ...eng }), repoDir));
+    findings.push(...filterBorderStateFindings(scanTree({ dir: repoDir, stateDir: join23(repoDir, BORDER_STATE_DIR), target: "tree", ...eng }), repoDir));
     findings.push(...filterBorderStateFindings(scanTagMessages({ repoDir, target: "git", ...eng }), repoDir));
   }
   if (!broken.has("secretlint")) {
@@ -43105,6 +43625,17 @@ async function runPipeline(o, ctx, lockWarning) {
   }
   findings.push(...scanAiArtifacts({ repoDir, refSet: [...ctx.refSet], cfg: o.cfg.rules, ...envOpt }));
   findings.push(...scanIdentity({ repoDir, refSet: [...ctx.refSet], cfg: o.cfg, ...envOpt }));
+  findings.push(...filterBorderStateFindings(scanExfilTree({ repoDir, hosts: o.cfg.rules.hosts, ...legOptions(o, sanitizer) }), repoDir));
+  findings.push(...filterBorderStateFindings(
+    scanCommitMessages({
+      repoDir,
+      refSet: ctx.refSet.length > 0 ? [...ctx.refSet] : [ctx.headSha],
+      remotes: o.cfg.targets.git.remotes,
+      hosts: o.cfg.rules.hosts,
+      ...legOptions(o, sanitizer)
+    }),
+    repoDir
+  ));
   const ledgerArtifacts = [];
   for (const channel of publishChannels()) {
     if (!o.effectiveTargets.includes(channel.id) || !channel.configured(o.cfg)) continue;
@@ -43279,21 +43810,271 @@ var NO_TARGETS_PROBE_CFG = {
   engines: { require: [], trufflehog: false }
 };
 
