@blamejs/exceptd-skills 0.13.6 → 0.13.7

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.13.7 — 2026-05-18
+
+Catalog cross-reference closure + two test-isolation fixes that surfaced after the v0.13.6 expansion.
+
+### Bugs
+
+**`exceptd doctor --ai-config` now matches the canonical Windsurf MCP config path.** The audit walker uses `SENSITIVE_PATTERNS` to identify files that need mode 0o600. Prior regex `/\.mcp_config\.json$/` required a literal `.` before `mcp_config.json` — so `~/.codeium/windsurf/mcp_config.json` (the real-world install path, no leading dot) was silently skipped. New regex `^mcp_config\.json$` covers the bare filename while `\.mcp_config\.json$` is kept for vendor-prefixed variants like `default.mcp_config.json`.
+
+**`refresh-external --from-fixture` no longer falls through to live RSS for the advisories source.** Fixture mode populated frozen payloads for kev / epss / nvd / rfc / pins / ghsa / osv but left the advisories poller (Qualys / RHSA / USN / ZDI / kernel.org / oss-security / JFrog / CISA) unfixturized — it called `fetch()` against the real RSS endpoints. Back-to-back fixture-mode runs (sequential vs `--swarm`) hit moving upstream data within the 10-15s test window and the `swarm and sequential reports diverge` assertion fired intermittently on macOS runners. The fixture loader now reads `tests/fixtures/refresh/advisories.json` into `ctx.fixtures.advisories` so all 8 feeds resolve to frozen content. New regression pin verifies `8/8 feeds reachable` from the fixture instead of any live count.
+
+### Features
+
+**42 new framework-control-gap entries** close every orphan forward reference introduced by the v0.13.6 catalog expansion. Coverage spans NIST 800-53 (IA-8, AU-9, SC-5), ISO 27001:2022 (A.5.21, A.8.9, A.8.15, A.8.21, A.8.24), PCI DSS 4.0 (2.2.3, 3.5, 6.2.4, 6.3.2, 10.5), OWASP LLM Top 10 (LLM01, LLM02, LLM05, LLM06, LLM07), OWASP API / Top 10 / SAMM, FedRAMP (AC-3, AC-4, SC-4, SC-7), EU AI Act Art.10 + Art.15, ISO/IEC 42001-AIMS (root + A.6.2.5), CIS Controls v8 7.4, ENISA mobile / IoT secure baselines, GDPR Art.32, NIS2 Art.21 availability, ATLAS AML.T0048, DORA Art.10, SLSA-3, OpenSSF Scorecard PinnedDependenciesID, NIST 800-218 SSDF (PO.4.2, PW.7.1). Each entry carries operator-facing `designed_for` / `misses[]` / `real_requirement` text and at least one evidence CVE from the v0.13.6 additions. `framework-control-gaps.json` total: 142 → 184.
+
+The high-leverage closures: `EU-AI-Act-Art15` (10 CVE anchors covering inference-server bundled-codec RCE, agentic-IDE command-injection, managed-AI-service SSRF, AI-platform overlay privesc, serialization-injection); `SLSA-3` (sleeper-package temporal-trust failure mode that L3-correct provenance alone does not catch); `ISO-IEC-42001-AIMS-A.6.2.5` (AIMS lifecycle gates extended to IDE-resident agentic primitives and managed-AI-platform overlays).
+
 ## 0.13.6 — 2026-05-18
 
 CVE catalog expansion (38 → 67 entries) covering threat classes the catalog previously did not address, plus a `doctor` undercount fix.

package/bin/exceptd.js

@@ -5557,9 +5557,16 @@ function cmdDoctor(runner, args, runOpts, pretty) {
       { dir: '.continue', display: '~/.continue' },
     ];
     // Files within those dirs that warrant the strict-mode check.
+    // v0.13.7: prior `/\.mcp_config\.json$/` regex required a literal `.`
+    // before `mcp_config.json`, so the real-world Windsurf install path
+    // (`~/.codeium/windsurf/mcp_config.json` — no leading dot) was
+    // silently missed by the audit. `^mcp_config\.json$` now matches the
+    // bare filename, and the trailing `.mcp_config.json` form is kept
+    // for vendor variants that prefix with a tag (e.g. `default.mcp_config.json`).
     const SENSITIVE_PATTERNS = [
       /^settings\.json$/,
       /^mcp\.json$/,
+      /^mcp_config\.json$/,
       /\.mcp_config\.json$/,
       /^api_key/,
       /\.token$/,

