@blamejs/exceptd-skills 0.18.6 → 0.18.7

package/lib/sign.js

@@ -52,9 +52,12 @@
  *   .keys/private.pem on Windows, restrictWindowsAcl() shells to icacls
  *   to strip inherited entries and grant Full Control only to the current
  *   user. If icacls is unavailable (Server Core, exotic shells), the call
- *   warns to stderr but does not fail keypair generation — generating the
- *   key was the load-bearing step; ACL tightening is best-effort hardening
- *   on top.
+ *   warns to stderr and generateKeypair() returns { aclHardened: false }.
+ *   The CLI dispatch then exits non-zero so automation (bootstrap.js,
+ *   doctor --fix) does not treat an unhardened key as a clean generation —
+ *   set EXCEPTD_ALLOW_WEAK_KEY_ACL=1 to accept the weaker ACL on a
+ *   single-user host. (The key write itself still succeeds; the non-zero
+ *   exit signals "key present but not ACL-hardened," not "no key.")
  *
  * Signing ceremony:
  *   1. node lib/sign.js generate-keypair    — generate keypair (one time, per deployment)
@@ -78,6 +81,12 @@ const path = require('path');
 const crypto = require('crypto');
 const { execFileSync } = require('child_process');
 const { safeExit } = require('./exit-codes');
+// Reuse the EXACT validator lib/verify.js applies at load time, so the signer
+// and the verifier can never disagree about what a well-formed manifest is.
+// Requiring verify.js is side-effect-free (its CLI block is guarded by
+// `require.main === module`) and verify.js does not require sign.js, so there
+// is no circular dependency.
+const { validateAgainstSchema } = require('./verify');
 
 const ROOT = path.join(__dirname, '..');
 const MANIFEST_PATH = path.join(ROOT, 'manifest.json');
@@ -85,6 +94,7 @@ const KEYS_DIR = path.join(ROOT, '.keys');
 const PUBLIC_KEYS_DIR = path.join(ROOT, 'keys');
 const PRIVATE_KEY_PATH = path.join(KEYS_DIR, 'private.pem');
 const PUBLIC_KEY_PATH = path.join(PUBLIC_KEYS_DIR, 'public.pem');
+const MANIFEST_SCHEMA_PATH = path.join(__dirname, 'schemas', 'manifest.schema.json');
 
 // --- public API ---
 
@@ -96,28 +106,6 @@ const PUBLIC_KEY_PATH = path.join(PUBLIC_KEYS_DIR, 'public.pem');
  * @param {{ rotate: boolean }} options
  */
 function generateKeypair({ rotate = false } = {}) {
-  if (fs.existsSync(PRIVATE_KEY_PATH) && !rotate) {
-    console.error('[sign] Private key already exists at .keys/private.pem');
-    console.error('[sign] Use --rotate to generate a new keypair and invalidate existing signatures.');
-    process.exit(1);
-  }
-
-  // Refuse to silently overwrite an existing public key when no private key
-  // is present. This is the v0.11.x signature-regression class: a host with
-  // a working pubkey but missing privkey running generate-keypair would
-  // produce a fresh pubkey divergent from every shipped signature. Operators
-  // running `exceptd doctor --fix` on a stock install would replace the
-  // shipped keys/public.pem with one whose private half exists only on
-  // their machine — every subsequent verify against shipped signatures fails.
-  // Force the operator to be explicit via --rotate (which signals intent to
-  // re-sign).
-  if (fs.existsSync(PUBLIC_KEY_PATH) && !rotate) {
-    console.error('[sign] Public key already exists at keys/public.pem but no matching private key.');
-    console.error('[sign] Refusing to overwrite the public key — that would orphan every existing signature.');
-    console.error('[sign] If you are setting up a fresh signing identity, pass --rotate to confirm. After --rotate you must re-sign all skills with sign-all.');
-    process.exit(1);
-  }
-
   fs.mkdirSync(KEYS_DIR, { recursive: true, mode: 0o700 });
   fs.mkdirSync(PUBLIC_KEYS_DIR, { recursive: true });
 
@@ -126,8 +114,49 @@ function generateKeypair({ rotate = false } = {}) {
     publicKeyEncoding: { type: 'spki', format: 'pem' }
   });
 