+// src/commands/exfil.ts
+import { createHash as createHash14 } from "node:crypto";
+import { existsSync as existsSync15, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync4, readFileSync as readFileSync15, rmSync as rmSync11, writeFileSync as writeFileSync5 } from "node:fs";
+import { tmpdir as tmpdir3 } from "node:os";
+import { dirname as dirname12, join as join24 } from "node:path";
+
+// src/commands/exfilGit.ts
+import { spawnSync as spawnSync15 } from "node:child_process";
+import { dirname as dirname11, resolve as resolve15 } from "node:path";
+var GIT_TIMEOUT_MS = 55e3;
+var MAX_BUFFER_BYTES = 32 * 1024 * 1024;
+var MAX_BLOB_BYTES = 2 * 1024 * 1024;
+var BATCH_SHAS = 500;
+function makeGit(repoDir, env2) {
+  const clean = {};
+  for (const [name, value] of Object.entries(env2)) {
+    if (!name.startsWith("GIT_")) clean[name] = value;
+  }
+  clean.GIT_CEILING_DIRECTORIES = dirname11(resolve15(repoDir));
+  clean.GIT_OPTIONAL_LOCKS = "0";
+  clean.GIT_TERMINAL_PROMPT = "0";
+  const spawnWith = (args, input2) => {
+    const r = spawnSync15("git", ["-C", resolve15(repoDir), ...args], {
+      timeout: GIT_TIMEOUT_MS,
+      maxBuffer: MAX_BUFFER_BYTES,
+      env: clean,
+      ...input2 !== void 0 ? { input: input2 } : {}
+    });
+    if (r.error !== void 0) return { stdout: Buffer.alloc(0), fail: `git ${args.slice(0, 2).join(" ")}: ${r.error.message}` };
+    if (r.status !== 0) {
+      const why = r.status === null ? `killed by ${String(r.signal)} (timeout ${String(GIT_TIMEOUT_MS)}ms)` : `exited ${String(r.status)}`;
+      return { stdout: Buffer.alloc(0), fail: `git ${args.slice(0, 3).join(" ")} ${why}: ${(r.stderr?.toString("utf8") ?? "").trim().slice(0, 200)}` };
+    }
+    return { stdout: r.stdout ?? Buffer.alloc(0), fail: null };
+  };
+  const runBuffer = (args, input2) => {
+    const r = spawnWith(args, input2);
+    if (r.fail !== null) throw new ConfigError("git-failed", r.fail);
+    return r.stdout;
+  };
+  return { run: (args) => runBuffer(args).toString("utf8"), runBuffer };
+}
+function parseLsTree(line) {
+  const m = /^\d{6} (\w+) ([0-9a-f]{40})\s+(\d+)\t(.+)$/.exec(line);
+  if (m === null || m[1] !== "blob") return null;
+  return { sha: m[2] ?? "", path: m[4] ?? "", size: Number(m[3]) };
+}
+function tipTree(git, rev) {
+  return git.run(["-c", "core.quotePath=false", "ls-tree", "-r", "--long", rev]).split("\n").map(parseLsTree).filter((b) => b !== null);
+}
+function historyBlobs(git, rev) {
+  const paths = /* @__PURE__ */ new Map();
+  for (const line of git.run(["rev-list", "--objects", rev]).split("\n")) {
+    if (line === "") continue;
+    const sp = line.indexOf(" ");
+    if (sp <= 0) continue;
+    if (!paths.has(line.slice(0, sp))) paths.set(line.slice(0, sp), line.slice(sp + 1));
+  }
+  const shas = [...paths.keys()];
+  const out = [];
+  for (let i = 0; i < shas.length; i += BATCH_SHAS) {
+    const checked = git.runBuffer(["cat-file", "--batch-check"], `${shas.slice(i, i + BATCH_SHAS).join("\n")}
+`).toString("utf8");
+    for (const line of checked.split("\n")) {
+      const m = /^([0-9a-f]{40}) (\w+) (\d+)$/.exec(line);
+      if (m === null || m[2] !== "blob") continue;
+      const path4 = paths.get(m[1] ?? "");
+      if (path4 !== void 0) out.push({ sha: m[1] ?? "", path: path4, size: Number(m[3]) });
+    }
+  }
+  return out;
+}
+function blobTexts(git, blobs) {
+  const sizes = new Map(blobs.map((b) => [b.sha, b.size]));
+  const wanted = [...new Set(blobs.map((b) => b.sha))].filter((s) => (sizes.get(s) ?? 0) <= MAX_BLOB_BYTES);
+  const out = /* @__PURE__ */ new Map();
+  for (let i = 0; i < wanted.length; i += BATCH_SHAS) {
+    const buf = git.runBuffer(["cat-file", "--batch", "--buffer"], `${wanted.slice(i, i + BATCH_SHAS).join("\n")}
+`);
+    let pos = 0;
+    while (pos < buf.length) {
+      const nl = buf.indexOf(10, pos);
+      if (nl === -1) break;
+      const parts = buf.subarray(pos, nl).toString("utf8").split(" ");
+      pos = nl + 1;
+      const sha = parts[0] ?? "";
+      if (parts[1] === "missing" || parts.length < 3) continue;
+      const size = Number(parts[2]);
+      const body = buf.subarray(pos, pos + size);
+      pos += size + 1;
+      if (!body.includes(0)) out.set(sha, body.toString("utf8"));
+    }
+  }
+  return out;
+}
+
+// src/commands/exfil.ts
+var EXFIL_USAGE = "usage: border exfil <ref|url> [ref...] [--deep] [--json]";
+var URL_SHAPE_RE = /^(?:[A-Za-z][A-Za-z0-9+.-]*:\/\/\S+|\S+@\S+:\S+)$/;
+var isExfilId = (rule) => rule.startsWith("exfil-");
+function toTreeFinding(f) {
+  return {
+    rule: f.id,
+    severity: f.severity,
+    target: "tree",
+    path: f.source,
+    line: f.line,
+    engine: f.engine,
+    message: f.message,
+    valueDigest: f.valueDigest,
+    snippet: f.snippet
+  };
+}
+function scanBlobsNative(git, blobs) {
+  const texts = blobTexts(git, blobs);
+  const findings = [];
+  for (const b of blobs) {
+    const text = texts.get(b.sha);
+    if (text === void 0) continue;
+    for (const f of scanTreeText({ text, source: b.path })) findings.push(toTreeFinding(f));
+  }
+  return findings;
+}
+async function scanTipTree(git, treeRoot, rev, env2) {
+  const blobs = tipTree(git, rev);
+  const texts = blobTexts(git, blobs);
+  const native = [];
+  const written = [];
+  for (const b of blobs) {
+    const text = texts.get(b.sha);
+    if (text === void 0) continue;
+    for (const f of scanTreeText({ text, source: b.path })) native.push(toTreeFinding(f));
+    if (b.path.split("/").includes("..") || b.path === "") continue;
+    const abs = join24(treeRoot, b.path);
+    if (existsSync15(abs)) continue;
+    mkdirSync10(dirname12(abs), { recursive: true });
+    writeFileSync5(abs, text, "utf8");
+    written.push(b.path);
+  }
+  const lint = (await scanPaths({ dir: treeRoot, files: written, target: "tree", env: env2 })).filter((f) => isExfilId(f.rule));
+  const gl = scanTree({ dir: treeRoot, stateDir: join24(treeRoot, ".border-state"), target: "tree", env: env2 }).filter((f) => isExfilId(f.rule)).map((f) => f.path !== void 0 && f.path.startsWith(`${treeRoot}/`) ? { ...f, path: f.path.slice(treeRoot.length + 1) } : f);
+  return [...native, ...lint, ...gl];
+}
+function exfilRulesDigest() {
+  const h = createHash14("sha256");
+  for (const p of [...resolveExfilFingerprintFiles({}), GITLEAKS_VENDORED_CONFIG]) {
+    let bytes;
+    try {
+      bytes = readFileSync15(p);
+    } catch {
+      throw new ConfigError("unreadable", `border exfil: rule input unreadable (fail closed): ${p}`);
+    }
+    h.update(p).update("\0").update(bytes).update("\0");
+  }
+  return h.digest("hex");
+}
+function sha256Hex2(text) {
+  return createHash14("sha256").update(text, "utf8").digest("hex");
+}
+async function runExfilCore(ctx) {
+  const positionals = ctx.positionals;
+  if (positionals.length === 0) throw new UnknownArgError(`border exfil expects <ref|url> [ref...] \u2014 ${EXFIL_USAGE}`);
+  const deep = ctx.flags.deep === true;
+  const first = positionals[0] ?? "";
+  const sandbox = { dir: "", tree: "" };
+  try {
+    const isUrl = URL_SHAPE_RE.test(first);
+    let repoDir;
+    let units;
+    let exposure = [];
+    if (isUrl) {
+      const url2 = first;
+      exposure = [sanitizeUrl(url2)];
+      sandbox.dir = mkdtempSync4(join24(tmpdir3(), "border-exfil-"));
+      const git2 = makeGit(sandbox.dir, ctx.env);
+      git2.run(["init", "-q"]);
+      git2.run(["remote", "add", "origin", url2]);
+      const specs = positionals.slice(1).length === 0 ? ["HEAD"] : positionals.slice(1);
+      units = [];
+      for (const spec of specs) {
+        git2.run(["fetch", "-q", "--no-tags", "origin", spec]);
+        units.push({ label: spec, rev: git2.run(["rev-parse", "FETCH_HEAD"]).trim() });
+      }
+      repoDir = sandbox.dir;
+    } else {
+      repoDir = resolveRepoDir(ctx.cwd, { env: ctx.env });
+      const git2 = makeGit(repoDir, ctx.env);
+      units = positionals.map((ref) => ({ label: ref, rev: git2.run(["rev-parse", "--verify", ref]).trim() }));
+    }
+    const git = makeGit(repoDir, ctx.env);
+    sandbox.tree = mkdtempSync4(join24(tmpdir3(), "border-exfil-tree-"));
+    const findings = [];
+    const seenBlob = /* @__PURE__ */ new Set();
+    for (const unit of units) {
+      findings.push(...await scanTipTree(git, sandbox.tree, unit.rev, ctx.env));
+      if (deep) {
+        const fresh = historyBlobs(git, unit.rev).filter((b) => {
+          const key = `${b.sha}\0${b.path}`;
+          if (seenBlob.has(key)) return false;
+          seenBlob.add(key);
+          return true;
+        });
+        findings.push(...scanBlobsNative(git, fresh));
+      }
+    }
+    if (isUrl) ctx.stderr("border exfil: URL mode scanned fetched tips only \u2014 tag notes are not fetched (remote-side leg, check/push own it)");
+    else findings.push(...scanTagMessages({ repoDir, target: "git", env: ctx.env }));
+    if (deep) {
+      findings.push(...scanGitHistory({ repoDir, refRange: units.map((u) => u.rev).join(" "), target: "git", env: ctx.env }).filter((f) => isExfilId(f.rule)));
+      findings.push(
+        ...scanCommitMessages({
+          repoDir,
+          refSet: units.map((u) => u.rev),
+          remotes: [],
+          hosts: [],
+          runGit: git.run,
+          env: ctx.env
+        })
+      );
+    }
+    const verdict = computeVerdict(findings);
+    const report = {
+      schemaVersion: 1,
+      key: sha256Hex2(`exfil:${isUrl ? "url" : "ref"}:${positionals.join(" ")}:${deep ? "deep" : "fast"}:${units.map((u) => u.rev).join(" ")}`),
+      head: units[0]?.rev ?? "",
+      dirty: false,
+      exposureSet: exposure,
+      refSet: positionals,
+      rulesHash: exfilRulesDigest(),
+      verdict,
+      counts: countFindings(findings),
+      findings,
+      ts: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    if (ctx.flags.json) ctx.stdout(renderReportJson(report));
+    else {
+      const scope = `${isUrl ? "URL" : "refs"} ${positionals.join(",")}${deep ? " (deep)" : ""}`;
+      ctx.stdout(`border exfil ${scope} ${report.verdict}: ${String(report.counts.total)} finding(s), ${String(report.counts.blocking)} blocking`);
+      for (const f of report.findings) {
+        ctx.stdout(`  ${f.severity} ${f.rule} [${f.engine}] ${f.path ?? f.commit ?? f.target}${f.line !== void 0 ? `:${String(f.line)}` : ""} ${f.message}`);
+      }
+    }
+    return exitCodeFromVerdict(verdict);
+  } finally {
+    if (sandbox.dir !== "") rmSync11(sandbox.dir, { recursive: true, force: true });
+    if (sandbox.tree !== "") rmSync11(sandbox.tree, { recursive: true, force: true });
+  }
+}
+var runExfil = (ctx) => runExfilCore(ctx);
+
 // src/llm/bundle.ts
-import { createHash as createHash13 } from "node:crypto";
-import { existsSync as existsSync15, mkdirSync as mkdirSync10, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname11, join as join24 } from "node:path";
+import { createHash as createHash15 } from "node:crypto";
+import { existsSync as existsSync16, mkdirSync as mkdirSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname14, join as join26 } from "node:path";
 
