border-customs 0.7.1 → 0.8.0

package/README.md

@@ -491,7 +491,7 @@ border <command> [options]
 | `llm-ingest <findings.json>` | validate agent findings and record the combined verdict |
 | `scan <[ecosystem:]name@version>` | inspect a third-party published artifact for residue before installing it |
 | `exfil <rev\|url>` | read-only exfil lens over a local rev or a remote URL (tip tree by default) |
-| `opencode <install\|status\|uninstall>` | install/status/uninstall the official OpenCode plugin adapter |
+| `opencode <install\|status\|uninstall\|inspect>` | install/status/uninstall the official OpenCode plugin adapter; `inspect` audits this machine's V1 load surface |
 
 Every subcommand accepts the same global flags (verified against `border <cmd> --help`):
 
@@ -717,7 +717,7 @@ plugin entry ships as `exports["./server"]`):
 ```jsonc
 {
   // pin the exact version — an @latest channel hits the registry on every cold start
-  "plugin": ["border-customs@0.7.1"]
+  "plugin": ["border-customs@0.8.0"]
 }
 ```
 
@@ -752,7 +752,7 @@ The `/border` slash command stays V1-only until the V2 command-delivery API sett
 
 What loads is one agent tool `border` plus a `/border` slash command. The tool spawns the CLI
 argv-only (no shell; 300 s cap, 64 KiB per stream) restricted to the closed command list
-`check`, `push`, `status`, `llm-request`, `llm-ingest`, `scan`, `roundtrip`, `--help`, and
+`check`, `push`, `status`, `llm-request`, `llm-ingest`, `scan`, `roundtrip`, `exfil`, `--help`, and
 renders the exit-code contract unchanged: 0 pass, 1 gate-blocked or partial push, 2 the gate
 could not answer — which since 0.5.1 also covers "no border CLI found or verified": the tool
 answers exit 2 cannot-answer and spawns nothing else. The tool REFUSES `--yes` — a real push
@@ -769,6 +769,18 @@ HTTP assertions — the `border` tool id present, `/border` present exactly once
 fails); plugin load failures are silent, so judge by the HTTP responses, never by the exit
 code.
 
+`border opencode inspect [--json]` audits this machine's **V1 load surface** as one gate-owned
+command: six read-only aspects — cache self-consistency (package.json vs plugin marker line),
+spec freshness (exact pin offline; dist-tag against the registry), the 0.5.1 identity handshake
+replayed against the CLI resolver's candidate order, Route A byte parity, Route A∧B dual-registration
+collision, and the scope declaration — aggregated fail-closed: any FAIL exits 1, else any CANNOT
+exits 2, all PASS exits 0. The certificate boundary is printed, not implied: `--json` carries
+`scope:"v1"`, and V2 load surfaces (project-local `.opencode/plugins/`, npm-prefix layouts, lazy
+activation) are a DECLARED BLIND SPOT pending V2 stabilization — a PASS is never evidence that
+"the whole machine is clean". The tool never writes: `--purge` lives in the drift-watch cron shell,
+which is now a thin consumer of `inspect --json` with the rc contract unchanged
+(FRESH 0 / DRIFT 1 / NOT-CACHED 0 / CANNOT 2).
+
 ## What this is not
 
 - **Not a vault or secret manager.** It detects credentials on their way out; it does not
@@ -815,6 +827,20 @@ code.
 
 ## Changelog
 
+### 0.8.0 (2026-09-30)
+- Add: **`border opencode inspect [--json]`** — the load-surface self-audit becomes a gate-owned
+  surface: six read-only aspects (cache self-consistency, spec freshness vs pin/registry, identity
+  handshake replay, Route A byte parity, Route A∧B dual-route collision, scope declaration),
+  fail-closed aggregation FAIL 1 > CANNOT 2 > PASS 0. `--json` pins `scope:"v1"` — V2 load surfaces
+  are a declared blind spot, not silently covered. Zero writes; `--purge` stays in the cron shell.
+- Change: **`exfil` joins the plugin's closed command list** (owner ruling R1 under the four-question
+  eligibility gate — no mutation, no credentials, no foreign-byte execution, no local egress;
+  packet: `.omo/evidence/F-EXFIL-ALLOWLIST-RULING-2026-09-30.md`). `border opencode …` verbs stay
+  terminal-only: they mutate `$XDG_CONFIG_HOME` and fail the gate's first question.
+- Change: `tools/plugin-drift-watch.mjs` retires to a thin shell over `border opencode inspect --json`
+  (single source of verdicts); the cron rc contract is byte-stable — FRESH 0, DRIFT 1, NOT-CACHED 0
+  (special-cased per ruling B2), CANNOT 2 — and the crontab line is unchanged.
+
 ### 0.7.1 (2026-09-30)
 - Fix: **release-gate test ruler race** (`test/push.integration.test.ts` I4) — the
   "dry-run made ZERO verdaccio requests" invariant counted lines in verdaccio's stdout
@@ -1000,6 +1026,8 @@ MIT, see [LICENSE](LICENSE).
 
 ## 中文概要
 
+**0.8.0（2026-09-30）装载面自审计**：`border opencode inspect [--json]` 把散在插件、cron 脚本与安装器里的装载检查制度化为门禁自有表面——六个只读方面（缓存自洽：package.json 对插件 marker 行；spec 新鲜度：exact pin 离线比、dist-tag 问注册表；身份握手按 CLI 候选序重放；Route A 字节 parity；A∧B 双注册相撞；scope 声明），fail-closed 聚合：任一 FAIL 退 1，否则任一 CANNOT 退 2，全 PASS 退 0。`--json` 面值钉死 `scope:"v1"`：V2 装载面（项目本地 `.opencode/plugins/`、npm-prefix 布局、懒激活态）是**声明的盲区**而非被覆盖——PASS 永远不等于"全机干净"。工具零写入；`--purge` 留在 cron 薄壳，壳的 rc 合同原样保持（FRESH 0 / DRIFT 1 / NOT-CACHED 0（裁定 B2 特判）/ CANNOT 2），crontab 一行未动。exfil 依主人裁定（R1）进插件命令闭集——四问判据全过：不变异、不碰凭据、不执行外来字节、不外传本地数据；`border opencode` 动词组因写 `$XDG_CONFIG_HOME` 留在终端侧。裁决包：`.omo/evidence/F-EXFIL-ALLOWLIST-RULING-2026-09-30.md`。
+
 **0.7.1（2026-09-30）发布门禁尺伤修复**：I4 集成测试的"dry-run 对 registry 零请求"断言按 verdaccio stdout 日志行计数，而日志是最终一致视图——CI 满载 runner 上更早阶段的合法 probe 行晚于快照落盘，把差额错记到 dry-run 头上（v0.7.0 run 36671401844 红 `6 !== 2`，同字节本机绿）。修复=尺子不松语义：所有快照前后加 FIFO drain 屏障（哨兵请求行可见⇒先前请求行必已落盘；哨兵流量不计入计数）。dry-run 零网络契约本身未动，两侧实测请求为零。
 
 **0.7.0（2026-09-28）OpenCode 2（beta）兼容**：插件模块双形状——V1 宿主调 `server()`（对象入口需 ≥1.18.29），V2 宿主（`opencode2`）调 `setup(ctx)` 经 `ctx.tool.transform` 注册同一个工具；spawn 前门（allowlist/`--yes`）与 0.5.1 身份握手两形状共享，双边渲染逐字 parity 由测试钉死。V2 懒激活（断言前须 `POST /api/plugin/await-activation`）；`/border` 命令暂仅 V1（V2 投递 API 未定形）；已在 beta-19271 项目本地两形态活体验证。V1 活体探针反真空化：opt-in 缺前提即 FAIL 点名补救。
@@ -1035,6 +1063,6 @@ border 是一个 fail-closed(失败即拦截)的推送前门禁 CLI:`npm install
 
 发布一致性(0.4.1):起因是 aihr 事故——PyPI 上标为 0.2.2 的 wheel 里 `__init__.__version__` 却写着 0.2.1,构件名、元数据与实际模块行为三者不一致,所有 `==0.2.2` 的用户静默装上了旧行为;同类漂移在本仓库也出现过两次(npm tarball 的 User-Agent 停在 0.3.0 而 package.json 是 0.3.1;package-lock.json 根版本两个 release 一直躺在 0.1.0)。发布阶段扫描器因此在构件内部逐源交叉核对版本号:`release-coherence-version-drift` 为 CRITICAL(package.json 与被强制打包的 package-lock、wheel 文件名对 dist-info 目录对 METADATA `Version:` 对 `__init__` 字面量、sdist 的 pyproject 对 PKG-INFO/setup 系字面量、Cargo.toml 对已打包的 Cargo.lock、.gemspec 对 metadata.gz、dist 文件名对 sdist 内 PKG-INFO);版本源存在但无法静态解析(动态 `__version__`、`attr:`、`dynamic = ["version"]`、坏 lockfile)判 MEDIUM `release-coherence-unverifiable-source`——不可核查绝不静默算干净;第二版本源根本没被打包时不发现在内,缺源不是漂移,这条边界是承重的,误报的门禁会把用户训练成 `--force`。唯一可静态强制的跨包管理器声明是 opt-in `release.twin`(`{pypi, npm}` 严格 zod 对列表,未知键 exit 2):同一 run 的 dist 里孪生版本不等 ⇒ CRITICAL `release-coherence-twin-drift`,消息点名两个构件。规则源文件与 residue 指纹表一样并入 rulesHash,改一个匹配器即令全部缓存 PASS 失效。
 
