@blamejs/exceptd-skills 0.12.13 → 0.12.16

package/keys/EXPECTED_FINGERPRINT

@@ -0,0 +1 @@
+SHA256:JX04VjFprM7+3gHJdO0Wi4tTCf1RKI9Roza3XOzAe0Y=

package/lib/auto-discovery.js

@@ -31,6 +31,31 @@ const fs = require("fs");
 const path = require("path");
 const { scoreCustom } = require("./scoring");
 
+// audit M P1-C: stored rwep_factors must reproduce the stored rwep_score.
+// `buildScoringInputs` is the single source of truth for both — it captures
+// the conservative defaults applied to a freshly-imported KEV draft (CISA
+// only lists vulnerabilities with documented exploitation, so we assume a
+// public PoC exists; reboot defaults to true because most KEV-listed CVEs
+// land in the kernel / hypervisor / vendor firmware where reboot is the
+// norm). The same input object is then handed to scoreCustom for the score
+// AND mapped into the `rwep_factors` shape stored on the draft. Calling
+// scoring.validate() on the post-import catalog will no longer flag every
+// auto-imported draft for divergence > 5.
+function buildScoringInputs(kevEntry /*, nvdPayload */) {
+  void kevEntry;
+  return {
+    cisa_kev: true,
+    poc_available: true,
+    ai_assisted_weapon: false,
+    ai_discovered: false,
+    active_exploitation: "suspected",
+    blast_radius: 15,
+    patch_available: false,
+    live_patch_available: false,
+    reboot_required: true,
+  };
+}
+
 const TODAY = new Date().toISOString().slice(0, 10);
 const TIMEOUT_MS = 10_000;
 const USER_AGENT = "exceptd-security/auto-discovery (+https://exceptd.com)";
@@ -110,37 +135,17 @@ function buildKevDraftEntry(kevEntry, nvdPayload, epssPayload) {
   const knownRansomware =
     String(kevEntry.knownRansomwareCampaignUse || "").toLowerCase() === "known";
 
-  // Compute initial RWEP. KEV → +25, suspected exploitation → +10.
-  // Unknown PoC/AI flags default to false (conservative — we don't
-  // claim more than we know). Blast radius defaults to 15 (mid-range)
-  // since we can't infer it from KEV metadata alone.
-  const rwep_factors = {
-    cisa_kev: true,
-    poc_available: null,                  // unknown — curation needed
-    ai_assisted_weapon: null,
-    ai_discovered: null,
-    active_exploitation: "suspected",     // KEV listing implies exploitation
-    blast_radius: 15,
-    patch_available: null,
-    live_patch_available: null,
-    reboot_required: null,
-  };
-  // scoreCustom() treats null fields as false, which under-counts the
-  // score. Pass concrete defaults for unknowns: poc_available=true is
-  // the conservative assumption for KEV entries (CISA generally only
-  // adds entries with documented exploitation), and reboot_required=
-  // true biases toward urgency.
-  const rwep_score = scoreCustom({
-    cisa_kev: true,
-    poc_available: true,
-    ai_assisted_weapon: false,
-    ai_discovered: false,
-    active_exploitation: "suspected",
-    blast_radius: 15,
-    patch_available: false,
-    live_patch_available: false,
-    reboot_required: true,
-  });
+  // audit M P1-C: stored rwep_factors and computed rwep_score MUST agree.
+  // Previously rwep_factors held nulls (for unknown poc/ai/reboot) but
+  // rwep_score was computed from concrete defaults (poc=true, reboot=true).
+  // `scoring.validate()` then flagged every auto-imported draft for
+  // divergence > 5. Now: one canonical input object → both surfaces.
+  // The curation flow rewrites these once an operator answers the editorial
+  // questions; until then, the boolean shape on rwep_factors is the
+  // conservative-default snapshot and reproduces the score exactly.
+  const scoringInputs = buildScoringInputs(kevEntry, nvdPayload);
+  const rwep_factors = { ...scoringInputs };
+  const rwep_score = scoreCustom(scoringInputs);
 