 // src/llm/diff.ts
-import { spawnSync as spawnSync14 } from "node:child_process";
-import { mkdtempSync as mkdtempSync4, rmSync as rmSync11, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname10, join as join23, resolve as resolve13 } from "node:path";
+import { spawnSync as spawnSync16 } from "node:child_process";
+import { mkdtempSync as mkdtempSync5, rmSync as rmSync12, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname13, join as join25, resolve as resolve16 } from "node:path";
 var GIT_DIFF_MAX_BUFFER = 64 * 1024 * 1024;
 function gitOut(repoDir, args, o, allowFail = false) {
-  const abs = resolve13(repoDir);
-  const r = spawnSync14("git", ["-C", abs, ...args], {
+  const abs = resolve16(repoDir);
+  const r = spawnSync16("git", ["-C", abs, ...args], {
     encoding: "utf8",
-    env: { ...o.env ?? process.env, GIT_CEILING_DIRECTORIES: dirname10(abs) },
+    env: { ...o.env ?? process.env, GIT_CEILING_DIRECTORIES: dirname13(abs) },
     timeout: 12e4,
     maxBuffer: GIT_DIFF_MAX_BUFFER
   });
@@ -43384,24 +44165,24 @@ function collectRawDeltas(repoDir, baseSha, headSha, o = {}) {
 var MASK_CHUNK_CHARS = 2e6;
 function maskViaEngineDetection(repoDir, texts, o = {}) {
   const sanitizer = new TextSanitizer();
-  const sandbox = mkdtempSync4(join23(repoDir, BORDER_STATE_DIR, "llm-mask-"));
+  const sandbox = mkdtempSync5(join25(repoDir, BORDER_STATE_DIR, "llm-mask-"));
   try {
     let idx = 0;
     for (const text of texts) {
       if (text === "") continue;
       for (let off = 0; off < text.length; off += MASK_CHUNK_CHARS, idx += 1) {
-        writeFileSync5(join23(sandbox, `detect-${String(idx)}.txt`), text.slice(off, off + MASK_CHUNK_CHARS), "utf8");
+        writeFileSync6(join25(sandbox, `detect-${String(idx)}.txt`), text.slice(off, off + MASK_CHUNK_CHARS), "utf8");
       }
     }
     scanTree({
       dir: sandbox,
-      stateDir: join23(repoDir, BORDER_STATE_DIR),
+      stateDir: join25(repoDir, BORDER_STATE_DIR),
       target: "llm-mask",
       sanitizer,
       ...engineEnv(o)
     });
   } finally {
-    rmSync11(sandbox, { recursive: true, force: true });
+    rmSync12(sandbox, { recursive: true, force: true });
   }
   return (text) => sanitizer.sanitize(text);
 }
@@ -43453,18 +44234,18 @@ async function runLlmRequestCore(ctx) {
     ctx.stderr("border: llm-request: no check record for the current state \u2014 run 'border check' first (the bundle derives from the recorded ctx)");
     return EXIT_ERROR;
   }
-  const absReport = join24(repoDir, record2.reportPath);
-  if (!existsSync15(absReport)) {
+  const absReport = join26(repoDir, record2.reportPath);
+  if (!existsSync16(absReport)) {
     ctx.stderr(`border: llm-request: report archive missing (${record2.reportPath} pruned?) \u2014 run 'border check' again`);
     return EXIT_ERROR;
   }
-  const report = JSON.parse(readFileSync14(absReport, "utf8"));
+  const report = JSON.parse(readFileSync16(absReport, "utf8"));
   if (report.key !== record2.key) {
     ctx.stderr("border: llm-request: report.json does not match its ledger record \u2014 run 'border check' again");
     return EXIT_ERROR;
   }
   const templatePath = resolvePromptTemplatePath(ctx.env);
-  if (!existsSync15(templatePath)) {
+  if (!existsSync16(templatePath)) {
     ctx.stderr(`border: llm-request: MISSING_TEMPLATE \u2014 prompt template not found at ${templatePath}; refusing to emit an unanswerable bundle`);
     return EXIT_ERROR;
   }
@@ -43510,11 +44291,11 @@ async function runLlmRequestCore(ctx) {
     fileDeltas,
     artifacts: record2.artifacts,
     deterministic: { verdict: report.verdict, counts: report.counts, findings: report.findings },
-    promptTemplate: { path: templatePath, sha256: createHash13("sha256").update(readFileSync14(templatePath)).digest("hex") }
+    promptTemplate: { path: templatePath, sha256: createHash15("sha256").update(readFileSync16(templatePath)).digest("hex") }
   };
-  const outPath = join24(dirname11(absReport), "llm-request.json");
-  mkdirSync10(dirname11(outPath), { recursive: true });
-  writeFileSync6(outPath, `${JSON.stringify(bundle, null, 2)}
+  const outPath = join26(dirname14(absReport), "llm-request.json");
+  mkdirSync11(dirname14(outPath), { recursive: true });
+  writeFileSync7(outPath, `${JSON.stringify(bundle, null, 2)}
 `, "utf8");
   const rel = outPath.slice(repoDir.length + 1);
   ctx.stdout(`border: llm-request: wrote ${rel} (base ${base.mode}, ${String(fileDeltas.length)} file deltas, ${String(report.findings.length)} deterministic findings)`);
@@ -43522,14 +44303,14 @@ async function runLlmRequestCore(ctx) {
 }
 
