@blamejs/exceptd-skills 0.18.11 → 0.18.13

package/scripts/check-codebase-patterns.js

@@ -49,6 +49,7 @@ const VALID_ALLOW_CLASSES = Object.freeze({
   "bidi-codepoint-literal": true,
   "unsorted-marked-array": true,
   "misaligned-marked-run": true,
+  "hand-rolled-sql": true,
 });
 
 const EXCLUDE_DIRS = new Set([
@@ -486,6 +487,37 @@ function detectMisalignedMarkedRun(files) {
   return hits;
 }
 
+// ---- hand-rolled SQL in a file that talks to a database ------------------
+//
+// exceptd ships no database today, so this is a FORWARD guard: the moment a
+// file imports a SQL driver, any SQL STATEMENT (`"SELECT …"`) or CLAUSE built
+// by string concatenation (`… + " WHERE " + …`) is a parameterization/injection
+// sink and must use the driver's bound-parameter API instead. The SQL-driver
+// import is the gate — a SQL-looking string in a file with no driver executes
+// nothing, so prose that merely begins with "Update …" / "Delete …" in a
+// non-DB file is never scanned (no false positives). A trusted static DDL
+// string can opt out with `// allow:hand-rolled-sql — <reason>`.
+const SQL_DRIVER_IMPORT = /require\(\s*["'](?:node:sqlite|better-sqlite3|sqlite3|sqlite|pg|mysql2?|knex|sequelize|drizzle-orm|postgres|@libsql\/[\w.-]+)(?:\/[^"']*)?["']\s*\)|\bfrom\s+["'](?:node:sqlite|better-sqlite3|pg|mysql2?|knex|sequelize|drizzle-orm)(?:\/[^"']*)?["']/;
+const SQL_STMT_START = /(["'`])\s*(?:SELECT\b|INSERT\s+(?:INTO|OR)\b|REPLACE\s+INTO\b|UPDATE\s+["'`]?[A-Za-z_]|DELETE\s+FROM\b|CREATE\s+(?:TABLE|UNIQUE\s+INDEX|INDEX|TRIGGER|VIRTUAL\s+TABLE)\b|ALTER\s+TABLE\b|DROP\s+(?:TABLE|TRIGGER|INDEX)\b|MERGE\s+INTO\b)/i;
+// Trailing-concat form tolerates an embedded SQL string-quote inside the
+// clause (e.g. `" WHERE name = 'x' " + id`) by scanning to the first `+`
+// concatenation operator rather than requiring the clause string to close on
+// the same quote with no interior quotes.
+const SQL_CLAUSE_FRAG = /(?:\+\s*["'`]\s*(?:SET|FROM|WHERE|VALUES|ORDER\s+BY|GROUP\s+BY|HAVING|RETURNING|LIMIT|OFFSET|ON\s+CONFLICT|(?:INNER\s+|LEFT\s+|RIGHT\s+|CROSS\s+)?JOIN)\b|["'`]\s*(?:SET|FROM|WHERE|VALUES\s*\(|ORDER\s+BY|GROUP\s+BY|HAVING|RETURNING|ON\s+CONFLICT|(?:INNER\s+|LEFT\s+|RIGHT\s+|CROSS\s+)?JOIN)\b[^+]*\+)/i;
+function detectHandRolledSql(files) {
+  const hits = [];
+  for (const rel of (files || filesUnder(["lib", "orchestrator", "bin/exceptd.js", "scripts"]))) {
+    const lines = readLines(rel);
+    if (!SQL_DRIVER_IMPORT.test(lines.join("\n"))) continue; // not a DB file — never scan prose
+    for (let i = 0; i < lines.length; i++) {
+      const code = stripLineComment(lines[i]);
+      if (SQL_STMT_START.test(code)) { hits.push({ file: rel, line: i + 1, content: lines[i].trim().slice(0, 110), why: "SQL statement in a string literal" }); continue; }
+      if (SQL_CLAUSE_FRAG.test(code)) { hits.push({ file: rel, line: i + 1, content: lines[i].trim().slice(0, 110), why: "SQL clause built by concatenation" }); }
+    }
+  }
+  return filterMarkers(hits, "hand-rolled-sql");
+}
+
 const CLASSES = [
   {
     id: "process-exit-after-stdout-write",
@@ -523,6 +555,12 @@ const CLASSES = [
     warnOnly: false,
     hint: "a typo'd or reason-less `// allow:<class>` suppresses nothing — fix the class id or add `— <reason>`",
   },
+  {
+    id: "hand-rolled-sql",
+    run: detectHandRolledSql,
+    warnOnly: false,
+    hint: "a SQL statement/clause assembled as a string in a file that imports a SQL driver is an injection sink — use bound parameters, or `// allow:hand-rolled-sql — <reason>` for a trusted static DDL string",
+  },
 ];
 
