@blamejs/exceptd-skills 0.11.14 → 0.12.0

package/lib/refresh-external.js

@@ -50,15 +50,20 @@ function parseArgs(argv) {
     fromFixture: null,   // path to fixture dir
     fromCache: null,     // path to .cache/upstream dir (or default if --from-cache passed bare)
     swarm: false,        // fan-out sources across worker threads
+    advisory: null,      // v0.12.0: single-advisory seed (CVE-* or GHSA-*)
     help: false,
     quiet: false,
+    json: false,
   };
   for (let i = 2; i < argv.length; i++) {
     const a = argv[i];
     if (a === "--apply") out.apply = true;
     else if (a === "--quiet") out.quiet = true;
     else if (a === "--swarm") out.swarm = true;
+    else if (a === "--json") out.json = true;
     else if (a === "--help" || a === "-h") out.help = true;
+    else if (a === "--advisory") { out.advisory = argv[++i]; }
+    else if (a.startsWith("--advisory=")) { out.advisory = a.slice("--advisory=".length); }
     else if (a === "--from-cache") {
       // accept either --from-cache <path> or --from-cache (default path)
       const next = argv[i + 1];
@@ -101,6 +106,26 @@ Modes:
   --indexes-only     rebuild data/_indexes/ only; no network. Equivalent to
                      \`exceptd refresh --indexes-only\`.
   --swarm            fan out sources across worker threads. Best with --from-cache.
+  --advisory <id>    (v0.12.0) seed a single catalog entry from a CVE or GHSA ID.
+                     Fetches from GitHub Advisory Database (covers npm + PyPI +
+                     Maven + Go + ...) and writes a DRAFT to data/cve-catalog.json
+                     marked with _auto_imported: true. Editorial fields
+                     (framework_control_gaps, iocs, atlas_refs, attack_refs)
+                     remain null pending review via:
+                       exceptd run cve-curation --advisory <id>
+                     Examples:
+                       exceptd refresh --advisory CVE-2026-45321
+                       exceptd refresh --advisory GHSA-xxxx-xxxx-xxxx --apply
+
+Sources (default = all):
+  kev   CISA Known Exploited Vulnerabilities
+  epss  FIRST EPSS exploit-prediction scores
+  nvd   NIST NVD per-CVE feed
+  rfc   IETF Datatracker per-RFC
+  pins  Upstream version-pin drift (MITRE ATLAS/ATT&CK/D3FEND/CWE) — report only
+  ghsa  (v0.12.0) GitHub Advisory Database — npm/PyPI/Maven/etc. Lands new CVE
+        IDs as DRAFTS (_auto_imported: true); catalog validator treats drafts
+        as warnings, not errors. Editorial review still required.
 
 Air-gap workflow:
   1. On a connected host:   \`exceptd refresh --prefetch\`
@@ -439,12 +464,58 @@ const PINS_SOURCE = {
   },
 };
 
+/**
+ * v0.12.0: GHSA (GitHub Advisory Database) source. Covers npm, PyPI,
+ * RubyGems, Maven, NuGet, Go, Composer, Swift, Erlang, Pub, Rust — all
+ * in one feed, updated within hours of disclosure. Much faster than KEV
+ * (variable, often days) or NVD (~10 days).
+ *
+ * Apply path: new CVE IDs from GHSA land in data/cve-catalog.json as
+ * DRAFTS (`_auto_imported: true` + `_draft: true`). The strict catalog
+ * validator treats drafts as warnings, not errors, so the nightly
+ * auto-PR pipeline can ship them without blocking on editorial review.
+ * Framework gaps + IoCs + ATLAS/ATT&CK refs require human or AI-assisted
+ * synthesis via `exceptd run cve-curation --advisory <id>`.
+ */
+const GHSA_SOURCE = {
+  name: "ghsa",
+  description: "GitHub Advisory Database — multi-ecosystem disclosure feed (npm, PyPI, Maven, Go, etc.)",
+  applies_to: "data/cve-catalog.json",
+  async fetchDiff(ctx) {
+    if (ctx.fixtures?.ghsa) return synthesizeFromFixture(ctx, "ghsa");
+    if (ctx.cacheDir) {
+      // Cache parity: ghsa cache layout is .cache/upstream/ghsa/<published-date>.json
+      // For v0.12.0 we fall through to live fetch — caching is a v0.13 follow-up.
+    }
+    const ghsa = require("./source-ghsa");
+    return ghsa.buildDiff(ctx);
+  },
+  async applyDiff(ctx, diffs) {
+    const ghsa = require("./source-ghsa");
+    let updated = 0;
+    const errors = [];
+    for (const d of diffs) {
+      if (d.field !== "_new_entry") continue;
+      if (!d.after || !d.id) continue;
+      if (ctx.cveCatalog[d.id]) continue; // never overwrite existing entries
+      try {
+        ctx.cveCatalog[d.id] = d.after;
+        updated++;
+      } catch (e) {
+        errors.push(`${d.id}: ${e.message}`);
+      }
+    }
+    return { updated, errors };
+  },
+};
+
 const ALL_SOURCES = {
   kev: KEV_SOURCE,
   epss: EPSS_SOURCE,
   nvd: NVD_SOURCE,
   rfc: RFC_SOURCE,
   pins: PINS_SOURCE,
+  ghsa: GHSA_SOURCE,
 };
 