   const product = [kevEntry.vendorProject, kevEntry.product]
     .filter(Boolean)
@@ -184,10 +189,21 @@ function buildKevDraftEntry(kevEntry, nvdPayload, epssPayload) {
       "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
       kevEntry.notes ? String(kevEntry.notes) : null,
     ].filter(Boolean),
-    source_verified: false,
+    // v0.12.15 (audit M P1-B): schema requires source_verified to be a
+    // YYYY-MM-DD string OR null; the prior `false` boolean produced an
+    // entry that failed strict catalog validation. Use null to mean
+    // "not yet verified" — operators populate the date during curation.
+    source_verified: null,
     last_updated: TODAY,
     last_verified: TODAY,
-    _auto_imported: {
+    // v0.12.15 (audit M P1-D): `_auto_imported` must be the boolean `true`
+    // for lib/validate-cve-catalog.js's draft-recognition check (strict
+    // `=== true` comparison). The prior object-shape was non-recognizable
+    // and the strict validator treated KEV-discovered drafts as
+    // hard-error entries instead of warning-tier drafts. The provenance
+    // metadata that used to be inline now lives in `_auto_imported_meta`.
+    _auto_imported: true,
+    _auto_imported_meta: {
       source: "KEV discovery",
       imported_at: TODAY,
       curation_needed: [
@@ -476,14 +492,20 @@ async function discoverNewRfcs(ctx, opts = {}) {
       skills_referencing: [],
       errata_count: null,
       last_verified: TODAY,
-      _auto_imported: {
+      // v0.12.15 (audit M P1-D, P3-T): boolean `_auto_imported: true` for
+      // strict-validator recognition; provenance moved to sibling
+      // `_auto_imported_meta`. Errata-URL hint converted to a real template
+      // literal so the rfc number actually interpolates (the previous double-
+      // quoted string left `${number}` as literal text in operator output).
+      _auto_imported: true,
+      _auto_imported_meta: {
         source: `RFC discovery (IETF ${wg} working group)`,
         imported_at: TODAY,
         curation_needed: [
           "relevance — project-specific framing of how this RFC matters for mid-2026 threats",
           "lag_notes — what gaps remain or where the RFC falls short",
           "skills_referencing — list of skills that should cite this RFC",
-          "errata_count — populate from <rfc-editor.org/errata/rfc${number}>",
+          `errata_count — populate from <rfc-editor.org/errata/rfc${number}>`,
         ],
       },
     };

package/lib/cross-ref-api.js

@@ -21,6 +21,15 @@ const INDEX_DIR = path.join(DATA_DIR, '_indexes');
 
 const _cache = new Map();
 
+// v0.12.14 (audit C-F7): catalog corruption no longer crashes the runner
+// uncaught. A malformed JSON file in data/ used to produce a SyntaxError
+// at require-time of any consumer (lib/playbook-runner.js), which threw
+// out of the run() entrypoint without honoring AGENTS.md's "non-zero
+// exit + {ok:false, error} to stderr" contract. Now: caught + degraded
+// to an empty catalog with a recorded _loadError that downstream code
+// can inspect.
+const _loadErrors = [];
+
 function loadCatalog(filename) {
   if (_cache.has(filename)) return _cache.get(filename);
   const full = path.join(DATA_DIR, filename);
@@ -28,9 +37,17 @@ function loadCatalog(filename) {
     _cache.set(filename, {});
     return {};
   }
-  const parsed = JSON.parse(fs.readFileSync(full, 'utf8'));
-  _cache.set(filename, parsed);
-  return parsed;
+  try {
+    const parsed = JSON.parse(fs.readFileSync(full, 'utf8'));
+    _cache.set(filename, parsed);
+    return parsed;
+  } catch (e) {
+    _loadErrors.push({ kind: 'catalog', file: filename, error: e.message });
+    const stub = {};
+    Object.defineProperty(stub, '_loadError', { value: e.message, enumerable: false });
+    _cache.set(filename, stub);
+    return stub;
+  }
 }
 
 function loadIndex(filename) {
@@ -40,9 +57,21 @@ function loadIndex(filename) {
     _cache.set('idx:' + filename, {});
     return {};
   }
-  const parsed = JSON.parse(fs.readFileSync(full, 'utf8'));
-  _cache.set('idx:' + filename, parsed);
-  return parsed;
+  try {
+    const parsed = JSON.parse(fs.readFileSync(full, 'utf8'));
+    _cache.set('idx:' + filename, parsed);
+    return parsed;
+  } catch (e) {
+    _loadErrors.push({ kind: 'index', file: filename, error: e.message });
+    const stub = {};
+    Object.defineProperty(stub, '_loadError', { value: e.message, enumerable: false });
+    _cache.set('idx:' + filename, stub);
+    return stub;
+  }
+}
+
+function getLoadErrors() {
+  return _loadErrors.slice();
 }
 
 function entries(catalog) {
@@ -221,4 +250,8 @@ module.exports = {
   // Lower-level access (engine uses these directly)
   _loadCatalog: loadCatalog,
   _loadIndex: loadIndex,
+  // v0.12.14: surface accumulated catalog/index load errors. Returns
+  // [{kind, file, error}, ...] for every catalog/index whose JSON
+  // parse failed. Empty array on a healthy install.
+  getLoadErrors,
 };

package/lib/cve-curation.js

@@ -43,6 +43,14 @@ const path = require("path");
 //      before deciding promotion.
 const { withCatalogLock } = require("./refresh-external");
 const { validate: validateAgainstSchema } = require("./validate-cve-catalog");
+// audit J F3: derive rwep_score via the canonical scoring helper rather
+// than a blind `Object.values(...).reduce(sum)`. The helper detects shape
+// (boolean inputs → scoreCustom; post-weight numeric inputs → sum + clamp)
+// so the curation apply-path produces a score that matches whatever the
+// catalog scorer or playbook-runner would have produced for the same
+// factors. Direct dependency on scoring.js is intentional — scoring.js is
+// the authoritative formula.
+const { deriveRwepFromFactors } = require("./scoring");
 
