border-customs 0.6.0 → 0.8.0

package/dist/index.js

@@ -13029,7 +13029,7 @@ var require_micromatch = __commonJS({
 
 // src/index.ts
 import { realpathSync } from "node:fs";
-import { fileURLToPath as fileURLToPath6, pathToFileURL } from "node:url";
+import { fileURLToPath as fileURLToPath7, pathToFileURL } from "node:url";
 
 // src/cli.ts
 import { parseArgs } from "node:util";
@@ -38093,12 +38093,12 @@ function packOnce(o) {
     throw new EngineRunError(`npm pack reported '${report.filename}' but no tarball landed in ${o.distDir}`, null);
   }
   const data = readFileSync3(tarballAbs);
-  const sha2564 = createHash3("sha256").update(data).digest("hex");
+  const sha2563 = createHash3("sha256").update(data).digest("hex");
   const sha1 = createHash3("sha1").update(data).digest("hex");
   if (sha1 !== report.shasum || data.byteLength !== report.size) {
     throw new EngineRunError(`npm pack report disagrees with the tarball bytes for ${report.filename} \u2014 corrupted or swapped artifact, failing closed`, null);
   }
-  return { filename: report.filename, sha256: sha2564, bytes: data.byteLength, tarballAbs };
+  return { filename: report.filename, sha256: sha2563, bytes: data.byteLength, tarballAbs };
 }
 function publintFinding(o, tarballAbs, identity) {
   const candidates = o.publintBinPath !== void 0 ? [o.publintBinPath] : [
@@ -39141,7 +39141,7 @@ async function runNpmArtifactStage(o) {
   const stateDir = join10(repoDir, BORDER_STATE_DIR);
   const distDir = join10(stateDir, "dist");
   mkdirSync3(distDir, { recursive: true });
-  const { filename, sha256: sha2564, bytes, tarballAbs } = packOnce({
+  const { filename, sha256: sha2563, bytes, tarballAbs } = packOnce({
     repoDir,
     distDir,
     ...o.env !== void 0 ? { env: o.env } : {},
@@ -39149,7 +39149,7 @@ async function runNpmArtifactStage(o) {
     ...o.npmTimeoutMs !== void 0 ? { npmTimeoutMs: o.npmTimeoutMs } : {}
   });
   const findings = [];
-  const extractDir = join10(stateDir, "tmp", sha2564.slice(0, 8));
+  const extractDir = join10(stateDir, "tmp", sha2563.slice(0, 8));
   rmSync3(extractDir, { recursive: true, force: true });
   mkdirSync3(extractDir, { recursive: true });
   try {
@@ -39254,7 +39254,7 @@ async function runNpmArtifactStage(o) {
   if (publint !== null) findings.push(publint);
   return {
     findings,
-    artifact: { file: `${BORDER_STATE_DIR}/dist/${filename}`, sha256: sha2564, bytes }
+    artifact: { file: `${BORDER_STATE_DIR}/dist/${filename}`, sha256: sha2563, bytes }
   };
 }
 
@@ -40354,9 +40354,9 @@ async function runRubygemsArtifactStage(o) {
     throw new EngineRunError(`gem build produced no ${gemName} in ${relative3(repoDir, distDir)} \u2014 failing closed (was the gemspec's literal name/version re-read?)`, null);
   }
   const bytes = readFileSync7(dist);
-  const sha2564 = createHash6("sha256").update(bytes).digest("hex");
+  const sha2563 = createHash6("sha256").update(bytes).digest("hex");
   const findings = [];
-  const extractDir = join12(stateDir, "tmp", sha2564.slice(0, 8));
+  const extractDir = join12(stateDir, "tmp", sha2563.slice(0, 8));
   rmSync4(extractDir, { recursive: true, force: true });
   mkdirSync4(extractDir, { recursive: true });
   const dataDir = `${extractDir}-data`;
@@ -40434,7 +40434,7 @@ async function runRubygemsArtifactStage(o) {
   }
   return {
     findings,
-    artifact: { file: `${BORDER_STATE_DIR}/dist/${gemName}`, sha256: sha2564, bytes: bytes.length }
+    artifact: { file: `${BORDER_STATE_DIR}/dist/${gemName}`, sha256: sha2563, bytes: bytes.length }
   };
 }
 
@@ -41996,9 +41996,9 @@ async function runCargoArtifactStage(o) {
     const dist = join18(distDir, crateName);
     renameSync(packed, dist);
     const bytes = readFileSync11(dist);
-    const sha2564 = createHash11("sha256").update(bytes).digest("hex");
+    const sha2563 = createHash11("sha256").update(bytes).digest("hex");
     const findings = [];
-    const extractDir = join18(stateDir, "tmp", sha2564.slice(0, 8));
+    const extractDir = join18(stateDir, "tmp", sha2563.slice(0, 8));
     rmSync8(extractDir, { recursive: true, force: true });
     mkdirSync8(extractDir, { recursive: true });
     try {
@@ -42051,7 +42051,7 @@ async function runCargoArtifactStage(o) {
     }
     return {
       findings,
-      artifact: { file: `${BORDER_STATE_DIR}/dist/${crateName}`, sha256: sha2564, bytes: bytes.length }
+      artifact: { file: `${BORDER_STATE_DIR}/dist/${crateName}`, sha256: sha2563, bytes: bytes.length }
     };
   } finally {
     rmSync8(targetDir, { recursive: true, force: true });
@@ -44482,43 +44482,551 @@ async function runLlmRequest(ctx) {
 }
 
 // src/commands/opencode.ts
+import { existsSync as existsSync22, lstatSync, mkdirSync as mkdirSync12, readFileSync as readFileSync20, rmSync as rmSync13, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname16, join as join31 } from "node:path";
+import { fileURLToPath as fileURLToPath6 } from "node:url";
+
+// src/opencode/inspect.ts
+import { existsSync as existsSync21, readFileSync as readFileSync19 } from "node:fs";
+import { join as join30 } from "node:path";
+
+// src/opencode/jsonconfig.ts
+import { existsSync as existsSync19, readdirSync as readdirSync10, readFileSync as readFileSync18 } from "node:fs";
+import { join as join29 } from "node:path";
+
+// src/opencode/contract.ts
 import { createHash as createHash17 } from "node:crypto";
-import { existsSync as existsSync18, lstatSync, mkdirSync as mkdirSync12, readFileSync as readFileSync18, rmSync as rmSync13, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync18 } from "node:fs";
