@blamejs/exceptd-skills 0.18.5 → 0.18.7

package/lib/collectors/scan-excludes.js

@@ -102,15 +102,28 @@ function isLinkedWorktreeDir(dir) {
  * the per-file syscall. The symlink-cycle `seen` set still guards every
  * directory and symlink by canonical path.
  *
+ * Depth-cap visibility: a subtree pruned because it would exceed `maxDepth`
+ * is otherwise an invisible coverage gap — the files inside are never emitted
+ * and the caller cannot tell "scanned, nothing there" from "never scanned".
+ * Pass `opts.truncations` (an array) to have the walker push one
+ * `{ rel, depth }` entry per directory whose contents were skipped for being
+ * beyond the cap, so a content collector can surface a `depth_capped` notice
+ * symmetric with its per-file size-cap reporting. The return value is
+ * unchanged (the file array); callers that don't pass `truncations` are
+ * unaffected.
+ *
  * @param {string} root absolute scan root
  * @param {object} [opts]
  * @param {number} [opts.maxDepth] max recursion depth (collector-specific)
  * @param {Set<string>} [opts.excludes] directory basenames to skip
+ * @param {Array<{rel:string, depth:number}>} [opts.truncations] out-param the
+ *        walker appends to when a directory is pruned for exceeding maxDepth
  * @returns {Array<{full:string, rel:string, name:string}>}
  */
 function walkTree(root, opts = {}) {
   const maxDepth = opts.maxDepth ?? 6;
   const excludes = opts.excludes ?? codeExcludeSet();
+  const truncations = Array.isArray(opts.truncations) ? opts.truncations : null;
   const out = [];
   const seen = new Set();
 
@@ -136,6 +149,18 @@ function walkTree(root, opts = {}) {
         // `.claude/worktrees/<id>/`; walking them rescans the same source
         // as the host tree and multiplies every hit.
         if (isLinkedWorktreeDir(full)) continue;
+        // Descending would land at depth+1 > maxDepth: the directory's
+        // contents are about to be dropped. Record the prune so the caller
+        // can report the unscanned subtree instead of silently missing it.
+        if (depth + 1 > maxDepth) {
+          if (truncations) {
+            truncations.push({
+              rel: path.relative(root, full).split(path.sep).join("/"),
+              depth: depth + 1,
+            });
+          }
+          continue;
+        }
         walk(full, depth + 1);
       } else if (entry.isSymbolicLink()) {
         // A symlink Dirent is neither isDirectory() nor isFile(). The old

package/lib/collectors/secrets.js

@@ -83,11 +83,26 @@ const CONTENT_GATED_KEY_EXTS = new Set([".pem", ".key"]);
 function carriesPrivateKey(file) {
   const ext = path.extname(file.name).toLowerCase();
   if (!CONTENT_GATED_KEY_EXTS.has(ext)) return true; // .p12/.pfx/id_* → private by nature
+  let fd;
   try {
-    if (fs.statSync(file.full).size > MAX_FILE_BYTES) return true; // too big to scan → conservative
-    return PEM_PRIVATE_KEY_MARKER.test(fs.readFileSync(file.full, "utf8"));
+    fd = fs.openSync(file.full, "r");
+    const st = fs.fstatSync(fd); // fstat on the open fd — no stat-then-read race
+    if (st.size > MAX_FILE_BYTES) return true; // too big to scan → conservative
+    // Read the whole descriptor to EOF. A single readSync may return fewer
+    // bytes than requested (a short read on a network / FUSE / interrupted fd),
+    // which would leave the buffer's tail NUL-padded; if the BEGIN marker sat
+    // past that boundary — e.g. a .pem with a leading `Bag Attributes` /
+    // subject= header block, the default OpenSSL pkcs12→PEM layout — the marker
+    // test would return false and silently drop a real private key. readFileSync
+    // on the open fd loops internally until EOF, so the test always sees the
+    // complete content. Reading from the already-open fd keeps the no-TOCTOU
+    // open→fstat ordering (no second path lookup).
+    const content = fs.readFileSync(fd, "utf8");
+    return PEM_PRIVATE_KEY_MARKER.test(content);
   } catch {
     return true; // unreadable → conservative (treat as a key)
+  } finally {
+    if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* non-fatal */ } }
   }
 }
 