-  fs.writeFileSync(PRIVATE_KEY_PATH, privateKey, { encoding: 'utf8', mode: 0o600 });
-  fs.writeFileSync(PUBLIC_KEY_PATH, publicKey, { encoding: 'utf8', mode: 0o644 });
+  // Atomic create-exclusive (flag 'wx' = O_CREAT|O_EXCL): the open itself
+  // refuses an existing key — there is no separate existsSync to race against,
+  // and exclusive-create won't follow a symlink/file an attacker preplanted at
+  // the key path. EEXIST translates to the same operator-facing refusals the
+  // bootstrap has always surfaced; --rotate is a deliberate re-key (flag 'w').
+  // The public-key refusal is the v0.11.x signature-regression guard: a host
+  // with a working pubkey but no privkey must NOT silently regenerate the
+  // pubkey (that orphans every shipped signature) — force --rotate to confirm.
+  const openFlag = rotate ? 'w' : 'wx';
+  let privFd;
+  try {
+    privFd = fs.openSync(PRIVATE_KEY_PATH, openFlag, 0o600);
+  } catch (e) {
+    if (e.code === 'EEXIST') {
+      console.error('[sign] Private key already exists at .keys/private.pem');
+      console.error('[sign] Use --rotate to generate a new keypair and invalidate existing signatures.');
+      process.exit(1);
+    }
+    throw e;
+  }
+  let pubFd;
+  try {
+    pubFd = fs.openSync(PUBLIC_KEY_PATH, openFlag, 0o644);
+  } catch (e) {
+    fs.closeSync(privFd);
+    // A pubkey clash after we exclusively created the privkey must not leave a
+    // half-written signing identity behind.
+    try { fs.unlinkSync(PRIVATE_KEY_PATH); } catch { /* best effort */ }
+    if (e.code === 'EEXIST') {
+      console.error('[sign] Public key already exists at keys/public.pem but no matching private key.');
+      console.error('[sign] Refusing to overwrite the public key — that would orphan every existing signature.');
+      console.error('[sign] If you are setting up a fresh signing identity, pass --rotate to confirm. After --rotate you must re-sign all skills with sign-all.');
+      process.exit(1);
+    }
+    throw e;
+  }
+  try {
+    fs.writeSync(privFd, privateKey);
+    fs.writeSync(pubFd, publicKey);
+  } finally {
+    fs.closeSync(privFd);
+    fs.closeSync(pubFd);
+  }
 
   // on win32, fs.writeFileSync `mode` does not produce
   // a POSIX-style restrictive ACL. Tighten via icacls so other desktop
@@ -174,6 +203,9 @@ function generateKeypair({ rotate = false } = {}) {
 function signAll() {
   const privateKey = loadPrivateKey();
   const manifest = loadManifest();
+  // Schema-validate BEFORE any mutation/write — refuse to sign a manifest
+  // the verifier would reject. Matches lib/verify.js signAll().
+  validateManifestSchema(manifest, 'sign-all');
   // Validate every entry's path before doing any I/O. Reject the whole
   // manifest on the first traversal attempt — we never want to sign
   // half a manifest then exit non-zero with a partial mutation.
@@ -230,6 +262,9 @@ function signAll() {
 function signOne(skillName) {
   const privateKey = loadPrivateKey();
   const manifest = loadManifest();
+  // Schema-validate BEFORE any mutation/write — refuse to sign a manifest
+  // the verifier would reject. Matches lib/verify.js signAll().
+  validateManifestSchema(manifest, 'sign');
   const skill = manifest.skills.find(s => s.name === skillName);
   if (!skill) { console.error(`Skill not found: ${skillName}`); process.exit(1); }
 
@@ -329,6 +364,33 @@ function loadManifest() {
   return JSON.parse(fs.readFileSync(MANIFEST_PATH, 'utf8'));
 }
 