 import os3 from "node:os";
 import { dirname as dirname15, join as join28 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 var PLUGIN_MARKER = "// border-opencode-plugin v";
 var COMMAND_MARKER = "<!-- border-opencode-command -->";
+var BORDER_PACKAGE = "border-customs";
+var DEFAULT_REGISTRY_BASE = "https://registry.npmjs.org";
+var REGISTRY_TIMEOUT_MS2 = 15e3;
+function sha256Hex3(bytes) {
+  return createHash17("sha256").update(bytes).digest("hex");
+}
+function firstLine(bytes) {
+  const text = bytes.toString("utf8");
+  const newline = text.indexOf("\n");
+  return newline < 0 ? text : text.slice(0, newline);
+}
 function opencodeConfigRoot(env2) {
   const xdg = env2["XDG_CONFIG_HOME"] ?? "";
   if (xdg.length > 0) return xdg;
   const home = env2["HOME"] ?? "";
   return join28(home.length > 0 ? home : os3.homedir(), ".config");
 }
-function resolvePluginAsset(moduleUrl, fileName) {
+function opencodeCacheRoot(env2) {
+  const xdg = env2["XDG_CACHE_HOME"] ?? "";
+  const base = xdg.length > 0 ? xdg : join28(env2["HOME"] ?? os3.homedir(), ".cache");
+  return join28(base, "opencode", "packages");
+}
+function routeAPluginPath(env2) {
+  return join28(opencodeConfigRoot(env2), "opencode", "plugins", "border.ts");
+}
+function packagedAssetPath(moduleUrl, fileName) {
   const here = dirname15(fileURLToPath5(moduleUrl));
   const candidates = [
     join28(here, "..", "plugin", fileName),
-    // dist mode (bundled): <root>/plugin/<f>
+    // dist (bundled) mode: <root>/plugin/<f>
     join28(here, "..", "..", "plugin", fileName)
     // src mode: <root>/plugin/<f>
   ];
   return candidates.find((p) => existsSync18(p)) ?? candidates[1];
 }
-function targetsFor(env2) {
-  const root = join28(opencodeConfigRoot(env2), "opencode");
-  return [
-    { fileName: "border.ts", destination: join28(root, "plugins", "border.ts"), marker: PLUGIN_MARKER },
-    { fileName: "border-command.md", destination: join28(root, "commands", "border.md"), marker: COMMAND_MARKER }
+function packagedDistEntry(moduleUrl) {
+  const here = dirname15(fileURLToPath5(moduleUrl));
+  const candidates = [
+    join28(here, "index.js"),
+    // dist (bundled) mode: <root>/dist/index.js
+    join28(here, "..", "dist", "index.js"),
+    // src/opencode mode one level under root
+    join28(here, "..", "..", "dist", "index.js")
+    // src mode: <root>/dist/index.js
   ];
+  return candidates.find((p) => existsSync18(p)) ?? candidates[2];
 }
-function sha2563(bytes) {
-  return createHash17("sha256").update(bytes).digest("hex");
+
+// src/opencode/jsonconfig.ts
+function stripJsoncComments(text) {
+  let out = "";
+  let inString = false;
+  let inLine = false;
+  let inBlock = false;
+  for (let i = 0; i < text.length; i += 1) {
+    const ch = text[i];
+    const next = text[i + 1] ?? "";
+    if (inLine) {
+      if (ch === "\n") {
+        inLine = false;
+        out += ch;
+      }
+      continue;
+    }
+    if (inBlock) {
+      if (ch === "*" && next === "/") {
+        inBlock = false;
+        i += 1;
+        out += " ";
+      }
+      continue;
+    }
+    if (inString) {
+      if (ch === "\\") {
+        out += ch + next;
+        i += 1;
+        continue;
+      }
+      if (ch === '"') inString = false;
+      out += ch;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      out += ch;
+      continue;
+    }
+    if (ch === "/" && next === "/") {
+      inLine = true;
+      i += 1;
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      inBlock = true;
+      i += 1;
+      continue;
+    }
+    out += ch;
+  }
+  return out;
 }
-function firstLine(bytes) {
-  const text = bytes.toString("utf8");
-  const newline = text.indexOf("\n");
-  return newline < 0 ? text : text.slice(0, newline);
+function parseJsonc(text) {
+  return JSON.parse(stripJsoncComments(text).replace(/,(\s*[}\]])/g, "$1"));
+}
+var isRecord2 = (v) => typeof v === "object" && v !== null;
+function splitNpmSpec(entry) {
+  const at = entry.lastIndexOf("@");
+  if (at <= 0) return { name: entry, spec: null };
+  return { name: entry.slice(0, at), spec: entry.slice(at + 1) };
+}
+function readPluginDeclarations(path4, pkg) {
+  const none = { path: path4, status: "absent", specs: [] };
+  let text;
+  try {
+    if (!existsSync19(path4)) return none;
+    text = readFileSync18(path4, "utf8");
+  } catch {
+    return { path: path4, status: "error", specs: [] };
+  }
+  let parsed;
+  try {
+    parsed = parseJsonc(text);
+  } catch {
+    return { path: path4, status: "error", specs: [] };
+  }
+  if (!isRecord2(parsed)) return { path: path4, status: "error", specs: [] };
+  const plugin = Array.isArray(parsed["plugin"]) ? parsed["plugin"] : [];
+  const specs = plugin.filter((e) => typeof e === "string" && splitNpmSpec(e).name === pkg);
+  return { path: path4, status: "ok", specs };
+}
+function listCacheDirs(cacheRoot, pkg) {
+  let names;
+  try {
+    names = readdirSync10(cacheRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith(`${pkg}@`)).map((e) => e.name).sort();
+  } catch {
+    return [];
+  }
+  return names.map((name) => {
+    const pkgRoot = join29(cacheRoot, name, "node_modules", pkg);
+    let packageVersion = null;
+    try {
+      const meta3 = parseJsonc(readFileSync18(join29(pkgRoot, "package.json"), "utf8"));
+      if (isRecord2(meta3) && typeof meta3["version"] === "string") packageVersion = meta3["version"];
+    } catch {
+      packageVersion = null;
+    }
+    let markerLine = null;
+    try {
+      markerLine = firstLine(readFileSync18(join29(pkgRoot, "plugin", "border.ts")));