@@ -227,7 +242,14 @@ const INDICATOR_PATTERNS = [
   // run halts at the first `-` of `-----END` (no backtracking, ReDoS-safe).
   // Private-key *files* (.pem/.key) are detected separately by file presence.
   { id: "ssh-private-key-block",      re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |ENCRYPTED |)PRIVATE KEY-----[A-Za-z0-9+/=\s]{20,4000}-----END/g },
-  { id: "openai-api-key",             re: /\bsk-(?:proj-|svcacct-|admin-|)[A-Za-z0-9_-]{20,}\b/g },
+  // The `(?!ant-)` lookahead keeps an Anthropic `sk-ant-*` key from also
+  // matching here. Without it the trailing empty alternative made the prefix
+  // optional (`sk-<20+ chars>`), so one Anthropic key double-fired as both
+  // openai-api-key and anthropic-api-key — inflating the hit count and
+  // mislabeling the vendor. The optional `(?:proj-|svcacct-|admin-)?` group
+  // still admits every real OpenAI shape (proj/svcacct/admin and the bare
+  // legacy `sk-` key); the lookahead is anchored, so no backtracking / ReDoS.
+  { id: "openai-api-key",             re: /\bsk-(?!ant-)(?:proj-|svcacct-|admin-)?[A-Za-z0-9_-]{20,}\b/g },
   { id: "anthropic-api-key",          re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
 ];
 
@@ -339,12 +361,26 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   const root = path.resolve(cwd);
 
   let files;
+  const truncations = [];
   try {
-    files = walkTree(root, { maxDepth: DEFAULT_MAX_DEPTH, excludes: DEFAULT_EXCLUDES });
+    files = walkTree(root, { maxDepth: DEFAULT_MAX_DEPTH, excludes: DEFAULT_EXCLUDES, truncations });
   } catch (e) {
     errors.push({ kind: "walk_failed", reason: e.message });
     files = [];
   }
+  // Subtrees pruned for exceeding the depth cap are NOT scanned. Surface them
+  // so an unscanned deep .env / id_rsa / api-key file is an observable gap,
+  // not a silent miss indistinguishable from "scanned, found nothing" —
+  // symmetric with the per-file `file_too_large_skipped` reporting below.
+  if (truncations.length) {
+    errors.push({
+      artifact_id: "repo-tree",
+      kind: "depth_capped",
+      reason: `${truncations.length} subtree(s) beyond depth ${DEFAULT_MAX_DEPTH} not scanned for secrets: ${truncations.slice(0, 20).map(t => t.rel).join(", ")}${truncations.length > 20 ? ", …" : ""}`,
+      truncated_paths: truncations.slice(0, 50).map(t => t.rel),
+      truncated_count: truncations.length,
+    });
+  }
   if (files.length > 50000) {
     errors.push({
       kind: "file_count_capped",

package/lib/cve-curation.js

@@ -42,7 +42,19 @@ const path = require("path");
 //   3. Validates the post-apply entry against lib/schemas/cve-catalog.schema.json
 //      before deciding promotion.
 const { withCatalogLock } = require("./refresh-external");
-const { validate: validateAgainstSchema } = require("./validate-cve-catalog");
+// `validate` is the LOOSE JSON-schema checker; `additionalChecks` is the
+// strict rule set (STRICT_CVSS_PATTERN, isUsableDate on every date field,
+// cisa_kev=true-requires-valid-date, cross-catalog ref resolution, Hard-Rule
+// #14 IoCs). The predeploy gate runs `validate-cve-catalog.js --strict`, which
+// promotes additionalChecks warnings to FATAL errors on NON-draft entries. The
+// apply path must gate promotion on BOTH — otherwise it strips the _draft
+// markers off an entry the very next predeploy run then FATAL-rejects.
+const {
+  validate: validateAgainstSchema,
+  additionalChecks,
+  STRICT_CVSS_PATTERN,
+  isUsableDate,
+} = require("./validate-cve-catalog");
 // derive rwep_score via the canonical scoring helper rather
 // than a blind `Object.values(...).reduce(sum)`. The helper detects shape
 // (boolean inputs → scoreCustom; post-weight numeric inputs → sum + clamp)
@@ -107,6 +119,30 @@ function loadJson(relOrAbs) {
   return v;
 }
 
