@blamejs/exceptd-skills 0.12.40 → 0.13.0

package/orchestrator/index.js

@@ -27,6 +27,7 @@ const { dispatch, routeQuery, getSkillContext } = require('./dispatcher');
 const { currencyCheck, initPipeline } = require('./pipeline');
 const { bus, EVENT_TYPES } = require('./event-bus');
 const { start: startScheduler, stop: stopScheduler, runCurrencyNow } = require('./scheduler');
+const { EXIT_CODES, safeExit } = require('../lib/exit-codes');
 
 const cmd = process.argv[2];
 const args = process.argv.slice(3);
@@ -145,7 +146,12 @@ Examples:
   exceptd framework-gap NIST-800-53 CVE-2026-31431
   exceptd framework-gap PCI-DSS-4.0 "prompt injection"
   exceptd framework-gap all CVE-2025-53773 --json`);
-    process.exit(2);
+    // v0.13 exit-code class fix: usage error is GENERIC_FAILURE (1),
+    // not DETECTED_ESCALATE (2). Pre-v0.13 the orchestrator emitted
+    // exit 2 for usage errors, colliding with CI gates that branch on
+    // exit 2 to mean "verb ran + detected escalation-worthy finding".
+    safeExit(EXIT_CODES.GENERIC_FAILURE);
+    return;
   }
 
   const root = path.join(__dirname, '..');
@@ -155,7 +161,8 @@ Examples:
     cveCatalog = JSON.parse(fs.readFileSync(path.join(root, 'data', 'cve-catalog.json'), 'utf8'));
   } catch (err) {
     console.error(`[framework-gap] cannot read catalog: ${err.message}`);
-    process.exit(2);
+    safeExit(EXIT_CODES.GENERIC_FAILURE);
+    return;
   }
 
   const requested = args[0].toLowerCase() === 'all'
@@ -292,20 +299,20 @@ async function runDispatch() {
 
 function runSkillContext(skillName) {
   if (!skillName) {
-    // Cycle 20 A P2 (v0.12.40): operator-facing surface must reference
-    // the canonical `exceptd skill <name>` form, not the orchestrator
-    // path that's an implementation detail. CLAUDE.md global rule:
-    // "no internal narrative in operator-facing artifacts."
     console.error('Usage: exceptd skill <skill-name>');
     console.error('       (Lists available skills: exceptd brief --all)');
-    process.exit(1);
+    safeExit(EXIT_CODES.GENERIC_FAILURE);
+    return;
   }
 
   const context = getSkillContext(skillName);
   if (!context) {
-    // Unified error shape across the CLI surface — see v0.10.3 bug #18.
-    process.stderr.write(JSON.stringify({ ok: false, error: `Skill not found: ${skillName}`, verb: "skill", hint: "Run `exceptd brief --all` or check skills/ for available skill IDs." }) + "\n");
-    process.exit(1);
+    // v0.13 envelope harmonization: ok:false bodies land on stdout
+    // alongside successful results so a single consumer can parse the
+    // verb's envelope without splitting across two streams.
+    process.stdout.write(JSON.stringify({ ok: false, verb: "skill", error: `Skill not found: ${skillName}`, hint: "Run `exceptd brief --all` or check skills/ for available skill IDs." }) + "\n");
+    safeExit(EXIT_CODES.GENERIC_FAILURE);
+    return;
   }
 
   console.log(`Skill: ${context.skill.name} v${context.skill.version}`);
@@ -332,7 +339,7 @@ function runPipeline(triggerType, payload) {
     console.log(`  Agent: ${stage.agent_path}`);
   }
   console.log('\nTo run each stage, load the agent definition and follow its instructions:');
-  console.log('  node orchestrator/index.js skill skill-update-loop');
+  console.log('  exceptd skill skill-update-loop');
   return run;
 }
 
@@ -368,12 +375,18 @@ async function runReport(format) {
   // string. Now: reject with structured JSON error matching other verbs.
   const VALID_REPORT_FORMATS = ['executive', 'technical', 'compliance', 'csaf'];
   if (!VALID_REPORT_FORMATS.includes(format)) {
-    process.stderr.write(JSON.stringify({
+    // v0.13 envelope harmonization: ok:false body on stdout, exit 1
+    // (GENERIC_FAILURE) not 2 (DETECTED_ESCALATE). Pre-v0.13 the
+    // body went to stderr and exit was 2; both broke CI consumers
+    // that expected the dispatch-error vs verb-finding distinction.
+    process.stdout.write(JSON.stringify({
       ok: false,
-      error: `report: format "${format}" not in accepted set ${JSON.stringify(VALID_REPORT_FORMATS)}.`,
       verb: 'report',
+      error: `report: format "${format}" not in accepted set ${JSON.stringify(VALID_REPORT_FORMATS)}.`,
+      accepted_formats: VALID_REPORT_FORMATS,
     }) + '\n');
-    process.exit(2);
+    safeExit(EXIT_CODES.GENERIC_FAILURE);
+    return;
   }
 