 // src/llm/ingest.ts
-import { createHash as createHash14 } from "node:crypto";
-import { existsSync as existsSync16, readFileSync as readFileSync15, readdirSync as readdirSync9 } from "node:fs";
-import { isAbsolute, join as join25, resolve as resolve14 } from "node:path";
+import { createHash as createHash16 } from "node:crypto";
+import { existsSync as existsSync17, readFileSync as readFileSync17, readdirSync as readdirSync9 } from "node:fs";
+import { isAbsolute, join as join27, resolve as resolve17 } from "node:path";
 var RULE_RE = /^[a-z0-9-]+$/;
 var MAX_TEXT = 4e3;
 var ALLOWED_KEYS = /* @__PURE__ */ new Set(["rule", "severity", "target", "path", "line", "commit", "message", "snippet", "engine", "valueDigest"]);
 function sha2562(text) {
-  return createHash14("sha256").update(text, "utf8").digest("hex");
+  return createHash16("sha256").update(text, "utf8").digest("hex");
 }
 function usageError(ctx, why) {
   ctx.stderr(`border: llm-ingest: ${why}`);
@@ -43543,11 +44324,11 @@ function findLatestBundle(repoDir) {
     return "no llm-request bundle found \u2014 run 'border llm-request' first";
   }
   for (const d of dirs.sort().reverse()) {
-    const p = join25(runsDir(repoDir), d, "llm-request.json");
-    if (!existsSync16(p)) continue;
+    const p = join27(runsDir(repoDir), d, "llm-request.json");
+    if (!existsSync17(p)) continue;
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync15(p, "utf8"));
+      parsed = JSON.parse(readFileSync17(p, "utf8"));
     } catch (err) {
       return `bundle ${p} is not valid JSON (${err instanceof Error ? err.message : String(err)}) \u2014 re-run 'border llm-request'`;
     }
@@ -43556,7 +44337,7 @@ function findLatestBundle(repoDir) {
     if (b.schemaVersion !== 1 || typeof b.key !== "string" || !/^[0-9a-f]{64}$/.test(b.key) || typeof b.head !== "string" || !/^[0-9a-f]{40}$/.test(b.head) || !Array.isArray(b.fileDeltas) || b.deterministic === void 0) {
       return `bundle ${p} fails its own schema \u2014 re-run 'border llm-request'`;
     }
-    return { dir: join25(runsDir(repoDir), d), bundle: b };
+    return { dir: join27(runsDir(repoDir), d), bundle: b };
   }
   return "no llm-request bundle found \u2014 run 'border llm-request' first";
 }
@@ -43607,10 +44388,10 @@ async function runLlmIngestCore(ctx) {
   const found = findLatestBundle(repoDir);
   if (typeof found === "string") return usageError(ctx, found);
   const { bundle } = found;
-  const findingsPath = isAbsolute(arg) ? arg : resolve14(ctx.cwd, arg);
+  const findingsPath = isAbsolute(arg) ? arg : resolve17(ctx.cwd, arg);
   let text;
   try {
-    text = readFileSync15(findingsPath, "utf8");
+    text = readFileSync17(findingsPath, "utf8");
   } catch {
     return usageError(ctx, `findings file not found: ${arg}`);
   }
@@ -43701,10 +44482,10 @@ async function runLlmRequest(ctx) {
 }
 
 // src/commands/opencode.ts
-import { createHash as createHash15 } from "node:crypto";
-import { existsSync as existsSync17, lstatSync, mkdirSync as mkdirSync11, readFileSync as readFileSync16, rmSync as rmSync12, writeFileSync as writeFileSync7 } from "node:fs";
+import { createHash as createHash17 } from "node:crypto";
+import { existsSync as existsSync18, lstatSync, mkdirSync as mkdirSync12, readFileSync as readFileSync18, rmSync as rmSync13, writeFileSync as writeFileSync8 } from "node:fs";
 import os3 from "node:os";
-import { dirname as dirname12, join as join26 } from "node:path";
+import { dirname as dirname15, join as join28 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 var PLUGIN_MARKER = "// border-opencode-plugin v";
 var COMMAND_MARKER = "<!-- border-opencode-command -->";
@@ -43712,27 +44493,27 @@ function opencodeConfigRoot(env2) {
   const xdg = env2["XDG_CONFIG_HOME"] ?? "";
   if (xdg.length > 0) return xdg;
   const home = env2["HOME"] ?? "";
-  return join26(home.length > 0 ? home : os3.homedir(), ".config");
+  return join28(home.length > 0 ? home : os3.homedir(), ".config");
 }
 function resolvePluginAsset(moduleUrl, fileName) {
-  const here = dirname12(fileURLToPath5(moduleUrl));
+  const here = dirname15(fileURLToPath5(moduleUrl));
   const candidates = [
-    join26(here, "..", "plugin", fileName),
+    join28(here, "..", "plugin", fileName),
     // dist mode (bundled): <root>/plugin/<f>
-    join26(here, "..", "..", "plugin", fileName)
+    join28(here, "..", "..", "plugin", fileName)
     // src mode: <root>/plugin/<f>
   ];
-  return candidates.find((p) => existsSync17(p)) ?? candidates[1];
+  return candidates.find((p) => existsSync18(p)) ?? candidates[1];
 }
 function targetsFor(env2) {
-  const root = join26(opencodeConfigRoot(env2), "opencode");
+  const root = join28(opencodeConfigRoot(env2), "opencode");
   return [
-    { fileName: "border.ts", destination: join26(root, "plugins", "border.ts"), marker: PLUGIN_MARKER },
-    { fileName: "border-command.md", destination: join26(root, "commands", "border.md"), marker: COMMAND_MARKER }
+    { fileName: "border.ts", destination: join28(root, "plugins", "border.ts"), marker: PLUGIN_MARKER },
+    { fileName: "border-command.md", destination: join28(root, "commands", "border.md"), marker: COMMAND_MARKER }
   ];
 }
 function sha2563(bytes) {
-  return createHash15("sha256").update(bytes).digest("hex");
+  return createHash17("sha256").update(bytes).digest("hex");
 }
 function firstLine(bytes) {
   const text = bytes.toString("utf8");
@@ -43749,7 +44530,7 @@ function fail(ctx, message) {
 function readPackagedAsset(ctx, fileName) {
   const source = resolvePluginAsset(import.meta.url, fileName);
   try {
-    return readFileSync16(source);
+    return readFileSync18(source);
   } catch {
     ctx.stderr(`border: opencode: packaged asset is missing (${source})`);
     ctx.stderr("border: opencode: the border install looks broken \u2014 `npm i -g border-customs` or a fresh checkout should carry plugin/.");
@@ -43758,7 +44539,7 @@ function readPackagedAsset(ctx, fileName) {
 }
 function readTarget(destination) {
   try {
-    return readFileSync16(destination);
+    return readFileSync18(destination);
   } catch {
     return null;
   }
@@ -43825,8 +44606,8 @@ function opencodeInstall(ctx) {
       ctx.stdout(`${target.destination}: up to date`);
       continue;
     }
-    mkdirSync11(dirname12(target.destination), { recursive: true });
-    writeFileSync7(target.destination, packaged);
+    mkdirSync12(dirname15(target.destination), { recursive: true });
+    writeFileSync8(target.destination, packaged);
     ctx.stdout(`${target.destination}: ${state === "outdated" ? "updated" : "installed"}`);
   }
   ctx.stdout("note: restart opencode to load the plugin \u2014 tools and commands are scanned at startup.");
@@ -43860,7 +44641,7 @@ function opencodeUninstall(ctx) {
         `refusing to remove ${target.destination} \u2014 the file is not ours (its first line lacks the marker '${target.marker}'); nothing was removed anywhere`
       );
     }
-    rmSync12(target.destination);
+    rmSync13(target.destination);
     ctx.stdout(`${target.destination}: removed`);
   }
   ctx.stdout("note: restart opencode for the tool and command to disappear.");
@@ -43888,7 +44669,7 @@ function runOpencode(ctx) {
 }
 
