zigmini 0.8.0-beta.6 → 0.8.0-beta.7

package/scripts/secret-scan.allow.json

@@ -0,0 +1,155 @@
+{
+  "allow": [
+    {"cidr":"127.0.0.0/8","reason":"loopback addresses are not personal"},
+    {"cidr":"0.0.0.0/32","reason":"bind-all address used in listen settings, not a host"},
+    {"cidr":"192.0.2.0/24","reason":"RFC 5737 documentation range (TEST-NET-1)"},
+    {"cidr":"198.51.100.0/24","reason":"RFC 5737 documentation range (TEST-NET-2)"},
+    {"cidr":"203.0.113.0/24","reason":"RFC 5737 documentation range (TEST-NET-3)"},
+    {"cidr":"10.0.2.0/24","reason":"Android emulator NAT range, same on every machine"},
+    {"domain":"example.com","reason":"RFC 2606 reserved example domain"},
+    {"value":"ghp_ZGWsecretSCANallowFIXTURE0000000000000","reason":"secret-scan test fixture: proves allow-listed values are not reported"},
+    {"value":"Abc_-0123456789abcdefghijklmnopqrstuvwxyzAB","reason":"synthetic enrollment token in Android test EnrollmentGuardTest.kt (alphabet sequence, not a credential)"},
+    {"value":"215776236+owen-ever@users.noreply.github.com","reason":"public repository GitHub noreply commit address, not a personal inbox"},
+    {"domain":"example.net","reason":"reserved documentation/test domain; no owner endpoint"},
+    {"domain":"example.org","reason":"reserved documentation/test domain; no owner endpoint"},
+    {"domain":"example.invalid","reason":"reserved documentation/test domain; no owner endpoint"},
+    {"domain":"invalid","reason":"reserved documentation/test domain; no owner endpoint"},
+    {"domain":"test","reason":"reserved documentation/test domain; no owner endpoint"},
+    {"value":"localhost","reason":"loopback hostname, not an owner endpoint"},
+    {"value":"192.168.0.7","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"8.8.8.8","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"10.0.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"10.255.255.255","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"172.16.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"172.31.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"192.168.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"100.64.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"100.127.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"9.0.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"11.0.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"172.15.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"172.32.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"171.16.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"173.16.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"192.167.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"192.169.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"191.168.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"193.168.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"100.63.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"100.128.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"99.64.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"101.64.0.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"fc00::1","rule":"ipv6-internal","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"fdff:ffff::1","rule":"ipv6-internal","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"zig.tail.ts.net","rule":"internal-host","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"mac.local","rule":"internal-host","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"172.31.255.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"192.168.1.10","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"100.127.255.254","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"10.0.0.2","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"10.0.0.9","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"192.168.0.8","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"fd12:3456::1","rule":"ipv6-internal","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"fe80::1","rule":"ipv6-internal","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"zig.tail1234.ts.net","rule":"internal-host","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"mac-mini.local","rule":"internal-host","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"redacted","rule":"internal-url","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"incorrect","rule":"authorization","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"100.101.102.103","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"255.255.255.0","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"192.168.0.9","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"192.168.0.5","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/","CHANGELOG.md"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"10.0.0.7","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"100.64.0.2","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"100.64.0.3","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"101.64.0.2","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"192.168.1.20","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"fd7a:115c::1","rule":"ipv6-internal","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"fd7a::1","rule":"ipv6-internal","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"mac.tail1234.ts.net","rule":"internal-host","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"a.ts.net","rule":"internal-host","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"host.docker.internal","rule":"internal-host","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"h","rule":"internal-url