+    } catch {
+      markerLine = null;
+    }
+    const markerVersion = markerLine !== null && markerLine.startsWith(PLUGIN_MARKER) ? markerLine.slice(PLUGIN_MARKER.length).trim() : null;
+    return { dir: join29(cacheRoot, name), tag: name.slice(pkg.length + 1), packageVersion, markerVersion, markerLine };
+  });
+}
+
+// src/opencode/aspects/cacheVersion.ts
+var isExactVersion = (spec) => /^\d+\.\d+\.\d+([-+].*)?$/.test(spec);
+function verifyCacheVersion(facts) {
+  const id = "cache-version";
+  const { cacheDirs, configs, cacheRoot, pkg } = facts;
+  const errored = configs.filter((c) => c.status === "error").map((c) => c.path);
+  const declared = configs.some((c) => c.specs.length > 0);
+  const where = configs.map((c) => `${c.path} [${c.status}]`).join(", ");
+  if (cacheDirs.length === 0) {
+    if (errored.length > 0) {
+      return { id, verdict: "CANNOT", detail: `no cache directory under ${cacheRoot} and the configuration is unreadable (${errored.join(", ")}) \u2014 cannot tell whether a Route-B load is claimed` };
+    }
+    if (declared) {
+      return { id, verdict: "CANNOT", detail: `NOT-CACHED: ${pkg} is declared (${configs.flatMap((c) => [...c.specs]).join(", ")}) but no cache directory exists under ${cacheRoot} \u2014 the load claim has no bytes behind it` };
+    }
+    return { id, verdict: "PASS", detail: `no ${pkg} cache directory under ${cacheRoot} and none declared (${where}) \u2014 Route B not in use, nothing to be stale` };
+  }
+  const pins = new Set(
+    configs.flatMap((c) => [...c.specs]).map((s) => splitNpmSpec(s).spec).filter((s) => s !== null && isExactVersion(s))
+  );
+  const problems = [];
+  for (const d of cacheDirs) {
+    if (d.packageVersion === null) {
+      problems.push(`${d.dir}: package.json missing or unreadable`);
+    }
+    if (d.markerLine === null) {
+      problems.push(`${d.dir}: plugin/border.ts missing or unreadable in the cached package`);
+    } else if (d.markerVersion === null) {
+      problems.push(`${d.dir}: plugin/border.ts first line lacks the marker '${PLUGIN_MARKER}'`);
+    } else if (d.packageVersion !== null && d.markerVersion !== d.packageVersion) {
+      problems.push(`${d.dir}: marker says ${d.markerVersion}, package.json says ${d.packageVersion}`);
+    }
+    if (pins.has(d.tag) && d.packageVersion !== null && d.packageVersion !== d.tag) {
+      problems.push(`${d.dir}: cached under exact spec '${d.tag}' but the package reports ${d.packageVersion}`);
+    }
+  }
+  if (problems.length > 0) {
+    return { id, verdict: "FAIL", detail: problems.join("; ") };
+  }
+  return {
+    id,
+    verdict: "PASS",
+    detail: `cache self-consistent: ${cacheDirs.map((d) => `${d.tag}->${d.packageVersion ?? "?"}`).join(", ")}`
+  };
+}
+
+// src/opencode/aspects/dualRoute.ts
+function verifyDualRoute(facts) {
+  const id = "dual-route";
+  const { configs, routeAInstalled, routeAPlugin, pkg } = facts;
+  const errored = configs.filter((c) => c.status === "error").map((c) => c.path);
+  if (errored.length > 0) {
+    return { id, verdict: "CANNOT", detail: `configuration unreadable (${errored.join(", ")}) \u2014 Route B presence cannot be counted` };
+  }
+  const declared = configs.flatMap((c) => [...c.specs]);
+  const hasB = declared.length > 0;
+  if (routeAInstalled && hasB) {
+    return {
+      id,
+      verdict: "FAIL",
+      detail: `both routes registered: Route A drop at ${routeAPlugin} AND Route B declaration ${declared.map((d) => `'${d}'`).join(", ")} \u2014 pick exactly one route (the dual-registration window blueprint \xA77 forbids)`
+    };
+  }
+  if (routeAInstalled) {
+    return { id, verdict: "PASS", detail: `Route A only: drop at ${routeAPlugin}, no ${pkg} config declaration` };
+  }
+  if (hasB) {
+    return { id, verdict: "PASS", detail: `Route B only: ${declared.map((d) => `'${d}'`).join(", ")}, no file drop at ${routeAPlugin}` };
+  }
+  return { id, verdict: "PASS", detail: "neither route registered \u2014 no border plugin load claimed on the V1 surface" };
+}
+
+// src/opencode/aspects/identity.ts
+import { execFile } from "node:child_process";
+import { existsSync as existsSync20 } from "node:fs";
+var HANDSHAKE_ARGV = ["--help"];
+var HANDSHAKE_BANNER_PREFIX = "border";
+var HANDSHAKE_USAGE_NEEDLE = "usage: border";
+var HANDSHAKE_TIMEOUT_MS = 2e4;
+var MAX_OUTPUT_BYTES = 64 * 1024;
+var defaultInspectRunner = (target, argv) => new Promise((resolve20) => {
+  execFile(
+    target.bin,
+    [...target.prefix, ...argv],
+    { timeout: HANDSHAKE_TIMEOUT_MS, maxBuffer: MAX_OUTPUT_BYTES, shell: false },
+    (error61, stdout, stderr) => {
+      const out = stdout.slice(0, MAX_OUTPUT_BYTES);
+      const err = stderr.slice(0, MAX_OUTPUT_BYTES);
+      if (error61 === null) {
+        resolve20({ status: 0, stdout: out, stderr: err });
+        return;
+      }
+      const failure = error61;
+      if (failure.code === "ENOENT" || failure.code === "EACCES" || failure.code === "ENOEXEC") {
+        resolve20({ status: null, stdout: out, stderr: err });
+        return;
+      }
+      const status = typeof failure.code === "number" ? failure.code : failure.killed === true || failure.signal != null ? 124 : -1;
+      resolve20({ status, stdout: out, stderr: err });
+    }
+  );
+});
+function passesHandshake(outcome) {
+  if (outcome.status !== 0) return false;
+  const firstLine2 = (outcome.stdout.match(/^\s*(.*)/) ?? ["", ""])[1] ?? "";
+  return firstLine2.startsWith(HANDSHAKE_BANNER_PREFIX) && outcome.stdout.includes(HANDSHAKE_USAGE_NEEDLE);
+}
+function identityCandidates(env2, distEntry) {