 const ROOT = path.resolve(__dirname, "..");
 const CVE_SCHEMA_PATH = path.join(ROOT, "lib", "schemas", "cve-catalog.schema.json");
@@ -50,11 +58,18 @@ let _cveSchemaCache = null;
 function loadCveEntrySchema() {
   if (_cveSchemaCache) return _cveSchemaCache;
   try {
+    // v0.12.15 (audit M P1-A): the prior version of this function looked for
+    // either `root.patternProperties["^CVE-\\d{4}-\\d+$"]` or an object
+    // `root.additionalProperties`. The actual schema at lib/schemas/cve-
+    // catalog.schema.json has NEITHER — its top level IS the entry shape
+    // (`{type:'object', required:[...], properties: {...}}`) because
+    // validate-cve-catalog.js iterates each CVE id key manually and runs
+    // the schema validator over each value. Result: loadCveEntrySchema()
+    // always returned null, the v0.12.12 codex P1 #1 fix (strict-schema
+    // gating of promotion) was silently disabled, and schema-violating
+    // entries promoted anyway. Use the root schema directly.
     const root = JSON.parse(fs.readFileSync(CVE_SCHEMA_PATH, "utf8"));
-    const entrySchema =
-      (root.patternProperties && root.patternProperties["^CVE-\\d{4}-\\d+$"]) ||
-      (root.additionalProperties && typeof root.additionalProperties === "object" ? root.additionalProperties : null);
-    _cveSchemaCache = entrySchema || null;
+    _cveSchemaCache = root || null;
     return _cveSchemaCache;
   } catch {
     return null;
@@ -264,7 +279,13 @@ function buildQuestionnaire(cveId, draft) {
   // Pull candidate catalogs. Each is optional — missing catalogs are skipped
   // gracefully. J7 makes these one-shot loads per process.
   const atlas = loadJson("data/atlas-ttps.json");
-  const attack = loadJson("data/attack-ttps.json");
+  // v0.12.15 (audit M P1-E): the catalog ships as data/attack-techniques.json
+  // (renamed from data/attack-ttps.json before the v0.12.12 release; the
+  // canonical file path is also what lib/validate-cve-catalog.js consumes).
+  // The prior `data/attack-ttps.json` lookup silently fell back to an empty
+  // object via loadJsonRaw's ENOENT handling, so the ATT&CK candidate
+  // questionnaire branch always returned zero proposals.
+  const attack = loadJson("data/attack-techniques.json");
   const cwe = loadJson("data/cwe-catalog.json");
   const frameworkGaps = loadJson("data/framework-control-gaps.json");
 
@@ -549,17 +570,15 @@ function applyAnswersUnderLock(cveId, catalog, catalogPath, answers) {
     appliedFields.push(field);
   }
 
-  // Derive rwep_score from rwep_factors when factors supplied without an
-  // explicit score. lib/scoring.js owns the canonical formula; we sum the
-  // numeric values here as a fallback.
+  // audit J F3: derive rwep_score via the canonical scoring helper rather
+  // than a blind sum. deriveRwepFromFactors detects shape (boolean inputs
+  // → scoreCustom; post-weight numeric inputs → sum + clamp) and routes
+  // accordingly, so the apply-path produces a score that agrees with
+  // scoring.validate() instead of diverging from it.
   if ("rwep_factors" in answers && !("rwep_score" in answers)
       && entry.rwep_factors && typeof entry.rwep_factors === "object") {
-    let sum = 0;
-    for (const v of Object.values(entry.rwep_factors)) {
-      if (typeof v === "number") sum += v;
-    }
-    entry.rwep_score = Math.max(0, Math.min(100, sum));
-    appliedFields.push("rwep_score (derived from rwep_factors)");
+    entry.rwep_score = deriveRwepFromFactors(entry.rwep_factors);
+    appliedFields.push("rwep_score (derived from rwep_factors via scoring.deriveRwepFromFactors)");
   }
 
   // last_updated reflects the apply moment.

package/lib/lint-skills.js

@@ -635,8 +635,13 @@ function loadContext() {
  */
 function findOrphanSkillFiles(manifestSkills) {
   if (!fs.existsSync(SKILLS_DIR)) return [];
+  // F19 — manifest paths are stored as forward-slash strings by contract
+  // (lib/verify.js validateSkillPath() rejects backslashes). The previous
+  // path.sep split was a no-op on Linux and incorrect on Windows when
+  // mixed separators arrived through other ingest paths; the cleaner
+  // contract is to normalise the comparison key directly.
   const referenced = new Set(
-    manifestSkills.map((s) => s.path.split(path.sep).join('/')),
+    manifestSkills.map((s) => String(s.path).replace(/\\/g, '/')),
   );
   const orphans = [];
   for (const entry of fs.readdirSync(SKILLS_DIR, { withFileTypes: true })) {