","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"10.9.9.9","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"100.100.1.2","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"172.31.255.255","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"1.1.1.1","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"2.2.2.2","rule":"ipv4","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"fd00::1","rule":"ipv6-internal","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"nope","rule":"authorization","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"fixture-token","rule":"authorization","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"hunter2","rule":"credential-assignment","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"claude-token","rule":"authorization","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"plain","rule":"authorization","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"wrong","rule":"authorization","files":[".omo/evidence/","scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/"],"reason":"synthetic test fixture; exact value in the named tests and their recorded mutation evidence only"},
+    {"value":"host.docker.internal","rule":"internal-host","reason":"Docker built-in host alias shared by all installations, not an owner hostname"},
+    {"value":"i.internal","rule":"internal-host","files":["src/cli/access.ts",".omo/evidence/","scripts/secret-scan.allow.json","src/enroll.ts"],"reason":"NetworkInterfaceInfo boolean property access, not a hostname"},
+    {"value":"string","rule":"device-serial","reason":"TypeScript type annotation, not a device serial"},
+    {"value":"String","rule":"device-serial","reason":"Kotlin type annotation, not a device serial"},
+    {"value":"127.0.0.1","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"203.0.113.5","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"localhost","rule":"internal-url","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"0.0.0.0","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"192.0.2.5","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"10.9.8.7","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"172.19.8.7","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"192.168.8.7","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"100.65.8.7","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"192.0.2.7","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"198.51.100.7","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"203.0.113.7","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"10.0.2.2","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"1.2.3.0","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"1.2.3.4","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"255.255.255.255","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"127.9.8.7","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"127.0.0.0","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"128.0.0.1","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"192.0.2.255","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"192.0.2.0","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"192.0.3.0","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"0.0.0.1","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"8.8.8.9","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"8.8.8.0","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"10.0.2.0","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"10.0.2.15","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"10.0.3.15","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"fd12::7","rule":"ipv6-internal","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"fc12:3456::7","rule":"ipv6-internal","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"fe80::7%en0","rule":"ipv6-internal","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"fe90::7","rule":"ipv6-internal","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"fea0::7","rule":"ipv6-internal","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"feb0::7","rule":"ipv6-internal","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"192.0.2.10","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"127.0.0.2","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"127.0.0.19","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic test input, including address-range boundaries; exact value only in tests and their evidence"},
+    {"value":"5a45f64c493ea432","rule":"device-serial","files":[".omo/evidence/npm-distribution/task-14-npm-distribution.txt","scripts/secret-scan.allow.json"],"reason":"destroyed isolated QA gateway or fake Robolectric gateway; not an owner device or credential"},
+    {"value":"88e1ab9c9b8773d3","rule":"device-serial","files":[".omo/evidence/npm-distribution/task-15-npm-distribution.txt","scripts/secret-scan.allow.json"],"reason":"destroyed isolated QA gateway or fake Robolectric gateway; not an owner device or credential"},
+    {"value":"0b70b55904aff5f2","rule":"device-serial","files":[".omo/evidence/npm-distribution/task-15-npm-distribution.txt","scripts/secret-scan.allow.json"],"reason":"destroyed isolated QA gateway or fake Robolectric gateway; not an owner device or credential"},
+    {"value":"fc00::","rule":"ipv6-internal","files":[".omo/evidence/npm-distribution/task-16-npm-distribution.txt","scripts/secret-scan.allow.json","android/core/src/main/kotlin/dev/zigmini/core/Enrollment.kt"],"reason":"destroyed isolated QA gateway or fake Robolectric gateway; not an owner device or credential"},
