@blamejs/exceptd-skills 0.18.6 → 0.18.7

package/lib/playbook-runner.js

@@ -357,19 +357,53 @@ function preflight(playbook, runOpts = {}) {
   return { ok: true, issues };
 }
 
-// lockDir lives at a stable global path so two CLI invocations from
+// lockDir lives at a stable per-user path so two CLI invocations from
 // different working directories still share lock state for cross-process
 // mutex enforcement. A process.cwd()-relative dir would let invocations
 // from /tmp and from /home/user/project simultaneously each see an empty
-// locks dir and both run unchallenged. The path
-// keys on os.platform() so Windows/macOS/Linux locks live under separate
-// directories (avoids cross-platform stale-PID confusion when a host is
-// shared across OSes via networked FS). Override via EXCEPTD_LOCK_DIR for
-// container/CI scenarios that need an explicit shared location.
+// locks dir and both run unchallenged.
+//
+// Resolution order (most-specific first):
+//   1. EXCEPTD_LOCK_DIR        explicit container/CI override
+//   2. EXCEPTD_HOME || ~/.exceptd  + /locks/<platform>   per-user default
+//   3. os.tmpdir()/exceptd-locks-<platform>              last-resort fallback
+//      when the per-user home is non-writable (read-only home, restricted
+//      sandbox/CI runner).
+//
+// The per-user home (mirroring the orchestrator's watch.lock + attestation
+// roots) is both the safer location — a per-user dir is not the
+// world-writable shared OS tempdir a preplant/symlink attack targets — and
+// the better fit for lockDir's stated goal: ~/.exceptd is per-user-stable
+// across working directories, whereas the shared tmpdir is the weaker
+// choice. The path keys on os.platform() so Windows/macOS/Linux locks live
+// under separate directories (avoids cross-platform stale-PID confusion when
+// a host is shared across OSes via networked FS).
+function resolveLockDir() {
+  if (process.env.EXCEPTD_LOCK_DIR) return process.env.EXCEPTD_LOCK_DIR;
+  const home = process.env.EXCEPTD_HOME || (os.homedir() && path.join(os.homedir(), '.exceptd'));
+  if (home) {
+    const dir = path.join(home, 'locks', process.platform);
+    try {
+      fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+      // Probe writability with a marker; remove on success. A home that
+      // mkdirs but can't be written (read-only mount, restrictive ACL) must
+      // fall through to the tmpdir fallback rather than silently no-op every
+      // lock write.
+      const probe = path.join(dir, `.write-probe-${process.pid}`);
+      fs.writeFileSync(probe, '');
+      fs.unlinkSync(probe);
+      return dir;
+    } catch { /* home non-writable — fall through to tmpdir */ }
+  }
+  return path.join(os.tmpdir(), `exceptd-locks-${process.platform}`);
+}
+
 function lockDir() {
-  const dir = process.env.EXCEPTD_LOCK_DIR
-    || path.join(os.tmpdir(), `exceptd-locks-${process.platform}`);
-  try { fs.mkdirSync(dir, { recursive: true }); } catch {}
+  const dir = resolveLockDir();
+  // Owner-only (0700): the mutex lock files inside use O_EXCL ('wx'), but
+  // tightening the parent directory keeps another local user from listing or
+  // tampering with this user's lock set.
+  try { fs.mkdirSync(dir, { recursive: true, mode: 0o700 }); } catch { /* exists / EACCES — non-fatal */ }
   return dir;
 }
 
@@ -388,14 +422,27 @@ function lockFilePath(playbookId) {
 // lifetime.
 const STALE_LOCK_MS = 30_000;
 
+// Create the mutex lock file with an exclusive, owner-only descriptor
+// (O_CREAT | O_EXCL | 0o600 via openSync 'wx'). The lock-file NAME is
+// deliberately predictable — it IS the cross-process mutex, so every contender
+// must agree on it; security comes from the exclusive create (a preplanted file
+// or symlink makes the open throw EEXIST/EPERM, never a silent follow), the
+// 0o700 lock directory, and the 0o600 mode — written through openSync so the
+// secure-create primitive is explicit rather than a bare writeFileSync. Throws
+// EEXIST when the lock is already held, which every caller already handles.