 // --- Cache-mode helpers ------------------------------------------------
@@ -653,7 +724,7 @@ function loadCtx(opts) {
     cacheDir: null,
   };
   if (opts.fromFixture) {
-    ctx.fixtures = { dir: path.resolve(opts.fromFixture), kev: true, epss: true, nvd: true, rfc: true, pins: true };
+    ctx.fixtures = { dir: path.resolve(opts.fromFixture), kev: true, epss: true, nvd: true, rfc: true, pins: true, ghsa: true };
   } else if (opts.fromCache) {
     const abs = path.resolve(opts.fromCache);
     ctx.cacheDir = abs;
@@ -694,6 +765,97 @@ function chosenSources(opts) {
   return out;
 }
 
+/**
+ * v0.12.0: single-advisory seed. Operator types
+ *   exceptd refresh --advisory CVE-2026-45321
+ * or
+ *   exceptd refresh --advisory GHSA-xxxx-xxxx-xxxx --apply
+ *
+ * Tool fetches from GHSA (covers npm, PyPI, etc.), normalizes to the
+ * exceptd catalog draft shape, and either prints the seed (default) or
+ * writes it to data/cve-catalog.json (--apply). Always exits non-zero
+ * when a draft is produced, signaling that editorial review is needed.
+ */
+async function seedSingleAdvisory(opts) {
+  const ghsa = require("./source-ghsa");
+  const id = opts.advisory;
+  const result = await ghsa.fetchAdvisoryById(id, {});
+  if (!result.ok) {
+    const err = { ok: false, verb: "refresh", error: `--advisory ${id}: ${result.error}`, source: result.source, hint: "Verify the ID format (CVE-YYYY-NNNN or GHSA-*) and network reachability. Set EXCEPTD_GHSA_FIXTURE for offline testing." };
+    if (opts.json) process.stdout.write(JSON.stringify(err) + "\n");
+    else process.stderr.write(`[refresh --advisory] ${err.error}\n  hint: ${err.hint}\n`);
+    process.exitCode = 2;
+    return;
+  }
+  const advisory = result.advisories[0];
+  if (!advisory) {
+    const err = { ok: false, verb: "refresh", error: `--advisory ${id}: no matching advisory found`, source: result.source };
+    if (opts.json) process.stdout.write(JSON.stringify(err) + "\n");
+    else process.stderr.write(`[refresh --advisory] ${err.error}\n`);
+    process.exitCode = 2;
+    return;
+  }
+  const normalized = ghsa.normalizeAdvisory(advisory);
+  if (!normalized) {
+    const err = { ok: false, verb: "refresh", error: `--advisory ${id}: advisory has no CVE ID (GHSA-only entries are not imported into the CVE catalog in v0.12)`, ghsa_id: advisory.ghsa_id || null };
+    if (opts.json) process.stdout.write(JSON.stringify(err) + "\n");
+    else process.stderr.write(`[refresh --advisory] ${err.error}\n`);
+    process.exitCode = 2;
+    return;
+  }
+  const cveId = Object.keys(normalized)[0];
+
+  if (!opts.apply) {
+    // Print the draft to stdout — operator pipes to jq / inspects /
+    // commits manually. Exit 3 = "draft produced, not applied."
+    const output = {
+      ok: true,
+      verb: "refresh",
+      mode: "advisory-seed-dry-run",
+      advisory_id: id,
+      cve_id: cveId,
+      draft: normalized[cveId],
+      hint: "Re-run with --apply to write this draft into data/cve-catalog.json. After apply, run `exceptd run cve-curation --advisory " + cveId + "` to surface editorial proposals (framework gaps, IoCs, ATLAS/ATT&CK refs).",
+    };
+    if (opts.json) process.stdout.write(JSON.stringify(output) + "\n");
+    else {
+      process.stdout.write(`[refresh --advisory] ${cveId} draft prepared (not applied).\n`);
+      process.stdout.write(`  Run with --apply to write into data/cve-catalog.json.\n`);
+      process.stdout.write(`  Then: exceptd run cve-curation --advisory ${cveId}\n`);
+    }
+    process.exitCode = 3;
+    return;
+  }
+
+  // Apply: write to cve-catalog.json with the _auto_imported flag.
+  const catalogPath = ABS("data/cve-catalog.json");
+  const catalog = JSON.parse(fs.readFileSync(catalogPath, "utf8"));
+  if (catalog[cveId] && !catalog[cveId]._auto_imported && !catalog[cveId]._draft) {
+    // Refuse to overwrite a human-curated entry.
+    const err = { ok: false, verb: "refresh", error: `${cveId} already present in catalog and is human-curated (not a draft). Refusing to overwrite. Edit manually if intentional.`, existing_last_updated: catalog[cveId].last_updated };
+    if (opts.json) process.stdout.write(JSON.stringify(err) + "\n");
+    else process.stderr.write(`[refresh --advisory] ${err.error}\n`);
+    process.exitCode = 4;
+    return;
+  }
+  catalog[cveId] = normalized[cveId];
+  fs.writeFileSync(catalogPath, JSON.stringify(catalog, null, 2) + "\n", "utf8");
+  const output = {
+    ok: true,
+    verb: "refresh",
+    mode: "advisory-seed-applied",
+    advisory_id: id,
+    cve_id: cveId,
+    written_to: "data/cve-catalog.json",
+    is_draft: true,
+    hint: "Draft written. Required next steps before this entry passes the strict catalog gate: (1) `exceptd run cve-curation --advisory " + cveId + "` to surface editorial proposals; (2) human review + fill in framework_control_gaps, atlas_refs, attack_refs, iocs; (3) add matching entry to data/zeroday-lessons.json; (4) remove `_auto_imported` and `_draft` flags.",
+  };
+  if (opts.json) process.stdout.write(JSON.stringify(output) + "\n");
+  else process.stdout.write(`[refresh --advisory] ${cveId} draft written to data/cve-catalog.json.\n  Next: exceptd run cve-curation --advisory ${cveId}\n`);
+  // Exit 3 even on successful write — "draft applied, editorial step pending."
+  process.exitCode = 3;
+}
+
 async function main() {
   const opts = parseArgs(process.argv);
   if (opts.help) {
@@ -701,6 +863,15 @@ async function main() {
     process.exit(0);
   }
 