+    {"value":"fe80::","rule":"ipv6-internal","files":[".omo/evidence/npm-distribution/task-16-npm-distribution.txt","scripts/secret-scan.allow.json"],"reason":"destroyed isolated QA gateway or fake Robolectric gateway; not an owner device or credential"},
+    {"value":"gw-a.local","rule":"internal-host","files":["scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/",".omo/evidence/"],"reason":"destroyed isolated QA gateway or fake Robolectric gateway; not an owner device or credential"},
+    {"value":"gw-b.local","rule":"internal-host","files":["scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/",".omo/evidence/"],"reason":"destroyed isolated QA gateway or fake Robolectric gateway; not an owner device or credential"},
+    {"value":"a1.s","rule":"authorization","files":[".omo/evidence/npm-distribution/task-16-npm-distribution.txt","scripts/secret-scan.allow.json",".omo/evidence/npm-distribution/task-19-npm-distribution.txt"],"reason":"destroyed isolated QA gateway or fake Robolectric gateway; not an owner device or credential"},
+    {"value":"b1.s","rule":"authorization","files":["scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/",".omo/evidence/"],"reason":"destroyed isolated QA gateway or fake Robolectric gateway; not an owner device or credential"},
+    {"value":"5.1.30.1","rule":"ipv4","files":["scripts/secret-scan.allow.json","test/","android/app/src/test/","android/core/src/test/",".omo/evidence/"],"reason":"four-part synthetic version from a schema comparison test, not a host"},
+    {"value":"machine.tailnet-name.ts.net","rule":"internal-host","files":[".omo/ulw-research/20260925-152742/wave-2-lane-access-control-FULL.md","scripts/secret-scan.allow.json",".omo/senpi-task/tasks/"],"reason":"explicit documentation example, not an owner endpoint"},
+    {"value":"machine.tailnet.ts.net","rule":"internal-host","files":[".omo/ulw-research/20260925-152742/wave-2-lane-access-control-FULL.md","scripts/secret-scan.allow.json",".omo/senpi-task/tasks/"],"reason":"explicit documentation example, not an owner endpoint"},
+    {"value":"192.168.0.12","rule":"ipv4","files":["docs/second-mac-check.ko.md","scripts/secret-scan.allow.json","docs/second-mac-check.md"],"reason":"explicit documentation example, not an owner endpoint"},
+    {"value":"100.64.0.0","rule":"ipv4","files":[".omo/plans/npm-distribution.md","scripts/secret-scan.allow.json"],"reason":"four-part software version in the distribution plan, not a host"},
+    {"value":"before_parking_fd9a4a5f-5b22-4ce0-8619-77d85ed90666","rule":"high-entropy-assignment","files":[".omo/evidence/parking-log-e0a3011b/real-run1.log","scripts/secret-scan.allow.json"],"reason":"before_parking UUID test marker, previously reviewed in task-5-npm-distribution.json secretVerdict; not authentication"},
+    {"value":"redacted","rule":"internal-url","reason":"redaction marker, not a reachable hostname"},
+    {"value":"zigmini@users.noreply.github.com","rule":"email","files":["docs/patch-notes-next.md","scripts/secret-scan.allow.json"],"reason":"synthetic Git author example in bug 163 documentation; not an owner inbox"},
+    {"value":"before_parking_a9b60dfc-b7a1-4f25-94f5-d9ca5786f0a7","rule":"high-entropy-assignment","files":[".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"before_parking UUID preservation-test marker; task-5 secretVerdict reviewed it as non-authentication"},
+    {"value":"redacted/.zigmini-gateway/secrets/omo-ws-token","rule":"high-entropy-assignment","files":[".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"redacted file-path placeholder, not a token"},
+    {"value":"before_parking_f9d8e423-af40-45a0-9f7c-3adc50cdf94a","rule":"high-entropy-assignment","files":[".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"before_parking UUID preservation-test marker; task-5 secretVerdict reviewed it as non-authentication"},
+    {"value":"npm-oidc-no-reply@github.com","rule":"email","files":[".omo/evidence/omo-5112-rollout-09740f57/registry-metadata.json","scripts/secret-scan.allow.json"],"reason":"public upstream npm publisher/maintainer metadata (GitHub Actions / omo-ai); not the owner inbox"},
+    {"value":"code.yeon.gyu@gmail.com","rule":"email","files":[".omo/evidence/omo-5112-rollout-09740f57/registry-metadata.json","scripts/secret-scan.allow.json"],"reason":"public upstream npm publisher/maintainer metadata (GitHub Actions / omo-ai); not the owner inbox"},
+    {"value":"d60c8f533040762fc4fc20f4a0dbb4dcf6b8466bc1f5b490ef6979afa17aa403","rule":"high-entropy-assignment","files":[".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"SHA-256 comparison digest, not auth.json or a credential; task-5 secretVerdict reviewed it"},
+    {"value":"before_parking_0e4af03e-d19f-4130-8b33-afab3f863f8f","rule":"high-entropy-assignment","files":[".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"before_parking UUID preservation-test marker; task-5 secretVerdict reviewed it as non-authentication"},
+    {"value":"10.20.30.40","rule":"ipv4","files":["test/","android/app/src/test/","android/core/src/test/",".omo/evidence/","scripts/secret-scan.allow.json"],"reason":"synthetic held-card rendering test input, not an owner endpoint"},
+    {"value":"device-id","rule":"device-serial","files":["src/security-check.ts","scripts/secret-scan.allow.json"],"reason":"public finding-kind label in the security card kind map, not a device serial"},
+    {"value":"redacted75","rule":"internal-url","reason":"exact redacted endpoint placeholder in rewritten history; not an owner host"},
+    {"value":"redacted51","rule":"internal-url","reason":"exact redacted endpoint placeholder in rewritten history; not an owner host"}
+  ]
+}