-OpenCode 插件适配层(0.5.0):零手工装载两条路线——主路是在 `opencode.jsonc` 声明 `"plugin": ["border-customs@0.5.0"]`(建议钉具体版本,@latest 每次冷启动都打注册表),opencode 自行下载构件,插件入口走 `exports["./server"]`;插件自带 CLI 解析,顺序为 `BORDER_BIN` 覆盖(独占,坏了就报错、绝不静默回退)> 包内同侧 `dist/index.js`(shebang 直接执行,不可执行则回退 PATH 上的 `node` 承载)> PATH 上的 `border`,免全局安装、免 PATH 配置;0.5.1 起任何候选都必须先过**身份握手**(以 `--help` 应答出 border 横幅与 `usage: border` 才算数),通过之前绝不投递用户 argv,握手不过即 cannot-answer exit 2、不运行任何其他二进制——0.5.0 曾用 `process.execPath` 承载包内 dist,而在插件宿主里 execPath 是 opencode 本体,边检门被静默冒充为宿主(2026-09-22 事故,见 0.5.1 变更日志)。备路是 `border opencode install|status|uninstall` 文件投递,落盘 `$XDG_CONFIG_HOME/opencode` 下的 `plugins/border.ts` 与 `commands/border.md`(无 XDG 回退 HOME/.config):受管文件凭 marker 行识别身份,同名外人文件 exit 2 拒绝、绝不覆盖,卸载只删自己带 marker 的文件,字节相同即 `up to date`。装载面只有一个 `border` 工具(argv-only 生成、无 shell、300 秒与每流 64 KiB 上限,命令闭集 check/push/status/llm-request/llm-ingest/scan/roundtrip/--help)与一条 `/border` 斜杠命令(config 钩子以 `??=` 自注册,用户同名文件命令保持权威)。边界如实说:allowlist 是 UX/防呆而非安全边界——插件进程与 opencode 进程同权,门禁的牙齿在 CLI 与账本,不在适配层;`push --yes` 按设计留在终端人审,工具端机械拒绝,会话内裸 push 本就是 CLI 合同的 DRY-RUN。装载验证走 opt-in 探针 `BORDER_OPENCODE_PROBE=1`(临时 HOME/XDG 起 `opencode serve` 对照组,断言 `border` 工具 id 与恰好一条 border 命令,重复即 FAIL;插件加载失败是静默的,只认 HTTP 响应不认退出码)。两条路线装载后都需重启 opencode:工具与命令在启动时扫描。
+OpenCode 插件适配层(0.5.0):零手工装载两条路线——主路是在 `opencode.jsonc` 声明 `"plugin": ["border-customs@0.5.0"]`(建议钉具体版本,@latest 每次冷启动都打注册表),opencode 自行下载构件,插件入口走 `exports["./server"]`;插件自带 CLI 解析,顺序为 `BORDER_BIN` 覆盖(独占,坏了就报错、绝不静默回退)> 包内同侧 `dist/index.js`(shebang 直接执行,不可执行则回退 PATH 上的 `node` 承载)> PATH 上的 `border`,免全局安装、免 PATH 配置;0.5.1 起任何候选都必须先过**身份握手**(以 `--help` 应答出 border 横幅与 `usage: border` 才算数),通过之前绝不投递用户 argv,握手不过即 cannot-answer exit 2、不运行任何其他二进制——0.5.0 曾用 `process.execPath` 承载包内 dist,而在插件宿主里 execPath 是 opencode 本体,边检门被静默冒充为宿主(2026-09-22 事故,见 0.5.1 变更日志)。备路是 `border opencode install|status|uninstall` 文件投递,落盘 `$XDG_CONFIG_HOME/opencode` 下的 `plugins/border.ts` 与 `commands/border.md`(无 XDG 回退 HOME/.config):受管文件凭 marker 行识别身份,同名外人文件 exit 2 拒绝、绝不覆盖,卸载只删自己带 marker 的文件,字节相同即 `up to date`。装载面只有一个 `border` 工具(argv-only 生成、无 shell、300 秒与每流 64 KiB 上限,命令闭集 check/push/status/llm-request/llm-ingest/scan/roundtrip/exfil/--help)与一条 `/border` 斜杠命令(config 钩子以 `??=` 自注册,用户同名文件命令保持权威)。边界如实说:allowlist 是 UX/防呆而非安全边界——插件进程与 opencode 进程同权,门禁的牙齿在 CLI 与账本,不在适配层;`push --yes` 按设计留在终端人审,工具端机械拒绝,会话内裸 push 本就是 CLI 合同的 DRY-RUN。装载验证走 opt-in 探针 `BORDER_OPENCODE_PROBE=1`(临时 HOME/XDG 起 `opencode serve` 对照组,断言 `border` 工具 id 与恰好一条 border 命令,重复即 FAIL;插件加载失败是静默的,只认 HTTP 响应不认退出码)。两条路线装载后都需重启 opencode:工具与命令在启动时扫描。
 
 外泄透镜(0.6.0):经典密钥扫描器看不见内网 IP、`user@内网主机`、家目录、凭据文件位置、主机画像这类"外泄形状"字面量——它们不是密钥,却如实描述公网仓库身后的私网。0.6.0 加五条规则 `exfil-rfc1918/exfil-ssh-target/exfil-home-path/exfil-cred-location/exfil-host-profile`,每个(规则×分面×通道)格子的**观察严重度**只有单一事实源 `src/exfil/severity.ts`:树面 HIGH 族走双生规则(gitleaks TOML + secretlint pattern,id 逐字节相等、三通道判决对等性有测试钉死),因两引擎都没有 HIGH 档而如实记为 CRITICAL(不硬掰,如实表);树面 MEDIUM 族走原生腿;提交消息面原生独占、id 带 `:message` 后缀,allow 条目按 id 精确匹配、跨面豁免在结构上不可能;tag note 分面归既有引擎腿 `tag-message-secret`,核心绝不重复发。规则源文件并入 rulesHash,改一个匹配器即令全部缓存 PASS 失效。独立只读入口 `border exfil <rev|url>`(默认树尖,`--deep` 补全史 blob 与全部可达提交消息;URL 模式落临时克隆、退出即销毁)。push 之后新增**落地核验**:ls-remote 复读远端尖、必要时精确 fetch 该对象,用同一套机制扫已公开树——干净则追加 `t:"landing"` 账本行并保留原退出码;有阻断发现则 exit 1 并明说 ALREADY PUBLIC;border 只检测、从不抹除;远端不可观测则 exit 2、一条记录都不造(没核验就没事实),已执行的 push 记录原样矗立——账本 append-only,任何情况下不改写历史。测试语料遵守夹具纪律:10.200.0.0/16 为预留夹具段(树面全通道静默、双生规则原生镜像该豁免,消息面例外照红),其余泄漏形状一律由 `assembleOctet`/`assembleHost` 运行时拼装,签出字节里没有完整泄漏 token——border 的透镜对自己的仓库绿,红故事照常武装。真值通道 `BORDER_EXFIL_TRUTH=1` 为 opt-in,红锚点带生命周期条款:上游作者清理后按设计转绿、留档不判败。

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "border-customs",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "border-customs",
-      "version": "0.7.1",
+      "version": "0.8.0",
       "license": "MIT",
       "dependencies": {
         "@opencode-ai/plugin": "^1.17.4",

package/dist/index.js

@@ -13029,7 +13029,7 @@ var require_micromatch = __commonJS({
 
 // src/index.ts
 import { realpathSync } from "node:fs";
-import { fileURLToPath as fileURLToPath6, pathToFileURL } from "node:url";
+import { fileURLToPath as fileURLToPath7, pathToFileURL } from "node:url";
 