+  // v0.12.0: `--advisory <id>` short-circuits the normal source loop and
+  // seeds a single CVE catalog entry from GHSA. Exits non-zero ("draft
+  // written, please review") so CI pipelines surface the needed editorial
+  // step. Operator must run `--apply` for the write to land; without it,
+  // the seed is printed to stdout for review.
+  if (opts.advisory) {
+    return seedSingleAdvisory(opts);
+  }
+
   const ctx = loadCtx(opts);
   const sources = chosenSources(opts);
   const log = (s) => opts.quiet || console.log(s);

package/lib/source-ghsa.js

@@ -0,0 +1,259 @@
+"use strict";
+
+/**
+ * lib/source-ghsa.js
+ *
+ * GitHub Advisory Database fetcher. The GHSA covers npm, PyPI, RubyGems,
+ * Maven, NuGet, Go, Composer, Swift, Erlang, Pub, and Rust ecosystems in
+ * one feed and is updated within hours of disclosure — much faster than
+ * NVD (~10 days) or KEV (variable, often days).
+ *
+ * Endpoint: GET https://api.github.com/advisories
+ *   - Unauthenticated: 60 req/hr (sufficient for nightly refresh)
+ *   - Authenticated:   5000 req/hr (set GITHUB_TOKEN env var)
+ *
+ * Returns drafts — every imported entry carries `_auto_imported: true`
+ * + `_draft: true` so the strict catalog validator treats them as
+ * warnings, not errors. Editorial fields (framework_control_gaps,
+ * iocs, atlas_refs) are left null until a human or AI assistant
+ * fills them in via the seven-phase playbook flow.
+ *
+ * Honors EXCEPTD_GHSA_FIXTURE env var for offline testing — value is a
+ * path to a JSON array matching the api.github.com/advisories shape.
+ *
+ * Zero npm deps. Node 24 stdlib only.
+ */
+
+const https = require("https");
+const fs = require("fs");
+
+const GHSA_HOST = "api.github.com";
+const GHSA_PATH = "/advisories?per_page=50&type=reviewed&sort=published&direction=desc";
+const REQUEST_TIMEOUT_MS = 10000;
+const USER_AGENT = "exceptd-security/source-ghsa (+https://exceptd.com)";
+
+/**
+ * Fetch a page of advisories (default: latest 50).
+ *
+ * Returns:
+ *   { ok: true,  advisories: [...], source: "github-api" | "fixture", rate_limit?: { remaining, reset } }
+ *   { ok: false, error, source: "offline" }
+ */
+async function fetchAdvisories({ timeoutMs = REQUEST_TIMEOUT_MS, path = GHSA_PATH, token = null } = {}) {
+  if (process.env.EXCEPTD_GHSA_FIXTURE) {
+    try {
+      const arr = JSON.parse(fs.readFileSync(process.env.EXCEPTD_GHSA_FIXTURE, "utf8"));
+      return { ok: true, advisories: Array.isArray(arr) ? arr : [arr], source: "fixture" };
+    } catch (e) {
+      return { ok: false, error: `fixture: ${e.message}`, source: "offline" };
+    }
+  }
+
+  return new Promise((resolve) => {
+    const headers = {
+      "Accept": "application/vnd.github+json",
+      "User-Agent": USER_AGENT,
+      "X-GitHub-Api-Version": "2022-11-28",
+    };
+    if (token || process.env.GITHUB_TOKEN) {
+      headers.Authorization = `Bearer ${token || process.env.GITHUB_TOKEN}`;
+    }
+    const req = https.get({
+      host: GHSA_HOST,
+      path,
+      headers,
+      timeout: timeoutMs,
+    }, (res) => {
+      if (res.statusCode !== 200) {
+        res.resume();
+        return resolve({ ok: false, error: `GHSA returned HTTP ${res.statusCode}`, source: "offline" });
+      }
+      const chunks = [];
+      res.on("data", (c) => chunks.push(c));
+      res.on("end", () => {
+        try {
+          const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+          const advisories = Array.isArray(body) ? body : (body ? [body] : []);
+          resolve({
+            ok: true,
+            advisories,
+            source: "github-api",
+            rate_limit: {