package/scripts/secret-scan.rules.json

@@ -0,0 +1,30 @@
+{
+  "rules": [
+    { "id": "private-key", "severity": "secret", "pattern": "-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----" },
+    { "id": "github-token", "severity": "secret", "pattern": "\\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{22,})\\b" },
+    { "id": "npm-token", "severity": "secret", "pattern": "\\bnpm_[A-Za-z0-9]{36}\\b" },
+    { "id": "anthropic-key", "severity": "secret", "pattern": "\\bsk-ant-[A-Za-z0-9_-]{20,}" },
+    { "id": "openai-key", "severity": "secret", "pattern": "\\bsk-(?!ant-)(?:proj-|svcacct-|admin-)?[A-Za-z0-9_-]{20,}" },
+    { "id": "notion-token", "severity": "secret", "pattern": "\\b(?:secret_[A-Za-z0-9]{43}|ntn_[A-Za-z0-9]{40,})\\b" },
+    { "id": "slack-token", "severity": "secret", "pattern": "\\bxox[abposr]-[A-Za-z0-9-]{10,}" },
+    { "id": "slack-webhook", "severity": "secret", "pattern": "https://hooks\\.slack\\.com/services/[A-Za-z0-9_/]{20,}" },
+    { "id": "aws-access-key", "severity": "secret", "pattern": "\\b(?:AKIA|ASIA)[0-9A-Z]{16}\\b" },
+    { "id": "jwt", "severity": "secret", "pattern": "\\beyJ[A-Za-z0-9_-]{8,}\\.eyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}" },
+    { "id": "high-entropy-assignment", "severity": "secret", "pattern": "(?:token|secret|password|passwd|api[_-]?key|auth)[A-Za-z0-9_]*[\"']?\\s*[:=]\\s*[\"'](?![/~])([A-Za-z0-9+/_=.-]{32,})[\"']", "flags": "i", "group": 1, "minEntropy": 3.5 },
+    { "id": "email", "severity": "personal", "pattern": "\\b(?!this@|super@)[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\\.[A-Za-z0-9-]+)*\\.[A-Za-z]{2,}\\b" },
+    { "id": "ipv4", "severity": "personal", "pattern": "(?<![\\d.])(?:(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)\\.){3}(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(?![\\d.])" },
+    { "id": "user-home-path", "severity": "personal", "pattern": "/Users/(?!Shared/)[A-Za-z0-9._-]+/" },
+    { "id": "ssh-public-key", "severity": "personal", "pattern": "(?:^|[ \\t])(?:(?:@cert-authority|@revoked)[ \\t]+)?(?:[^\\s]+[ \\t]+)?(?:ssh-(?:rsa|ed25519|dss)|ecdsa-sha2-[A-Za-z0-9-]+|sk-(?:ssh-ed25519|ecdsa-sha2-nistp256)@openssh\\.com)[ \\t]+[A-Za-z0-9+/]{20,}={0,3}" },
+    { "id": "ipv6-internal", "severity": "personal", "pattern": "(?<![A-Za-z0-9:])(?:f[cd][0-9a-f]{2}|fe[89ab][0-9a-f]):[0-9a-f:]+(?:%[A-Za-z0-9_.-]+)?(?![A-Za-z0-9:])", "flags": "i" },
+    { "id": "internal-host", "severity": "personal", "pattern": "(?<![A-Za-z0-9_.-])(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\\.)+(?:local|lan|internal|home\\.arpa|ts\\.net)(?=\\.(?![A-Za-z0-9_.-])|[^A-Za-z0-9_.-]|$)", "flags": "i" },
+    { "id": "internal-url", "severity": "personal", "pattern": "\\b(?:https?|wss?|ssh|smb|ftp|redis|postgres(?:ql)?|mysql)://(?:[^\\s/@]+@)?([a-z][a-z0-9-]*):\\d{1,5}\\b", "flags": "i", "group": 1 },
+    { "id": "adb-device", "severity": "personal", "pattern": "\\badb-[A-Za-z0-9_-]+\\._adb-tls-(?:connect|pairing)\\._tcp\\b" },
+    { "id": "device-serial", "severity": "personal", "pattern": "\\b(?:serial(?:number|_number|_no)?|device[_-]?(?:id|serial)|UDID)[\\\"']?\\s*[:=]\\s*[\\\"']?([A-Za-z0-9][A-Za-z0-9_-]{5,})(?=[\\\"'\\s,;}]|$)", "flags": "i", "group": 1 },
+    { "id": "tailscale-key", "severity": "secret", "pattern": "\\btskey-(?:auth|api|client|oauth)-[A-Za-z0-9_-]{10,}\\b" },
+    { "id": "gcp-api-key", "severity": "secret", "pattern": "\\bAIza[A-Za-z0-9_-]{35}\\b" },
+    { "id": "credential-assignment", "severity": "secret", "pattern": "\\b(?:password|passwd|client_secret|aws_secret_access_key|session_id|session_token)[\\\"']?\\s*[:=]\\s*[\\\"']?([A-Za-z0-9][A-Za-z0-9+/_=.!@#$%^&*-]{3,})(?=[\\\"'\\s,;}]|$)", "flags": "i", "group": 1 },
+    { "id": "authorization", "severity": "secret", "pattern": "\\bauthorization[\\\"']?\\s*[:=]\\s*[\\\"']?(?:Bearer|Basic)\\s+([A-Za-z0-9_+/.=-]{4,})", "flags": "i", "group": 1 },
+    { "id": "cookie-header", "severity": "secret", "pattern": "\\b(?:set-cookie|cookie)[\\\"']?\\s*[:=]\\s*[\\\"']?([A-Za-z0-9_.-]+=[A-Za-z0-9_+/.%=-]+(?:;[ \\t]*[A-Za-z0-9_.-]+=[A-Za-z0-9_+/.%=-]+)*)", "flags": "i", "group": 1 },
+    { "id": "phone-number", "severity": "personal", "pattern": "(?<![A-Za-z0-9_+])(?:010[- .]?\\d{4}[- .]?\\d{4}|\\+82[- .]?(?:10[- .]?\\d{4}[- .]?\\d{4}|[1-9]\\d?[- .]?\\d{3,4}[- .]?\\d{4}))(?![A-Za-z0-9_])" }
+  ]
+}