+function writeLockFile(p, playbookId) {
+  const fd = fs.openSync(p, 'wx', 0o600);
+  try {
+    fs.writeSync(fd, JSON.stringify({ pid: process.pid, started_at: new Date().toISOString(), playbook: playbookId }, null, 2));
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
 function acquireLock(playbookId) {
   const p = lockFilePath(playbookId);
   if (!p) return null;
-  const writePayload = () => fs.writeFileSync(
-    p,
-    JSON.stringify({ pid: process.pid, started_at: new Date().toISOString(), playbook: playbookId }, null, 2),
-    { flag: 'wx' }
-  );
+  const writePayload = () => writeLockFile(p, playbookId);
   try {
     writePayload();
     return p;
@@ -458,9 +505,7 @@ function acquireLockDiagnostic(playbookId) {
   const p = lockFilePath(playbookId);
   if (!p) return { ok: false, reason: 'no_lock_path' };
   try {
-    fs.writeFileSync(p,
-      JSON.stringify({ pid: process.pid, started_at: new Date().toISOString(), playbook: playbookId }, null, 2),
-      { flag: 'wx' });
+    writeLockFile(p, playbookId);
     return { ok: true, path: p };
   } catch (e) {
     if (e && (e.code === 'EEXIST' || e.code === 'EPERM')) {
@@ -476,9 +521,7 @@ function acquireLockDiagnostic(playbookId) {
       if (Number.isInteger(pid) && pid > 0 && pid !== process.pid && !pidAlive(pid)) {
         try { fs.unlinkSync(p); } catch {}
         try {
-          fs.writeFileSync(p,
-            JSON.stringify({ pid: process.pid, started_at: new Date().toISOString(), playbook: playbookId }, null, 2),
-            { flag: 'wx' });
+          writeLockFile(p, playbookId);
           return { ok: true, path: p, reclaimed_from_pid: pid };
         } catch (e2) {
           return { ok: false, reason: 'reclaim_failed', error: e2.message, lock_path: p, holder_pid: pid };
@@ -494,9 +537,7 @@ function acquireLockDiagnostic(playbookId) {
         if (mtimeMs !== null && (Date.now() - mtimeMs) > STALE_LOCK_MS) {
           try { fs.unlinkSync(p); } catch {}
           try {
-            fs.writeFileSync(p,
-              JSON.stringify({ pid: process.pid, started_at: new Date().toISOString(), playbook: playbookId }, null, 2),
-              { flag: 'wx' });
+            writeLockFile(p, playbookId);
             return { ok: true, path: p, reclaimed_self_stale_pid: true, prior_mtime_ms: mtimeMs };
           } catch (e3) {
             return { ok: false, reason: 'reclaim_failed', error: e3.message, lock_path: p, holder_pid: pid };
@@ -1058,6 +1099,14 @@ function analyze(playbookId, directiveId, detectResult, agentSignals = {}, runOp
     const vexStatus = (vexFixed && vexFixed.has(c.cve_id)) ? 'fixed' : null;
     return {
       cve_id: c.cve_id,
+      // attack_class is the coarse chainable taxonomy (kernel-lpe /
+      // mcp-supply-chain / ai-c2 / prompt-injection / container-escape / …)
+      // the sbom -> deep-dive feeds_into rules quantify over
+      // (`any matched_cve.attack_class == 'kernel-lpe'`). It comes from the
+      // catalog entry's explicit attack_class only — no fuzzy inference from
+      // the free-form `type`, so an unclassified CVE stays null and the chain
+      // correctly does not fire (no false escalation) rather than misrouting.
+      attack_class: c.entry?.attack_class ?? null,
       rwep: c.rwep_score,
       cvss_score: c.entry?.cvss_score ?? null,
       cvss_vector: c.entry?.cvss_vector ?? null,
@@ -1408,7 +1457,7 @@ function analyze(playbookId, directiveId, detectResult, agentSignals = {}, runOp
     findingShape = {};
   }
   for (const ec of an.escalation_criteria || []) {
-    if (evalCondition(ec.condition, { ...agentSignals, ...evalCtxRoot, rwep: adjustedRwep, blast_radius_score: blastRadiusScore, theater_verdict: theaterVerdict, analyze: result, finding: findingShape }, playbook)) {
+    if (evalCondition(ec.condition, { ...agentSignals, ...evalCtxRoot, rwep: adjustedRwep, blast_radius_score: blastRadiusScore, theater_verdict: theaterVerdict, compliance_theater_check: result.compliance_theater_check, jurisdiction_obligations: (playbook.phases && playbook.phases.govern && playbook.phases.govern.jurisdiction_obligations) || [], analyze: result, matched_cve: result.matched_cves || [], finding: findingShape }, playbook)) {
       escalations.push({ condition: ec.condition, action: ec.action, target_playbook: ec.target_playbook || null });
     }
   }
@@ -1932,7 +1981,32 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
     // and could suppress a legitimate downstream chain.
     ...agentSignals,
     rwep: analyzeResult.rwep?.adjusted,
+    // Bare-token parity with the escalation context (analyze()): catalog
+    // feeds_into conditions reference the unqualified tokens `blast_radius_score`
+    // and `theater_verdict` (e.g. framework.json's feeds_into into sbom). Without
+    // these top-level keys resolvePath returns null and `null >= 4` is false
+    // regardless of the engine-computed blast radius, so the chain is dead. They
+    // are spread AFTER ...agentSignals so the engine value wins over any
+    // operator-submitted signals.blast_radius_score / signals.theater_verdict.