+// Build the cross-reference context additionalChecks() consumes — the same
+// id Sets lib/validate-cve-catalog.js#main() assembles. Cached per process
+// (the underlying catalogs are immutable inside one CLI run). A `null` Set
+// (catalog absent) makes additionalChecks() skip that ref family, matching
+// the validator's defense-in-depth behaviour.
+let _strictCtxCache = null;
+function strictCheckCtx() {
+  if (_strictCtxCache) return _strictCtxCache;
+  const keySet = (relPath) => {
+    const cat = loadJson(relPath);
+    return cat && typeof cat === "object"
+      ? new Set(Object.keys(cat).filter((k) => !k.startsWith("_")))
+      : null;
+  };
+  _strictCtxCache = {
+    atlasKeys: keySet("data/atlas-ttps.json"),
+    cweKeys: keySet("data/cwe-catalog.json"),
+    attackKeys: keySet("data/attack-techniques.json"),
+    d3fendKeys: keySet("data/d3fend-catalog.json"),
+    frameworkKeys: keySet("data/framework-control-gaps.json"),
+  };
+  return _strictCtxCache;
+}
+
 /**
  * Score a candidate by counting keyword overlap with the draft entry.
  * Returns 0..100. Pure heuristic — reviewer makes the final call.
@@ -519,19 +555,42 @@ function applyAnswersUnderLock(cveId, catalog, catalogPath, answers) {
   // is ignored (so a typo'd key in answers.json doesn't pollute the entry).
   // Each entry: [field, validator(value) -> bool, transformer(value) -> stored].
   const id = (x) => x;
+
+  // rwep_factors must arrive as the post-weight (Shape B) block the schema
+  // mandates: a non-array object whose EVERY value is a finite number. A
+  // permissive "any object" check let a mixed-shape bag through — post-weight
+  // integers carrying a string active_exploitation, or an all-numeric block
+  // plus a rogue extra key holding a ladder string ('confirmed'). Either
+  // shape flips deriveRwepFromFactors() onto its Shape-A (scoreCustom) route,
+  // which reads the post-weight integers as booleans and DROPS the unmapped
+  // ai_factor weight — deriving a silently wrong rwep_score (e.g. 55/75 for a
+  // bag the operator intended as 90) and writing it to the catalog. Rejecting
+  // any non-numeric value here turns that silent mis-score into a surfaced
+  // rejected_fields entry at apply time, instead of relying on the downstream
+  // scoring.validate() divergence gate (which runs only at predeploy, after
+  // the wrong score is already on disk).
+  const isPostWeightFactors = (v) =>
+    v && typeof v === "object" && !Array.isArray(v) &&
+    Object.values(v).every((x) => typeof x === "number" && Number.isFinite(x));
+
   const ALLOWED = [
     ["framework_control_gaps", (v) => v && typeof v === "object" && !Array.isArray(v), id],
     ["iocs",                   (v) => v && typeof v === "object" && !Array.isArray(v), id],
     ["atlas_refs",             (v) => Array.isArray(v), id],
     ["attack_refs",            (v) => Array.isArray(v), id],
-    ["rwep_factors",           (v) => v && typeof v === "object" && !Array.isArray(v), id],
+    ["rwep_factors",           isPostWeightFactors, id],
     ["rwep_score",             (v) => typeof v === "number", id],
     ["rwep_notes",             (v) => typeof v === "string", id],
     ["cvss_score",             (v) => typeof v === "number", id],
-    ["cvss_vector",            (v) => typeof v === "string" && /^CVSS:[0-9]/.test(v), id],
+    // Match the predeploy strict gate at apply time: a non-existent CVSS
+    // version (`CVSS:9/...`) and a malformed/impossible KEV date previously
+    // survived the per-field check, landed on the entry, then blocked
+    // promotion downstream. Rejecting them here surfaces the exact field as a
+    // rejected_fields entry instead of a silent block.