 function main() {
@@ -559,6 +597,10 @@ module.exports = {
   detectOrphanAllowClass,
   detectUnsortedMarkedArray,
   detectMisalignedMarkedRun,
+  detectHandRolledSql,
+  SQL_DRIVER_IMPORT,
+  SQL_STMT_START,
+  SQL_CLAUSE_FRAG,
   scanUnsortedMarkedArray,
   scanMisalignedMarkedRun,
   requireMainRanges,

package/scripts/check-test-subjects.js

@@ -54,8 +54,17 @@ function deriveSubjects() {
       if (!["lib", "scripts", "orchestrator", "bin"].includes(parent)) add(parent + "-" + base, "alias:" + rel);
       const txt = read(rel);
       for (const m of txt.matchAll(/(?:^|\n)\s*(?:async\s+)?(?:function|class)\s+([A-Za-z_$][\w$]*)/g)) add(camelKebab(m[1]), "fn:" + rel);
-      const exp = txt.match(/module\.exports\s*=\s*\{([\s\S]*?)\}/);
-      if (exp) for (const k of exp[1].matchAll(/([A-Za-z_$][\w$]*)\s*[,:}\n]/g)) add(camelKebab(k[1]), "fn:" + rel);
+      // Capture the FULL module.exports object via a brace-balanced scan. A
+      // non-greedy /\{([\s\S]*?)\}/ stops at the first nested `}` and drops
+      // every export name after it (the brace-truncation class), under-deriving
+      // subjects so a real export silently has no required test.
+      const expAt = txt.search(/module\.exports\s*=\s*\{/);
+      if (expAt >= 0) {
+        const open = txt.indexOf("{", expAt);
+        let depth = 0, end = -1;
+        for (let k = open; k < txt.length; k++) { const ch = txt[k]; if (ch === "{") depth++; else if (ch === "}" && --depth === 0) { end = k; break; } }
+        if (end > open) for (const m of txt.slice(open + 1, end).matchAll(/([A-Za-z_$][\w$]*)\s*[,:}\n]/g)) add(camelKebab(m[1]), "fn:" + rel);
+      }
     }
   }
   ["lib", "orchestrator", "scripts", "bin", "sources/validators"].forEach(walkSrc);
@@ -74,7 +83,14 @@ function deriveSubjects() {
   // data catalog files
   for (const e of ls("data")) if (e.isFile() && e.name.endsWith(".json")) add(e.name.replace(/\.json$/, ""), "data");
   // data ENTRY primitives: every CVE id + every playbook
-  try { const cat = JSON.parse(read("data/cve-catalog.json")); for (const k of Object.keys(cat)) if (k !== "_meta") add(k.toLowerCase(), "cve-primitive"); } catch {}
+  // CVE-primitive subjects. An unreadable / malformed / empty catalog must NOT
+  // silently derive zero CVE subjects — that would let the reverse-coverage gate
+  // PASS with no CVE coverage at all (the absent-input false-pass class). Fail
+  // loud instead.
+  let cveDerived = 0;
+  try { const cat = JSON.parse(read("data/cve-catalog.json")); for (const k of Object.keys(cat)) if (k !== "_meta") { add(k.toLowerCase(), "cve-primitive"); cveDerived++; } }
+  catch (e) { throw new Error("check-test-subjects: cannot read/parse data/cve-catalog.json — refusing to derive subjects (reverse coverage would falsely pass with no CVE coverage): " + e.message); }
+  if (cveDerived === 0) throw new Error("check-test-subjects: data/cve-catalog.json yielded zero CVE entries — refusing to let reverse coverage pass with no CVE coverage.");
   for (const e of ls("data/playbooks")) if (e.isFile() && e.name.endsWith(".json")) { const b = e.name.replace(/\.json$/, ""); add(b, "playbook-primitive"); add("playbook-" + b, "alias:playbook"); }
   // workflows
   for (const e of ls(".github/workflows")) if (/\.ya?ml$/.test(e.name)) { const b = e.name.replace(/\.ya?ml$/, ""); add(b, "workflow"); add(b + "-workflow", "workflow"); }
@@ -111,14 +127,19 @@ function run() {
   for (const t of testFiles) if (!subjects.has(t.toLowerCase())) forward.push({ file: "tests/" + t + ".test.js", suggested: suggest(t) });
   const reverse = [];
   for (const [s, kind] of subjects) if (!testSet.has(s)) reverse.push({ subject: s, kind });
-  return { subjects: subjects.size, forward, reverse };
+  // Reverse-REQUIRED subset: only module / cve / playbook subjects must have a
+  // test (aliases, data files, cli verbs, repo artifacts are valid targets but
+  // not reverse-required). The exit-code logic gates on THIS, consistently
+  // across --worklist and the human/predeploy paths.
+  const reverseRequired = reverse.filter((x) => x.kind.startsWith("module:") || x.kind.startsWith("cve-primitive") || x.kind.startsWith("playbook-primitive"));
+  return { subjects: subjects.size, forward, reverse, reverseRequired };
 }
 