+/**
+ * Validate the manifest against lib/schemas/manifest.schema.json BEFORE
+ * signing, mirroring lib/verify.js signAll() (which throws on schema
+ * violation before re-signing). Without this the signer is the WEAKER
+ * check: a manifest that is path-safe but schema-invalid (unknown
+ * per-skill field, malformed version, bad atlas_ref, missing required
+ * field) gets a valid manifest_signature here, then lib/verify.js
+ * loadManifestValidated() THROWS on the same schema at install time and
+ * refuses to verify any skill. The producer must never emit an artifact
+ * the consumer rejects, so the signer is held to at least the verifier's
+ * bar. The validator itself is imported from lib/verify.js so the two
+ * halves can never drift to different rules.
+ *
+ * @param {object} manifest parsed manifest.json
+ * @param {string} who 'sign-all' | 'sign' — surfaced in the error
+ * @throws on any schema violation
+ */
+function validateManifestSchema(manifest, who) {
+  const schema = JSON.parse(fs.readFileSync(MANIFEST_SCHEMA_PATH, 'utf8'));
+  const errors = validateAgainstSchema(manifest, schema, 'manifest');
+  if (errors.length > 0) {
+    const detail = errors.slice(0, 10).map(e => '  - ' + e).join('\n');
+    const more = errors.length > 10 ? `\n  ...and ${errors.length - 10} more` : '';
+    throw new Error(`[sign] manifest.json failed schema validation before ${who} — refusing to sign:\n${detail}${more}`);
+  }
+}
+
 /**
  * canonical byte form of the manifest, used for both
  * signing (lib/sign.js) and verification (lib/verify.js).
@@ -460,9 +522,24 @@ if (require.main === module) {
   const arg = process.argv[3];
 
   switch (cmd) {
-    case 'generate-keypair':
-      generateKeypair({ rotate: process.argv.includes('--rotate') });
+    case 'generate-keypair': {
+      const { aclHardened } = generateKeypair({ rotate: process.argv.includes('--rotate') });
+      // On win32 a failed icacls hardening leaves the private key inheriting
+      // the parent ACL — potentially readable by other desktop users. Make
+      // that detectable to automation (bootstrap.js, doctor --fix) instead of
+      // burying it in a mid-banner line under a 0 exit: fail loud unless the
+      // operator opts into the weaker ACL on a host where it is acceptable.
+      // exitCode (not process.exit) so the buffered stdout banner drains.
+      if (process.platform === 'win32' && aclHardened === false) {
+        if (process.env.EXCEPTD_ALLOW_WEAK_KEY_ACL === '1') {
+          console.warn('[sign] WARN: private-key ACL was NOT hardened; continuing because EXCEPTD_ALLOW_WEAK_KEY_ACL=1.');
+        } else {
+          console.error('[sign] ERROR: private key written but Windows ACL hardening FAILED — the key may be readable by other desktop users on this machine. Strip inheritance manually (icacls .keys\\private.pem /inheritance:r /grant:r "%USERNAME%":F), or set EXCEPTD_ALLOW_WEAK_KEY_ACL=1 to accept the weaker ACL on a single-user host.');
+          safeExit(1);
+        }
+      }
       break;
+    }
     case 'sign-all':
       signAll();
       break;
@@ -502,6 +579,7 @@ module.exports = {
   signOne,
   normalize,
   validateSkillPath,
+  validateManifestSchema,
   canonicalManifestBytes,
   signCanonicalManifest,
   restrictWindowsAcl,

package/lib/source-advisories.js

@@ -49,6 +49,7 @@
 
 const path = require('path');
 const fs = require('fs');
+const { withRetry } = require('../vendor/blamejs/retry.js');
 
 const TODAY = new Date().toISOString().slice(0, 10);
 
@@ -338,13 +339,30 @@ async function fetchFeed(feed, ctx) {
     return { ok: true, body: fs.readFileSync(p, 'utf8') };
   }
   if (typeof fetch !== 'function') return { ok: false, error: 'fetch() not available — Node 18+ required' };
-  try {
+  // Adopt the vendored blamejs retry primitive (BJS-02): a transient feed
+  // failure (HTTP 429/5xx, timeout/abort, network reset) is retried with
+  // backoff + jitter instead of dropping the feed on the first hiccup. A
+  // permanent 4xx is not retried. Each attempt gets a fresh abort timer.
+  const attempt = async () => {
     const ac = new AbortController();
     const timer = setTimeout(() => ac.abort(), 8000);
-    const r = await fetch(feed.url, { signal: ac.signal, headers: { 'User-Agent': 'exceptd-advisories-poller/0.13.1 (+https://exceptd.com)' } });
-    clearTimeout(timer);
-    if (!r.ok) return { ok: false, error: `HTTP ${r.status}` };
-    return { ok: true, body: await r.text() };
+    try {
+      const r = await fetch(feed.url, { signal: ac.signal, headers: { 'User-Agent': 'exceptd-advisories-poller/0.13.1 (+https://exceptd.com)' } });
+      if (!r.ok) { const e = new Error(`HTTP ${r.status}`); e.statusCode = r.status; throw e; }
+      return await r.text();
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+  const retryable = (err) => {
+    if (err && typeof err.statusCode === 'number') return err.statusCode === 429 || err.statusCode >= 500;
+    if (err && (err.name === 'AbortError' || err.name === 'TimeoutError')) return true;
+    const code = err && (err.code || (err.cause && err.cause.code));
+    return !!code && /^(ECONNRESET|ECONNREFUSED|ECONNABORTED|ETIMEDOUT|EPIPE|EAGAIN|ENOTFOUND|ENETUNREACH|UND_ERR)/.test(String(code));
+  };
+  try {
+    const body = await withRetry(attempt, { maxAttempts: 3, baseDelayMs: 100, maxDelayMs: 2000, jitterFactor: 0.5, isRetryable: retryable });
+    return { ok: true, body };
   } catch (e) {
     return { ok: false, error: e.message || String(e) };
   }