+    ["cvss_vector",            (v) => typeof v === "string" && STRICT_CVSS_PATTERN.test(v), id],
     ["cisa_kev",               (v) => typeof v === "boolean", id],
-    ["cisa_kev_date",          (v) => v === null || typeof v === "string", id],
-    ["cisa_kev_due_date",      (v) => v === null || typeof v === "string", id],
+    ["cisa_kev_date",          (v) => v === null || (typeof v === "string" && isUsableDate(v).ok), id],
+    ["cisa_kev_due_date",      (v) => v === null || (typeof v === "string" && isUsableDate(v).ok), id],
     ["poc_available",          (v) => typeof v === "boolean", id],
     ["poc_description",        (v) => typeof v === "string", id],
     ["ai_discovered",          (v) => typeof v === "boolean", id],
@@ -597,8 +656,20 @@ function applyAnswersUnderLock(cveId, catalog, catalogPath, answers) {
     const errs = validateAgainstSchema(entry, entrySchema, "cve-entry", `${cveId}`);
     if (Array.isArray(errs) && errs.length > 0) schemaErrors.push(...errs);
   }
+  // The loose schema accepts values the predeploy `validate-cve-catalog.js
+  // --strict` gate FATAL-rejects on a non-draft entry: a cvss_vector for a
+  // non-existent CVSS version (`CVSS:9/...` passes the schema's
+  // `^CVSS:[0-9]+(\.[0-9]+)?/` but fails STRICT_CVSS_PATTERN), a cisa_kev=true
+  // with a malformed/impossible cisa_kev_date, an atlas/attack/cwe/d3fend/
+  // framework ref that resolves to no catalog entry, or a poc+public-exploit
+  // source with no iocs. Run the SAME additionalChecks() the validator runs
+  // and fold its findings into the promotion gate, so the apply path never
+  // strips _draft off an entry the next predeploy run then rejects. Surfaced
+  // under a dedicated `strict_warnings` key so the operator sees exactly which
+  // strict rule blocked promotion.
+  const strictWarnings = additionalChecks(cveId, entry, strictCheckCtx());
   let promoted = false;
-  if (warnings.length === 0 && schemaErrors.length === 0) {
+  if (warnings.length === 0 && schemaErrors.length === 0 && strictWarnings.length === 0) {
     delete entry._auto_imported;
     delete entry._draft;
     delete entry._draft_reason;
@@ -621,15 +692,20 @@ function applyAnswersUnderLock(cveId, catalog, catalogPath, answers) {
     is_draft: !promoted,
     residual_warnings: warnings,
     schema_errors: schemaErrors,
+    strict_warnings: strictWarnings,
     catalog_path: catalogPath,
     next_steps: promoted
       ? [
-          `Draft promoted to full entry. Run \`node lib/validate-cve-catalog.js --quiet\` to confirm it passes the strict schema gate.`,
+          `Draft promoted to full entry. Run \`node lib/validate-cve-catalog.js --strict --quiet\` to confirm it passes the predeploy gate.`,
           `Add a matching entry to data/zeroday-lessons.json (AGENTS.md rule #6).`,
           `Run \`npm run predeploy\` before tagging.`,
         ]
       : [
-          `Entry remains a DRAFT (${warnings.length} required field(s) still unpopulated). Supply answers for: ${warnings.slice(0, 6).join(", ")}${warnings.length > 6 ? ", ..." : ""}.`,
+          warnings.length > 0
+            ? `Entry remains a DRAFT (${warnings.length} required field(s) still unpopulated). Supply answers for: ${warnings.slice(0, 6).join(", ")}${warnings.length > 6 ? ", ..." : ""}.`
+            : (schemaErrors.length > 0
+                ? `Entry remains a DRAFT — schema validation failed: ${schemaErrors.slice(0, 4).join("; ")}${schemaErrors.length > 4 ? "; ..." : ""}.`
+                : `Entry remains a DRAFT — the predeploy --strict checks rejected it: ${strictWarnings.slice(0, 4).join("; ")}${strictWarnings.length > 4 ? "; ..." : ""}.`),
           `Re-run \`exceptd refresh --curate ${cveId}\` to see the updated questionnaire.`,
         ],
   };