+  const configured = env2["BORDER_BIN"];
+  if (configured !== void 0 && configured.length > 0) {
+    return [{ bin: configured, prefix: [], label: `BORDER_BIN=${configured}` }];
+  }
+  const candidates = [];
+  if (existsSync20(distEntry)) {
+    candidates.push({ bin: distEntry, prefix: [], label: "packaged dist/index.js (shebang exec)" });
+    candidates.push({ bin: "node", prefix: [distEntry], label: "packaged dist/index.js under PATH node" });
+  }
+  candidates.push({ bin: "border", prefix: [], label: "border on PATH" });
+  return candidates;
+}
+async function verifyIdentity(deps) {
+  const id = "identity-handshake";
+  const runner = deps.runner ?? defaultInspectRunner;
+  const candidates = identityCandidates(deps.env, deps.distEntry);
+  const reasons = [];
+  let anySpawned = false;
+  for (const candidate of candidates) {
+    const probe = await runner(candidate, HANDSHAKE_ARGV);
+    if (passesHandshake(probe)) {
+      return { id, verdict: "PASS", detail: `${candidate.label} passed the identity handshake` };
+    }
+    if (probe.status !== null) {
+      anySpawned = true;
+      reasons.push(`${candidate.label}: spawned but --help did not answer as border (impostor?)`);
+    } else {
+      reasons.push(`${candidate.label}: unspawnable (ENOENT/EACCES/ENOEXEC)`);
+    }
+  }
+  if (anySpawned) {
+    return { id, verdict: "FAIL", detail: `a border binary was reachable but failed the identity handshake \u2014 impersonation shape: ${reasons.join("; ")}` };
+  }
+  return { id, verdict: "CANNOT", detail: `no border binary reachable \u2014 tried: ${reasons.join("; ")}` };
+}
+
+// src/opencode/aspects/routeA.ts
+function verifyRouteAParity(facts) {
+  const id = "route-a-parity";
+  const { routeAPlugin, routeAInstalled } = facts;
+  if (!routeAInstalled) {
+    return { id, verdict: "PASS", detail: `${routeAPlugin}: absent \u2014 Route A not installed, nothing to be stale` };
+  }
+  if (facts.packagedPlugin === null) {
+    return { id, verdict: "CANNOT", detail: "the packaged plugin asset is unreadable \u2014 the border install itself looks broken, parity cannot be judged" };
+  }
+  const installed = facts.routeABytes;
+  if (installed === null) {
+    return { id, verdict: "CANNOT", detail: `${routeAPlugin}: present but unreadable \u2014 parity cannot be judged` };
+  }
+  const installedSha = sha256Hex3(installed);
+  const packagedSha = sha256Hex3(facts.packagedPlugin);
+  if (installedSha === packagedSha) {
+    return { id, verdict: "PASS", detail: `${routeAPlugin}: up-to-date installed=${installedSha} packaged=${packagedSha}` };
+  }
+  const ours = firstLine(installed).startsWith(PLUGIN_MARKER);
+  const shape = ours ? "outdated (marker ours, bytes differ)" : "foreign (first line lacks the marker)";
+  return { id, verdict: "FAIL", detail: `${routeAPlugin}: ${shape} installed=${installedSha} packaged=${packagedSha}` };
+}
+
+// src/opencode/aspects/scope.ts
+var SCOPE_ID = "scope";
+var SCOPE_NAME = "v1-load-surface";
+var SCOPE_UNCOVERED = [
+  "V2 project-local .opencode/plugins/",
+  "V2 npm-prefix/node_modules installs",
+  "V2 lazy activation state"
+];
+function verifyScope() {
+  return {
+    id: SCOPE_ID,
+    verdict: "PASS",
+    detail: `verdict scope = ${SCOPE_NAME}; NOT covered (declared blind, separate ledger item): ${SCOPE_UNCOVERED.join(", ")}`
+  };
+}
+
+// src/opencode/registry.ts
+var isRecord3 = (v) => typeof v === "object" && v !== null;
+var defaultRegistryFetcher = async (url2, init) => {
+  if (!/^https?:\/\//.test(url2)) throw new Error(`border opencode inspect refuses non-http(s) URL: ${url2}`);
+  const res = await fetch(url2, {
+    redirect: "follow",
+    signal: init.signal,
+    headers: { "user-agent": "border-customs (+https://github.com/TachikomaGundam/Border-Customs; border opencode inspect)" }
+  });
+  const raw = res.headers.get("content-length");
+  const parsed = raw === null ? Number.NaN : Number(raw);
+  return {
+    status: res.status,
+    contentLength: Number.isFinite(parsed) && parsed >= 0 ? parsed : null,
+    chunks: () => {
+      if (res.body === null) {
+        return {
+          async *[Symbol.asyncIterator]() {
+          }
+        };
+      }
+      return res.body;
+    }
+  };
+};
+function npmTagUrl(pkg, tag, base = DEFAULT_REGISTRY_BASE) {
+  const enc = pkg.startsWith("@") ? pkg.replace("/", "%2F") : encodeURIComponent(pkg);
+  return `${base}/${enc}/${encodeURIComponent(tag)}`;
+}
+var REGISTRY_BODY_CAP = 8 * 1024 * 1024;
+async function fetchRegistryVersion(fetcher, url2, timeoutMs) {
+  const res = await fetcher(url2, { signal: AbortSignal.timeout(timeoutMs) });
+  if (res.status !== 200) throw new Error(`HTTP ${String(res.status)} from ${url2}`);
+  const parts = [];
+  let total = 0;
+  for await (const chunk of res.chunks()) {
+    total += chunk.byteLength;
+    if (total > REGISTRY_BODY_CAP) throw new Error(`${url2} exceeds the ${String(REGISTRY_BODY_CAP)} B metadata cap`);
+    parts.push(Buffer.from(chunk));
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.concat(parts).toString("utf8"));
+  } catch {
+    throw new Error(`metadata response from ${url2} is not valid JSON`);
+  }
+  if (!isRecord3(parsed) || typeof parsed["version"] !== "string" || parsed["version"].length === 0) {
+    throw new Error(`metadata response from ${url2} carries no "version" string`);
+  }
+  return parsed["version"];
+}
+
+// src/opencode/aspects/specFreshness.ts
+var isExactVersion2 = (spec) => /^\d+\.\d+\.\d+([-+].*)?$/.test(spec);
+async function verifySpecFreshness(facts, deps = {}) {
+  const id = "spec-freshness";