+              remaining: parseInt(res.headers["x-ratelimit-remaining"], 10) || null,
+              reset: parseInt(res.headers["x-ratelimit-reset"], 10) || null,
+            },
+          });
+        } catch (e) {
+          resolve({ ok: false, error: `parse: ${e.message}`, source: "offline" });
+        }
+      });
+    });
+    req.on("timeout", () => req.destroy(new Error("timeout")));
+    req.on("error", (e) => resolve({ ok: false, error: e.message, source: "offline" }));
+  });
+}
+
+/**
+ * Fetch a single advisory by ID — accepts CVE-* or GHSA-* identifiers.
+ *
+ * GHSA-IDs hit /advisories/<ghsa-id> directly. CVE-IDs require a search
+ * since the API is keyed by GHSA. We fall back to a query-string search.
+ */
+async function fetchAdvisoryById(id, opts = {}) {
+  if (!id || typeof id !== "string") {
+    return { ok: false, error: "id is required (CVE-* or GHSA-*)", source: "offline" };
+  }
+  if (process.env.EXCEPTD_GHSA_FIXTURE) {
+    const r = await fetchAdvisories(opts);
+    if (!r.ok) return r;
+    const match = r.advisories.find(a =>
+      (a.ghsa_id && a.ghsa_id.toUpperCase() === id.toUpperCase()) ||
+      (a.cve_id && a.cve_id.toUpperCase() === id.toUpperCase())
+    );
+    if (!match) return { ok: false, error: `${id} not in fixture`, source: "fixture" };
+    return { ok: true, advisories: [match], source: "fixture" };
+  }
+  if (/^GHSA-/i.test(id)) {
+    return fetchAdvisories({ ...opts, path: `/advisories/${id.toLowerCase()}` });
+  }
+  if (/^CVE-\d{4}-\d+$/i.test(id)) {
+    return fetchAdvisories({ ...opts, path: `/advisories?cve_id=${encodeURIComponent(id.toUpperCase())}` });
+  }
+  return { ok: false, error: `unrecognized id format (expected CVE-YYYY-NNNN or GHSA-*): ${id}`, source: "offline" };
+}
+
+/**
+ * Normalize a GHSA advisory object to the exceptd catalog draft shape.
+ * Fields the GHSA carries authoritatively: cve_id, ghsa_id, summary,
+ * severity, cvss, vulnerabilities (package + version range), published_at,
+ * references. Editorial fields (framework_control_gaps, iocs, atlas_refs,
+ * attack_refs, rwep_factors) are LEFT NULL — drafts. The seven-phase
+ * playbook flow OR a human reviewer fills these in.
+ *
+ * Returns null if the advisory lacks a CVE ID (we don't import GHSA-only
+ * advisories into the CVE catalog — they belong in a separate GHSA index
+ * which is a v0.13 design).
+ */
+function normalizeAdvisory(adv) {
+  if (!adv || !adv.cve_id) return null;
+
+  const ecosystems = new Set();
+  const affected = [];
+  const ecosystemPackages = [];
+  for (const v of (adv.vulnerabilities || [])) {
+    if (v?.package?.ecosystem) ecosystems.add(v.package.ecosystem);
+    if (v?.package?.name) {
+      ecosystemPackages.push(`${v.package.ecosystem || "?"}:${v.package.name}`);
+      if (v.vulnerable_version_range) {
+        affected.push(`${v.package.name} ${v.vulnerable_version_range}`);
+      }
+    }
+  }
+
+  const cvssScore = adv.cvss?.score ?? null;
+  const cvssVector = adv.cvss?.vector_string || null;
+  const severity = (adv.severity || "").toLowerCase();
+  // Derive a coarse type from package ecosystem when nothing better available.
+  const inferredType = ecosystems.has("npm") ? "supply-chain-npm"
+    : ecosystems.has("pip") ? "supply-chain-pypi"
+    : ecosystems.has("maven") ? "supply-chain-maven"
+    : ecosystems.has("rubygems") ? "supply-chain-gem"
+    : "supply-chain-other";
+
+  return {
+    [adv.cve_id]: {
+      name: adv.summary || adv.cve_id,
+      type: inferredType,
+      cvss_score: cvssScore,
+      cvss_vector: cvssVector,
+      cisa_kev: false,
+      cisa_kev_date: null,
+      cisa_kev_pending: severity === "critical",