 // src/push/git.ts
-import { spawnSync as spawnSync15 } from "node:child_process";
+import { spawnSync as spawnSync17 } from "node:child_process";
 var DIVERGED_MESSAGE = "history diverged; border never force-pushes; resolve manually";
 function pushArgv(url2, branch, mode) {
   return mode === "dry-run" ? ["push", "--dry-run", url2, branch, "--follow-tags"] : ["push", url2, branch, "--follow-tags"];
@@ -43923,7 +44704,7 @@ function lsRemoteMap(repoDir, remote, env2) {
   return parseLsRemote(text, remote.target);
 }
 function isAncestor(repoDir, remoteSha, localSha, env2) {
-  const r = spawnSync15("git", ["-C", repoDir, "merge-base", "--is-ancestor", remoteSha, localSha], {
+  const r = spawnSync17("git", ["-C", repoDir, "merge-base", "--is-ancestor", remoteSha, localSha], {
     encoding: "utf8",
     env: { ...env2, GIT_CEILING_DIRECTORIES: repoDir }
   });
@@ -43958,7 +44739,7 @@ function pushTimeoutMs(env2) {
 }
 function executePush(i) {
   const timeoutMs = pushTimeoutMs(i.env);
-  const r = spawnSync15("git", ["-C", i.repoDir, ...pushArgv(i.remote.url, i.branch, "execute")], {
+  const r = spawnSync17("git", ["-C", i.repoDir, ...pushArgv(i.remote.url, i.branch, "execute")], {
     stdio: "inherit",
     env: i.env,
     timeout: timeoutMs
@@ -43983,6 +44764,101 @@ function confirmRemoteBranch(i) {
   return sha;
 }
 
+// src/push/landing.ts
+import { spawnSync as spawnSync18 } from "node:child_process";
+import { mkdtempSync as mkdtempSync6, rmSync as rmSync14 } from "node:fs";
+import { tmpdir as tmpdir4 } from "node:os";
+import { dirname as dirname16, join as join29, resolve as resolve18 } from "node:path";
+var LANDINGS_REF_PREFIX = "refs/border-landings/";
+async function runLandingVerification(o) {
+  if (o.legs.length === 0) return null;
+  const rulesHash = landingRulesHash(o);
+  const observe = o.observeRemoteTip ?? ((remote, branch) => defaultObserveRemoteTip(o.repoDir, remote, branch, o.env));
+  const scan = o.scanRemoteTip ?? ((remote, branch, sha) => defaultScanRemoteTip(o, remote, branch, sha));
+  const sink = o.record ?? ((r) => appendRecord(o.repoDir, r));
+  for (const leg of o.legs) {
+    const sha = observe(leg.target, leg.branch);
+    if (sha === null || sha === "") {
+      o.err(`border: ${leg.target.target} landed, verification unavailable (remote tip unfetchable) \u2014 exit 2; PASS not endorsed for the public face`);
+      return EXIT_ERROR;
+    }
+    let findings;
+    try {
+      findings = await scan(leg.target, leg.branch, sha);
+    } catch (err) {
+      o.err(
+        `border: ${leg.target.target} landed, verification unavailable (remote tip fetch/scan failed: ${err instanceof Error ? err.message : String(err)}; first bytes: ${sha.slice(0, 8)}) \u2014 exit 2; PASS not endorsed for the public face`
+      );
+      return EXIT_ERROR;
+    }
+    const blocking = findings.filter((f) => isBlocking(f.severity)).length;
+    const verdict = blocking > 0 ? "blocked" : "clean";
+    sink(buildLandingRecord({ key: o.key, target: leg.target.target, ref: `refs/heads/${leg.branch}`, remoteSha: sha, verdict, blocking, rulesHash }));
+    if (blocking > 0) {
+      o.err(`border: ${leg.target.target} ALREADY PUBLIC; border detects, never erases \u2014 ${String(blocking)} blocking finding(s) on the landed tip ${sha.slice(0, 12)}`);
+      for (const f of findings.filter((x) => isBlocking(x.severity))) {
+        o.err(`border:   ${f.severity} ${f.rule} [${f.engine}] ${f.path ?? f.commit ?? f.target}${f.line !== void 0 ? `:${String(f.line)}` : ""}`);
+      }
+      return EXIT_BLOCKED;
+    }
+    o.out(`border: ${leg.target.target} landing verified \u2014 remote tip ${sha.slice(0, 12)} clean (t:${verdict} record appended)`);
+  }
+  return null;
+}
+function landingRulesHash(o) {
+  const { records } = readLedger(o.repoDir);
+  const pass = latestPassCoveringTargets(records, o.key, ["git"]);
+  if (pass === null) {
+    throw new Error(`landing: no PASS record under key ${o.key.slice(0, 8)} \u2014 refusing to record a landing fact against unknown rules`);
+  }
+  return pass.rulesHash;
+}
+function gitPlain(repoDir, env2, args) {
+  const clean = {};
+  for (const [name, value] of Object.entries(env2)) {
+    if (!name.startsWith("GIT_")) clean[name] = value;
+  }
+  clean.GIT_CEILING_DIRECTORIES = dirname16(resolve18(repoDir));
+  clean.GIT_OPTIONAL_LOCKS = "0";
+  clean.GIT_TERMINAL_PROMPT = "0";
+  const r = spawnSync18("git", ["-C", resolve18(repoDir), ...args], { encoding: "utf8", env: clean, timeout: 55e3, maxBuffer: 32 * 1024 * 1024 });
+  return { status: r.status ?? 1, stdout: r.stdout ?? "" };
+}
+function defaultObserveRemoteTip(repoDir, remote, branch, env2) {
+  const r = gitPlain(repoDir, env2, ["ls-remote", remote.url, `refs/heads/${branch}`]);
+  if (r.status !== 0) return null;
+  const sha = /^[0-9a-f]{40}/.exec(r.stdout)?.[0] ?? null;
+  return sha;
+}
+async function defaultScanRemoteTip(o, remote, branch, remoteSha) {
+  const git = makeGit(o.repoDir, o.env);
+  let rev = remoteSha;
+  let ownedTempRef = null;
+  try {
+    try {
+      git.run(["cat-file", "-e", `${remoteSha}^{object}`]);
+    } catch {
+      const landingRef = `${LANDINGS_REF_PREFIX}${remote.target.replace(/[^A-Za-z0-9_.-]/g, "-")}`;
+      git.run(["fetch", "-q", "--no-tags", remote.url, `refs/heads/${branch}:${landingRef}`]);
+      ownedTempRef = landingRef;
+      rev = git.run(["rev-parse", landingRef]).trim();
+    }
+    const treeRoot = mkdtempSync6(join29(tmpdir4(), "border-landing-tree-"));
+    try {
+      return await scanTipTree(git, treeRoot, rev, o.env);
+    } finally {
+      rmSync14(treeRoot, { recursive: true, force: true });
+    }
+  } finally {
+    if (ownedTempRef !== null) {
+      try {
+        git.run(["update-ref", "-d", ownedTempRef]);
+      } catch {
+      }
+    }
+  }
+}
+
 // src/commands/push.ts
 var DRY_RUN_PREFIX = "DRY-RUN";
 var GIT_PUSH_DRY_RUN = "git push --dry-run";
@@ -44001,6 +44877,18 @@ async function runPush(ctx) {
   });
   if (loaded.kind === "no-op") {
     for (const warning of loaded.warnings) ctx.stderr(`border: ${warning}`);
+    let orphans = [];
+    try {
+      orphans = remoteTrackingDrift(resolveRepoDir(ctx.cwd, { env: ctx.env })).orphans;
+    } catch {
+      orphans = [];
+    }
+    if (orphans.length > 0) {
+      ctx.stderr(
+        `border: remote config drift \u2014 remote-tracking refs exist for UNCONFIGURED remotes: ${orphans.join(", ")}; their remote.* entries are gone (wiped or partial clone). Restore them or prune the refs; refusing to report this as a no-op.`
+      );
+      return EXIT_ERROR;
+    }
     ctx.stdout("border: no targets discovered \u2014 nothing to push (NO-OP)");
     return EXIT_PASS;
   }
@@ -44134,6 +45022,15 @@ async function executeYesPush(ctx, loaded) {
       done.push(leg.target);
       ctx.stdout(`border: pushed ${leg.target} \u2014 ${shortSha(remoteSha)} confirmed via ls-remote`);
     }
+    const landing = await runLandingVerification({
+      repoDir,
+      key: state.key,
+      legs: legs.map((leg) => ({ target: leg, branch })),
+      env: env2,
+      out: ctx.stdout,
+      err: ctx.stderr
+    });
+    if (landing !== null) return landing;
   }
   for (const channel of publishChannels()) {
     if (!pending.some((t) => t.kind === channel.id)) continue;
@@ -44152,17 +45049,17 @@ async function executeYesPush(ctx, loaded) {
 }
 