+  const { configs, cacheDirs, pkg } = facts;
+  const errored = configs.filter((c) => c.status === "error").map((c) => c.path);
+  if (errored.length > 0) {
+    return { id, verdict: "CANNOT", detail: `configuration unreadable (${errored.join(", ")}) \u2014 the expected version cannot be determined` };
+  }
+  const specs = [...new Set(configs.flatMap((c) => [...c.specs]).map((s) => splitNpmSpec(s).spec).filter((s) => s !== null))];
+  if (specs.length === 0) {
+    return { id, verdict: "PASS", detail: `no ${pkg} spec declared in opencode config \u2014 nothing to be fresh` };
+  }
+  const expected = /* @__PURE__ */ new Map();
+  const fetcher = deps.fetcher ?? defaultRegistryFetcher;
+  const timeoutMs = deps.timeoutMs ?? REGISTRY_TIMEOUT_MS2;
+  for (const spec of specs) {
+    if (isExactVersion2(spec)) {
+      expected.set(spec, spec);
+      continue;
+    }
+    try {
+      expected.set(spec, await fetchRegistryVersion(fetcher, npmTagUrl(pkg, spec, deps.registryBase), timeoutMs));
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return { id, verdict: "CANNOT", detail: `registry unreachable for spec '${pkg}@${spec}': ${message} \u2014 border never reads silence as fresh` };
+    }
+  }
+  if (cacheDirs.length === 0) {
+    return { id, verdict: "PASS", detail: `nothing cached to compare (see cache-version); spec resolves to ${[...new Set(expected.values())].join(", ")}` };
+  }
+  const wanted = new Set(expected.values());
+  const judged = cacheDirs.filter((d) => d.packageVersion !== null);
+  const stale = judged.filter((d) => !wanted.has(d.packageVersion));
+  if (judged.length > 0 && stale.length > 0) {
+    return {
+      id,
+      verdict: "FAIL",
+      detail: `cache holds ${stale.map((d) => `${d.tag}->${d.packageVersion}`).join(",")}, spec expects ${[...wanted].join(",")}`
+    };
+  }
+  return { id, verdict: "PASS", detail: `cache matches spec: ${[...wanted].join(",")}` };
+}
+
+// src/opencode/inspect.ts
+function aggregateVerdict(aspects) {
+  if (aspects.some((a) => a.verdict === "FAIL")) return "FAIL";
+  if (aspects.some((a) => a.verdict === "CANNOT")) return "CANNOT";
+  return "PASS";
+}
+function inspectExit(verdict) {
+  switch (verdict) {
+    case "FAIL":
+      return EXIT_BLOCKED;
+    case "CANNOT":
+      return EXIT_ERROR;
+    case "PASS":
+      return EXIT_PASS;
+  }
+}
+function readPackagedPlugin(path4) {
+  try {
+    return readFileSync19(path4);
+  } catch {
+    return null;
+  }
+}
+function gatherFacts(env2, cwd, deps) {
+  const pkg = deps.package ?? BORDER_PACKAGE;
+  const pluginDrop = routeAPluginPath(env2);
+  const cacheRoot = deps.cacheRoot ?? opencodeCacheRoot(env2);
+  const globalPath = deps.globalConfigPath ?? join30(opencodeConfigRoot(env2), "opencode", "opencode.jsonc");
+  const routeAInstalled = existsSync21(pluginDrop);
+  return {
+    pkg,
+    env: env2,
+    cacheRoot,
+    cacheDirs: listCacheDirs(cacheRoot, pkg),
+    configs: [readPluginDeclarations(globalPath, pkg), readPluginDeclarations(join30(cwd, "opencode.jsonc"), pkg)],
+    packagedPlugin: readPackagedPlugin(packagedAssetPath(import.meta.url, "border.ts")),
+    routeAPlugin: pluginDrop,
+    routeAInstalled,
+    routeABytes: routeAInstalled ? readPackagedPlugin(pluginDrop) : null
+  };
+}
+async function runInspectCore(ctx, deps = {}) {
+  const facts = gatherFacts(ctx.env, ctx.cwd, deps);
+  const aspects = [
+    verifyCacheVersion(facts),
+    await verifySpecFreshness(facts, {
+      ...deps.registryFetcher !== void 0 ? { fetcher: deps.registryFetcher } : {},
+      ...deps.registryBase !== void 0 ? { registryBase: deps.registryBase } : {}
+    }),
+    await verifyIdentity({
+      ...deps.runner !== void 0 ? { runner: deps.runner } : {},
+      distEntry: deps.distEntry ?? packagedDistEntry(import.meta.url),
+      env: facts.env
+    }),
+    verifyRouteAParity(facts),
+    verifyDualRoute(facts),
+    verifyScope()
+  ];
+  const verdict = aggregateVerdict(aspects);
+  const report = { schemaVersion: 1, scope: "v1", verdict, aspects };
+  if (ctx.flags.json) {
+    ctx.stdout(JSON.stringify(report));
+  } else {
+    ctx.stdout(`border opencode inspect [${report.scope}] ${verdict}`);
+    for (const a of aspects) {
+      ctx.stdout(`  ${a.verdict.padEnd(6)} ${a.id}: ${a.detail}`);
+    }
+  }
+  return inspectExit(verdict);
+}
+
+// src/commands/opencode.ts
+function resolvePluginAsset(moduleUrl, fileName) {
+  const here = dirname16(fileURLToPath6(moduleUrl));
+  const candidates = [
+    join31(here, "..", "plugin", fileName),
+    // dist mode (bundled): <root>/plugin/<f>
+    join31(here, "..", "..", "plugin", fileName)
+    // src mode: <root>/plugin/<f>
+  ];
+  return candidates.find((p) => existsSync22(p)) ?? candidates[1];
+}
+function targetsFor(env2) {
+  const root = join31(opencodeConfigRoot(env2), "opencode");
+  return [
+    { fileName: "border.ts", destination: join31(root, "plugins", "border.ts"), marker: PLUGIN_MARKER },
+    { fileName: "border-command.md", destination: join31(root, "commands", "border.md"), marker: COMMAND_MARKER }
+  ];
 }
 function carriesMarker(bytes, marker) {
   return firstLine(bytes).startsWith(marker);
@@ -44530,7 +45038,7 @@ function fail(ctx, message) {
 function readPackagedAsset(ctx, fileName) {
   const source = resolvePluginAsset(import.meta.url, fileName);
   try {
-    return readFileSync18(source);
+    return readFileSync20(source);
   } catch {
     ctx.stderr(`border: opencode: packaged asset is missing (${source})`);
     ctx.stderr("border: opencode: the border install looks broken \u2014 `npm i -g border-customs` or a fresh checkout should carry plugin/.");