package/lib/source-ghsa.js

@@ -33,6 +33,16 @@ const GHSA_PATH = "/advisories?per_page=50&type=reviewed&sort=published&directio
 const REQUEST_TIMEOUT_MS = 10000;
 const USER_AGENT = "exceptd-security/source-ghsa (+https://exceptd.com)";
 
+// Cap the streamed response so a hijacked DNS / compromised CDN / MITM serving
+// api.github.com can't stream unbounded bytes into RAM. A 50-advisory page is
+// well under a MB; 16 MB is generous headroom. Symmetric with the JSON cap
+// getJsonOnce enforces in lib/refresh-network.js and the OSV poller's cap.
+// Tunable via EXCEPTD_GHSA_RESPONSE_CAP_BYTES for future API growth.
+function ghsaResponseCapBytes() {
+  const env = parseInt(process.env.EXCEPTD_GHSA_RESPONSE_CAP_BYTES, 10);
+  return Number.isFinite(env) && env > 0 ? env : 16 * 1024 * 1024;
+}
+
 /**
  * Field-dropped watch set — fields the buildDiff regression-detector
  * watches when the upstream still has an entry but a previously-populated
@@ -123,8 +133,22 @@ function ghsaRequestOnce({ path, headers, timeoutMs }) {
         return resolve({ ok: false, error: `GHSA returned HTTP ${status}`, source: "offline" });
       }
       const chunks = [];
-      res.on("data", (c) => chunks.push(c));
+      let total = 0;
+      const cap = ghsaResponseCapBytes();
+      let capped = false;
+      res.on("data", (c) => {
+        total += c.length;
+        if (total > cap) {
+          capped = true;
+          req.destroy(new Error(`GHSA response exceeds ${cap}-byte cap during streaming download`));
+          return;
+        }
+        chunks.push(c);
+      });
       res.on("end", () => {
+        // If the cap fired, req.destroy already routed through req.on("error");
+        // don't also resolve here (avoids a double-settle on the promise).
+        if (capped) return;
         try {
           const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
           const advisories = Array.isArray(body) ? body : (body ? [body] : []);

package/lib/source-osv.js

@@ -47,6 +47,17 @@ const OSV_HOST = "api.osv.dev";
 const REQUEST_TIMEOUT_MS = 10000;
 const USER_AGENT = "exceptd-security/source-osv (+https://exceptd.com)";
 