 // src/cli.ts
 import { parseArgs } from "node:util";
@@ -38093,12 +38093,12 @@ function packOnce(o) {
     throw new EngineRunError(`npm pack reported '${report.filename}' but no tarball landed in ${o.distDir}`, null);
   }
   const data = readFileSync3(tarballAbs);
-  const sha2564 = createHash3("sha256").update(data).digest("hex");
+  const sha2563 = createHash3("sha256").update(data).digest("hex");
   const sha1 = createHash3("sha1").update(data).digest("hex");
   if (sha1 !== report.shasum || data.byteLength !== report.size) {
     throw new EngineRunError(`npm pack report disagrees with the tarball bytes for ${report.filename} \u2014 corrupted or swapped artifact, failing closed`, null);
   }
-  return { filename: report.filename, sha256: sha2564, bytes: data.byteLength, tarballAbs };
+  return { filename: report.filename, sha256: sha2563, bytes: data.byteLength, tarballAbs };
 }
 function publintFinding(o, tarballAbs, identity) {
   const candidates = o.publintBinPath !== void 0 ? [o.publintBinPath] : [
@@ -39141,7 +39141,7 @@ async function runNpmArtifactStage(o) {
   const stateDir = join10(repoDir, BORDER_STATE_DIR);
   const distDir = join10(stateDir, "dist");
   mkdirSync3(distDir, { recursive: true });
-  const { filename, sha256: sha2564, bytes, tarballAbs } = packOnce({
+  const { filename, sha256: sha2563, bytes, tarballAbs } = packOnce({
     repoDir,
     distDir,
     ...o.env !== void 0 ? { env: o.env } : {},
@@ -39149,7 +39149,7 @@ async function runNpmArtifactStage(o) {
     ...o.npmTimeoutMs !== void 0 ? { npmTimeoutMs: o.npmTimeoutMs } : {}
   });
   const findings = [];
-  const extractDir = join10(stateDir, "tmp", sha2564.slice(0, 8));
+  const extractDir = join10(stateDir, "tmp", sha2563.slice(0, 8));
   rmSync3(extractDir, { recursive: true, force: true });
   mkdirSync3(extractDir, { recursive: true });
   try {
@@ -39254,7 +39254,7 @@ async function runNpmArtifactStage(o) {
   if (publint !== null) findings.push(publint);
   return {
     findings,
-    artifact: { file: `${BORDER_STATE_DIR}/dist/${filename}`, sha256: sha2564, bytes }
+    artifact: { file: `${BORDER_STATE_DIR}/dist/${filename}`, sha256: sha2563, bytes }
   };
 }
 
@@ -40354,9 +40354,9 @@ async function runRubygemsArtifactStage(o) {
     throw new EngineRunError(`gem build produced no ${gemName} in ${relative3(repoDir, distDir)} \u2014 failing closed (was the gemspec's literal name/version re-read?)`, null);
   }
   const bytes = readFileSync7(dist);
-  const sha2564 = createHash6("sha256").update(bytes).digest("hex");
+  const sha2563 = createHash6("sha256").update(bytes).digest("hex");
   const findings = [];
-  const extractDir = join12(stateDir, "tmp", sha2564.slice(0, 8));
+  const extractDir = join12(stateDir, "tmp", sha2563.slice(0, 8));
   rmSync4(extractDir, { recursive: true, force: true });
   mkdirSync4(extractDir, { recursive: true });
   const dataDir = `${extractDir}-data`;
@@ -40434,7 +40434,7 @@ async function runRubygemsArtifactStage(o) {
   }
   return {
     findings,
-    artifact: { file: `${BORDER_STATE_DIR}/dist/${gemName}`, sha256: sha2564, bytes: bytes.length }
+    artifact: { file: `${BORDER_STATE_DIR}/dist/${gemName}`, sha256: sha2563, bytes: bytes.length }
   };
 }
 
@@ -41996,9 +41996,9 @@ async function runCargoArtifactStage(o) {
     const dist = join18(distDir, crateName);
     renameSync(packed, dist);
     const bytes = readFileSync11(dist);
-    const sha2564 = createHash11("sha256").update(bytes).digest("hex");
+    const sha2563 = createHash11("sha256").update(bytes).digest("hex");
     const findings = [];
-    const extractDir = join18(stateDir, "tmp", sha2564.slice(0, 8));
+    const extractDir = join18(stateDir, "tmp", sha2563.slice(0, 8));
     rmSync8(extractDir, { recursive: true, force: true });
     mkdirSync8(extractDir, { recursive: true });
     try {
@@ -42051,7 +42051,7 @@ async function runCargoArtifactStage(o) {
     }
     return {
       findings,
-      artifact: { file: `${BORDER_STATE_DIR}/dist/${crateName}`, sha256: sha2564, bytes: bytes.length }
+      artifact: { file: `${BORDER_STATE_DIR}/dist/${crateName}`, sha256: sha2563, bytes: bytes.length }
     };
   } finally {
     rmSync8(targetDir, { recursive: true, force: true });
@@ -44482,43 +44482,551 @@ async function runLlmRequest(ctx) {
 }
 