package/lib/lint-skills.js

@@ -679,7 +679,7 @@ function lintSkill(entry, ctx) {
   // on their own cadence and the catalog frequently carries
   // auto-imported drafts that skills can legitimately cite.
   if (ctx.cveCatalog && body && typeof body === 'string') {
-    const cveRefRe = /\b(CVE-(?:19|20)\d{2}-\d{4,7}|MAL-\d{4}-[A-Z0-9-]+)\b/g;
+    const cveRefRe = /\b(CVE-\d{4}-\d{4,7}|MAL-\d{4}-[A-Z0-9-]+)\b/g;
     const seen = new Set();
     let m;
     while ((m = cveRefRe.exec(body)) !== null) {
@@ -819,6 +819,59 @@ function findOrphanSkillFiles(manifestSkills) {
   return orphans;
 }
 
+// Manifest cover arrays that must resolve to a real catalog entry, paired
+// with the loadContext() key-set they resolve against. The manifest is an
+// enriched superset of frontmatter (it may carry curated refs absent from
+// any skill body), and those manifest-only refs are what build-indexes'
+// reverse-ref surface and refresh-reverse-refs read — yet the per-skill
+// frontmatter ref-resolution above never sees them. Without this pass a
+// typo'd or stale manifest-only ref (e.g. a hand-edit, or one re-signed
+// into manifest_signature) becomes an orphaned control reference in the
+// signed manifest + every derived surface, the exact "no orphaned controls"
+// failure (AGENTS.md Hard Rule #4) the frontmatter resolution prevents —
+// applied to the manifest-only delta the frontmatter pass is blind to.
+const MANIFEST_COVER_RESOLUTION = [
+  { field: 'atlas_refs', ctxKey: 'atlasKeys', catalog: 'data/atlas-ttps.json' },
+  { field: 'attack_refs', ctxKey: 'attackKeys', catalog: 'data/attack-techniques.json' },
+  { field: 'framework_gaps', ctxKey: 'frameworkKeys', catalog: 'data/framework-control-gaps.json' },
+  { field: 'rfc_refs', ctxKey: 'rfcKeys', catalog: 'data/rfc-references.json' },
+  { field: 'cwe_refs', ctxKey: 'cweKeys', catalog: 'data/cwe-catalog.json' },
+  { field: 'd3fend_refs', ctxKey: 'd3fendKeys', catalog: 'data/d3fend-catalog.json' },
+  { field: 'dlp_refs', ctxKey: 'dlpKeys', catalog: 'data/dlp-controls.json' },
+];
+
+/*
+ * Manifest cover-array ref resolution. For every manifest skill entry,
+ * assert each ref in its cross-reference cover arrays resolves to a
+ * top-level non-underscore key in the matching catalog. This extends the
+ * per-skill frontmatter ref-resolution (which reads only skill bodies) to
+ * the MANIFEST cover arrays — the signed, index-feeding source of truth
+ * that build-indexes' reverse-ref surface and refresh-reverse-refs read.
+ *
+ * A ctxKey set that is null (the optional attack-techniques.json catalog is
+ * absent in older trees) skips that field, mirroring loadContext()'s
+ * graceful-degradation contract for ctx.attackKeys.
+ *
+ * @returns {string[]} `<skill>.<field>: <ref> not present in <catalog>` lines
+ */
+function findUnresolvedManifestCoverRefs(manifestSkills, ctx) {
+  const errors = [];
+  for (const entry of manifestSkills) {
+    const name = entry.name || entry.id || '<unknown>';
+    for (const { field, ctxKey, catalog } of MANIFEST_COVER_RESOLUTION) {
+      const keySet = ctx[ctxKey];
+      if (!keySet) continue; // catalog absent — degrade gracefully
+      const refs = Array.isArray(entry[field]) ? entry[field] : [];
+      for (const ref of refs) {
+        if (!keySet.has(ref)) {
+          errors.push(`${name}.${field}: "${ref}" not present in ${catalog}`);
+        }
+      }
+    }
+  }
+  return errors;
+}
+
 // Substrings that indicate an artifact `source` makes a network call. Used