+    blast_radius_score: analyzeResult.blast_radius_score,
+    theater_verdict: analyzeResult.compliance_theater_check?.verdict,
+    // Bare top-level `compliance_theater_check` so catalog conditions that
+    // reference `compliance_theater_check.verdict` unqualified (framework.json's
+    // feeds_into into sbom) resolve — without it resolvePath returns null and the
+    // clause is dead regardless of the engine verdict. The `analyze.*` alias
+    // below stays for conditions that use the qualified path.
+    compliance_theater_check: analyzeResult.compliance_theater_check,
+    // Govern-phase jurisdiction obligations so feeds_into conditions like
+    // `… AND jurisdiction_obligations contains 'EU'` (framework → sbom) resolve.
+    jurisdiction_obligations: (g && g.jurisdiction_obligations) || (playbook.phases && playbook.phases.govern && playbook.phases.govern.jurisdiction_obligations) || [],
     theater_score: analyzeResult.compliance_theater_check?.verdict === 'theater' ? 0 : 100,
+    // Top-level matched_cve array so the shipped sbom feeds_into quantifiers
+    // (`any matched_cve.attack_class == 'kernel-lpe'`, … IN ['ai-c2', …]) re-root
+    // at each matched CVE. Without it the quantifier head resolves null and the
+    // sbom -> kernel/mcp/ai-api deep-dive chains stay dead even when a matched
+    // CVE carries the attack_class. The `analyze.matched_cves` alias stays for
+    // conditions that use the qualified path.
+    matched_cve: analyzeResult.matched_cves || [],
     analyze: analyzeResult,
     validate: validateResult,
     finding: analyzeFindingShape(analyzeResult),
@@ -2397,11 +2471,12 @@ function sanitizeOperatorText(s) {
   // U+007F, U+0080-009F, private-use, unassigned), so the family pass is a
   // documented-intent superset removal and the result is identical to the
   // single \p{C} strip.
-  const familyStripped = normalised
-    .replace(codepointClass.BIDI_RE_G, '')
-    .replace(codepointClass.C0_CTRL_RE_G, '')
-    .replace(codepointClass.ZW_RE_G, '')
-    .replace(codepointClass.NULL_RE_G, '');
+  const familyStripped = codepointClass.applyCharStripPolicies(normalised, {
+    bidiPolicy: 'strip',
+    controlPolicy: 'strip',
+    zeroWidthPolicy: 'strip',
+    nullBytePolicy: 'strip',
+  });
   const stripped = familyStripped.replace(/\p{C}/gu, '');
   const trimmed = stripped.trim();
   if (trimmed.length === 0) return null;
@@ -3309,7 +3384,23 @@ function normalizeSubmission(submission, playbook) {
     }
     if (typeof val === "object" && val !== null) {
       const aid = knownArtifacts.has(key) ? key : (val.artifact || key);
-      out.artifacts[aid] = { value: val.value, captured: val.captured !== false };
+      // Preserve every evidence-bearing key the observation carried, not just
+      // `value`. An observation whose secret/path lives under a non-`value`
+      // key (e.g. { path, matched, reason } — a natural collector shape) was
+      // previously collapsed to { value: undefined, captured } here, silently
+      // discarding the actual evidence. Two observations capturing DIFFERENT
+      // secrets under path/matched then hashed and diffed byte-identical, so
+      // `attest diff` reported a false "unchanged" and masked real drift.
+      // The reserved control keys (artifact/indicator/result) drive
+      // signal_overrides below and are intentionally not echoed as evidence.
+      const { artifact: _a, indicator: _i, result: _r, captured: _c, value: _v, ...evidence } = val;
+      const normalizedArtifact = { captured: val.captured !== false };
+      if (val.value !== undefined) normalizedArtifact.value = val.value;
+      for (const [ek, ev] of Object.entries(evidence)) {
+        if (ek === "__proto__" || ek === "constructor" || ek === "prototype") continue;
+        normalizedArtifact[ek] = ev;
+      }
+      out.artifacts[aid] = normalizedArtifact;
       if (val.indicator && val.result !== undefined) {
         const newVerdict = canonicalizeOutcome(val.result);
         if (out.signal_overrides[val.indicator] !== undefined && out._signal_origins[val.indicator] !== undefined) {
@@ -3861,6 +3952,15 @@ function extractSubmissionForHash(sub) {
   return pick;
 }
 
+// Identity fields a `contains`/`includes` membership test targets when the
+// array holds objects (e.g. jurisdiction_obligations records). Membership is
+// field-scoped to these so a non-identity field (clock_starts, obligation,
+// regulation, a free-form tag) that happens to equal the member cannot satisfy
+// the predicate. `jurisdiction` is the only field the catalog's object-array
+// `contains` conditions target today; the allowlist is the seam to extend if a
+// future condition deliberately matches a different identity field.