   // v0.11.1 feature #55: `report csaf` emits a CSAF 2.0 envelope covering
@@ -693,7 +706,8 @@ async function runValidateCves(rawArgs = []) {
     catalog = JSON.parse(fs.readFileSync(catalogPath, 'utf8'));
   } catch (err) {
     console.error(`[validate-cves] cannot read ${catalogPath}: ${err.message}`);
-    process.exit(2);
+    safeExit(EXIT_CODES.GENERIC_FAILURE);
+    return;
   }
 
   // --since <ISO|YYYY-MM-DD>: scope-limit validation to CVEs whose
@@ -863,7 +877,7 @@ async function runValidateCves(rawArgs = []) {
   }
   if (driftFound > 0) {
     console.log(`\n[validate-cves] DRIFT DETECTED on ${driftFound} CVE(s). Update data/cve-catalog.json and bump source_verified.`);
-    if (!noFail) process.exit(1);
+    if (!noFail) { safeExit(EXIT_CODES.GENERIC_FAILURE); return; }
   } else {
     console.log('[validate-cves] No drift detected against reachable sources.');
   }
@@ -914,7 +928,8 @@ async function runValidateRfcs(rawArgs = []) {
     refs = JSON.parse(fs.readFileSync(refsPath, 'utf8'));
   } catch (err) {
     console.error(`[validate-rfcs] cannot read ${refsPath}: ${err.message}`);
-    process.exit(2);
+    safeExit(EXIT_CODES.GENERIC_FAILURE);
+    return;
   }
 
   // --since <ISO|YYYY-MM-DD>: scope-limit (parity with validate-cves).
@@ -1043,7 +1058,7 @@ async function runValidateRfcs(rawArgs = []) {
   console.log();
   if (driftFound > 0) {
     console.log(`[validate-rfcs] DRIFT DETECTED on ${driftFound} entry(ies). Update data/rfc-references.json and bump last_verified.`);
-    if (!noFail) process.exit(1);
+    if (!noFail) { safeExit(EXIT_CODES.GENERIC_FAILURE); return; }
   } else if (unreachable > 0) {
     console.log(`[validate-rfcs] ${unreachable} entry(ies) unreachable. Network/IETF Datatracker is intermittent — re-run later.`);
   } else if (!offline && validator) {
@@ -1078,7 +1093,8 @@ function runWatchlist(rawArgs = []) {
     manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
   } catch (err) {
     console.error(`[watchlist] cannot read ${manifestPath}: ${err.message}`);
-    process.exit(2);
+    safeExit(EXIT_CODES.GENERIC_FAILURE);
+    return;
   }
 
   // Exclude entries that are explicitly marked `status: "deprecated"` so
@@ -1125,7 +1141,12 @@ function runWatchlist(rawArgs = []) {
 
   const jsonOut = rawArgs.includes('--json');
   if (jsonOut) {
+    // v0.13.0 envelope harmonization: top-level `ok: true` so every
+    // verb's JSON body shares the contract whether emitted by
+    // bin/exceptd.js emit() (which auto-defaults `ok`) or by the
+    // orchestrator dispatch (which writes stdout directly).
     const out = {
+      ok: true,
       generated_at: new Date().toISOString(),
       skills_scanned: skills.length,
       parse_errors: parseErrors,
@@ -1378,11 +1399,11 @@ Environment variables:
   EXCEPTD_SCAN_TARGETS Directories to scan for MCP configs
 
 Examples:
-  node orchestrator/index.js scan
-  node orchestrator/index.js skill kernel-lpe-triage
-  node orchestrator/index.js currency
-  node orchestrator/index.js report executive
-  node orchestrator/index.js watch
+  exceptd scan
+  exceptd skill kernel-lpe-triage
+  exceptd currency
+  exceptd report executive
+  exceptd watch
 `);
 }
 
@@ -1394,7 +1415,7 @@ Examples:
 if (require.main === module) {
   main().catch(err => {
     console.error('[orchestrator] Fatal:', err.message);
-    process.exit(1);
+    process.exitCode = 1;
   });
 }
 

package/orchestrator/scheduler.js

@@ -277,12 +277,12 @@ function runMonthlyCveValidation() {
   console.log(`[scheduler] Monthly CVE validation reminder — ${timestamp}`);
   console.log('[scheduler] Action: Verify all data/cve-catalog.json entries against NVD and CISA KEV.');
   console.log('[scheduler] Action: Update last_verified dates in data/exploit-availability.json.');
-  console.log('[scheduler] Run: node orchestrator/index.js validate-cves');
+  console.log('[scheduler] Run: exceptd validate-cves');
 
   return {
     task: 'monthly_cve_validation',
     timestamp,
-    action: 'Run node orchestrator/index.js validate-cves to check all CVE entries'
+    action: 'Run `exceptd validate-cves` to check all CVE entries'
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.12.40",
+  "version": "0.13.0",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 10 catalogs, 34 jurisdictions, pre-computed indexes, Ed25519-signed.",
   "keywords": [
     "ai-security",