 if (require.main === module) {
   const r = run();
-  if (process.argv.includes("--worklist")) { process.stdout.write(JSON.stringify(r) + "\n"); process.exitCode = (r.forward.length || r.reverse.length) ? 1 : 0; }
+  const revMods = r.reverseRequired;
+  if (process.argv.includes("--worklist")) { process.stdout.write(JSON.stringify(r) + "\n"); process.exitCode = (r.forward.length || revMods.length) ? 1 : 0; }
   else {
-    const revMods = r.reverse.filter((x) => x.kind.startsWith("module:") || x.kind.startsWith("cve-primitive") || x.kind.startsWith("playbook-primitive"));
     console.log(`[check-test-subjects] valid subjects=${r.subjects} | FORWARD violations=${r.forward.length} | REVERSE (module/cve/playbook) gaps=${revMods.length}`);
     if (r.forward.length || revMods.length) { console.log("[check-test-subjects] FAIL — run with --worklist for the full list."); process.exitCode = 1; }
     else console.log("[check-test-subjects] ok — every test maps to a subject and every subject has a test.");

package/scripts/predeploy.js

@@ -335,16 +335,27 @@ function runGate(gate) {
     const ceil = typeof gate.informationalMaxExitCode === "number"
       ? gate.informationalMaxExitCode
       : Infinity;
-    // A signal kill (spawnSync returns status:null with r.signal set — e.g. a
-    // 137 OOM kill) is a crash, not an informational soft-signal. Without this,
-    // an OOM-killed informational gate fell through to "informational" and the
-    // release proceeded as if the gate had merely produced advisory output.
-    if (r.signal || (r.status !== null && r.status > ceil)) {
+    // A spawn failure (spawnSync returns r.error set, status:null, signal:null —
+    // e.g. the gate command is missing / ENOENT / EACCES) is a crash, not an
+    // informational soft-signal. So is a signal kill (status:null with r.signal
+    // set — e.g. a 137 OOM kill) and a status that exceeds the soft-signal
+    // ceiling. Without surfacing the spawn-error case, an informational gate
+    // that never even ran fell through to "informational" and the release
+    // proceeded as if the gate had merely produced advisory output. The
+    // status===null && !signal case (no error object, but the process never
+    // produced an exit code) is treated the same way — a gate that did not
+    // exit cleanly cannot be classified as a soft signal.
+    const spawnFailed = !!r.error || (r.status === null && !r.signal);
+    if (r.error || r.signal || spawnFailed || (r.status !== null && r.status > ceil)) {
       return {
         status: "failed",
-        exitCode: r.status,
-        message: r.signal
+        exitCode: r.status ?? null,
+        message: r.error
+          ? `informational gate failed to spawn (treated as a crash): ${r.error.message}`
+          : r.signal
           ? `informational gate killed by signal ${r.signal} (treated as a crash)`
+          : r.status === null
+          ? `informational gate did not exit cleanly (no exit code, no signal) — treated as a crash`
           : `informational gate crashed (exit ${r.status} > informationalMaxExitCode=${ceil})`,
         durationMs,
         warnCount,
@@ -438,7 +449,7 @@ function main() {
   process.exit(failures.length > 0 ? 1 : 0); // allow:process-exit-after-stdout-write — local-only gate runner; output is the human/CI summary written synchronously above, never a piped --json result channel
 }
 