+      cisa_kev_pending_reason: severity === "critical"
+        ? `GHSA severity critical (CVSS ${cvssScore}). KEV listing typically follows for critical advisories with confirmed exploitation; verify before publish.`
+        : null,
+      poc_available: null,
+      poc_description: null,
+      ai_discovered: null,
+      ai_assisted_weaponization: null,
+      active_exploitation: severity === "critical" ? "suspected" : "unknown",
+      affected: ecosystemPackages.join(", ") || null,
+      affected_versions: affected,
+      vector: null,
+      complexity: null,
+      patch_available: null,
+      patch_required_reboot: false,
+      live_patch_available: null,
+      live_patch_tools: [],
+      framework_control_gaps: null,
+      atlas_refs: [],
+      attack_refs: [],
+      rwep_score: null,
+      rwep_factors: null,
+      rwep_notes: "Auto-imported from GHSA. RWEP factors require editorial review before this entry passes the strict catalog gate.",
+      epss_score: null,
+      epss_percentile: null,
+      epss_date: null,
+      epss_source: adv.cve_id ? `https://api.first.org/data/v1/epss?cve=${adv.cve_id}` : null,
+      source_verified: new Date().toISOString().slice(0, 10),
+      verification_sources: [
+        ...(adv.html_url ? [adv.html_url] : []),
+        ...(adv.cve_id ? [`https://nvd.nist.gov/vuln/detail/${adv.cve_id}`] : []),
+        ...(adv.references || []).slice(0, 10),
+      ],
+      vendor_advisories: [
+        {
+          vendor: "GitHub Security Advisories",
+          advisory_id: adv.ghsa_id || null,
+          url: adv.html_url || `https://github.com/advisories?query=${encodeURIComponent(adv.cve_id)}`,
+          severity: severity || null,
+          published_date: (adv.published_at || "").slice(0, 10) || null,
+        },
+      ],
+      iocs: null,
+      _auto_imported: true,
+      _draft: true,
+      _draft_reason: "Imported from GHSA on " + new Date().toISOString().slice(0, 10) + ". Editorial fields (framework_control_gaps, atlas_refs, attack_refs, iocs, vector, complexity, rwep_factors) require human review. Run `exceptd run sbom --evidence -` against an affected repo to gather IoCs; consult MITRE ATLAS + ATT&CK catalogs for refs.",
+      _source_ghsa_id: adv.ghsa_id || null,
+      _source_published_at: adv.published_at || null,
+      last_updated: new Date().toISOString().slice(0, 10),
+    },
+  };
+}
+
+/**
+ * Build a refresh diff for the existing refresh-external orchestrator.
+ * Compares the latest 50 advisories' CVE IDs against the local catalog;
+ * any CVE ID not in the catalog becomes an "add" diff.
+ */
+async function buildDiff(ctx) {
+  const result = await fetchAdvisories({});
+  if (!result.ok) {
+    return { status: "unreachable", diffs: [], errors: 1, summary: `GHSA fetch failed: ${result.error}` };
+  }
+  const existing = new Set(Object.keys(ctx.cveCatalog || {}).filter(k => /^CVE-/.test(k)));
+  const diffs = [];
+  for (const adv of result.advisories) {
+    if (!adv.cve_id) continue;
+    if (existing.has(adv.cve_id)) continue;
+    const normalized = normalizeAdvisory(adv);
+    if (!normalized) continue;
+    diffs.push({
+      id: adv.cve_id,
+      field: "_new_entry",
+      before: null,
+      after: normalized[adv.cve_id],
+      severity: adv.severity || null,
+      source: "ghsa",
+    });
+  }
+  return {
+    status: "ok",
+    diffs,
+    errors: 0,
+    summary: `GHSA returned ${result.advisories.length} reviewed advisories; ${diffs.length} new CVE ID(s) not yet in local catalog.`,
+    rate_limit: result.rate_limit || null,
+  };
+}
+
+module.exports = { fetchAdvisories, fetchAdvisoryById, normalizeAdvisory, buildDiff };

