border-customs 0.7.1 → 0.8.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/README.md +66 -12
  2. package/dist/assets/exfil-src/rules.ts +1 -1
  3. package/dist/assets/exfil-src/rulesPath.ts +28 -0
  4. package/dist/assets/exfil-src/scan.ts +2 -0
  5. package/dist/assets/exfil-src/severity.ts +7 -3
  6. package/dist/assets/package-lock.json +2 -2
  7. package/dist/index.js +1055 -432
  8. package/package.json +1 -1
  9. package/plugin/border-command.md +1 -1
  10. package/plugin/border.ts +4 -3
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "border-customs",
3
- "version": "0.7.1",
3
+ "version": "0.8.1",
4
4
  "//": "publint is a runtime dep (exact pin): the npm-stage engine is invoked via bin resolution against the installed layout, so consumers get the publint-fail leg out of the box; the dev suite resolves the same node_modules/.bin/publint — no devDependencies entry is needed for it to stay green.",
5
5
  "description": "Fail-closed git push gate: secret scanning + supply-chain checks before any remote leaves the machine",
6
6
  "type": "module",
package/plugin/border-command.md CHANGED
@@ -5,7 +5,7 @@ User request: $ARGUMENTS
5
5
 
6
6
  Interpret the request as ONE `border` CLI invocation: the first word is the
7
7
  command (`check`, `push`, `status`, `llm-request`, `llm-ingest`, `scan`,
8
- `roundtrip`, or `--help`) and the rest are argv tokens. Call the `border` tool
8
+ `roundtrip`, `exfil`, or `--help`) and the rest are argv tokens. Call the `border` tool
9
9
  with `command` set to the first word and `extra` set to the remaining tokens,
10
10
  then report the CLI exit code (0 pass / 1 gate-blocked or partial push / 2 gate
11
11
  could not answer) and the relevant lines of its output. If no request was given,
package/plugin/border.ts CHANGED
@@ -1,4 +1,4 @@
1
- // border-opencode-plugin v0.7.1
1
+ // border-opencode-plugin v0.8.1
2
2
  // Official opencode plugin adapter for the border fail-closed push gate.
3
3
  // Registers ONE agent tool, `border`, that drives the border CLI — argv-only
4
4
  // (node:child_process execFile, never a shell), top-level commands restricted
@@ -65,6 +65,7 @@ const ALLOWED_COMMANDS: readonly string[] = [
65
65
  "llm-ingest",
66
66
  "scan",
67
67
  "roundtrip",
68
+ "exfil",
68
69
  "--help",
69
70
  ];
70
71
 
@@ -230,7 +231,7 @@ User request: $ARGUMENTS
230
231
 
231
232
  Interpret the request as ONE \`border\` CLI invocation: the first word is the
232
233
  command (\`check\`, \`push\`, \`status\`, \`llm-request\`, \`llm-ingest\`, \`scan\`,
233
- \`roundtrip\`, or \`--help\`) and the rest are argv tokens. Call the \`border\` tool
234
+ \`roundtrip\`, \`exfil\`, or \`--help\`) and the rest are argv tokens. Call the \`border\` tool
234
235
  with \`command\` set to the first word and \`extra\` set to the remaining tokens,
235
236
  then report the CLI exit code (0 pass / 1 gate-blocked or partial push / 2 gate
236
237
  could not answer) and the relevant lines of its output. If no request was given,
@@ -287,7 +288,7 @@ export interface V2PluginContext {
287
288
  const TOOL_DESCRIPTION =
288
289
  "Run the border fail-closed push-gate CLI on this machine. " +
289
290
  "Pass the top-level command word in `command` (one of: check, push, status, " +
290
- "llm-request, llm-ingest, scan, roundtrip, --help) and every remaining argv " +
291
+ "llm-request, llm-ingest, scan, roundtrip, exfil, --help) and every remaining argv " +
291
292
  "token in `extra`. The call is spawned argv-only (no shell) with a 300s " +
292
293
  "timeout; the result always ends with the CLI exit code: 0 pass, 1 " +
293
294
  "gate-blocked or partial push, 2 gate could not answer. Before running your " +