 // src/commands/opencode.ts
+import { existsSync as existsSync22, lstatSync, mkdirSync as mkdirSync12, readFileSync as readFileSync20, rmSync as rmSync13, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname16, join as join31 } from "node:path";
+import { fileURLToPath as fileURLToPath6 } from "node:url";
+
+// src/opencode/inspect.ts
+import { existsSync as existsSync21, readFileSync as readFileSync19 } from "node:fs";
+import { join as join30 } from "node:path";
+
+// src/opencode/jsonconfig.ts
+import { existsSync as existsSync19, readdirSync as readdirSync10, readFileSync as readFileSync18 } from "node:fs";
+import { join as join29 } from "node:path";
+
+// src/opencode/contract.ts
 import { createHash as createHash17 } from "node:crypto";
-import { existsSync as existsSync18, lstatSync, mkdirSync as mkdirSync12, readFileSync as readFileSync18, rmSync as rmSync13, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync18 } from "node:fs";
 import os3 from "node:os";
 import { dirname as dirname15, join as join28 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 var PLUGIN_MARKER = "// border-opencode-plugin v";
 var COMMAND_MARKER = "<!-- border-opencode-command -->";
+var BORDER_PACKAGE = "border-customs";
+var DEFAULT_REGISTRY_BASE = "https://registry.npmjs.org";
+var REGISTRY_TIMEOUT_MS2 = 15e3;
+function sha256Hex3(bytes) {
+  return createHash17("sha256").update(bytes).digest("hex");
+}
+function firstLine(bytes) {
+  const text = bytes.toString("utf8");
+  const newline = text.indexOf("\n");
+  return newline < 0 ? text : text.slice(0, newline);
+}
 function opencodeConfigRoot(env2) {
   const xdg = env2["XDG_CONFIG_HOME"] ?? "";
   if (xdg.length > 0) return xdg;
   const home = env2["HOME"] ?? "";
   return join28(home.length > 0 ? home : os3.homedir(), ".config");
 }
-function resolvePluginAsset(moduleUrl, fileName) {
+function opencodeCacheRoot(env2) {
+  const xdg = env2["XDG_CACHE_HOME"] ?? "";
+  const base = xdg.length > 0 ? xdg : join28(env2["HOME"] ?? os3.homedir(), ".cache");
+  return join28(base, "opencode", "packages");
+}
+function routeAPluginPath(env2) {
+  return join28(opencodeConfigRoot(env2), "opencode", "plugins", "border.ts");
+}
+function packagedAssetPath(moduleUrl, fileName) {
   const here = dirname15(fileURLToPath5(moduleUrl));
   const candidates = [
     join28(here, "..", "plugin", fileName),
-    // dist mode (bundled): <root>/plugin/<f>
+    // dist (bundled) mode: <root>/plugin/<f>
     join28(here, "..", "..", "plugin", fileName)
     // src mode: <root>/plugin/<f>
   ];
   return candidates.find((p) => existsSync18(p)) ?? candidates[1];
 }
-function targetsFor(env2) {
-  const root = join28(opencodeConfigRoot(env2), "opencode");
-  return [
-    { fileName: "border.ts", destination: join28(root, "plugins", "border.ts"), marker: PLUGIN_MARKER },
-    { fileName: "border-command.md", destination: join28(root, "commands", "border.md"), marker: COMMAND_MARKER }
+function packagedDistEntry(moduleUrl) {
+  const here = dirname15(fileURLToPath5(moduleUrl));
+  const candidates = [
+    join28(here, "index.js"),
+    // dist (bundled) mode: <root>/dist/index.js
+    join28(here, "..", "dist", "index.js"),
+    // src/opencode mode one level under root
+    join28(here, "..", "..", "dist", "index.js")
+    // src mode: <root>/dist/index.js
   ];
+  return candidates.find((p) => existsSync18(p)) ?? candidates[2];
 }
-function sha2563(bytes) {
-  return createHash17("sha256").update(bytes).digest("hex");
+
+// src/opencode/jsonconfig.ts
+function stripJsoncComments(text) {
+  let out = "";
+  let inString = false;
+  let inLine = false;
+  let inBlock = false;
+  for (let i = 0; i < text.length; i += 1) {
+    const ch = text[i];
+    const next = text[i + 1] ?? "";
+    if (inLine) {
+      if (ch === "\n") {
+        inLine = false;
+        out += ch;
+      }
+      continue;
+    }
+    if (inBlock) {
+      if (ch === "*" && next === "/") {
+        inBlock = false;
+        i += 1;
+        out += " ";
+      }
+      continue;
+    }
+    if (inString) {
+      if (ch === "\\") {
+        out += ch + next;
+        i += 1;
+        continue;
+      }
+      if (ch === '"') inString = false;
+      out += ch;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      out += ch;
+      continue;
+    }
+    if (ch === "/" && next === "/") {
+      inLine = true;
+      i += 1;
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      inBlock = true;
+      i += 1;
+      continue;
+    }
+    out += ch;
+  }
+  return out;
 }
-function firstLine(bytes) {
-  const text = bytes.toString("utf8");
-  const newline = text.indexOf("\n");
-  return newline < 0 ? text : text.slice(0, newline);
+function parseJsonc(text) {
+  return JSON.parse(stripJsoncComments(text).replace(/,(\s*[}\]])/g, "$1"));
+}
+var isRecord2 = (v) => typeof v === "object" && v !== null;
+function splitNpmSpec(entry) {
+  const at = entry.lastIndexOf("@");
+  if (at <= 0) return { name: entry, spec: null };
+  return { name: entry.slice(0, at), spec: entry.slice(at + 1) };
+}
+function readPluginDeclarations(path4, pkg) {
+  const none = { path: path4, status: "absent", specs: [] };
+  let text;
+  try {
+    if (!existsSync19(path4)) return none;
+    text = readFileSync18(path4, "utf8");
+  } catch {
+    return { path: path4, status: "error", specs: [] };
+  }
+  let parsed;
+  try {
+    parsed = parseJsonc(text);
+  } catch {
+    return { path: path4, status: "error", specs: [] };
+  }
+  if (!isRecord2(parsed)) return { path: path4, status: "error", specs: [] };
+  const plugin = Array.isArray(parsed["plugin"]) ? parsed["plugin"] : [];
+  const specs = plugin.filter((e) => typeof e === "string" && splitNpmSpec(e).name === pkg);
+  return { path: path4, status: "ok", specs };
+}
+function listCacheDirs(cacheRoot, pkg) {
+  let names;
+  try {
+    names = readdirSync10(cacheRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith(`${pkg}@`)).map((e) => e.name).sort();
+  } catch {
+    return [];
+  }
+  return names.map((name) => {
+    const pkgRoot = join29(cacheRoot, name, "node_modules", pkg);
+    let packageVersion = null;
+    try {
+      const meta3 = parseJsonc(readFileSync18(join29(pkgRoot, "package.json"), "utf8"));
+      if (isRecord2(meta3) && typeof meta3["version"] === "string") packageVersion = meta3["version"];
+    } catch {
+      packageVersion = null;
+    }
+    let markerLine = null;
+    try {
+      markerLine = firstLine(readFileSync18(join29(pkgRoot, "plugin", "border.ts")));
+    } catch {
+      markerLine = null;
+    }
+    const markerVersion = markerLine !== null && markerLine.startsWith(PLUGIN_MARKER) ? markerLine.slice(PLUGIN_MARKER.length).trim() : null;
+    return { dir: join29(cacheRoot, name), tag: name.slice(pkg.length + 1), packageVersion, markerVersion, markerLine };
+  });
+}
+
+// src/opencode/aspects/cacheVersion.ts
+var isExactVersion = (spec) => /^\d+\.\d+\.\d+([-+].*)?$/.test(spec);
+function verifyCacheVersion(facts) {
+  const id = "cache-version";
+  const { cacheDirs, configs, cacheRoot, pkg } = facts;
+  const errored = configs.filter((c) => c.status === "error").map((c) => c.path);
+  const declared = configs.some((c) => c.specs.length > 0);
+  const where = configs.map((c) => `${c.path} [${c.status}]`).join(", ");
+  if (cacheDirs.length === 0) {
+    if (errored.length > 0) {
+      return { id, verdict: "CANNOT", detail: `no cache directory under ${cacheRoot} and the configuration is unreadable (${errored.join(", ")}) \u2014 cannot tell whether a Route-B load is claimed` };
+    }
+    if (declared) {
+      return { id, verdict: "CANNOT", detail: `NOT-CACHED: ${pkg} is declared (${configs.flatMap((c) => [...c.specs]).join(", ")}) but no cache directory exists under ${cacheRoot} \u2014 the load claim has no bytes behind it` };
+    }
+    return { id, verdict: "PASS", detail: `no ${pkg} cache directory under ${cacheRoot} and none declared (${where}) \u2014 Route B not in use, nothing to be stale` };
+  }
+  const pins = new Set(
+    configs.flatMap((c) => [...c.specs]).map((s) => splitNpmSpec(s).spec).filter((s) => s !== null && isExactVersion(s))
+  );
+  const problems = [];
+  for (const d of cacheDirs) {
+    if (d.packageVersion === null) {
+      problems.push(`${d.dir}: package.json missing or unreadable`);
+    }
+    if (d.markerLine === null) {
+      problems.push(`${d.dir}: plugin/border.ts missing or unreadable in the cached package`);
+    } else if (d.markerVersion === null) {
+      problems.push(`${d.dir}: plugin/border.ts first line lacks the marker '${PLUGIN_MARKER}'`);
+    } else if (d.packageVersion !== null && d.markerVersion !== d.packageVersion) {
+      problems.push(`${d.dir}: marker says ${d.markerVersion}, package.json says ${d.packageVersion}`);
+    }
+    if (pins.has(d.tag) && d.packageVersion !== null && d.packageVersion !== d.tag) {
+      problems.push(`${d.dir}: cached under exact spec '${d.tag}' but the package reports ${d.packageVersion}`);
+    }
+  }
+  if (problems.length > 0) {
+    return { id, verdict: "FAIL", detail: problems.join("; ") };
+  }
+  return {
+    id,
+    verdict: "PASS",
+    detail: `cache self-consistent: ${cacheDirs.map((d) => `${d.tag}->${d.packageVersion ?? "?"}`).join(", ")}`
+  };
+}
+
+// src/opencode/aspects/dualRoute.ts
+function verifyDualRoute(facts) {
+  const id = "dual-route";
+  const { configs, routeAInstalled, routeAPlugin, pkg } = facts;
+  const errored = configs.filter((c) => c.status === "error").map((c) => c.path);
+  if (errored.length > 0) {
+    return { id, verdict: "CANNOT", detail: `configuration unreadable (${errored.join(", ")}) \u2014 Route B presence cannot be counted` };
+  }
+  const declared = configs.flatMap((c) => [...c.specs]);
+  const hasB = declared.length > 0;
+  if (routeAInstalled && hasB) {
+    return {
+      id,
+      verdict: "FAIL",
+      detail: `both routes registered: Route A drop at ${routeAPlugin} AND Route B declaration ${declared.map((d) => `'${d}'`).join(", ")} \u2014 pick exactly one route (the dual-registration window blueprint \xA77 forbids)`
+    };
+  }
+  if (routeAInstalled) {
+    return { id, verdict: "PASS", detail: `Route A only: drop at ${routeAPlugin}, no ${pkg} config declaration` };
+  }
+  if (hasB) {
+    return { id, verdict: "PASS", detail: `Route B only: ${declared.map((d) => `'${d}'`).join(", ")}, no file drop at ${routeAPlugin}` };
+  }
+  return { id, verdict: "PASS", detail: "neither route registered \u2014 no border plugin load claimed on the V1 surface" };
+}
+
+// src/opencode/aspects/identity.ts
+import { execFile } from "node:child_process";
+import { existsSync as existsSync20 } from "node:fs";
+var HANDSHAKE_ARGV = ["--help"];
+var HANDSHAKE_BANNER_PREFIX = "border";
+var HANDSHAKE_USAGE_NEEDLE = "usage: border";
+var HANDSHAKE_TIMEOUT_MS = 2e4;
+var MAX_OUTPUT_BYTES = 64 * 1024;
+var defaultInspectRunner = (target, argv) => new Promise((resolve20) => {
+  execFile(
+    target.bin,
+    [...target.prefix, ...argv],
+    { timeout: HANDSHAKE_TIMEOUT_MS, maxBuffer: MAX_OUTPUT_BYTES, shell: false },
+    (error61, stdout, stderr) => {
+      const out = stdout.slice(0, MAX_OUTPUT_BYTES);
+      const err = stderr.slice(0, MAX_OUTPUT_BYTES);
+      if (error61 === null) {
+        resolve20({ status: 0, stdout: out, stderr: err });
+        return;
+      }
+      const failure = error61;
+      if (failure.code === "ENOENT" || failure.code === "EACCES" || failure.code === "ENOEXEC") {
+        resolve20({ status: null, stdout: out, stderr: err });
+        return;
+      }
+      const status = typeof failure.code === "number" ? failure.code : failure.killed === true || failure.signal != null ? 124 : -1;
+      resolve20({ status, stdout: out, stderr: err });
+    }
+  );
+});
+function passesHandshake(outcome) {
+  if (outcome.status !== 0) return false;
+  const firstLine2 = (outcome.stdout.match(/^\s*(.*)/) ?? ["", ""])[1] ?? "";
+  return firstLine2.startsWith(HANDSHAKE_BANNER_PREFIX) && outcome.stdout.includes(HANDSHAKE_USAGE_NEEDLE);
+}
+function identityCandidates(env2, distEntry) {
+  const configured = env2["BORDER_BIN"];
+  if (configured !== void 0 && configured.length > 0) {
+    return [{ bin: configured, prefix: [], label: `BORDER_BIN=${configured}` }];
+  }
+  const candidates = [];
+  if (existsSync20(distEntry)) {
+    candidates.push({ bin: distEntry, prefix: [], label: "packaged dist/index.js (shebang exec)" });
+    candidates.push({ bin: "node", prefix: [distEntry], label: "packaged dist/index.js under PATH node" });
+  }
+  candidates.push({ bin: "border", prefix: [], label: "border on PATH" });
+  return candidates;
+}
+async function verifyIdentity(deps) {
+  const id = "identity-handshake";
+  const runner = deps.runner ?? defaultInspectRunner;
+  const candidates = identityCandidates(deps.env, deps.distEntry);
+  const reasons = [];
+  let anySpawned = false;
+  for (const candidate of candidates) {
+    const probe = await runner(candidate, HANDSHAKE_ARGV);
+    if (passesHandshake(probe)) {
+      return { id, verdict: "PASS", detail: `${candidate.label} passed the identity handshake` };
+    }
+    if (probe.status !== null) {
+      anySpawned = true;
+      reasons.push(`${candidate.label}: spawned but --help did not answer as border (impostor?)`);
+    } else {
+      reasons.push(`${candidate.label}: unspawnable (ENOENT/EACCES/ENOEXEC)`);
+    }
+  }
+  if (anySpawned) {
+    return { id, verdict: "FAIL", detail: `a border binary was reachable but failed the identity handshake \u2014 impersonation shape: ${reasons.join("; ")}` };
+  }
+  return { id, verdict: "CANNOT", detail: `no border binary reachable \u2014 tried: ${reasons.join("; ")}` };
+}
+
+// src/opencode/aspects/routeA.ts
+function verifyRouteAParity(facts) {
+  const id = "route-a-parity";
+  const { routeAPlugin, routeAInstalled } = facts;
+  if (!routeAInstalled) {
+    return { id, verdict: "PASS", detail: `${routeAPlugin}: absent \u2014 Route A not installed, nothing to be stale` };
+  }
+  if (facts.packagedPlugin === null) {
+    return { id, verdict: "CANNOT", detail: "the packaged plugin asset is unreadable \u2014 the border install itself looks broken, parity cannot be judged" };
+  }
+  const installed = facts.routeABytes;
+  if (installed === null) {
+    return { id, verdict: "CANNOT", detail: `${routeAPlugin}: present but unreadable \u2014 parity cannot be judged` };
+  }
+  const installedSha = sha256Hex3(installed);
+  const packagedSha = sha256Hex3(facts.packagedPlugin);
+  if (installedSha === packagedSha) {
+    return { id, verdict: "PASS", detail: `${routeAPlugin}: up-to-date installed=${installedSha} packaged=${packagedSha}` };
+  }
+  const ours = firstLine(installed).startsWith(PLUGIN_MARKER);
+  const shape = ours ? "outdated (marker ours, bytes differ)" : "foreign (first line lacks the marker)";
+  return { id, verdict: "FAIL", detail: `${routeAPlugin}: ${shape} installed=${installedSha} packaged=${packagedSha}` };
+}
+
+// src/opencode/aspects/scope.ts
+var SCOPE_ID = "scope";
+var SCOPE_NAME = "v1-load-surface";
+var SCOPE_UNCOVERED = [
+  "V2 project-local .opencode/plugins/",
+  "V2 npm-prefix/node_modules installs",
+  "V2 lazy activation state"
+];
+function verifyScope() {
+  return {
+    id: SCOPE_ID,
+    verdict: "PASS",
+    detail: `verdict scope = ${SCOPE_NAME}; NOT covered (declared blind, separate ledger item): ${SCOPE_UNCOVERED.join(", ")}`
+  };
+}
+
+// src/opencode/registry.ts
+var isRecord3 = (v) => typeof v === "object" && v !== null;
+var defaultRegistryFetcher = async (url2, init) => {
+  if (!/^https?:\/\//.test(url2)) throw new Error(`border opencode inspect refuses non-http(s) URL: ${url2}`);
+  const res = await fetch(url2, {
+    redirect: "follow",
+    signal: init.signal,
+    headers: { "user-agent": "border-customs (+https://github.com/TachikomaGundam/Border-Customs; border opencode inspect)" }
+  });
+  const raw = res.headers.get("content-length");
+  const parsed = raw === null ? Number.NaN : Number(raw);
+  return {
+    status: res.status,
+    contentLength: Number.isFinite(parsed) && parsed >= 0 ? parsed : null,
+    chunks: () => {
+      if (res.body === null) {
+        return {
+          async *[Symbol.asyncIterator]() {
+          }
+        };
+      }
+      return res.body;
+    }
+  };
+};
+function npmTagUrl(pkg, tag, base = DEFAULT_REGISTRY_BASE) {
+  const enc = pkg.startsWith("@") ? pkg.replace("/", "%2F") : encodeURIComponent(pkg);
+  return `${base}/${enc}/${encodeURIComponent(tag)}`;
+}
+var REGISTRY_BODY_CAP = 8 * 1024 * 1024;
+async function fetchRegistryVersion(fetcher, url2, timeoutMs) {
+  const res = await fetcher(url2, { signal: AbortSignal.timeout(timeoutMs) });
+  if (res.status !== 200) throw new Error(`HTTP ${String(res.status)} from ${url2}`);
+  const parts = [];
+  let total = 0;
+  for await (const chunk of res.chunks()) {
+    total += chunk.byteLength;
+    if (total > REGISTRY_BODY_CAP) throw new Error(`${url2} exceeds the ${String(REGISTRY_BODY_CAP)} B metadata cap`);
+    parts.push(Buffer.from(chunk));
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.concat(parts).toString("utf8"));
+  } catch {
+    throw new Error(`metadata response from ${url2} is not valid JSON`);
+  }
+  if (!isRecord3(parsed) || typeof parsed["version"] !== "string" || parsed["version"].length === 0) {
+    throw new Error(`metadata response from ${url2} carries no "version" string`);
+  }
+  return parsed["version"];
+}
+
+// src/opencode/aspects/specFreshness.ts
+var isExactVersion2 = (spec) => /^\d+\.\d+\.\d+([-+].*)?$/.test(spec);
+async function verifySpecFreshness(facts, deps = {}) {
+  const id = "spec-freshness";
+  const { configs, cacheDirs, pkg } = facts;
+  const errored = configs.filter((c) => c.status === "error").map((c) => c.path);
+  if (errored.length > 0) {
+    return { id, verdict: "CANNOT", detail: `configuration unreadable (${errored.join(", ")}) \u2014 the expected version cannot be determined` };
+  }
+  const specs = [...new Set(configs.flatMap((c) => [...c.specs]).map((s) => splitNpmSpec(s).spec).filter((s) => s !== null))];
+  if (specs.length === 0) {
+    return { id, verdict: "PASS", detail: `no ${pkg} spec declared in opencode config \u2014 nothing to be fresh` };
+  }
+  const expected = /* @__PURE__ */ new Map();
+  const fetcher = deps.fetcher ?? defaultRegistryFetcher;
+  const timeoutMs = deps.timeoutMs ?? REGISTRY_TIMEOUT_MS2;
+  for (const spec of specs) {
+    if (isExactVersion2(spec)) {
+      expected.set(spec, spec);
+      continue;
+    }
+    try {
+      expected.set(spec, await fetchRegistryVersion(fetcher, npmTagUrl(pkg, spec, deps.registryBase), timeoutMs));
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return { id, verdict: "CANNOT", detail: `registry unreachable for spec '${pkg}@${spec}': ${message} \u2014 border never reads silence as fresh` };
+    }
+  }
+  if (cacheDirs.length === 0) {
+    return { id, verdict: "PASS", detail: `nothing cached to compare (see cache-version); spec resolves to ${[...new Set(expected.values())].join(", ")}` };
+  }
+  const wanted = new Set(expected.values());
+  const judged = cacheDirs.filter((d) => d.packageVersion !== null);
+  const stale = judged.filter((d) => !wanted.has(d.packageVersion));
+  if (judged.length > 0 && stale.length > 0) {
+    return {
+      id,
+      verdict: "FAIL",
+      detail: `cache holds ${stale.map((d) => `${d.tag}->${d.packageVersion}`).join(",")}, spec expects ${[...wanted].join(",")}`
+    };
+  }
+  return { id, verdict: "PASS", detail: `cache matches spec: ${[...wanted].join(",")}` };
+}
+
+// src/opencode/inspect.ts
+function aggregateVerdict(aspects) {
+  if (aspects.some((a) => a.verdict === "FAIL")) return "FAIL";
+  if (aspects.some((a) => a.verdict === "CANNOT")) return "CANNOT";
+  return "PASS";
+}
+function inspectExit(verdict) {
+  switch (verdict) {
+    case "FAIL":
+      return EXIT_BLOCKED;
+    case "CANNOT":
+      return EXIT_ERROR;
+    case "PASS":
+      return EXIT_PASS;
+  }
+}
+function readPackagedPlugin(path4) {
+  try {
+    return readFileSync19(path4);
+  } catch {
+    return null;
+  }
+}
+function gatherFacts(env2, cwd, deps) {
+  const pkg = deps.package ?? BORDER_PACKAGE;
+  const pluginDrop = routeAPluginPath(env2);
+  const cacheRoot = deps.cacheRoot ?? opencodeCacheRoot(env2);
+  const globalPath = deps.globalConfigPath ?? join30(opencodeConfigRoot(env2), "opencode", "opencode.jsonc");
+  const routeAInstalled = existsSync21(pluginDrop);
+  return {
+    pkg,
+    env: env2,
+    cacheRoot,
+    cacheDirs: listCacheDirs(cacheRoot, pkg),
+    configs: [readPluginDeclarations(globalPath, pkg), readPluginDeclarations(join30(cwd, "opencode.jsonc"), pkg)],
+    packagedPlugin: readPackagedPlugin(packagedAssetPath(import.meta.url, "border.ts")),
+    routeAPlugin: pluginDrop,
+    routeAInstalled,
+    routeABytes: routeAInstalled ? readPackagedPlugin(pluginDrop) : null
+  };
+}
+async function runInspectCore(ctx, deps = {}) {
+  const facts = gatherFacts(ctx.env, ctx.cwd, deps);
+  const aspects = [
+    verifyCacheVersion(facts),
+    await verifySpecFreshness(facts, {
+      ...deps.registryFetcher !== void 0 ? { fetcher: deps.registryFetcher } : {},
+      ...deps.registryBase !== void 0 ? { registryBase: deps.registryBase } : {}
+    }),
+    await verifyIdentity({
+      ...deps.runner !== void 0 ? { runner: deps.runner } : {},
+      distEntry: deps.distEntry ?? packagedDistEntry(import.meta.url),
+      env: facts.env
+    }),
+    verifyRouteAParity(facts),
+    verifyDualRoute(facts),
+    verifyScope()
+  ];
+  const verdict = aggregateVerdict(aspects);
+  const report = { schemaVersion: 1, scope: "v1", verdict, aspects };
+  if (ctx.flags.json) {
+    ctx.stdout(JSON.stringify(report));
+  } else {
+    ctx.stdout(`border opencode inspect [${report.scope}] ${verdict}`);
+    for (const a of aspects) {
+      ctx.stdout(`  ${a.verdict.padEnd(6)} ${a.id}: ${a.detail}`);
+    }
+  }
+  return inspectExit(verdict);
+}
+
+// src/commands/opencode.ts
+function resolvePluginAsset(moduleUrl, fileName) {
+  const here = dirname16(fileURLToPath6(moduleUrl));
+  const candidates = [
+    join31(here, "..", "plugin", fileName),
+    // dist mode (bundled): <root>/plugin/<f>
+    join31(here, "..", "..", "plugin", fileName)
+    // src mode: <root>/plugin/<f>
+  ];
+  return candidates.find((p) => existsSync22(p)) ?? candidates[1];
+}
+function targetsFor(env2) {
+  const root = join31(opencodeConfigRoot(env2), "opencode");
+  return [
+    { fileName: "border.ts", destination: join31(root, "plugins", "border.ts"), marker: PLUGIN_MARKER },
+    { fileName: "border-command.md", destination: join31(root, "commands", "border.md"), marker: COMMAND_MARKER }
+  ];
 }
 function carriesMarker(bytes, marker) {
   return firstLine(bytes).startsWith(marker);
@@ -44530,7 +45038,7 @@ function fail(ctx, message) {
 function readPackagedAsset(ctx, fileName) {
   const source = resolvePluginAsset(import.meta.url, fileName);
   try {
-    return readFileSync18(source);
+    return readFileSync20(source);
   } catch {
     ctx.stderr(`border: opencode: packaged asset is missing (${source})`);
     ctx.stderr("border: opencode: the border install looks broken \u2014 `npm i -g border-customs` or a fresh checkout should carry plugin/.");
@@ -44539,7 +45047,7 @@ function readPackagedAsset(ctx, fileName) {
 }
 function readTarget(destination) {
   try {
-    return readFileSync18(destination);
+    return readFileSync20(destination);
   } catch {
     return null;
   }
@@ -44606,7 +45114,7 @@ function opencodeInstall(ctx) {
       ctx.stdout(`${target.destination}: up to date`);
       continue;
     }
-    mkdirSync12(dirname15(target.destination), { recursive: true });
+    mkdirSync12(dirname16(target.destination), { recursive: true });
     writeFileSync8(target.destination, packaged);
     ctx.stdout(`${target.destination}: ${state === "outdated" ? "updated" : "installed"}`);
   }
@@ -44620,8 +45128,8 @@ function opencodeStatus(ctx) {
   for (const { target, packaged } of prepared) {
     const current = readTarget(target.destination);
     const state = classify(target, current, packaged);
-    const installedSha = current === null ? "-" : sha2563(current);
-    ctx.stdout(`${target.destination}: ${state}  installed=${installedSha}  packaged=${sha2563(packaged)}`);
+    const installedSha = current === null ? "-" : sha256Hex3(current);
+    ctx.stdout(`${target.destination}: ${state}  installed=${installedSha}  packaged=${sha256Hex3(packaged)}`);
   }
   return EXIT_PASS;
 }
@@ -44648,23 +45156,27 @@ function opencodeUninstall(ctx) {
   return EXIT_PASS;
 }
 function runOpencode(ctx) {
-  const [sub, ...rest] = ctx.positionals;
-  if (rest.length > 0) {
-    throw new UnknownArgError(
-      `opencode ${sub ?? "<none>"}: unexpected argument '${rest[0] ?? ""}' \u2014 usage: border opencode install | status | uninstall`
-    );
-  }
+  const [sub, ...restAll] = ctx.positionals;
+  const rest = restAll.filter((arg) => arg !== "--json");
+  const USAGE = "usage: border opencode install | status | uninstall | inspect";
   switch (sub) {
     case "install":
-      return opencodeInstall(ctx);
     case "status":
-      return opencodeStatus(ctx);
     case "uninstall":
-      return opencodeUninstall(ctx);
+    case "inspect": {
+      if (rest.length > 0) {
+        throw new UnknownArgError(`opencode ${sub}: unexpected argument '${rest[0] ?? ""}' \u2014 ${USAGE}`);
+      }
+      const table2 = {
+        install: opencodeInstall,
+        status: opencodeStatus,
+        uninstall: opencodeUninstall,
+        inspect: runInspectCore
+      };
+      return table2[sub](ctx);
+    }
     default:
-      throw new UnknownArgError(
-        `opencode: unknown subcommand '${sub ?? "<none>"}' \u2014 usage: border opencode install | status | uninstall`
-      );
+      throw new UnknownArgError(`opencode: unknown subcommand '${sub ?? "<none>"}' \u2014 ${USAGE}`);
   }
 }
 