package/lib/validate-cve-catalog.js

@@ -172,14 +172,30 @@ function main() {
   const lessonKeys = new Set(Object.keys(lessons).filter((k) => !k.startsWith('_')));
 
   let failed = 0;
+  let drafts = 0;
   for (const key of cveKeys) {
     const entry = catalog[key];
+    // v0.12.0: GHSA-imported drafts are flagged `_auto_imported: true` +
+    // `_draft: true`. They pass validation as WARNINGS (printed but not
+    // exit-failing) so the nightly auto-PR pipeline can ship them while
+    // editorial fields await human or AI-assisted enrichment via
+    // `exceptd run cve-curation --advisory <id>`.
+    const isDraft = entry && (entry._auto_imported === true || entry._draft === true);
     const errors = validate(entry, schema, 'cve', key);
-    if (!lessonKeys.has(key)) {
+    if (!lessonKeys.has(key) && !isDraft) {
       errors.push(
         `${key}: missing matching entry in data/zeroday-lessons.json (rule #6: zero-day learning is live)`,
       );
     }
+    if (isDraft) {
+      drafts++;
+      if (!opts.quiet) {
+        console.log(`DRAFT ${key} (auto-imported — needs editorial review)`);
+        for (const e of errors) console.log(`        - [warn] ${e}`);
+      }
+      // Drafts don't increment `failed` — they're warnings, not errors.
+      continue;
+    }
     if (errors.length === 0) {
       if (!opts.quiet) console.log(`PASS  ${key}`);
     } else {
@@ -203,10 +219,11 @@ function main() {
   }
 
   const total = cveKeys.length;
-  const passed = total - failed;
-  console.log(
-    `\n${passed}/${total} CVE entries validated${failed ? `, ${failed} failed` : ''}.`,
-  );
+  const passed = total - failed - drafts;
+  const summary = `\n${passed}/${total} CVE entries validated` +
+    (drafts ? `, ${drafts} draft(s) (auto-imported)` : '') +
+    (failed ? `, ${failed} failed` : '') + '.';
+  console.log(summary);
   process.exit(failed === 0 ? 0 : 1);
 }
 

package/manifest-snapshot.json

@@ -1,6 +1,6 @@
 {
   "_comment": "Auto-generated by scripts/refresh-manifest-snapshot.js — do not hand-edit. Public skill surface used by check-manifest-snapshot.js to detect breaking removals.",
-  "_generated_at": "2026-05-13T01:22:11.901Z",
+  "_generated_at": "2026-05-13T02:31:32.493Z",
   "atlas_version": "5.1.0",
   "skill_count": 38,
   "skills": [