+// Cap the streamed response so a hostile or misconfigured endpoint (a hijacked
+// DNS / compromised CDN / OSV_HOST_OVERRIDE pointed at a malicious server)
+// can't stream unbounded bytes into RAM. A real /v1/vulns/{id} or /v1/query
+// response is a few KB; 16 MB is generous headroom. Symmetric with the JSON
+// cap getJsonOnce enforces in lib/refresh-network.js. Tunable via
+// EXCEPTD_OSV_RESPONSE_CAP_BYTES for future API growth.
+function osvResponseCapBytes() {
+  const env = parseInt(process.env.EXCEPTD_OSV_RESPONSE_CAP_BYTES, 10);
+  return Number.isFinite(env) && env > 0 ? env : 16 * 1024 * 1024;
+}
+
 // Identifier namespaces OSV uses as PRIMARY keys. GHSA-* is intentionally
 // NOT in this list — `seedSingleAdvisory` in lib/refresh-external.js routes
 // CVE-* and GHSA-* through `source-ghsa` because GHSA carries richer field
@@ -214,8 +225,22 @@ function osvRequestOnce({ method, reqPath, body, timeoutMs }) {
         return resolve({ ok: false, error, status, source: "offline" });
       }
       const chunks = [];
-      res.on("data", (c) => chunks.push(c));
+      let total = 0;
+      const cap = osvResponseCapBytes();
+      let capped = false;
+      res.on("data", (c) => {
+        total += c.length;
+        if (total > cap) {
+          capped = true;
+          req.destroy(new Error(`OSV response exceeds ${cap}-byte cap during streaming download`));
+          return;
+        }
+        chunks.push(c);
+      });
       res.on("end", () => {
+        // If the cap fired, req.destroy already routed through req.on("error");
+        // don't also resolve here (avoids a double-settle on the promise).
+        if (capped) return;
         try {
           const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
           resolve({ ok: true, record: parsed, source: "osv-api" });

package/lib/upstream-check.js

@@ -55,7 +55,7 @@ async function fetchLatestPublished({ timeoutMs = REQUEST_TIMEOUT_MS, pkgName =
   }
 
   return new Promise((resolve) => {
-    const path = `/${encodeURIComponent(pkgName).replace("%40", "@").replace("%2F", "/")}`;
+    const path = `/${encodeURIComponent(pkgName).replace(/%40/g, "@").replace(/%2F/g, "/")}`;
     const req = https.get({
       host: REGISTRY_HOST,
       path,

package/lib/validate-cve-catalog.js

@@ -43,10 +43,15 @@ const FRAMEWORK_GAPS_PATH = path.join(REPO_ROOT, 'data', 'framework-control-gaps
 // one of these, the entry must carry an `iocs` block per AGENTS.md Hard Rule
 // #14. Surfaced as a warning by default so drafts and pre-IoC entries don't
 // break patch-class compatibility; promoted to an error under --strict.
+// The host-based entries anchor on scheme + host so a lookalike that merely
+// embeds the host as a label (`exploit-db.com.attacker.example`,
+// `not-exploit-db.com`, `evil.com/?ref=packetstormsecurity.com`) is no longer
+// misclassified as a public-exploit source. Verified zero classification
+// change across the live catalog's verification URLs.
 const PUBLIC_EXPLOIT_URL_PATTERNS = [
-  /github\.com\/.+\/(exploits?|poc|pocs)\b/i,
-  /\bexploit-?db\.com\b/i,
-  /\bpacketstormsecurity\.com\b/i,
+  /^https?:\/\/(?:[\w-]+\.)*github\.com\/.+\/(?:exploits?|pocs?)\b/i,
+  /^https?:\/\/(?:[\w-]+\.)*exploit-?db\.com(?:[/:?#]|$)/i,
+  /^https?:\/\/(?:[\w-]+\.)*packetstormsecurity\.com(?:[/:?#]|$)/i,
   /\bmetasploit\b/i,
   /\/poc\//i,
   /-poc\b/i,
@@ -215,6 +220,17 @@ function isUsableDate(value) {
   }
   const d = new Date(value + 'T00:00:00Z');
   if (Number.isNaN(d.getTime())) return { ok: false, reason: 'unparseable' };
+  // Reject impossible calendar dates (Feb 30, Apr 31, Feb 29 in a non-leap
+  // year). `new Date('2026-02-30T00:00:00Z')` does NOT throw — it silently
+  // rolls over to March 2 and reports a valid getTime() — so a malformed KEV
+  // deadline would pass this, the only date-validity guard. Require the parsed
+  // Y-M-D to round-trip back to the input components.
+  const [yStr, mStr, dStr] = value.split('-');
+  if (d.getUTCFullYear() !== Number(yStr) ||
+      d.getUTCMonth() + 1 !== Number(mStr) ||
+      d.getUTCDate() !== Number(dStr)) {
+    return { ok: false, reason: `impossible calendar date ${value}` };
+  }
   const year = Number(value.slice(0, 4));
   if (year < MIN_VALID_YEAR || year > MAX_VALID_YEAR) {
     return {

package/lib/validate-indexes.js

@@ -36,6 +36,49 @@ function sha256(buf) {
   return crypto.createHash("sha256").update(buf).digest("hex");
 }
 