 // src/roundtrip/orchestrate.ts
-import { mkdtempSync as mkdtempSync5, rmSync as rmSync13, writeFileSync as writeFileSync8 } from "node:fs";
+import { mkdtempSync as mkdtempSync7, rmSync as rmSync15, writeFileSync as writeFileSync9 } from "node:fs";
 import { randomBytes } from "node:crypto";
-import { tmpdir as tmpdir3 } from "node:os";
-import { join as join27 } from "node:path";
+import { tmpdir as tmpdir5 } from "node:os";
+import { join as join30 } from "node:path";
 
 // src/scan/fetch.ts
-import { createHash as createHash16 } from "node:crypto";
+import { createHash as createHash18 } from "node:crypto";
 import { basename as basename5 } from "node:path";
 var SCAN_MAX_ARTIFACT_BYTES = 200 * 1024 * 1024;
 var SCAN_REQUEST_TIMEOUT_MS = 6e4;
-var SCAN_USER_AGENT = "border-customs/0.5.1 (+https://github.com/sumteclab/border; border scan)";
+var SCAN_USER_AGENT = "border-customs/0.7.1 (+https://github.com/sumteclab/border; border scan)";
 var CRATES_DOWNLOAD_HOST = "https://static.crates.io";
 var defaultScanFetcher = async (url2, init) => {
   if (!/^https?:\/\//.test(url2)) throw new EngineRunError(`border scan refuses non-http(s) URL: ${url2}`, null);
@@ -44287,8 +45184,8 @@ async function fetchArtifact(spec, o) {
     }
   }
 }
-function sha256Hex2(data) {
-  return createHash16("sha256").update(data).digest("hex");
+function sha256Hex3(data) {
+  return createHash18("sha256").update(data).digest("hex");
 }
 
 // src/scan/spec.ts
@@ -44331,9 +45228,9 @@ function parseScanSpec(raw) {
 }
 
 // src/roundtrip/localArtifact.ts
-import { createReadStream, existsSync as existsSync18, statSync as statSync2 } from "node:fs";
-import { createHash as createHash17 } from "node:crypto";
-import { basename as basename6, resolve as resolve15 } from "node:path";
+import { createReadStream, existsSync as existsSync19, statSync as statSync3 } from "node:fs";
+import { createHash as createHash19 } from "node:crypto";
+import { basename as basename6, resolve as resolve19 } from "node:path";
 var EXT_TABLE = /* @__PURE__ */ new Map([
   [".whl", "pypi"],
   [".tgz", "npm"],
@@ -44379,9 +45276,9 @@ var GRAMMAR_HINT = {
   rubygems: "gem package names, e.g. rt-gem-1.0.0.gem"
 };
 function classifyLocalInput(raw, cwd, parsesAsRegistrySpec) {
-  const abs = resolve15(cwd, raw);
-  if (existsSync18(abs)) {
-    const st = statSync2(abs);
+  const abs = resolve19(cwd, raw);
+  if (existsSync19(abs)) {
+    const st = statSync3(abs);
     if (st.isDirectory()) {
       bad3(`'${raw}' resolves to a directory (${abs}) \u2014 local mode needs a single artifact FILE, not a directory`);
     }
@@ -44415,7 +45312,7 @@ function classifyLocalInput(raw, cwd, parsesAsRegistrySpec) {
   return null;
 }
 async function readLocalArtifact(absPath, cap = SCAN_MAX_ARTIFACT_BYTES) {
-  const hash2 = createHash17("sha256");
+  const hash2 = createHash19("sha256");
   const parts = [];
   let total = 0;
   for await (const chunk of createReadStream(absPath)) {
@@ -44641,7 +45538,7 @@ var CLAIM_SCANNER_PY = [
 ].join("\n");
 