@@ -44768,7 +45280,7 @@ function confirmRemoteBranch(i) {
 import { spawnSync as spawnSync18 } from "node:child_process";
 import { mkdtempSync as mkdtempSync6, rmSync as rmSync14 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { dirname as dirname16, join as join29, resolve as resolve18 } from "node:path";
+import { dirname as dirname17, join as join32, resolve as resolve18 } from "node:path";
 var LANDINGS_REF_PREFIX = "refs/border-landings/";
 async function runLandingVerification(o) {
   if (o.legs.length === 0) return null;
@@ -44818,7 +45330,7 @@ function gitPlain(repoDir, env2, args) {
   for (const [name, value] of Object.entries(env2)) {
     if (!name.startsWith("GIT_")) clean[name] = value;
   }
-  clean.GIT_CEILING_DIRECTORIES = dirname16(resolve18(repoDir));
+  clean.GIT_CEILING_DIRECTORIES = dirname17(resolve18(repoDir));
   clean.GIT_OPTIONAL_LOCKS = "0";
   clean.GIT_TERMINAL_PROMPT = "0";
   const r = spawnSync18("git", ["-C", resolve18(repoDir), ...args], { encoding: "utf8", env: clean, timeout: 55e3, maxBuffer: 32 * 1024 * 1024 });
@@ -44843,7 +45355,7 @@ async function defaultScanRemoteTip(o, remote, branch, remoteSha) {
       ownedTempRef = landingRef;
       rev = git.run(["rev-parse", landingRef]).trim();
     }
-    const treeRoot = mkdtempSync6(join29(tmpdir4(), "border-landing-tree-"));
+    const treeRoot = mkdtempSync6(join32(tmpdir4(), "border-landing-tree-"));
     try {
       return await scanTipTree(git, treeRoot, rev, o.env);
     } finally {
@@ -45052,14 +45564,14 @@ async function executeYesPush(ctx, loaded) {
 import { mkdtempSync as mkdtempSync7, rmSync as rmSync15, writeFileSync as writeFileSync9 } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { tmpdir as tmpdir5 } from "node:os";
-import { join as join30 } from "node:path";
+import { join as join33 } from "node:path";
 