@@ -44539,7 +45047,7 @@ function readPackagedAsset(ctx, fileName) {
 }
 function readTarget(destination) {
   try {
-    return readFileSync18(destination);
+    return readFileSync20(destination);
   } catch {
     return null;
   }
@@ -44606,7 +45114,7 @@ function opencodeInstall(ctx) {
       ctx.stdout(`${target.destination}: up to date`);
       continue;
     }
-    mkdirSync12(dirname15(target.destination), { recursive: true });
+    mkdirSync12(dirname16(target.destination), { recursive: true });
     writeFileSync8(target.destination, packaged);
     ctx.stdout(`${target.destination}: ${state === "outdated" ? "updated" : "installed"}`);
   }
@@ -44620,8 +45128,8 @@ function opencodeStatus(ctx) {
   for (const { target, packaged } of prepared) {
     const current = readTarget(target.destination);
     const state = classify(target, current, packaged);
-    const installedSha = current === null ? "-" : sha2563(current);
-    ctx.stdout(`${target.destination}: ${state}  installed=${installedSha}  packaged=${sha2563(packaged)}`);
+    const installedSha = current === null ? "-" : sha256Hex3(current);
+    ctx.stdout(`${target.destination}: ${state}  installed=${installedSha}  packaged=${sha256Hex3(packaged)}`);
   }
   return EXIT_PASS;
 }
@@ -44648,23 +45156,27 @@ function opencodeUninstall(ctx) {
   return EXIT_PASS;
 }
 function runOpencode(ctx) {
-  const [sub, ...rest] = ctx.positionals;
-  if (rest.length > 0) {
-    throw new UnknownArgError(
-      `opencode ${sub ?? "<none>"}: unexpected argument '${rest[0] ?? ""}' \u2014 usage: border opencode install | status | uninstall`
-    );
-  }
+  const [sub, ...restAll] = ctx.positionals;
+  const rest = restAll.filter((arg) => arg !== "--json");
+  const USAGE = "usage: border opencode install | status | uninstall | inspect";
   switch (sub) {
     case "install":
-      return opencodeInstall(ctx);
     case "status":
-      return opencodeStatus(ctx);
     case "uninstall":
-      return opencodeUninstall(ctx);
+    case "inspect": {
+      if (rest.length > 0) {
+        throw new UnknownArgError(`opencode ${sub}: unexpected argument '${rest[0] ?? ""}' \u2014 ${USAGE}`);
+      }
+      const table2 = {
+        install: opencodeInstall,
+        status: opencodeStatus,
+        uninstall: opencodeUninstall,
+        inspect: runInspectCore
+      };
+      return table2[sub](ctx);
+    }
     default:
-      throw new UnknownArgError(
-        `opencode: unknown subcommand '${sub ?? "<none>"}' \u2014 usage: border opencode install | status | uninstall`
-      );
+      throw new UnknownArgError(`opencode: unknown subcommand '${sub ?? "<none>"}' \u2014 ${USAGE}`);
   }
 }
 
@@ -44768,7 +45280,7 @@ function confirmRemoteBranch(i) {
 import { spawnSync as spawnSync18 } from "node:child_process";
 import { mkdtempSync as mkdtempSync6, rmSync as rmSync14 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { dirname as dirname16, join as join29, resolve as resolve18 } from "node:path";
+import { dirname as dirname17, join as join32, resolve as resolve18 } from "node:path";
 var LANDINGS_REF_PREFIX = "refs/border-landings/";
 async function runLandingVerification(o) {
   if (o.legs.length === 0) return null;
@@ -44818,7 +45330,7 @@ function gitPlain(repoDir, env2, args) {
   for (const [name, value] of Object.entries(env2)) {
     if (!name.startsWith("GIT_")) clean[name] = value;
   }
-  clean.GIT_CEILING_DIRECTORIES = dirname16(resolve18(repoDir));
+  clean.GIT_CEILING_DIRECTORIES = dirname17(resolve18(repoDir));
   clean.GIT_OPTIONAL_LOCKS = "0";
   clean.GIT_TERMINAL_PROMPT = "0";
   const r = spawnSync18("git", ["-C", resolve18(repoDir), ...args], { encoding: "utf8", env: clean, timeout: 55e3, maxBuffer: 32 * 1024 * 1024 });
@@ -44843,7 +45355,7 @@ async function defaultScanRemoteTip(o, remote, branch, remoteSha) {
       ownedTempRef = landingRef;
       rev = git.run(["rev-parse", landingRef]).trim();
     }
-    const treeRoot = mkdtempSync6(join29(tmpdir4(), "border-landing-tree-"));
+    const treeRoot = mkdtempSync6(join32(tmpdir4(), "border-landing-tree-"));
     try {
       return await scanTipTree(git, treeRoot, rev, o.env);
     } finally {
@@ -45052,14 +45564,14 @@ async function executeYesPush(ctx, loaded) {
 import { mkdtempSync as mkdtempSync7, rmSync as rmSync15, writeFileSync as writeFileSync9 } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { tmpdir as tmpdir5 } from "node:os";
-import { join as join30 } from "node:path";
+import { join as join33 } from "node:path";
 
 // src/scan/fetch.ts
 import { createHash as createHash18 } from "node:crypto";
 import { basename as basename5 } from "node:path";
 var SCAN_MAX_ARTIFACT_BYTES = 200 * 1024 * 1024;
 var SCAN_REQUEST_TIMEOUT_MS = 6e4;
-var SCAN_USER_AGENT = "border-customs/0.6.0 (+https://github.com/sumteclab/border; border scan)";
+var SCAN_USER_AGENT = "border-customs/0.8.0 (+https://github.com/sumteclab/border; border scan)";
 var CRATES_DOWNLOAD_HOST = "https://static.crates.io";
 var defaultScanFetcher = async (url2, init) => {
   if (!/^https?:\/\//.test(url2)) throw new EngineRunError(`border scan refuses non-http(s) URL: ${url2}`, null);
@@ -45113,7 +45625,7 @@ async function fetchJson(fetcher, url2, timeoutMs) {
     fail2(`metadata response from ${url2} is not valid JSON`);
   }
 }
-var isRecord2 = (v) => typeof v === "object" && v !== null;
+var isRecord4 = (v) => typeof v === "object" && v !== null;
 function channelBaseUrl(eco) {
   const ch = publishChannels().find((c) => c.id === eco);