 // src/roundtrip/manifest.ts
-import { createHash as createHash18 } from "node:crypto";
+import { createHash as createHash20 } from "node:crypto";
 var RT_ENGINE = "roundtrip";
 var RT_RESIDUE_RULE = "roundtrip-residue-file";
 var RT_MODIFY_RULE = "roundtrip-modified-file";
@@ -44692,7 +45589,7 @@ var PERSISTENCE_PATTERNS = [
 function isPersistenceSurface(path4) {
   return PERSISTENCE_PATTERNS.some((re) => re.test(path4));
 }
-var digestOf = (what) => createHash18("sha256").update(what).digest("hex");
+var digestOf = (what) => createHash20("sha256").update(what).digest("hex");
 function classifyResidue(label, diff, attribution = null) {
   const findings = [];
   for (const e of diff.added) {
@@ -44739,7 +45636,7 @@ function classifyResidue(label, diff, attribution = null) {
 
 // src/roundtrip/orchestrate.ts
 function containerNameFor(label, rand = randomBytes(3).toString("hex")) {
-  return `rt-${sha256Hex2(label).slice(0, 8)}-${rand}`;
+  return `rt-${sha256Hex3(label).slice(0, 8)}-${rand}`;
 }
 var shArgv = (name) => {
   if (!/^[A-Za-z0-9@._+/-]+$/.test(name)) {
@@ -44860,7 +45757,7 @@ function runPipeline2(exec, profile, spec, label, hostPath, container, closure,
     return {
       findings: classifyResidue(label, diffManifests(m1, m3), attribution),
       installDelta,
-      baselineDigest: sha256Hex2([...m1.keys()].join("\n"))
+      baselineDigest: sha256Hex3([...m1.keys()].join("\n"))
     };
   } finally {
     try {
@@ -44894,25 +45791,25 @@ async function runRoundtripCore(ctx, deps = {}) {
     ctx.stderr("roundtrip: docker unavailable \u2014 cannot verify");
     return EXIT_ERROR;
   }
-  const baseDir = mkdtempSync5(join27(tmpdir3(), "border-roundtrip-"));
+  const baseDir = mkdtempSync7(join30(tmpdir5(), "border-roundtrip-"));
   try {
     const localRead = local !== null ? await readLocalArtifact(local.absPath) : null;
     const bytes = localRead?.bytes ?? (await fetchArtifact(spec, { fetcher: deps.fetcher ?? defaultScanFetcher })).bytes;
-    const artifactSha256 = localRead !== null ? localRead.sha256 : sha256Hex2(bytes);
-    const hostPath = join27(baseDir, "artifact");
-    writeFileSync8(hostPath, bytes);
+    const artifactSha256 = localRead !== null ? localRead.sha256 : sha256Hex3(bytes);
+    const hostPath = join30(baseDir, "artifact");
+    writeFileSync9(hostPath, bytes);
     const container = containerNameFor(label);
     const closure = spec.ecosystem === "pypi" ? resolvePipClosure(exec, profile, hostPath, label, spec) : null;
     const { findings, installDelta, baselineDigest } = runPipeline2(exec, profile, spec, label, hostPath, container, closure, (msg) => ctx.stderr(msg));
     const verdict = computeVerdict(findings);
     const report = {
       schemaVersion: 1,
-      key: sha256Hex2(`roundtrip:${label}:${baselineDigest}:${verdict}`),
+      key: sha256Hex3(`roundtrip:${label}:${baselineDigest}:${verdict}`),
       head: baselineDigest.slice(0, 40),
       dirty: false,
       exposureSet: [label],
       refSet: [],
-      rulesHash: sha256Hex2(`${profile.image}|${profile.install(profile.artifactPath, spec).join(" ")}|${profile.uninstall(spec).join(" ")}`),
+      rulesHash: sha256Hex3(`${profile.image}|${profile.install(profile.artifactPath, spec).join(" ")}|${profile.uninstall(spec).join(" ")}`),
       verdict,
       counts: countFindings(findings),
       findings,
@@ -44944,7 +45841,7 @@ async function runRoundtripCore(ctx, deps = {}) {
     }
     return exitCodeFromVerdict(verdict);
   } finally {
-    rmSync13(baseDir, { recursive: true, force: true });
+    rmSync15(baseDir, { recursive: true, force: true });
   }
 }
 function parsesRegistrySpec(raw) {
@@ -45000,9 +45897,9 @@ function dockerAvailableGuard(exec) {
 var runRoundtrip = (ctx) => runRoundtripCore(ctx);
 
 // src/scan/scan.ts
-import { mkdtempSync as mkdtempSync6 } from "node:fs";
-import { tmpdir as tmpdir4 } from "node:os";
-import { join as join29 } from "node:path";
+import { mkdtempSync as mkdtempSync8 } from "node:fs";
+import { tmpdir as tmpdir6 } from "node:os";
+import { join as join32 } from "node:path";
 
 // src/scan/config.ts
 function buildScanConfigYaml(eco) {
@@ -45029,8 +45926,8 @@ function synthesizeScanConfig(eco) {
 }
 