package/src/agent-request-rules.ts

@@ -0,0 +1,82 @@
+import { fileURLToPath } from "node:url";
+import { readRulesFile } from "./agent-rules.ts";
+
+export const PACKAGE_REQUEST_RULES_FILE = fileURLToPath(new URL("../assets/agent/gateway-request-rules.md", import.meta.url));
+export const REQUEST_RULES_TAG = "zigmini-request-rules";
+
+export interface ProviderRequestEvent {
+	readonly payload: unknown;
+	readonly model?: { readonly api: string };
+	readonly streamKind?: "main" | "auxiliary";
+}
+
+function record(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function strings(value: unknown): value is string[] {
+	return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+
+/** Captured by one extension instance. Updates take effect when a new instance loads. */
+export function loadRequestRules(file = PACKAGE_REQUEST_RULES_FILE): string {
+	return readRulesFile(file).text;
+}
+
+/** Changes only the final request payload. Never modifies the session's prompt or messages. */
+export function applyRequestRules(event: ProviderRequestEvent, rules: string): unknown {
+	const payload = event.payload;
+	if (event.streamKind !== "main" || rules === "" || !record(payload)) return payload;
+	const block = `<${REQUEST_RULES_TAG}>\n${rules}\n</${REQUEST_RULES_TAG}>`;
+	const append = (text: string): string => text.includes(block) ? text : `${text}${text === "" ? "" : "\n\n"}${block}`;
+	switch (event.model?.api) {
+		case "openai-responses":
+		case "openai-codex-responses":
+		case "azure-openai-responses":
+			return { ...payload, instructions: append(typeof payload.instructions === "string" ? payload.instructions : "") };
+		case "openai-completions": {
+			if (!Array.isArray(payload.messages)) return payload;
+			const at = payload.messages.findIndex((message) => record(message) && (message.role === "system" || message.role === "developer"));
+			if (at < 0) return { ...payload, messages: [{ role: "system", content: block }, ...payload.messages] };
+			return {
+				...payload,
+				messages: payload.messages.map((message, index) => {
+					if (index !== at || !record(message)) return message;
+					if (typeof message.content === "string") return { ...message, content: append(message.content) };
+					if (!Array.isArray(message.content)) return message;
+					const present = message.content.some((part) => record(part) && part.type === "text" && part.text === block);
+					return present ? message : { ...message, content: [...message.content, { type: "text", text: block }] };
+				}),
+			};
+		}
+		case "anthropic-messages": {
+			if (!Array.isArray(payload.system)) return { ...payload, system: append(typeof payload.system === "string" ? payload.system : "") };
+			const present = payload.system.some((part) => record(part) && part.type === "text" && part.text === block);
+			return present ? payload : { ...payload, system: [...payload.system, { type: "text", text: block }] };
+		}
+		case "claude-sdk-oauth": {
+			const system = payload.systemPrompt;
+			// SDK snapshots are durable. Keep the same prompt prefix, but do not record this request decoration.
+			if (typeof system === "string") return { ...payload, systemPrompt: { type: "custom", prompt: append(system), snapshot: false } };
+			if (strings(system)) {
+				return { ...payload, systemPrompt: { type: "custom", prompt: system.includes(block) ? system : [...system, block], snapshot: false } };
+			}
+			if (system === undefined) {
+				return { ...payload, systemPrompt: { type: "custom", prompt: block, snapshot: false } };
+			}
+			if (!record(system)) return payload;
+			if (system.type === "preset") {
+				return { ...payload, systemPrompt: { ...system, append: append(typeof system.append === "string" ? system.append : ""), snapshot: false } };
+			}
+			if (system.type === "custom" && typeof system.prompt === "string") {
+				return { ...payload, systemPrompt: { ...system, prompt: append(system.prompt), snapshot: false } };
+			}
+			if (system.type === "custom" && strings(system.prompt)) {
+				return { ...payload, systemPrompt: { ...system, prompt: system.prompt.includes(block) ? system.prompt : [...system.prompt, block], snapshot: false } };
+			}
+			return payload;
+		}
+		default:
+			return payload;
+	}
+}