+/**
+ * Confirm every derived index OUTPUT exists, is a real file, and parses as
+ * JSON. Returns an array of human-readable issue strings (empty = all good).
+ * Source-hash drift alone does NOT catch a deleted/truncated/corrupted output,
+ * so this runs in addition to the source-hash comparison.
+ */
+function verifyOutputs(idxDir, outputs) {
+  const issues = [];
+  // O_NOFOLLOW + a single descriptor: the open atomically refuses a symlinked
+  // index path (ELOOP) and every subsequent stat/read rides the same fd, so
+  // there is no existsSync->lstat->readFileSync TOCTOU on the path. Where
+  // O_NOFOLLOW is unavailable the flag degrades to 0 (plain open).
+  const O_NOFOLLOW = fs.constants.O_NOFOLLOW || 0;
+  for (const file of outputs) {
+    const abs = path.join(idxDir, file);
+    let fd;
+    try {
+      fd = fs.openSync(abs, fs.constants.O_RDONLY | O_NOFOLLOW);
+    } catch (e) {
+      if (e.code === "ELOOP") {
+        issues.push(`derived index file is a symbolic link: data/_indexes/${file}`);
+      } else if (e.code === "ENOENT") {
+        issues.push(`derived index file missing: data/_indexes/${file} — run npm run build-indexes`);
+      } else {
+        issues.push(`derived index file unreadable: data/_indexes/${file} (${e.message})`);
+      }
+      continue;
+    }
+    try {
+      // readFileSync(fd) loops read() to EOF — a single readSync may return
+      // fewer than st.size bytes (short read on a network/FUSE-backed fd),
+      // leaving the tail NUL-filled and truncating the JSON. Reading via the
+      // open fd keeps the open→fstat ordering TOCTOU-free.
+      JSON.parse(fs.readFileSync(fd, "utf8"));
+    } catch (e) {
+      issues.push(`derived index file does not parse: data/_indexes/${file} (${e.message})`);
+    } finally {
+      fs.closeSync(fd);
+    }
+  }
+  return issues;
+}
+
 function main() {
   if (!fs.existsSync(META)) {
     console.error("[validate-indexes] data/_indexes/_meta.json missing — run `npm run build-indexes`.");
@@ -122,6 +165,24 @@ function main() {
     }
   }
 
+  // Verify the derived index OUTPUTS themselves exist and parse. Source-hash
+  // drift alone does not catch a deleted/truncated/corrupted OUTPUT: a clean
+  // source tree with a missing index file would otherwise pass as "current".
+  // _meta.outputs is the canonical list build-indexes records; an absent list
+  // FAILS (rather than silently skipping the check) so an old _meta can't pass.
+  // Absent `outputs` list (an older build that predates this field) is itself a
+  // staleness condition — fold it into the unified STALE report rather than
+  // early-returning, so a concurrent source-hash drift still surfaces too.
+  const outputs = Array.isArray(meta.outputs) ? meta.outputs : null;
+  if (!outputs || outputs.length === 0) {
+    missing.push(
+      "data/_indexes/_meta.json has no `outputs` list — rebuild with " +
+      "`npm run build-indexes` so derived-index integrity can be confirmed"
+    );
+  } else {
+    for (const issue of verifyOutputs(IDX_DIR, outputs)) missing.push(issue);
+  }
+
   const issues = [...drift, ...missing];
   if (issues.length === 0) {
     console.log(`[validate-indexes] indexes current — ${recordedKeys.size} sources hashed at ${meta.generated_at}.`);
@@ -136,4 +197,4 @@ function main() {
 
 if (require.main === module) main();
 
-module.exports = { main };
+module.exports = { main, verifyOutputs };

package/lib/validate-playbooks.js

@@ -521,7 +521,10 @@ function checkCrossRefs(playbook, ctx, playbookIds) {
   // here at error severity.
   if (meta.air_gap_mode === true) {
     const look = phases.look || {};
-    const netSourceRe = /(https?:\/\/|gh api|gh release|curl |wget |fetch )/;
+    // Case-insensitive + word-bounded so `HTTPS://`, `Curl`, and `fetch(` (no
+    // trailing space) still flag a network source — otherwise an artifact could
+    // ship under air_gap_mode with no offline alternative and run incomplete.
+    const netSourceRe = /(https?:\/\/|\bgh (?:api|release)\b|\bcurl\b|\bwget\b|\bfetch\b)/i;
     for (const [i, art] of (look.artifacts || []).entries()) {
       if (!art || typeof art !== 'object') continue;
       if (typeof art.source === 'string' && netSourceRe.test(art.source)) {

package/lib/validate-vendor.js

@@ -37,15 +37,23 @@ function main() {
   const prov = JSON.parse(fs.readFileSync(PROV, "utf8"));
   const issues = [];
 