+const OBJECT_MEMBERSHIP_FIELDS = ['jurisdiction'];
+
 function evalCondition(expr, ctx, playbook) {
   if (!expr) return false;
   expr = expr.trim();
@@ -3879,6 +3979,91 @@ function evalCondition(expr, ctx, playbook) {
   const andParts = splitAtTopLevel(expr, 'AND');
   if (andParts.length > 1) return andParts.every(s => evalCondition(s, ctx, playbook));
 
+  // Quantifier prefix: catalog conditions write `any <path> <op> <value>`
+  // (e.g. framework.json's feeds_into `any compliance_theater_check.verdict ==
+  // 'theater' …`). An unhandled `any `/`all ` prefix is unparseable and falls
+  // through to `false`, silently disabling the clause it gates. Strip the
+  // quantifier and re-evaluate the inner comparison: when the LHS path resolves
+  // to a scalar (the framework theater_verdict case) the quantifier is prose
+  // emphasis and the scalar comparison is the intended test; when the LHS first
+  // segment resolves to an array, apply the predicate existentially (`any`) /
+  // universally (`all`) across its elements. The inner clause is only the leaf
+  // comparison (the surrounding AND/OR has already been split off above).
+  const quant = expr.match(/^(any|all)\s+(.+)$/);
+  if (quant) {
+    const [, kind, inner] = quant;
+    // `any head.rest <op|keyword> …` → re-root the predicate at each element of
+    // `head` and apply it existentially (`any`) / universally (`all`). The head
+    // is the FIRST dotted-path token of the inner clause; what follows it (`==`,
+    // `IN [...]`, `contains`, `matches /…/`, `>=`, …) is operator-agnostic — the
+    // inner clause is re-evaluated whole against `{ …ctx, [head]: el }`, so every
+    // operator the leaf parser already understands works under a quantifier.
+    // Earlier this branch only re-rooted clauses whose operator was in the
+    // comparison set (`>=|<=|==|=|<|>|!=`); `IN`/`contains`/`matches` were
+    // omitted, so e.g. sbom.json's `any matched_cve.attack_class IN
+    // ['ai-c2','prompt-injection']` (the sbom→ai-api feeds_into trigger) fell
+    // through to a whole-ctx eval where `matched_cve.attack_class` resolved to
+    // undefined on the array and the clause was permanently false, while the
+    // sibling `== 'kernel-lpe'` quantifiers fired. Requiring a `.`-qualified head
+    // keeps the bare-token form (`any <path>`) routed to the non-emptiness branch
+    // below.
+    const headMatch = inner.match(/^([A-Za-z_][\w-]*)(?:\.[A-Za-z_][\w-]*)+(?:[\s.[]|$)/);
+    if (headMatch) {
+      const head = headMatch[1];
+      const arr = resolvePath(ctx, head);
+      if (Array.isArray(arr)) {
+        const test = el => evalCondition(inner, { ...ctx, [head]: el }, playbook);
+        return kind === 'all' ? arr.length > 0 && arr.every(test) : arr.some(test);
+      }
+    }
+    // Bare-quantifier non-emptiness form: `any <path>` / `all <path>` with no
+    // comparison operator is a quantifier OVER the resolved collection itself —
+    // the author's intent is "at least one X exists" (`any`) / "every X is
+    // truthy" (`all`), i.e. a non-emptiness / existence test. sbom.json's
+    // `any actively_exploited_match …` EU CRA Art.14 (24h) notify_legal
+    // escalation is the canonical case. Without this, the inner bare token has
+    // no operator, so no comparison branch parses it and it falls through to
+    // condition_unparsed → false, silently disabling the escalation even when
+    // the array holds entries. Match ONLY a pure dotted-path token (no operator,
+    // keyword, bracket, or space); anything with a comparison/keyword still
+    // routes to the prose fall-through below so a genuinely malformed inner
+    // clause stays observable.
+    if (/^[A-Za-z_][\w-]*(?:\.[A-Za-z_][\w-]*)*$/.test(inner)) {
+      const v = resolvePath(ctx, inner);
+      if (Array.isArray(v)) {
+        return kind === 'all' ? v.length > 0 && v.every(Boolean) : v.length > 0;
+      }
+      // Non-array scalar: existence/truthiness (null/undefined/0/'' → false).