package/src/cli/access.ts

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { isPrivateIPv4, type Network } from "../enroll.ts";
+import { type Language, message, resolveLanguage } from "./messages.ts";
 
 /**
  * External access choice (plan Todo 27). Setup and the web 설정 panel pick how the phone reaches the app port:
@@ -27,47 +28,42 @@ export interface ResolveDeps {
 
 export type Resolved = { readonly ok: true; readonly record: AccessRecord } | { readonly ok: false; readonly message: string };
 
-export const TAILSCALE_GUIDE = [
-	"Tailscale이 이 맥에 없습니다. 아래 순서로 설치한 뒤 같은 명령을 다시 실행하세요.",
-	"  1. 맥: https://tailscale.com/download/mac 에서 Tailscale을 설치하고 로그인합니다.",
-	"  2. 폰: Play 스토어에서 Tailscale을 설치하고 맥과 같은 계정으로 로그인합니다.",
-	"  3. Tailscale 관리 화면에서 MagicDNS를 켭니다(주소가 기기 이름으로 나옵니다).",
-].join("\n");
+export const TAILSCALE_GUIDE = message("ko", "tailscaleGuide");
 
 export function isAccessChoice(value: unknown): value is AccessChoice {
 	return (ACCESS_CHOICES as readonly unknown[]).includes(value);
 }
 
 /** The owner's domain: only `https://host[:port]` with no path, query, fragment or user info (89 security note 3: TLS required). */
-export function parseDomain(text: string): { readonly url: string } | { readonly error: string } {
+export function parseDomain(text: string, lang: Language = "ko"): { readonly url: string } | { readonly error: string } {
 	let url: URL;
 	try {
 		url = new URL(text.trim());
 	} catch {
-		return { error: `자기 도메인 주소가 URL이 아닙니다: ${text}` };
+		return { error: message(lang, "domainUrl", { text }) };
 	}
-	if (url.protocol !== "https:") return { error: "자기 도메인은 https:// 주소만 받습니다. 앱의 인증 값이 평문으로 지나가지 않도록 TLS가 필요합니다." };
+	if (url.protocol !== "https:") return { error: message(lang, "domainTls") };
 	if (url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "" || url.pathname !== "/") {
-		return { error: "자기 도메인은 https://<도메인>[:포트] 형식만 받습니다(경로, ?, #, 사용자 정보 없이)." };
+		return { error: message(lang, "domainFormat") };
 	}
 	return { url: url.origin };
 }
 
-export function parseTailscale(stdout: string, appPort: number): { readonly url: string } | { readonly error: string } {
+export function parseTailscale(stdout: string, appPort: number, lang: Language = "ko"): { readonly url: string } | { readonly error: string } {
 	let status: { BackendState?: unknown; Self?: { DNSName?: unknown; TailscaleIPs?: unknown } } | null;
 	try {
 		status = JSON.parse(stdout) as typeof status;
 	} catch {
-		return { error: "tailscale status --json 출력을 읽지 못했습니다." };
+		return { error: message(lang, "tailscaleJson") };
 	}
 	if (status?.BackendState !== "Running") {
-		return { error: `Tailscale이 연결되어 있지 않습니다(상태: ${String(status?.BackendState ?? "?")}). Tailscale 앱에서 로그인하고 연결하세요.` };
+		return { error: message(lang, "tailscaleState", { state: String(status?.BackendState ?? "?") }) };
 	}
 	const name = typeof status.Self?.DNSName === "string" ? status.Self.DNSName.replace(/\.$/, "") : "";
 	const ips = Array.isArray(status.Self?.TailscaleIPs) ? status.Self.TailscaleIPs : [];
 	const ip = ips.find((value): value is string => typeof value === "string" && /^100\.\d+\.\d+\.\d+$/.test(value));
 	const host = name !== "" ? name : ip;
-	if (host === undefined) return { error: "Tailscale에서 이 맥의 MagicDNS 이름과 100.x 주소를 찾지 못했습니다." };
+	if (host === undefined) return { error: message(lang, "tailscaleHost") };
 	return { url: `http://${host}:${appPort}` };
 }
 