 // src/scan/materialize.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync12, readdirSync as readdirSync10, readFileSync as readFileSync17, rmSync as rmSync14, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join28 } from "node:path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync13, readdirSync as readdirSync10, readFileSync as readFileSync19, rmSync as rmSync16, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join31 } from "node:path";
 var CRATES_ENVELOPE_FILES = ["Cargo.toml.orig", ".cargo-ok", ".cargo_vcs_info.json"];
 var fail3 = (why) => {
   throw new Error(`border scan cannot materialize the artifact (${why}) \u2014 refusing to stage an unusable tree (fail-closed)`);
@@ -45047,12 +45944,12 @@ function unwrapSingleDir(dir) {
   const entries = readdirSync10(dir, { withFileTypes: true });
   const dirs = entries.filter((e) => e.isDirectory());
   if (entries.length === 1 && dirs.length === 1 && dirs[0] !== void 0) {
-    return join28(dir, dirs[0].name);
+    return join31(dir, dirs[0].name);
   }
   return dir;
 }
 function requireManifest(repoDir, ecosystem, candidates) {
-  if (!candidates.some((rel) => existsSync19(join28(repoDir, rel)))) {
+  if (!candidates.some((rel) => existsSync20(join31(repoDir, rel)))) {
     fail3(`${ecosystem} package tree has none of [${candidates.join(", ")}] at its root`);
   }
 }
@@ -45062,19 +45959,19 @@ function materializePackage(o) {
 `);
   });
   const safe = safeArtifactName(o.filename, `${o.ecosystem}-artifact`);
-  const archive = join28(o.baseDir, safe);
-  writeFileSync9(archive, o.bytes);
-  const extractDir = join28(o.baseDir, "extract");
-  mkdirSync12(extractDir, { recursive: true });
+  const archive = join31(o.baseDir, safe);
+  writeFileSync10(archive, o.bytes);
+  const extractDir = join31(o.baseDir, "extract");
+  mkdirSync13(extractDir, { recursive: true });
   extractFlat(archive, extractDir);
   let repoDir = unwrapSingleDir(extractDir);
   if (o.ecosystem === "rubygems") {
     const outer = repoDir;
     const dataCandidates = findNativeMissArchives(outer).filter((f) => f.endsWith("data.tar.gz"));
-    const inner = dataCandidates[0] ?? join28(outer, "data.tar.gz");
-    if (!existsSync19(inner)) fail3(".gem archive contains no data.tar.gz");
-    const gemTree = join28(o.baseDir, "gem-tree");
-    mkdirSync12(gemTree, { recursive: true });
+    const inner = dataCandidates[0] ?? join31(outer, "data.tar.gz");
+    if (!existsSync20(inner)) fail3(".gem archive contains no data.tar.gz");
+    const gemTree = join31(o.baseDir, "gem-tree");
+    mkdirSync13(gemTree, { recursive: true });
     extractFlat(inner, gemTree);
     repoDir = unwrapSingleDir(gemTree);
   } else if (o.ecosystem === "npm") {
@@ -45084,11 +45981,11 @@ function materializePackage(o) {
   } else {
     requireManifest(repoDir, o.ecosystem, ["Cargo.toml"]);
     for (const file2 of CRATES_ENVELOPE_FILES) {
-      const path4 = join28(repoDir, file2);
-      if (!existsSync19(path4)) continue;
-      const original = readFileSync17(path4);
-      rmSync14(path4, { force: true });
-      note(`border scan: crates envelope normalized: ${file2} sha256=${sha256Hex2(original)}`);
+      const path4 = join31(repoDir, file2);
+      if (!existsSync20(path4)) continue;
+      const original = readFileSync19(path4);
+      rmSync16(path4, { force: true });
+      note(`border scan: crates envelope normalized: ${file2} sha256=${sha256Hex3(original)}`);
     }
   }
   const env2 = o.env;
@@ -45114,7 +46011,7 @@ async function runScanCore(ctx, deps = {}) {
   }
   const cfg = synthesizeScanConfig(spec.ecosystem);
   const fetcher = deps.fetcher ?? defaultScanFetcher;
-  const baseDir = mkdtempSync6(join29(tmpdir4(), "border-scan-"));
+  const baseDir = mkdtempSync8(join32(tmpdir6(), "border-scan-"));
   try {
     const { bytes, filename } = await fetchArtifact(spec, { fetcher });
     const env2 = { ...ctx.env };
@@ -45125,12 +46022,12 @@ async function runScanCore(ctx, deps = {}) {
     const verdict = computeVerdict(findings);
     const report = {
       schemaVersion: 1,
-      key: sha256Hex2(`scan:${spec.ecosystem}:${spec.name}@${spec.version}:${head}`),
+      key: sha256Hex3(`scan:${spec.ecosystem}:${spec.name}@${spec.version}:${head}`),
       head,
       dirty: false,
       exposureSet: [`${spec.ecosystem}:${spec.name}@${spec.version}`],
       refSet: [],
-      rulesHash: sha256Hex2(buildScanConfigYaml(spec.ecosystem)),
+      rulesHash: sha256Hex3(buildScanConfigYaml(spec.ecosystem)),
       verdict,
       counts: countFindings(findings),
       findings,
@@ -45193,6 +46090,14 @@ function runStatus(ctx) {
     return EXIT_ERROR;
   }
   for (const w of ledger.warnings) ctx.stderr(`border: WARNING ${w}`);
+  try {
+    const drift = remoteTrackingDrift(repoDir);
+    const names = drift.configured.length > 0 ? drift.configured.join(", ") : "(none configured \u2014 nothing can ever be pushed)";
+    const orphanNote = drift.orphans.length > 0 ? ` \u2014 DRIFT: tracking refs without config for: ${drift.orphans.join(", ")}` : "";
+    ctx.stdout(`git remotes: ${names}${orphanNote}`);
+  } catch {
+    ctx.stdout("git remotes: (unknown \u2014 not a git repo?)");
+  }
   let newest;
   for (const r of ledger.records) if (r.t === "check") newest = r;
   if (newest === void 0) {
@@ -45240,11 +46145,12 @@ var handlers = {
   "llm-ingest": runLlmIngest,
   scan: runScan2,
   roundtrip: runRoundtrip,
-  opencode: runOpencode
+  opencode: runOpencode,
+  exfil: runExfil
 };
 
 // src/cli/types.ts
-var SUBCOMMANDS = ["check", "push", "status", "llm-request", "llm-ingest", "scan", "roundtrip", "opencode"];
+var SUBCOMMANDS = ["check", "push", "status", "llm-request", "llm-ingest", "scan", "roundtrip", "opencode", "exfil"];
 
 // src/cli.ts
 var VALID_TARGETS = targetIds();
@@ -45263,6 +46169,7 @@ function usage() {
     "  scan           inspect a third-party package ([ecosystem:]name@version) for residue",
     "  roundtrip      install+uninstall a package (registry spec or local artifact file) in a throwaway container, report uninstall residue",
     "  opencode       install|status|uninstall the official opencode plugin adapter (files under $XDG_CONFIG_HOME/opencode)",
+    "  exfil          read-only exfil-lens scan of <ref|url> [ref...]: tip tree + tag notes (--deep adds reachable-history blobs + commit messages)",
     "",
     "flags:",
     "  --config <path>             config file (default: ./border.yaml, then git-remote fallback)",
@@ -45273,11 +46180,12 @@ function usage() {
     "  --llm                       include the optional LLM review layer",
     "  --json                      machine-readable report on stdout",
     "  --record / --no-record      `border roundtrip` records a ledger proof by default; --no-record opts out",
+    "  --deep                      `border exfil`: also scan reachable-history blobs and the `:message` commit-message facet",
     "  --help, -h                  this table",
     "",
     "exit codes: 0 pass (MEDIUM/INFO/LOW allowed) | 1 gate-blocked (CRITICAL/HIGH) or partial push | 2 config/tool error",
     "",
-    "subcommands: check, push, status, llm-request, llm-ingest, scan, roundtrip, opencode"
+    "subcommands: check, push, status, llm-request, llm-ingest, scan, roundtrip, opencode, exfil"
   ].join("\n");
 }
 function isSubcommand(value) {
@@ -45310,6 +46218,7 @@ function parseFlags(argv) {
         json: { type: "boolean" },
         record: { type: "boolean" },
         "no-record": { type: "boolean" },
+        deep: { type: "boolean" },
         help: { type: "boolean" }
       }
     });
@@ -45326,7 +46235,8 @@ function parseFlags(argv) {
       ...requireEngine !== void 0 ? { requireEngine: splitList(requireEngine, { flag: "--require-engine", item: "engine" }) } : {},
       llm: llm === true,
       json: json2 === true,
-      ...values["no-record"] === true ? { record: false } : values.record === true ? { record: true } : {}
+      ...values["no-record"] === true ? { record: false } : values.record === true ? { record: true } : {},
+      ...values.deep === true ? { deep: true } : {}
     };
     return { flags, positionals, help: values.help === true };
   } catch (err) {