 // src/scan/fetch.ts
 import { createHash as createHash18 } from "node:crypto";
 import { basename as basename5 } from "node:path";
 var SCAN_MAX_ARTIFACT_BYTES = 200 * 1024 * 1024;
 var SCAN_REQUEST_TIMEOUT_MS = 6e4;
-var SCAN_USER_AGENT = "border-customs/0.7.1 (+https://github.com/sumteclab/border; border scan)";
+var SCAN_USER_AGENT = "border-customs/0.8.0 (+https://github.com/sumteclab/border; border scan)";
 var CRATES_DOWNLOAD_HOST = "https://static.crates.io";
 var defaultScanFetcher = async (url2, init) => {
   if (!/^https?:\/\//.test(url2)) throw new EngineRunError(`border scan refuses non-http(s) URL: ${url2}`, null);
@@ -45113,7 +45625,7 @@ async function fetchJson(fetcher, url2, timeoutMs) {
     fail2(`metadata response from ${url2} is not valid JSON`);
   }
 }
-var isRecord2 = (v) => typeof v === "object" && v !== null;
+var isRecord4 = (v) => typeof v === "object" && v !== null;
 function channelBaseUrl(eco) {
   const ch = publishChannels().find((c) => c.id === eco);
   if (ch === void 0 || ch.defaultUrl.length === 0) {
@@ -45144,7 +45656,7 @@ async function fetchArtifact(spec, o) {
   switch (spec.ecosystem) {
     case "npm": {
       const meta3 = await fetchJson(o.fetcher, npmMetadataUrl(spec.name, spec.version), timeoutMs);
-      const dist = isRecord2(meta3) && isRecord2(meta3["dist"]) ? meta3["dist"] : {};
+      const dist = isRecord4(meta3) && isRecord4(meta3["dist"]) ? meta3["dist"] : {};
       const tarball = dist["tarball"];
       if (typeof tarball !== "string" || tarball.length === 0) fail2(`npm metadata for ${label} has no dist.tarball`);
       if (!/^https?:\/\//.test(tarball)) fail2(`npm dist.tarball for ${label} is not an http(s) URL`);
@@ -45155,8 +45667,8 @@ async function fetchArtifact(spec, o) {
     }
     case "pypi": {
       const meta3 = await fetchJson(o.fetcher, pypiMetadataUrl(spec.name, spec.version), timeoutMs);
-      const urls = isRecord2(meta3) && Array.isArray(meta3["urls"]) ? meta3["urls"] : [];
-      const files = urls.filter(isRecord2);
+      const urls = isRecord4(meta3) && Array.isArray(meta3["urls"]) ? meta3["urls"] : [];
+      const files = urls.filter(isRecord4);
       const sdists = files.filter((f) => f["packagetype"] === "sdist");
       const sdist = sdists.find((f) => typeof f["filename"] === "string" && f["filename"].endsWith(".tar.gz"));
       if (sdist === void 0) {
@@ -45184,7 +45696,7 @@ async function fetchArtifact(spec, o) {
     }
   }
 }
-function sha256Hex3(data) {
+function sha256Hex4(data) {
   return createHash18("sha256").update(data).digest("hex");
 }
 