@@ -77,21 +73,21 @@ export function lanUrl(network: Network, appPort: number): string | null {
 	return address === undefined ? null : `http://${address}:${appPort}`;
 }
 
-export function resolveAccess(choice: AccessChoice, domain: string | undefined, appPort: number, deps: ResolveDeps): Resolved {
+export function resolveAccess(choice: AccessChoice, domain: string | undefined, appPort: number, deps: ResolveDeps, lang: Language = "ko"): Resolved {
 	if (choice === "domain") {
-		const parsed = parseDomain(domain ?? "");
+		const parsed = parseDomain(domain ?? "", lang);
 		return "error" in parsed ? { ok: false, message: parsed.error } : { ok: true, record: { choice, url: parsed.url } };
 	}
 	if (choice === "lan") {
 		const url = lanUrl(deps.network, appPort);
 		return url === null
-			? { ok: false, message: "기본 경로 네트워크의 사설 IP(10.x, 172.16-31.x, 192.168.x)를 찾지 못했습니다. 집 Wi-Fi에 연결한 뒤 다시 실행하세요." }
+			? { ok: false, message: message(lang, "lanMissing") }
 			: { ok: true, record: { choice, url } };
 	}
 	const run = deps.tailscale();
-	if (run === null) return { ok: false, message: TAILSCALE_GUIDE };
-	if (run.code !== 0) return { ok: false, message: `tailscale status 가 종료 코드 ${run.code}로 실패했습니다. Tailscale 앱이 실행 중인지 확인하세요.` };
-	const parsed = parseTailscale(run.stdout, appPort);
+	if (run === null) return { ok: false, message: message(lang, "tailscaleGuide") };
+	if (run.code !== 0) return { ok: false, message: message(lang, "tailscaleFailed", { code: run.code }) };
+	const parsed = parseTailscale(run.stdout, appPort, lang);
 	return "error" in parsed ? { ok: false, message: parsed.error } : { ok: true, record: { choice, url: parsed.url } };
 }
 
@@ -119,13 +115,13 @@ export function appPortEnv(appPort: number): Record<string, string> {
 	return { ZGW_LAN_PORT: String(appPort), ZGW_LAN_HOST: "0.0.0.0" };
 }
 
-export function proxyGuide(url: string, appPort: number): string {
+export function proxyGuide(url: string, appPort: number, lang: Language = "ko"): string {
 	return [
-		"리버스 프록시가 아래 주소를 이 맥의 앱 포트로 넘기는지 확인하세요. Caddy 예시(Caddyfile 한 블록, 인증서는 Caddy가 받습니다):",
+		message(lang, "proxyIntro"),
 		`  ${new URL(url).host} {`,
 		`  \treverse_proxy 127.0.0.1:${appPort}`,
 		"  }",
-		"공유기에서 443 포트를 프록시가 있는 기기로 넘겨야 합니다. 설정을 바꾼 뒤 `zigmini doctor`로 다시 확인합니다.",
+		message(lang, "proxyEnd"),
 	].join("\n");
 }
 
@@ -133,12 +129,12 @@ export type Fetch = (url: string, init?: RequestInit) => Promise<Response>;
 export type PingResult = { readonly ok: true } | { readonly ok: false; readonly detail: string };
 
 /** `GET <url>/api/enroll/ping` must answer 200 `{ ok: true }` through the proxy and its certificate. */
-export async function pingAccess(fetcher: Fetch, url: string, timeoutMs = PING_TIMEOUT_MS): Promise<PingResult> {
+export async function pingAccess(fetcher: Fetch, url: string, timeoutMs = PING_TIMEOUT_MS, lang: Language = "ko"): Promise<PingResult> {
 	try {
 		const response = await fetcher(`${url}/api/enroll/ping`, { signal: AbortSignal.timeout(timeoutMs) });
 		if (response.status !== 200) return { ok: false, detail: `HTTP ${response.status}` };
 		const body = await response.json().catch(() => null) as { ok?: unknown } | null;
-		return body?.ok === true ? { ok: true } : { ok: false, detail: "응답이 zigmini 게이트웨이의 것이 아님" };
+		return body?.ok === true ? { ok: true } : { ok: false, detail: message(lang, "pingBody") };
 	} catch (error) {
 		return { ok: false, detail: error instanceof Error ? error.message : String(error) };
 	}
@@ -146,14 +142,14 @@ export async function pingAccess(fetcher: Fetch, url: string, timeoutMs = PING_T
 
 export interface AccessItem { readonly id: "access"; readonly label: string; readonly status: "ok" | "bad" | "off"; readonly detail: string }
 