   if (ch === void 0 || ch.defaultUrl.length === 0) {
@@ -45144,7 +45656,7 @@ async function fetchArtifact(spec, o) {
   switch (spec.ecosystem) {
     case "npm": {
       const meta3 = await fetchJson(o.fetcher, npmMetadataUrl(spec.name, spec.version), timeoutMs);
-      const dist = isRecord2(meta3) && isRecord2(meta3["dist"]) ? meta3["dist"] : {};
+      const dist = isRecord4(meta3) && isRecord4(meta3["dist"]) ? meta3["dist"] : {};
       const tarball = dist["tarball"];
       if (typeof tarball !== "string" || tarball.length === 0) fail2(`npm metadata for ${label} has no dist.tarball`);
       if (!/^https?:\/\//.test(tarball)) fail2(`npm dist.tarball for ${label} is not an http(s) URL`);
@@ -45155,8 +45667,8 @@ async function fetchArtifact(spec, o) {
     }
     case "pypi": {
       const meta3 = await fetchJson(o.fetcher, pypiMetadataUrl(spec.name, spec.version), timeoutMs);
-      const urls = isRecord2(meta3) && Array.isArray(meta3["urls"]) ? meta3["urls"] : [];
-      const files = urls.filter(isRecord2);
+      const urls = isRecord4(meta3) && Array.isArray(meta3["urls"]) ? meta3["urls"] : [];
+      const files = urls.filter(isRecord4);
       const sdists = files.filter((f) => f["packagetype"] === "sdist");
       const sdist = sdists.find((f) => typeof f["filename"] === "string" && f["filename"].endsWith(".tar.gz"));
       if (sdist === void 0) {
@@ -45184,7 +45696,7 @@ async function fetchArtifact(spec, o) {
     }
   }
 }
-function sha256Hex3(data) {
+function sha256Hex4(data) {
   return createHash18("sha256").update(data).digest("hex");
 }
 
@@ -45228,7 +45740,7 @@ function parseScanSpec(raw) {
 }
 
 // src/roundtrip/localArtifact.ts
-import { createReadStream, existsSync as existsSync19, statSync as statSync3 } from "node:fs";
+import { createReadStream, existsSync as existsSync23, statSync as statSync3 } from "node:fs";
 import { createHash as createHash19 } from "node:crypto";
 import { basename as basename6, resolve as resolve19 } from "node:path";
 var EXT_TABLE = /* @__PURE__ */ new Map([
@@ -45277,7 +45789,7 @@ var GRAMMAR_HINT = {
 };
 function classifyLocalInput(raw, cwd, parsesAsRegistrySpec) {
   const abs = resolve19(cwd, raw);
-  if (existsSync19(abs)) {
+  if (existsSync23(abs)) {
     const st = statSync3(abs);
     if (st.isDirectory()) {
       bad3(`'${raw}' resolves to a directory (${abs}) \u2014 local mode needs a single artifact FILE, not a directory`);
@@ -45636,7 +46148,7 @@ function classifyResidue(label, diff, attribution = null) {
 
 // src/roundtrip/orchestrate.ts
 function containerNameFor(label, rand = randomBytes(3).toString("hex")) {
-  return `rt-${sha256Hex3(label).slice(0, 8)}-${rand}`;
+  return `rt-${sha256Hex4(label).slice(0, 8)}-${rand}`;
 }
 var shArgv = (name) => {
   if (!/^[A-Za-z0-9@._+/-]+$/.test(name)) {
@@ -45757,7 +46269,7 @@ function runPipeline2(exec, profile, spec, label, hostPath, container, closure,
     return {
       findings: classifyResidue(label, diffManifests(m1, m3), attribution),
       installDelta,
-      baselineDigest: sha256Hex3([...m1.keys()].join("\n"))
+      baselineDigest: sha256Hex4([...m1.keys()].join("\n"))
     };
   } finally {
     try {
@@ -45791,12 +46303,12 @@ async function runRoundtripCore(ctx, deps = {}) {
     ctx.stderr("roundtrip: docker unavailable \u2014 cannot verify");
     return EXIT_ERROR;
   }
-  const baseDir = mkdtempSync7(join30(tmpdir5(), "border-roundtrip-"));
+  const baseDir = mkdtempSync7(join33(tmpdir5(), "border-roundtrip-"));
   try {
     const localRead = local !== null ? await readLocalArtifact(local.absPath) : null;
     const bytes = localRead?.bytes ?? (await fetchArtifact(spec, { fetcher: deps.fetcher ?? defaultScanFetcher })).bytes;
-    const artifactSha256 = localRead !== null ? localRead.sha256 : sha256Hex3(bytes);
-    const hostPath = join30(baseDir, "artifact");
+    const artifactSha256 = localRead !== null ? localRead.sha256 : sha256Hex4(bytes);
+    const hostPath = join33(baseDir, "artifact");
     writeFileSync9(hostPath, bytes);
     const container = containerNameFor(label);
     const closure = spec.ecosystem === "pypi" ? resolvePipClosure(exec, profile, hostPath, label, spec) : null;
@@ -45804,12 +46316,12 @@ async function runRoundtripCore(ctx, deps = {}) {
     const verdict = computeVerdict(findings);
     const report = {
       schemaVersion: 1,
-      key: sha256Hex3(`roundtrip:${label}:${baselineDigest}:${verdict}`),
+      key: sha256Hex4(`roundtrip:${label}:${baselineDigest}:${verdict}`),
       head: baselineDigest.slice(0, 40),
       dirty: false,
       exposureSet: [label],
       refSet: [],
-      rulesHash: sha256Hex3(`${profile.image}|${profile.install(profile.artifactPath, spec).join(" ")}|${profile.uninstall(spec).join(" ")}`),
+      rulesHash: sha256Hex4(`${profile.image}|${profile.install(profile.artifactPath, spec).join(" ")}|${profile.uninstall(spec).join(" ")}`),
       verdict,
       counts: countFindings(findings),
       findings,
@@ -45899,7 +46411,7 @@ var runRoundtrip = (ctx) => runRoundtripCore(ctx);
 // src/scan/scan.ts
 import { mkdtempSync as mkdtempSync8 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
-import { join as join32 } from "node:path";
+import { join as join35 } from "node:path";
 
 // src/scan/config.ts
 function buildScanConfigYaml(eco) {
@@ -45926,8 +46438,8 @@ function synthesizeScanConfig(eco) {
 }
 