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-18T07:02:32.618Z",
+  "generated_at": "2026-05-18T14:18:03.242Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "fac154a4d63a13c1289d3498abab8d28433c30b79393e63f49c6a2ce21f7922e",
+    "manifest.json": "dc4472e1476028be9f69537ae5b19998b32eeaa6951bacf570898ed4abdef2d1",
     "data/atlas-ttps.json": "c2aee9c70ec24cf48f1ea4daf170aa6e7b93292888239c46a8ec9e522ee32119",
     "data/attack-techniques.json": "29cd5690040c7153dbf293b7e3a99b72fc897b0495478e369f7ce7004b8d64f4",
     "data/cve-catalog.json": "b3731361d298483648264215fd8dbfca36d0f4e2ead4aebf7c49718e12038e1f",
@@ -12,7 +12,7 @@
     "data/d3fend-catalog.json": "a1fc2827ceb344669e148d55197dbf1b0e5b20bcc618e90517639c17d67ee82d",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
     "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
-    "data/framework-control-gaps.json": "d49c75de55e6e1dabec46e6e975619489a2093b0be53c2a0b654e5c1826fbe46",
+    "data/framework-control-gaps.json": "a8bb654f6ed2fba5290dc6acac73ee423c1afcb2dca27bce3303adc3ee40f791",
     "data/global-frameworks.json": "9ba563a85f7f8d6c3c957de64945e20925a89d0ed6ea6fc561cf093811acf558",
     "data/rfc-references.json": "e253a548c8a829d178d5aea601e268724b85c936ccbfa51c2e5d80c5f8efe2b0",
     "data/zeroday-lessons.json": "bb3fec080f649a5968f8d0c6d69ca4d32fb120de0f7d07b1f5058184d4d3ff3a",

package/data/_indexes/activity-feed.json

@@ -13,6 +13,14 @@
       "schema_version": "1.0.0",
       "entry_count": 67
     },
+    {
+      "date": "2026-05-18",
+      "type": "catalog_update",
+      "artifact": "data/framework-control-gaps.json",
+      "path": "data/framework-control-gaps.json",
+      "schema_version": "1.0.0",
+      "entry_count": 184
+    },
     {
       "date": "2026-05-18",
       "type": "catalog_update",
@@ -73,14 +81,6 @@
       "schema_version": "1.1.0",
       "entry_count": 28
     },
-    {
-      "date": "2026-05-15",
-      "type": "catalog_update",
-      "artifact": "data/framework-control-gaps.json",
-      "path": "data/framework-control-gaps.json",
-      "schema_version": "1.0.0",
-      "entry_count": 142
-    },
     {
       "date": "2026-05-15",
       "type": "catalog_update",

package/data/_indexes/catalog-summaries.json

@@ -163,7 +163,7 @@
       "path": "data/framework-control-gaps.json",
       "purpose": "Per-control framework gap declarations: SI-2, A.8.8, PCI 6.3.3, etc. Each entry names the control, the lag, the evidence CVE, and remediation guidance.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-05-15",
+      "last_updated": "2026-05-18",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -172,7 +172,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 142,
+      "entry_count": 184,
       "sample_keys": [
         "ALL-AI-PIPELINE-INTEGRITY",
         "ALL-MCP-TOOL-TRUST",