-module.exports = { GATES };
+module.exports = { GATES, runGate };
 
 if (require.main === module) {
   try {

package/scripts/refresh-upstream-catalogs.js

@@ -275,8 +275,13 @@ async function refreshRfc({ dry = false, _deps = {} } = {}) {
     const cur = cat[id];
     if (!cur) continue;
     let touched = false;
-    if (cur._auto_imported && cur.status !== RFC_STATUS_MAP[e.status]) {
-      cur.status = RFC_STATUS_MAP[e.status];
+    // Mirror the new-add path's `|| e.status` fallback: an upstream status
+    // outside RFC_STATUS_MAP must NOT write `undefined` (which would drop the
+    // status field on an existing curated row). Fall back to the raw upstream
+    // status, and only bump when the mapped value actually differs.
+    const mapped = RFC_STATUS_MAP[e.status] || e.status;
+    if (cur._auto_imported && mapped && cur.status !== mapped) {
+      cur.status = mapped;
       touched = true;
       statusBumped++;
     }
@@ -654,6 +659,15 @@ function backfillAtlas(cur, fresh) {
       if (!cur[key] && val) { cur[key] = val; touched = true; }
     }
   };
+  // Parity with backfillAttack: include the short description + tactic in the
+  // backfill set. Existing curated ATLAS rows often carry only {name} and need
+  // the short description + tactic too, not just description_full/platforms/etc.
+  fillIfEmpty("description", fresh.description);
+  // tactic: atlasEntryFromStix() emits a STRING for a single-tactic technique
+  // and an array for multi-tactic, so backfill both forms. fillIfEmpty only
+  // writes when cur is empty, so an existing (string OR array) tactic is never
+  // overwritten — the common single-tactic case is no longer left unhydrated.
+  fillIfEmpty("tactic", fresh.tactic);
   fillIfEmpty("description_full", fresh.description_full);
   fillIfEmpty("platforms", fresh.platforms);
   fillIfEmpty("detection", fresh.detection);
@@ -928,5 +942,8 @@ module.exports = {
   // Exported for regression tests: fetchUrl's status/redirect handling and
   // writeCatalog's atomicity are load-bearing fail-closed properties.
   fetchUrl,
-  writeCatalog
+  writeCatalog,
+  // Exported for regression tests: backfillAtlas must mirror backfillAttack's
+  // description + array-tactic backfill on curated rows.
+  backfillAtlas
 };

package/sources/validators/cve-validator.js

@@ -272,7 +272,13 @@ async function validateCve(cveId, localEntry) {
   const disputed = (fetched.cve_tags || []).some(t => /disputed/i.test(t)) ||
     /disputed/i.test(fetched.nvd_vuln_status || '');
   if (cveFoundInNvd && disputed) {
-    pushDiscrepancy(discrepancies, 'cve_status', local?.status ?? null, 'disputed', 'high');
+    // `local` is the projected shape (cvss_*, cisa_kev*, epss_*) and never
+    // carries a status field — reading local?.status here always yielded null,
+    // so the local side of a disputed discrepancy reported nothing. Read the
+    // catalog's own status/cve_status off the RAW input so an entry that
+    // already records the dispute (or a stale "active" status) is surfaced.
+    const localCveStatus = localEntry?.cve_status ?? localEntry?.status ?? null;
+    pushDiscrepancy(discrepancies, 'cve_status', localCveStatus, 'disputed', 'high');
   }
 