+      return !!v;
+    }
+    // Scalar (or unresolved-array) LHS: the quantifier is prose; evaluate the
+    // bare inner comparison. If it still doesn't parse it falls through to the
+    // condition_unparsed diagnostic below, so a genuinely malformed clause stays
+    // observable rather than silently passing.
+    return evalCondition(inner, ctx, playbook);
+  }
+
+  // Membership clauses (`contains`/`includes`/`IN [...]`) parse fine but resolve
+  // their LHS path to a collection. When that path does NOT exist in ctx (the
+  // resolved value is null/undefined — an authoring typo in the LHS token, or a
+  // wrong-shape ctx that never populated the collection), the branch returns a
+  // silent `false` that disables whatever escalation / feeds_into the clause
+  // gates with no signal. The clause PARSED, so condition_unparsed (a
+  // parse-failure diagnostic) never fires. Surface a distinct, low-severity
+  // condition_path_unresolved so an LHS-path typo is observable — deduped on the
+  // condition string like condition_unparsed. A present-but-empty array (or any
+  // present value that simply isn't a collection) is a LEGITIMATE false, not an
+  // unresolved path, so it does NOT push: only a literally-absent path does.
+  const pushPathUnresolved = () => {
+    const target = (ctx && Array.isArray(ctx._runErrors)) ? ctx._runErrors
+      : (playbook && Array.isArray(playbook._runErrors)) ? playbook._runErrors
+      : null;
+    if (target) {
+      pushRunError(target, { kind: 'condition_path_unresolved', condition: String(expr).slice(0, 200) },
+        { dedupeKey: x => x.condition || '' });
+    }
+  };
+
   // "rwep >= 90". The LHS/RHS path tokens admit hyphens because signal and
   // indicator IDs are canonically hyphenated across the catalog (e.g.
   // `no-security-md`, `kver-in-affected-range`); a `\w`-only token silently
@@ -3921,15 +4106,79 @@ function evalCondition(expr, ctx, playbook) {
   // "scope.targets includes named_remote" — `contains` is accepted as a
   // synonym for `includes` (the catalog uses both); hyphenated paths + members
   // are admitted for the same reason as the comparison branch above.
-  m = expr.match(/^([A-Za-z_][\w-]*(?:\.[A-Za-z_][\w-]*)*)\s+(?:includes|contains)\s+([\w-]+)$/);
+  // The member may be a bare token OR a quoted string (the catalog's
+  // `jurisdiction_obligations contains 'EU'` / `contains 'EU/EU CRA Art.14 24h'`
+  // forms). When the array holds objects (jurisdiction_obligations are records
+  // like `{ jurisdiction:'EU', regulation:'NIS2 Art.21', … }`), membership is
+  // field-TARGETED: it matches an identity field of the obligation, not ANY
+  // field value. An unscoped `Object.values(el).includes(member)` over-matched
+  // — `contains 'EU'` would be satisfied by a non-jurisdiction field that
+  // happened to equal 'EU' (e.g. a tag), and `contains 'detect_confirmed'`
+  // would match the unrelated `clock_starts` field that holds that exact value
+  // in the shipped obligations. Scoping to OBJECT_MEMBERSHIP_FIELDS keeps the
+  // intended "the obligation is for jurisdiction X" semantic and prevents a
+  // future field collision (or an operator-/agent-supplied obligations array)
+  // from forcing a notify_legal escalation via a non-jurisdiction field.
+  m = expr.match(/^([A-Za-z_][\w-]*(?:\.[A-Za-z_][\w-]*)*)\s+(?:includes|contains)\s+(?:'([^']+)'|"([^"]+)"|([\w-]+))$/);
   if (m) {
+    const member = m[2] !== undefined ? m[2] : (m[3] !== undefined ? m[3] : m[4]);
     const arr = resolvePath(ctx, m[1]);
-    return Array.isArray(arr) && arr.includes(m[2]);
+    if (!Array.isArray(arr)) {
+      if (arr == null) pushPathUnresolved();
+      return false;
+    }
+    return arr.some((el) =>
+      el === member ||
+      (el && typeof el === 'object' &&
+        OBJECT_MEMBERSHIP_FIELDS.some((f) => el[f] === member))
+    );
+  }
+
+  // "matched_cve.attack_class IN ['kernel-lpe', 'rce']" — membership against a
+  // bracketed literal list; members may be quoted or bare. A scalar LHS must be
+  // in the list; an array LHS must intersect it. Unhandled before, so every
+  // `IN [...]` escalation/feeds_into atom fell through to a silent false.
+  // The member list is split quote-aware: a naive `split(',')` is unaware of
+  // quotes, so a quoted member that itself contains a comma (`'EU, US'`) would
+  // be broken into two members (`EU` and `US`), neither of which equals the
+  // author's intended whole member — the clause then evaluated false with no
+  // diagnostic (the regex still matched the bracket, so condition_unparsed never
+  // fired). splitInMembers walks the list tracking single/double quote state and
+  // only splits on commas at quote-depth 0, then strips the surrounding quotes.