package/data/_indexes/frequency.json

@@ -2519,6 +2519,7 @@
       "D3-SFA"
     ],
     "framework_gaps": [
+      "ATLAS-AML.T0048",
       "AU-Essential-8-App-Hardening",
       "AU-Essential-8-Backup",
       "AU-Essential-8-MFA",
@@ -2526,55 +2527,96 @@
       "AU-ISM-1546",
       "AU-ISM-1808",
       "CIS-Controls-v8-10.1",
+      "CIS-Controls-v8-7.4",
       "CIS-Controls-v8-Control6",
       "CIS-Kubernetes-Benchmark-4.2.13",
       "CIS-Kubernetes-Benchmark-5.3",
       "CIS-Kubernetes-Benchmark-5.7",
       "DORA-Art-9",
+      "DORA-Art10",
       "DORA-Art28",
       "DORA-IA-CTPP-Oversight",
       "DORA-ITS-TLPT",
       "DORA-RTS-Incident-Classification",
       "DORA-RTS-Subcontracting",
+      "ENISA-IoT-security-baseline",
+      "ENISA-mobile-secure-baseline",
       "EU-AI-Act-Annex-IX-Conformity",
       "EU-AI-Act-Art-15",
       "EU-AI-Act-Art-53-GPAI",
       "EU-AI-Act-Art-55-Systemic",
+      "EU-AI-Act-Art10",
+      "EU-AI-Act-Art15",
       "EU-AI-Act-GPAI-CoP",
       "EU-CRA-Art13",
+      "FedRAMP-AC-3",
+      "FedRAMP-AC-4",
+      "FedRAMP-SC-4",
+      "FedRAMP-SC-7",
+      "GDPR-Art32",
       "HIPAA-Security-Rule-2026-NPRM-164.308",
       "HIPAA-Security-Rule-2026-NPRM-164.310",
       "HIPAA-Security-Rule-2026-NPRM-164.312",
       "HIPAA-Security-Rule-2026-NPRM-164.314",
       "ISO-27001-2022-A.5.15",
+      "ISO-27001-2022-A.5.21",
       "ISO-27001-2022-A.5.7",
       "ISO-27001-2022-A.8.13",
+      "ISO-27001-2022-A.8.15",
+      "ISO-27001-2022-A.8.21",
       "ISO-27001-2022-A.8.22",
+      "ISO-27001-2022-A.8.24",
       "ISO-27001-2022-A.8.7",
+      "ISO-27001-2022-A.8.9",
+      "ISO-IEC-42001-AIMS",
+      "ISO-IEC-42001-AIMS-A.6.2.5",
+      "NIS2-Art21-availability",
       "NIS2-Art21-business-continuity",
       "NIS2-Art21-identity-management",
       "NIS2-Art21-incident-handling",
       "NIS2-Art21-network-security",
       "NIS2-Art21-supply-chain",
       "NIS2-Art21-vulnerability-management",
+      "NIST-800-218-SSDF-PO.4.2",
       "NIST-800-218-SSDF-PW.4",
+      "NIST-800-218-SSDF-PW.7.1",
       "NIST-800-53-AC-3",
       "NIST-800-53-AC-6",
+      "NIST-800-53-AU-9",
       "NIST-800-53-IA-2",
+      "NIST-800-53-IA-8",
       "NIST-800-53-SC-39",
       "NIST-800-53-SC-44",
+      "NIST-800-53-SC-5",
       "NIST-800-53-SI-10",
       "NIST-800-53-SR-3",
       "NIST-AI-RMF-MAP-3.4",
       "NIST-AI-RMF-MEASURE-2.7",
+      "OWASP-API-Security-Top-10-API4:2023",
+      "OWASP-API-Security-Top-10-API8:2023",
       "OWASP-LLM-Top-10-2025-LLM05",
+      "OWASP-LLM-Top-10-LLM01",
+      "OWASP-LLM-Top-10-LLM02",
+      "OWASP-LLM-Top-10-LLM05",
+      "OWASP-LLM-Top-10-LLM06",
+      "OWASP-LLM-Top-10-LLM07",
       "OWASP-ML-Top-10-2023-ML06",
+      "OWASP-SAMM-Code-Review",
+      "OWASP-Top-10-2021-A03",
       "OWASP-Top-10-2021-A06",
+      "OWASP-Top-10-2021-A10",
+      "OpenSSF-Scorecard-PinnedDependenciesID",
+      "PCI-DSS-4.0-10.5",
+      "PCI-DSS-4.0-2.2.3",
+      "PCI-DSS-4.0-3.5",
       "PCI-DSS-4.0-5.1",
+      "PCI-DSS-4.0-6.2.4",
+      "PCI-DSS-4.0-6.3.2",
       "PCI-DSS-4.0.1-11.6.1",
       "PCI-DSS-4.0.1-12.10.7",
       "PCI-DSS-4.0.1-12.3.3",
       "PCI-DSS-4.0.1-6.4.3",
+      "SLSA-3",
       "SLSA-v1.0-Source-L3",
       "UK-CAF-A1",
       "UK-CAF-B2",