 // src/scan/materialize.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync13, readdirSync as readdirSync10, readFileSync as readFileSync19, rmSync as rmSync16, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join31 } from "node:path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync13, readdirSync as readdirSync11, readFileSync as readFileSync21, rmSync as rmSync16, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join34 } from "node:path";
 var CRATES_ENVELOPE_FILES = ["Cargo.toml.orig", ".cargo-ok", ".cargo_vcs_info.json"];
 var fail3 = (why) => {
   throw new Error(`border scan cannot materialize the artifact (${why}) \u2014 refusing to stage an unusable tree (fail-closed)`);
@@ -45941,15 +46453,15 @@ function extractFlat(archive, destDir) {
   }
 }
 function unwrapSingleDir(dir) {
-  const entries = readdirSync10(dir, { withFileTypes: true });
+  const entries = readdirSync11(dir, { withFileTypes: true });
   const dirs = entries.filter((e) => e.isDirectory());
   if (entries.length === 1 && dirs.length === 1 && dirs[0] !== void 0) {
-    return join31(dir, dirs[0].name);
+    return join34(dir, dirs[0].name);
   }
   return dir;
 }
 function requireManifest(repoDir, ecosystem, candidates) {
-  if (!candidates.some((rel) => existsSync20(join31(repoDir, rel)))) {
+  if (!candidates.some((rel) => existsSync24(join34(repoDir, rel)))) {
     fail3(`${ecosystem} package tree has none of [${candidates.join(", ")}] at its root`);
   }
 }
@@ -45959,18 +46471,18 @@ function materializePackage(o) {
 `);
   });
   const safe = safeArtifactName(o.filename, `${o.ecosystem}-artifact`);
-  const archive = join31(o.baseDir, safe);
+  const archive = join34(o.baseDir, safe);
   writeFileSync10(archive, o.bytes);
-  const extractDir = join31(o.baseDir, "extract");
+  const extractDir = join34(o.baseDir, "extract");
   mkdirSync13(extractDir, { recursive: true });
   extractFlat(archive, extractDir);
   let repoDir = unwrapSingleDir(extractDir);
   if (o.ecosystem === "rubygems") {
     const outer = repoDir;
     const dataCandidates = findNativeMissArchives(outer).filter((f) => f.endsWith("data.tar.gz"));
-    const inner = dataCandidates[0] ?? join31(outer, "data.tar.gz");
-    if (!existsSync20(inner)) fail3(".gem archive contains no data.tar.gz");
-    const gemTree = join31(o.baseDir, "gem-tree");
+    const inner = dataCandidates[0] ?? join34(outer, "data.tar.gz");
+    if (!existsSync24(inner)) fail3(".gem archive contains no data.tar.gz");
+    const gemTree = join34(o.baseDir, "gem-tree");
     mkdirSync13(gemTree, { recursive: true });
     extractFlat(inner, gemTree);
     repoDir = unwrapSingleDir(gemTree);
@@ -45981,11 +46493,11 @@ function materializePackage(o) {
   } else {
     requireManifest(repoDir, o.ecosystem, ["Cargo.toml"]);
     for (const file2 of CRATES_ENVELOPE_FILES) {
-      const path4 = join31(repoDir, file2);
-      if (!existsSync20(path4)) continue;
-      const original = readFileSync19(path4);
+      const path4 = join34(repoDir, file2);
+      if (!existsSync24(path4)) continue;
+      const original = readFileSync21(path4);
       rmSync16(path4, { force: true });
-      note(`border scan: crates envelope normalized: ${file2} sha256=${sha256Hex3(original)}`);
+      note(`border scan: crates envelope normalized: ${file2} sha256=${sha256Hex4(original)}`);
     }
   }
   const env2 = o.env;
@@ -46011,7 +46523,7 @@ async function runScanCore(ctx, deps = {}) {
   }
   const cfg = synthesizeScanConfig(spec.ecosystem);
   const fetcher = deps.fetcher ?? defaultScanFetcher;
-  const baseDir = mkdtempSync8(join32(tmpdir6(), "border-scan-"));
+  const baseDir = mkdtempSync8(join35(tmpdir6(), "border-scan-"));
   try {
     const { bytes, filename } = await fetchArtifact(spec, { fetcher });
     const env2 = { ...ctx.env };
@@ -46022,12 +46534,12 @@ async function runScanCore(ctx, deps = {}) {
     const verdict = computeVerdict(findings);
     const report = {
       schemaVersion: 1,
-      key: sha256Hex3(`scan:${spec.ecosystem}:${spec.name}@${spec.version}:${head}`),
+      key: sha256Hex4(`scan:${spec.ecosystem}:${spec.name}@${spec.version}:${head}`),
       head,
       dirty: false,
       exposureSet: [`${spec.ecosystem}:${spec.name}@${spec.version}`],
       refSet: [],
-      rulesHash: sha256Hex3(buildScanConfigYaml(spec.ecosystem)),
+      rulesHash: sha256Hex4(buildScanConfigYaml(spec.ecosystem)),
       verdict,
       counts: countFindings(findings),
       findings,
@@ -46168,7 +46680,7 @@ function usage() {
     "  llm-ingest     record provenance captured by the harness",
     "  scan           inspect a third-party package ([ecosystem:]name@version) for residue",
     "  roundtrip      install+uninstall a package (registry spec or local artifact file) in a throwaway container, report uninstall residue",
-    "  opencode       install|status|uninstall the official opencode plugin adapter (files under $XDG_CONFIG_HOME/opencode)",
+    "  opencode       install|status|uninstall|inspect the official opencode plugin adapter (files under $XDG_CONFIG_HOME/opencode; inspect = read-only V1 load-surface audit)",
     "  exfil          read-only exfil-lens scan of <ref|url> [ref...]: tip tree + tag notes (--deep adds reachable-history blobs + commit messages)",
     "",
     "flags:",
@@ -46311,7 +46823,7 @@ function isMainModule({ argv1, moduleUrl, realpath }) {
       return p;
     }
   };
-  return pathToFileURL(canonical(argv1)).href === pathToFileURL(canonical(fileURLToPath6(moduleUrl))).href;
+  return pathToFileURL(canonical(argv1)).href === pathToFileURL(canonical(fileURLToPath7(moduleUrl))).href;
 }
 if (isMainModule({ argv1: process.argv[1], moduleUrl: import.meta.url, realpath: realpathSync.native })) {
   const outcome = run(process.argv.slice(2));