   // --- Compare CVSS (only if NVD reachable & has data) ---

package/sources/validators/rfc-validator.js

@@ -13,6 +13,10 @@
  *   drift        — at least one of those fields disagrees.
  *   missing      — Datatracker does not have this RFC / draft.
  *   unreachable  — network failed or the request timed out.
+ *   skipped      — the catalog key is not an IETF RFC/DRAFT (e.g. CSAF-2.0,
+ *                  ISO-29147, ISO-30111). Datatracker only tracks IETF
+ *                  documents, so these have no upstream to compare against —
+ *                  they are intentionally not validated here, NOT drift.
  *
  * Zero external dependencies. Node 24 stdlib (fetch + AbortController).
  *
@@ -107,15 +111,26 @@ function compareEntry(local, upstream) {
   return discrepancies;
 }
 
+// Datatracker only tracks IETF RFCs and Internet-Drafts. A catalog key that is
+// neither (CSAF-2.0, ISO-29147, ISO-30111, …) has no IETF upstream to compare
+// against, so it is out of scope for this validator rather than a discrepancy.
+function isIetfKey(id) {
+  return typeof id === 'string' && (id.startsWith('RFC-') || id.startsWith('DRAFT-'));
+}
+
 async function validateRfc(id, entry) {
   let docName;
   if (id.startsWith('RFC-')) docName = rfcNumberFromKey(id);
   else if (id.startsWith('DRAFT-')) docName = draftSlugFromKey(id);
   else {
+    // Not an IETF document — there is nothing on Datatracker to diff against.
+    // Report a distinct, non-drift status with no discrepancies so callers
+    // don't surface a permanent false-positive "drift" for every ISO/CSAF
+    // reference the catalog carries.
     return {
       id,
-      status: 'drift',
-      discrepancies: [`unrecognized catalog key shape: ${id}`],
+      status: 'skipped',
+      discrepancies: [],
       local: entry,
       fetched: null,
     };
@@ -150,7 +165,10 @@ async function validateRfc(id, entry) {
 }
 
 async function validateAllRfcs(refs, { concurrency = 4 } = {}) {
-  const ids = Object.keys(refs).filter(k => !k.startsWith('_'));
+  // Skip "_"-prefixed meta keys AND any non-IETF reference (ISO/CSAF/etc.):
+  // Datatracker has no record of those, so validating them only ever produced
+  // permanent false-positive "drift". They are simply out of scope here.
+  const ids = Object.keys(refs).filter(k => !k.startsWith('_') && isIetfKey(k));
   const results = [];
   for (let i = 0; i < ids.length; i += concurrency) {
     const batch = ids.slice(i, i + concurrency);

package/sources/validators/version-pin-validator.js

@@ -7,8 +7,17 @@
  *
  *   - MITRE ATLAS:     GitHub releases (mitre-atlas/atlas-data)
  *   - MITRE ATT&CK:    GitHub releases (mitre-attack/attack-stix-data)
- *   - MITRE D3FEND:    GitHub releases (mitre-d3fend/d3fend-data)
- *   - MITRE CWE:       GitHub releases (mitre/cwe)
+ *
+ * MITRE D3FEND and MITRE CWE do NOT publish tagged GitHub releases — D3FEND
+ * ships its ontology from d3fend/d3fend-ontology untagged, and CWE distributes
+ * XML from cwe.mitre.org. Their pin currency is tracked on the upstream-check
+ * path (lib/upstream-check.js) against those canonical mitre.org endpoints, not
+ * via the GitHub releases API. They remain enumerated here for completeness but
+ * are flagged `github_releases: false`, so the GitHub-release check is skipped
+ * for them and they are reported as `tracked_elsewhere` rather than emitting a
+ * spurious `unreachable` (a release API call for a repo with no releases always
+ * fails). This keeps the live path checking the same two GitHub-release repos
+ * the cache path (pinsDiffFromCache) checks.
  *
  * Each check returns:
  *   { pin_name, local_version, latest_version, drift: bool, source_url, error? }
@@ -29,24 +38,35 @@ const PINS = [
     repo: "mitre-atlas/atlas-data",
     local_path_hint: "manifest.json — atlas_version",
     strip_v_prefix: true,
+    github_releases: true,
   },
   {
     pin_name: "attack_version",
     repo: "mitre-attack/attack-stix-data",
     local_path_hint: "manifest.json — attack_version",
     strip_v_prefix: true,
+    github_releases: true,
   },
   {
+    // D3FEND does not tag GitHub releases — currency is tracked via
+    // lib/upstream-check.js against the canonical mitre.org endpoint. Listed
+    // here for completeness; the GitHub-release check is skipped.
     pin_name: "d3fend_version",
     repo: "d3fend/d3fend-data",
     local_path_hint: "data/d3fend-catalog.json _meta.version",
     strip_v_prefix: true,
+    github_releases: false,
+    tracked_via: "lib/upstream-check.js (d3fend.mitre.org)",
   },
   {
+    // CWE distributes XML from cwe.mitre.org with no tagged GitHub releases —
+    // currency is tracked via lib/upstream-check.js. GitHub-release check skipped.
     pin_name: "cwe_version",
     repo: "mitre/cwe",
     local_path_hint: "data/cwe-catalog.json _meta.version",
     strip_v_prefix: true,
+    github_releases: false,
+    tracked_via: "lib/upstream-check.js (cwe.mitre.org)",
   },
 ];
 