-export async function accessItem(record: AccessRecord | null | "invalid", ping: (url: string) => Promise<PingResult>): Promise<AccessItem> {
-	const label = "외부 접속";
-	if (record === null) return { id: "access", label, status: "off", detail: "고르지 않음(앱 포트 꺼짐)" };
-	if (record === "invalid") return { id: "access", label, status: "bad", detail: `${ACCESS_FILE}를 읽지 못했습니다. \`zigmini setup --access ...\`로 다시 고르세요` };
+export async function accessItem(record: AccessRecord | null | "invalid", ping: (url: string) => Promise<PingResult>, lang: Language = "ko"): Promise<AccessItem> {
+	const label = message(lang, "accessLabel");
+	if (record === null) return { id: "access", label, status: "off", detail: message(lang, "accessOff") };
+	if (record === "invalid") return { id: "access", label, status: "bad", detail: message(lang, "accessRead", { file: ACCESS_FILE }) };
 	const result = await ping(record.url);
 	return result.ok
 		? { id: "access", label, status: "ok", detail: `${record.choice} ${record.url}` }
-		: { id: "access", label, status: "bad", detail: `${record.choice} ${record.url} 확인 실패: ${result.detail}` };
+		: { id: "access", label, status: "bad", detail: message(lang, "accessCheck", { ...record, detail: result.detail }) };
 }
 
 /**
@@ -180,6 +176,7 @@ export interface AccessApiDeps extends ResolveDeps {
  * the launchd environment, so that stays with `zigmini setup --access`.
  */
 export async function handleAccessApi(req: Request, deps: AccessApiDeps): Promise<Response> {
+	const lang = resolveLanguage(deps.home, process.env);
 	if (req.method === "GET") {
 		const saved = readAccess(deps.home);
 		return Response.json({ access: saved === "invalid" ? null : saved, invalid: saved === "invalid", appPort: deps.appPort });
@@ -187,17 +184,17 @@ export async function handleAccessApi(req: Request, deps: AccessApiDeps): Promis
 	if (req.method !== "POST") return Response.json({ error: "method_not_allowed" }, { status: 405 });
 	if (foreignOrigin(req.headers, deps.webPort)) return Response.json({ error: "forbidden_origin" }, { status: 403 });
 	if (deps.appPort <= 0) {
-		return Response.json({ error: "app_port_off", message: "앱 포트가 꺼져 있습니다. 맥 터미널에서 `zigmini setup --access <선택>`을 먼저 실행하세요." }, { status: 409 });
+		return Response.json({ error: "app_port_off", message: message(lang, "appOff") }, { status: 409 });
 	}
 	const body = await req.json().catch(() => null) as { choice?: unknown; domain?: unknown } | null;
-	if (!isAccessChoice(body?.choice)) return Response.json({ error: "bad_choice", message: `선택은 ${ACCESS_CHOICES.join(", ")} 중 하나입니다.` }, { status: 400 });
+	if (!isAccessChoice(body?.choice)) return Response.json({ error: "bad_choice", message: message(lang, "apiChoice", { choices: ACCESS_CHOICES.join(", ") }) }, { status: 400 });
 	const domain = typeof body.domain === "string" ? body.domain : undefined;
-	const resolved = resolveAccess(body.choice, domain, deps.appPort, deps);
+	const resolved = resolveAccess(body.choice, domain, deps.appPort, deps, lang);
 	if (!resolved.ok) return Response.json({ error: "unresolved", message: resolved.message }, { status: 422 });
 	if (resolved.record.choice === "domain") {
 		const result = await deps.ping(resolved.record.url);
 		if (!result.ok) {
-			return Response.json({ error: "ping_failed", message: `${resolved.record.url} 확인 실패: ${result.detail}\n${proxyGuide(resolved.record.url, deps.appPort)}` }, { status: 502 });
+			return Response.json({ error: "ping_failed", message: message(lang, "apiPing", { url: resolved.record.url, detail: result.detail, guide: proxyGuide(resolved.record.url, deps.appPort, lang) }) }, { status: 502 });
 		}
 	}
 	writeAccess(deps.home, resolved.record);