@@ -45228,7 +45740,7 @@ function parseScanSpec(raw) {
 }
 
 // src/roundtrip/localArtifact.ts
-import { createReadStream, existsSync as existsSync19, statSync as statSync3 } from "node:fs";
+import { createReadStream, existsSync as existsSync23, statSync as statSync3 } from "node:fs";
 import { createHash as createHash19 } from "node:crypto";
 import { basename as basename6, resolve as resolve19 } from "node:path";
 var EXT_TABLE = /* @__PURE__ */ new Map([
@@ -45277,7 +45789,7 @@ var GRAMMAR_HINT = {
 };
 function classifyLocalInput(raw, cwd, parsesAsRegistrySpec) {
   const abs = resolve19(cwd, raw);
-  if (existsSync19(abs)) {
+  if (existsSync23(abs)) {
     const st = statSync3(abs);
     if (st.isDirectory()) {
       bad3(`'${raw}' resolves to a directory (${abs}) \u2014 local mode needs a single artifact FILE, not a directory`);
@@ -45636,7 +46148,7 @@ function classifyResidue(label, diff, attribution = null) {
 
 // src/roundtrip/orchestrate.ts
 function containerNameFor(label, rand = randomBytes(3).toString("hex")) {
-  return `rt-${sha256Hex3(label).slice(0, 8)}-${rand}`;
+  return `rt-${sha256Hex4(label).slice(0, 8)}-${rand}`;
 }
 var shArgv = (name) => {
   if (!/^[A-Za-z0-9@._+/-]+$/.test(name)) {
@@ -45757,7 +46269,7 @@ function runPipeline2(exec, profile, spec, label, hostPath, container, closure,
     return {
       findings: classifyResidue(label, diffManifests(m1, m3), attribution),
       installDelta,
-      baselineDigest: sha256Hex3([...m1.keys()].join("\n"))
+      baselineDigest: sha256Hex4([...m1.keys()].join("\n"))
     };
   } finally {
     try {
@@ -45791,12 +46303,12 @@ async function runRoundtripCore(ctx, deps = {}) {
     ctx.stderr("roundtrip: docker unavailable \u2014 cannot verify");
     return EXIT_ERROR;
   }
-  const baseDir = mkdtempSync7(join30(tmpdir5(), "border-roundtrip-"));
+  const baseDir = mkdtempSync7(join33(tmpdir5(), "border-roundtrip-"));
   try {
     const localRead = local !== null ? await readLocalArtifact(local.absPath) : null;
     const bytes = localRead?.bytes ?? (await fetchArtifact(spec, { fetcher: deps.fetcher ?? defaultScanFetcher })).bytes;
-    const artifactSha256 = localRead !== null ? localRead.sha256 : sha256Hex3(bytes);
-    const hostPath = join30(baseDir, "artifact");
+    const artifactSha256 = localRead !== null ? localRead.sha256 : sha256Hex4(bytes);
+    const hostPath = join33(baseDir, "artifact");
     writeFileSync9(hostPath, bytes);
     const container = containerNameFor(label);
     const closure = spec.ecosystem === "pypi" ? resolvePipClosure(exec, profile, hostPath, label, spec) : null;
@@ -45804,12 +46316,12 @@ async function runRoundtripCore(ctx, deps = {}) {
     const verdict = computeVerdict(findings);
     const report = {
       schemaVersion: 1,
-      key: sha256Hex3(`roundtrip:${label}:${baselineDigest}:${verdict}`),
+      key: sha256Hex4(`roundtrip:${label}:${baselineDigest}:${verdict}`),
       head: baselineDigest.slice(0, 40),
       dirty: false,
       exposureSet: [label],
       refSet: [],
-      rulesHash: sha256Hex3(`${profile.image}|${profile.install(profile.artifactPath, spec).join(" ")}|${profile.uninstall(spec).join(" ")}`),
+      rulesHash: sha256Hex4(`${profile.image}|${profile.install(profile.artifactPath, spec).join(" ")}|${profile.uninstall(spec).join(" ")}`),
       verdict,
       counts: countFindings(findings),
       findings,
@@ -45899,7 +46411,7 @@ var runRoundtrip = (ctx) => runRoundtripCore(ctx);
 // src/scan/scan.ts
 import { mkdtempSync as mkdtempSync8 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
-import { join as join32 } from "node:path";
+import { join as join35 } from "node:path";
 
 // src/scan/config.ts
 function buildScanConfigYaml(eco) {
@@ -45926,8 +46438,8 @@ function synthesizeScanConfig(eco) {
 }
 