@@ -113,6 +133,23 @@ async function checkAllPins(ctx) {
   const out = [];
   for (const pin of PINS) {
     const local = normalize(resolveLocalVersion(pin.pin_name, ctx), pin.strip_v_prefix);
+    // Pins whose upstream does not publish GitHub releases (D3FEND, CWE) have
+    // no release tag to compare against — calling the releases API would always
+    // fail and surface a spurious `unreachable`. Report them as tracked
+    // elsewhere (drift:null, no error) so the live path checks exactly the same
+    // GitHub-release repos as the cache path.
+    if (pin.github_releases === false) {
+      out.push({
+        pin_name: pin.pin_name,
+        local_version: local,
+        latest_version: null,
+        drift: null,
+        tracked_elsewhere: true,
+        tracked_via: pin.tracked_via || null,
+        local_path_hint: pin.local_path_hint,
+      });
+      continue;
+    }
     const release = await latestGithubRelease(pin.repo);
     if (release.error) {
       out.push({

package/vendor/blamejs/_PROVENANCE.json

@@ -34,7 +34,7 @@
     },
     "worker-pool.js": {
       "vendored_path": "vendor/blamejs/worker-pool.js",
-      "vendored_sha256": "fa9814c2d18db221a2dc552cf2a5047467d87a2590cbc9d64b8a0a340e545b55",
+      "vendored_sha256": "948549d82e481f241e5babb6bdddd27bf7148fb8ed1c389b9f2f7ad035e4e56b",
       "upstream_path": "lib/worker-pool.js",
       "upstream_sha256_at_pin": "262f99e9cc3d4a8f4eba9ad3e28401e8a1f47f78040afa63c9b17eb998437171",
       "stripped": [
@@ -50,7 +50,8 @@
         "worker recycle on uncaught error / timeout / exit"
       ],
       "exceptd_deltas": [
-        "scriptPath validator rejects Windows UNC + extended-path prefixes (\\\\?\\, \\\\.\\, \\\\<server>\\) — defense-in-depth against worker-spawn from network shares on win32 platforms"
+        "scriptPath validator rejects Windows UNC + extended-path prefixes (\\\\?\\, \\\\.\\, \\\\<server>\\) — defense-in-depth against worker-spawn from network shares on win32 platforms",
+        "_onWorkerExit respawn branch: call _maybeResolveDrain() after _drainQueue() so drain() settles when a worker recycles with an empty queue (the no-respawn branch already did; the respawn branch could hang pending drain waiters)."
       ]
     },
     "codepoint-class.js": {

package/vendor/blamejs/worker-pool.js

@@ -322,6 +322,12 @@ function create(scriptPath, opts) {
     if (!terminated && workerSlots.length < size) {
       try { _spawnWorker(); } catch (_e) { /* already audited */ }
       _drainQueue();
+      // exceptd delta: also settle pending drain() waiters after a respawn.
+      // _drainQueue() only schedules queued tasks; if the queue is already
+      // empty (a worker recycled with nothing left to do) the pool is now idle
+      // and a caller awaiting drain() must be resolved, exactly as the
+      // no-respawn branch below does — otherwise drain() hangs forever.
+      _maybeResolveDrain();
     } else {
       _maybeResolveDrain();
     }