+  // The CLOSING `]` is located quote-aware too: a `[^\]]*` capture stops at the
+  // FIRST `]`, so a quoted member containing a literal `]` (`'a]b'`) truncated
+  // the list early and left trailing text the `$` anchor couldn't match — the
+  // whole clause then fell through to condition_unparsed for every input. The
+  // matching bracket is now found at quote-depth 0 (an unquoted `]` is still the
+  // terminator; a `]` inside a quoted member is part of that member). Trailing
+  // text after the closing bracket, or an unterminated bracket, still fails to
+  // match and surfaces as condition_unparsed.
+  m = expr.match(/^([A-Za-z_][\w-]*(?:\.[A-Za-z_][\w-]*)*)\s+IN\s+\[/);
+  if (m) {
+    const body = sliceInBracketBody(expr.slice(m[0].length));
+    if (body !== null) {
+      const members = splitInMembers(body);
+      const lv = resolvePath(ctx, m[1]);
+      if (Array.isArray(lv)) return lv.some((x) => members.includes(String(x)));
+      // lv == null means the LHS path doesn't exist in ctx (typo / wrong-shape) —
+      // surface it as condition_path_unresolved so the dead clause is observable,
+      // mirroring the contains/includes branch. A present scalar that's simply not
+      // in the member list is a legitimate false and pushes nothing.
+      if (lv == null) { pushPathUnresolved(); return false; }
+      return members.includes(String(lv));
+    }
+    // body === null → no quote-depth-0 closing `]` ends the string; fall through
+    // to the condition_unparsed diagnostic so the malformed clause stays visible.
   }
 
-  // "matched_cve.vector matches /regex/"
-  m = expr.match(/^([A-Za-z_][\w-]*(?:\.[A-Za-z_][\w-]*)*)\s+matches\s+\/(.+)\/$/);
+  // "matched_cve.vector matches /regex/" — both delimiters are accepted: the
+  // slash form `matches /re/` and the quote form `matches 're'` / `matches "re"`.
+  // The catalog authors both (mcp.json's feeds_into uses the quoted form), and a
+  // delimiter-specific parser silently disabled whichever form it didn't match —
+  // the same class as the hyphenated-token gap above.
+  m = expr.match(/^([A-Za-z_][\w-]*(?:\.[A-Za-z_][\w-]*)*)\s+matches\s+(?:\/(.+)\/|'([^']+)'|"([^"]+)")$/);
   if (m) {
+    const pattern = m[2] !== undefined ? m[2] : (m[3] !== undefined ? m[3] : m[4]);
     const val = resolvePath(ctx, m[1]);
     if (typeof val !== 'string') return false;
     // An operator-supplied or playbook-supplied regex with a syntax bug
@@ -3939,9 +4188,9 @@ function evalCondition(expr, ctx, playbook) {
     // analyze() can surface analyze.runtime_errors[] without losing the
     // diagnostic.
     try {
-      return new RegExp(m[2], 'i').test(val); // allow:dynamic-regex — m[2] comes from an Ed25519-signed catalog playbook condition (/…/), so the pattern cannot be attacker-controlled without breaking the signature; the try/catch covers construction-time syntax errors only (it does NOT defend against catastrophic backtracking — do not reuse this shape for operator-supplied patterns)
+      return new RegExp(pattern, 'i').test(val); // allow:dynamic-regex — pattern comes from an Ed25519-signed catalog playbook condition (/…/ or '…'), so it cannot be attacker-controlled without breaking the signature; the try/catch covers construction-time syntax errors only (it does NOT defend against catastrophic backtracking — do not reuse this shape for operator-supplied patterns)
     } catch (e) {
-      const errorRec = { _regex_eval_error: { source: m[1], expr: m[2], message: e && e.message ? String(e.message) : String(e) } };
+      const errorRec = { _regex_eval_error: { source: m[1], expr: pattern, message: e && e.message ? String(e.message) : String(e) } };
       // Two sites where ctx may carry an accumulator: runOpts._runErrors
       // (threaded from run()) or ctx._runErrors directly. Prefer the runOpts
       // form; fall back to ctx.