 // src/scan/materialize.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync13, readdirSync as readdirSync10, readFileSync as readFileSync19, rmSync as rmSync16, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join31 } from "node:path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync13, readdirSync as readdirSync11, readFileSync as readFileSync21, rmSync as rmSync16, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join34 } from "node:path";
 var CRATES_ENVELOPE_FILES = ["Cargo.toml.orig", ".cargo-ok", ".cargo_vcs_info.json"];
 var fail3 = (why) => {
   throw new Error(`border scan cannot materialize the artifact (${why}) \u2014 refusing to stage an unusable tree (fail-closed)`);
@@ -45941,15 +46453,15 @@ function extractFlat(archive, destDir) {
   }
 }
 function unwrapSingleDir(dir) {
-  const entries = readdirSync10(dir, { withFileTypes: true });
+  const entries = readdirSync11(dir, { withFileTypes: true });
   const dirs = entries.filter((e) => e.isDirectory());
   if (entries.length === 1 && dirs.length === 1 && dirs[0] !== void 0) {
-    return join31(dir, dirs[0].name);
+    return join34(dir, dirs[0].name);
   }
   return dir;
 }
 function requireManifest(repoDir, ecosystem, candidates) {
-  if (!candidates.some((rel) => existsSync20(join31(repoDir, rel)))) {
+  if (!candidates.some((rel) => existsSync24(join34(repoDir, rel)))) {
     fail3(`${ecosystem} package tree has none of [${candidates.join(", ")}] at its root`);
   }
 }
@@ -45959,18 +46471,18 @@ function materializePackage(o) {
 `);
   });
   const safe = safeArtifactName(o.filename, `${o.ecosystem}-artifact`);
-  const archive = join31(o.baseDir, safe);
+  const archive = join34(o.baseDir, safe);
   writeFileSync10(archive, o.bytes);
-  const extractDir = join31(o.baseDir, "extract");
+  const extractDir = join34(o.baseDir, "extract");
   mkdirSync13(extractDir, { recursive: true });
   extractFlat(archive, extractDir);
   let repoDir = unwrapSingleDir(extractDir);
   if (o.ecosystem === "rubygems") {
     const outer = repoDir;
     const dataCandidates = findNativeMissArchives(outer).filter((f) => f.endsWith("data.tar.gz"));
-    const inner = dataCandidates[0] ?? join31(outer, "data.tar.gz");
-    if (!existsSync20(inner)) fail3(".gem archive contains no data.tar.gz");
-    const gemTree = join31(o.baseDir, "gem-tree");
+    const inner = dataCandidates[0] ?? join34(outer, "data.tar.gz");
+    if (!existsSync24(inner)) fail3(".gem archive contains no data.tar.gz");
+    const gemTree = join34(o.baseDir, "gem-tree");
     mkdirSync13(gemTree, { recursive: true });
     extractFlat(inner, gemTree);
     repoDir = unwrapSingleDir(gemTree);
@@ -45981,11 +46493,11 @@ function materializePackage(o) {
   } else {
     requireManifest(repoDir, o.ecosystem, ["Cargo.toml"]);
     for (const file2 of CRATES_ENVELOPE_FILES) {
-      const path4 = join31(repoDir, file2);
-      if (!existsSync20(path4)) continue;
-      const original = readFileSync19(path4);
+      const path4 = join34(repoDir, file2);
+      if (!existsSync24(path4)) continue;
+      const original = readFileSync21(path4);
       rmSync16(path4, { force: true });
-      note(`border scan: crates envelope normalized: ${file2} sha256=${sha256Hex3(original)}`);
+      note(`border scan: crates envelope normalized: ${file2} sha256=${sha256Hex4(original)}`);
     }
   }
   const env2 = o.env;
@@ -46011,7 +46523,7 @@ async function runScanCore(ctx, deps = {}) {
   }
   const cfg = synthesizeScanConfig(spec.ecosystem);
   const fetcher = deps.fetcher ?? defaultScanFetcher;
-  const baseDir = mkdtempSync8(join32(tmpdir6(), "border-scan-"));
+  const baseDir = mkdtempSync8(join35(tmpdir6(), "border-scan-"));
   try {
     const { bytes, filename } = await fetchArtifact(spec, { fetcher });
     const env2 = { ...ctx.env };
@@ -46022,12 +46534,12 @@ async function runScanCore(ctx, deps = {}) {
     const verdict = computeVerdict(findings);
     const report = {
       schemaVersion: 1,
-      key: sha256Hex3(`scan:${spec.ecosystem}:${spec.name}@${spec.version}:${head}`),
+      key: sha256Hex4(`scan:${spec.ecosystem}:${spec.name}@${spec.version}:${head}`),
       head,
       dirty: false,
       exposureSet: [`${spec.ecosystem}:${spec.name}@${spec.version}`],
       refSet: [],
-      rulesHash: sha256Hex3(buildScanConfigYaml(spec.ecosystem)),
+      rulesHash: sha256Hex4(buildScanConfigYaml(spec.ecosystem)),
       verdict,
       counts: countFindings(findings),
       findings,
@@ -46168,7 +46680,7 @@ function usage() {
     "  llm-ingest     record provenance captured by the harness",
     "  scan           inspect a third-party package ([ecosystem:]name@version) for residue",
     "  roundtrip      install+uninstall a package (registry spec or local artifact file) in a throwaway container, report uninstall residue",
-    "  opencode       install|status|uninstall the official opencode plugin adapter (files under $XDG_CONFIG_HOME/opencode)",
+    "  opencode       install|status|uninstall|inspect the official opencode plugin adapter (files under $XDG_CONFIG_HOME/opencode; inspect = read-only V1 load-surface audit)",
     "  exfil          read-only exfil-lens scan of <ref|url> [ref...]: tip tree + tag notes (--deep adds reachable-history blobs + commit messages)",
     "",
     "flags:",
@@ -46311,7 +46823,7 @@ function isMainModule({ argv1, moduleUrl, realpath }) {
       return p;
     }
   };
-  return pathToFileURL(canonical(argv1)).href === pathToFileURL(canonical(fileURLToPath6(moduleUrl))).href;
+  return pathToFileURL(canonical(argv1)).href === pathToFileURL(canonical(fileURLToPath7(moduleUrl))).href;
 }
 if (isMainModule({ argv1: process.argv[1], moduleUrl: import.meta.url, realpath: realpathSync.native })) {
   const outcome = run(process.argv.slice(2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "border-customs",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "//": "publint is a runtime dep (exact pin): the npm-stage engine is invoked via bin resolution against the installed layout, so consumers get the publint-fail leg out of the box; the dev suite resolves the same node_modules/.bin/publint — no devDependencies entry is needed for it to stay green.",
   "description": "Fail-closed git push gate: secret scanning + supply-chain checks before any remote leaves the machine",
   "type": "module",

package/plugin/border-command.md

@@ -5,7 +5,7 @@ User request: $ARGUMENTS
 
 Interpret the request as ONE `border` CLI invocation: the first word is the
 command (`check`, `push`, `status`, `llm-request`, `llm-ingest`, `scan`,
-`roundtrip`, or `--help`) and the rest are argv tokens. Call the `border` tool
+`roundtrip`, `exfil`, or `--help`) and the rest are argv tokens. Call the `border` tool
 with `command` set to the first word and `extra` set to the remaining tokens,
 then report the CLI exit code (0 pass / 1 gate-blocked or partial push / 2 gate
 could not answer) and the relevant lines of its output. If no request was given,

package/plugin/border.ts

@@ -1,4 +1,4 @@
-// border-opencode-plugin v0.7.1
+// border-opencode-plugin v0.8.0
 // Official opencode plugin adapter for the border fail-closed push gate.
 // Registers ONE agent tool, `border`, that drives the border CLI — argv-only
 // (node:child_process execFile, never a shell), top-level commands restricted
@@ -65,6 +65,7 @@ const ALLOWED_COMMANDS: readonly string[] = [
   "llm-ingest",
   "scan",
   "roundtrip",
+  "exfil",
   "--help",
 ];
 
@@ -230,7 +231,7 @@ User request: $ARGUMENTS
 
 Interpret the request as ONE \`border\` CLI invocation: the first word is the
 command (\`check\`, \`push\`, \`status\`, \`llm-request\`, \`llm-ingest\`, \`scan\`,
-\`roundtrip\`, or \`--help\`) and the rest are argv tokens. Call the \`border\` tool
+\`roundtrip\`, \`exfil\`, or \`--help\`) and the rest are argv tokens. Call the \`border\` tool
 with \`command\` set to the first word and \`extra\` set to the remaining tokens,
 then report the CLI exit code (0 pass / 1 gate-blocked or partial push / 2 gate
 could not answer) and the relevant lines of its output. If no request was given,
@@ -287,7 +288,7 @@ export interface V2PluginContext {
 const TOOL_DESCRIPTION =
   "Run the border fail-closed push-gate CLI on this machine. " +
   "Pass the top-level command word in `command` (one of: check, push, status, " +
-  "llm-request, llm-ingest, scan, roundtrip, --help) and every remaining argv " +
+  "llm-request, llm-ingest, scan, roundtrip, exfil, --help) and every remaining argv " +
   "token in `extra`. The call is spawned argv-only (no shell) with a 300s " +
   "timeout; the result always ends with the CLI exit code: 0 pass, 1 " +
   "gate-blocked or partial push, 2 gate could not answer. Before running your " +