 // by lintPlaybookAirGap() to flag artifacts that lack an air_gap_alternative.
 // Conservative-by-design — false positives are surfaced as `warn` (not
@@ -917,6 +970,7 @@ function main() {
   // A targeted single-skill lint is for diagnosing one entry; running
   // the orphan walk there would surface unrelated findings.
   let orphans = [];
+  let manifestRefErrors = [];
   let airGapWarnings = [];
   if (!opts.skill) {
     orphans = findOrphanSkillFiles(manifest.skills);
@@ -925,6 +979,18 @@ function main() {
       console.log(`        - skill.md exists on disk but not in manifest: ${o}`);
       console.log(`          fix: re-run sign-all (\`node $(exceptd path)/lib/sign.js sign-all\` from a contributor checkout) after adding it to manifest.json, OR delete the orphan directory`);
     }
+    // Manifest cover-array ref resolution (Hard Rule #4 — no orphaned
+    // controls). The per-skill pass above resolves frontmatter refs; this
+    // resolves the manifest cover arrays the reverse-ref surface reads, so a
+    // typo'd/stale manifest-only ref can't ship as an orphaned control. A
+    // hard failure (not a --strict warning): an unresolved control ref is
+    // unconditionally wrong, matching the frontmatter ref-resolution voice.
+    manifestRefErrors = findUnresolvedManifestCoverRefs(manifest.skills, ctx);
+    for (const e of manifestRefErrors) {
+      console.log(`FAIL  <manifest-cover-ref>`);
+      console.log(`        - ${e}`);
+      console.log(`          fix: correct the typo'd/stale ref in manifest.json (or add the entry to the catalog), then re-run sign-all + refresh-reverse-refs + build-indexes`);
+    }
     // P4 — air-gap completeness lint over data/playbooks/*.json.
     airGapWarnings = lintPlaybookAirGap();
     for (const w of airGapWarnings) {
@@ -938,12 +1004,15 @@ function main() {
   const total = results.length;
   const passed = total - failed - warned;
   const orphanSummary = orphans.length ? `, ${orphans.length} orphan skill.md file(s)` : '';
+  const manifestRefSummary = manifestRefErrors.length
+    ? `, ${manifestRefErrors.length} unresolved manifest cover ref(s)`
+    : '';
   const warnSummary = warned ? `, ${warned} with warnings` : '';
   const airGapSummary = airGapWarnings && airGapWarnings.length
     ? `, ${airGapWarnings.length} playbook artifact(s) missing air_gap_alternative`
     : '';
   console.log(
-    `\n${passed}/${total} skills passed${warnSummary}${failed ? `, ${failed} failed` : ''}${orphanSummary}${airGapSummary}.`,
+    `\n${passed}/${total} skills passed${warnSummary}${failed ? `, ${failed} failed` : ''}${orphanSummary}${manifestRefSummary}${airGapSummary}.`,
   );
   // --strict treats any warning (per-skill or playbook air-gap) as a
   // release-blocking failure so a warned regression cannot ship silently.
@@ -951,7 +1020,7 @@ function main() {
   if (strictFail) {
     console.log(`[lint-skills] --strict: ${warned + (airGapWarnings ? airGapWarnings.length : 0)} warning(s) treated as failures.`);
   }
-  safeExit(failed === 0 && orphans.length === 0 && !strictFail ? 0 : 1);
+  safeExit(failed === 0 && orphans.length === 0 && manifestRefErrors.length === 0 && !strictFail ? 0 : 1);
   return;
 }
 
@@ -962,6 +1031,9 @@ module.exports = {
   extractFrontmatterBlock,
   unquote,
   findOrphanSkillFiles,
+  findUnresolvedManifestCoverRefs,
+  loadContext,
+  MANIFEST_COVER_RESOLUTION,
   findMissingSections,
   lintPlaybookAirGap,
   PLAYBOOK_NET_PATTERNS,