@@ -3993,9 +4242,23 @@ function resolvePath(obj, dot) {
 function splitAtTopLevel(expr, sep) {
   const parts = [];
   const needle = ' ' + sep + ' ';
-  let depth = 0, buf = '', i = 0;
+  let depth = 0, buf = '', i = 0, quote = null;
   while (i < expr.length) {
     const ch = expr[i];
+    // Inside a quoted string literal, parens and the ` AND `/` OR ` needle are
+    // LITERAL text, not boolean structure. A regex member like `matches 'foo('`
+    // carries an unbalanced `(` that — counted blindly — would leave depth=1 so
+    // a real top-level OR/AND would never split at depth 0 (silently disabling
+    // the disjunct/conjunct), and a member like `contains 'EU AND US'` would be
+    // torn at the inner ` AND ` as if it were an operator. Track quote state and
+    // skip both while inside a quote. An unescaped matching quote closes the
+    // literal; `\'`/`\"` stay in. Mirrors splitInMembers' quote-aware walk.
+    if (quote) {
+      if (ch === '\\' && i + 1 < expr.length) { buf += ch + expr[i + 1]; i += 2; continue; }
+      if (ch === quote) quote = null;
+      buf += ch; i++; continue;
+    }
+    if (ch === "'" || ch === '"') { quote = ch; buf += ch; i++; continue; }
     if (ch === '(') { depth++; buf += ch; i++; continue; }
     if (ch === ')') { depth--; buf += ch; i++; continue; }
     if (depth === 0 && expr.startsWith(needle, i)) {
@@ -4011,18 +4274,90 @@ function splitAtTopLevel(expr, sep) {
   return parts;
 }
 
+/**
+ * Quote-aware splitter for the body of an `IN [...]` member list. Splits on
+ * commas that are OUTSIDE any quoted run, then strips the surrounding quotes and
+ * trims each member. A naive `.split(',')` is quote-unaware, so a quoted member
+ * that contains a comma (`'EU, US'`) would be torn into two members; this walks
+ * the string tracking single/double quote state so a comma inside a quoted run
+ * is treated as a literal part of that member. Bare (unquoted) members are
+ * supported too — the catalog authors both forms (`'ai-c2', 'prompt-injection'`
+ * and bare `kernel-lpe`). Empty members (e.g. a trailing comma) are dropped.
+ */
+function splitInMembers(listStr) {
+  const out = [];
+  let buf = '';
+  let quote = null;
+  for (let i = 0; i < listStr.length; i++) {
+    const ch = listStr[i];
+    if (quote) {
+      if (ch === quote) quote = null;
+      else buf += ch;
+      continue;
+    }
+    if (ch === "'" || ch === '"') { quote = ch; continue; }
+    if (ch === ',') { out.push(buf.trim()); buf = ''; continue; }
+    buf += ch;
+  }
+  out.push(buf.trim());
+  return out.filter((s) => s.length);
+}
+
+/**
+ * Locate the closing `]` of an `IN [...]` list quote-aware and return the body
+ * between the (already-consumed) `[` and that `]`. `rest` is the text after the
+ * opening bracket. The terminator is the first `]` encountered at quote-depth 0;
+ * a `]` inside a single/double-quoted member (`'a]b'`) is part of the member, not
+ * the terminator. A `[^\]]*` regex capture instead stops at the FIRST `]`, so a
+ * quoted `]` truncated the list and left trailing text the `$` anchor rejected —
+ * the clause then fell through to condition_unparsed for every input.
+ *
+ * Returns the body string on success, or `null` when the list is malformed:
+ * unterminated (no quote-depth-0 `]`) or carrying non-whitespace text after the
+ * closing bracket. `null` lets the caller fall through to the condition_unparsed
+ * diagnostic so a malformed clause stays observable rather than passing silently.
+ */
+function sliceInBracketBody(rest) {
+  let quote = null;
+  for (let i = 0; i < rest.length; i++) {
+    const ch = rest[i];
+    if (quote) { if (ch === quote) quote = null; continue; }
+    if (ch === "'" || ch === '"') { quote = ch; continue; }
+    if (ch === ']') {
+      // The bracket must be the final structural token: only whitespace may
+      // follow. Anything else (e.g. `IN ['a'] AND …` reaching here, or stray
+      // trailing text) is malformed for this leaf parser.
+      return rest.slice(i + 1).trim() === '' ? rest.slice(0, i) : null;
+    }
+  }
+  return null; // no quote-depth-0 closing bracket → unterminated list
+}
+
 /**
  * Strip a balanced pair of outer parens, if and only if the very first and last
  * characters are matching parens at the same depth boundary. `(A) AND (B)` keeps
- * its parens; `((A AND B))` peels one layer.
+ * its parens; `((A AND B))` peels one layer. The depth scan is quote-aware: a
+ * paren inside a quoted string literal (e.g. a regex member `matches '(a|b)'` or
+ * an unbalanced `matches 'foo('`) is literal text, not grouping structure, so it
+ * must not move the depth counter — otherwise a quoted `)` could make the outer
+ * pair look unbalanced (skipping a legitimate strip) or an unbalanced quoted `(`
+ * could make a non-wrapping pair look outer-spanning (stripping wrongly).
  */
 function stripOuterParens(expr) {
   while (expr.length >= 2 && expr[0] === '(' && expr[expr.length - 1] === ')') {
     let depth = 0;
     let outerMatches = true;
+    let quote = null;
     for (let i = 0; i < expr.length - 1; i++) {
-      if (expr[i] === '(') depth++;
-      else if (expr[i] === ')') depth--;
+      const ch = expr[i];
+      if (quote) {
+        if (ch === '\\') { i++; continue; }
+        if (ch === quote) quote = null;
+        continue;
+      }
+      if (ch === "'" || ch === '"') { quote = ch; continue; }
+      if (ch === '(') depth++;
+      else if (ch === ')') depth--;
       if (depth === 0 && i < expr.length - 1) { outerMatches = false; break; }
     }
     if (outerMatches) expr = expr.slice(1, -1).trim();

package/lib/prefetch.js

@@ -297,6 +297,11 @@ async function timedFetch(url, headers = {}) {
     });
     if (!res.ok) {
       const err = new Error(`HTTP ${res.status}`);
+      // The vendored retry classifier (vendor/blamejs/retry.js isRetryable)
+      // keys off err.statusCode — set it so a 429/5xx from KEV/NVD/EPSS/OSV
+      // routes through the job-queue backoff instead of being dropped on the
+      // first hiccup. err.status kept for callers that read it for messaging.
+      err.statusCode = res.status;
       err.status = res.status;
       throw err;
     }
@@ -913,5 +918,5 @@ module.exports = {
   // Not part of the operator-facing API — internal contract for tests
   // that need to exercise the lockfile path without spawning the full
   // prefetch network pipeline.
-  _internal: { withIndexLock, writeFileAtomic, loadIndex, saveIndex },
+  _internal: { withIndexLock, writeFileAtomic, loadIndex, saveIndex, timedFetch },
 };

package/lib/refresh-external.js

@@ -267,11 +267,42 @@ const KEV_SOURCE = {
     const report = await validateAllCves(ctx.cveCatalog, { concurrency: 4 });
     const diffs = [];
     let errors = 0;
+    // Mirror the cache path's implausibly-small-feed guard. The live KEV map is
+    // fetched once per process and its size is surfaced on every reachable
+    // result as fetched.sources.kev.total_entries. A feed that JSON-parses but
+    // is far below a real CISA snapshot (a partial CDN response, a momentarily
+    // near-empty feed) must not be trusted to de-list curated entries. When the
+    // size is known and below the floor we hold ALL de-listings for review,
+    // exactly as kevDiffFromCache does; when the size is unknown (no reachable
+    // KEV result carried it) we fall back to the per-entry curated-signal guard.
+    let liveFeedSize = null;
+    for (const r of report.results) {
+      const n = r && r.fetched && r.fetched.sources && r.fetched.sources.kev
+        && r.fetched.sources.kev.total_entries;
+      if (typeof n === "number") { liveFeedSize = n; break; }
+    }
+    const feedComplete = liveFeedSize === null || liveFeedSize >= KEV_FEED_MIN_PLAUSIBLE;
     for (const r of report.results) {
       if (r.status === "unreachable") errors++;
       for (const d of r.discrepancies || []) {
         if (d.field === "cisa_kev" || d.field === "cisa_kev_date") {
-          diffs.push({ id: r.cve_id, field: d.field, before: d.local, after: d.fetched, severity: d.severity });
+          const diff = { id: r.cve_id, field: d.field, before: d.local, after: d.fetched, severity: d.severity };
+          // Symmetric with the --from-cache path: a LIVE KEV de-listing
+          // (true→false) is held for review (applyDiff skips review_only)
+          // instead of auto-downgrading the entry when EITHER the entry carries
+          // strong human-curated exploitation signal OR the live feed is
+          // implausibly small. Without this the live path silently de-listed
+          // confirmed-exploitation CVEs the cache path would have held back, and
+          // a truncated-but-valid feed could de-list every non-curated entry.
+          if (d.field === "cisa_kev" && d.local === true && d.fetched === false &&
+              (!feedComplete || hasCuratedExploitSignal(ctx.cveCatalog && ctx.cveCatalog[r.cve_id]))) {
+            diff.review_only = true;
+            diff.kev_delist_review = true;
+            diff.note = !feedComplete
+              ? `KEV de-listing held for review: live feed returned only ${liveFeedSize} entries (< ${KEV_FEED_MIN_PLAUSIBLE}), likely incomplete. Confirm against a complete CISA KEV snapshot before de-listing ${r.cve_id}.`
+              : `KEV de-listing held for review: ${r.cve_id} carries curated exploitation signal; confirm a genuine CISA removal before downgrading.`;
+          }
+          diffs.push(diff);
         }
       }
     }