-  // License file.
-  if (prov.license_file && prov.license_sha256) {
-    const p = path.join(ROOT, "vendor", "blamejs", prov.license_file);
-    if (!fs.existsSync(p)) {
-      issues.push(`missing license file: ${prov.license_file}`);
+  // License file. A recorded license_file with NO license_sha256 is an
+  // unverifiable integrity claim, not a skip: stripping the hash from the
+  // manifest must not silently disable the LICENSE-text check (the
+  // absent-field-fails-open class). Only a manifest that records no
+  // license_file at all is exempt.
+  if (prov.license_file) {
+    if (!prov.license_sha256) {
+      issues.push(`license_file recorded (${prov.license_file}) without license_sha256 — integrity unverifiable`);
     } else {
-      const live = sha256(fs.readFileSync(p));
-      if (live !== prov.license_sha256) {
-        issues.push(`LICENSE drift: recorded ${prov.license_sha256.slice(0, 12)}…, live ${live.slice(0, 12)}…`);
+      const p = path.join(ROOT, "vendor", "blamejs", prov.license_file);
+      if (!fs.existsSync(p)) {
+        issues.push(`missing license file: ${prov.license_file}`);
+      } else {
+        const live = sha256(fs.readFileSync(p));
+        if (live !== prov.license_sha256) {
+          issues.push(`LICENSE drift: recorded ${prov.license_sha256.slice(0, 12)}…, live ${live.slice(0, 12)}…`);
+        }
       }
     }
   }
@@ -57,10 +65,43 @@ function main() {
       issues.push(`missing vendored file: ${info.vendored_path}`);
       continue;
     }
+    // A files[] entry recorded without vendored_sha256 is an unverifiable
+    // integrity claim — surface it as a clean issue rather than crashing on
+    // `undefined.slice()` while formatting a drift message (the absent-field
+    // class, symmetric with the license path above).
+    if (!info.vendored_sha256) {
+      issues.push(`${info.vendored_path} recorded without vendored_sha256 — integrity unverifiable`);
+      continue;
+    }
     const live = sha256(fs.readFileSync(p));
     if (live !== info.vendored_sha256) {
       issues.push(`drift in ${info.vendored_path}: recorded ${info.vendored_sha256.slice(0, 12)}…, live ${live.slice(0, 12)}…`);
     }
+    // Offline upstream-pin cross-check. The vendored_sha256 compare above is
+    // self-attesting — it only proves the file matches its OWN recorded hash,
+    // never that the bytes match blamejs@<pin> upstream. The full upstream
+    // verification (scripts/validate-vendor-online.js) needs the network and
+    // is not a predeploy gate, so a hand-edited upstream_sha256_at_pin
+    // advertising a pin that never existed otherwise passes every
+    // automatically-run gate.
+    //
+    // For a file recorded with NO strip rules, the vendored bytes are
+    // byte-identical to upstream by definition, so upstream_sha256_at_pin MUST
+    // equal vendored_sha256. A divergence is a forged or internally
+    // inconsistent pin claim, and it is provable OFFLINE — no fetch required.
+    // This closes the upstream side of the integrity check for every
+    // unmodified vendored file (the common case) inside the existing gate.
+    const stripped = Array.isArray(info.stripped) ? info.stripped : [];
+    if (stripped.length === 0) {
+      if (!info.upstream_sha256_at_pin) {
+        issues.push(`${info.vendored_path} has no strip rules but records no upstream_sha256_at_pin — upstream pin claim unverifiable`);
+      } else if (info.upstream_sha256_at_pin !== info.vendored_sha256) {
+        issues.push(
+          `${info.vendored_path} records no strip rules, so its upstream_sha256_at_pin must equal vendored_sha256, ` +
+            `but upstream_sha256_at_pin is ${String(info.upstream_sha256_at_pin).slice(0, 12)}… vs vendored ${info.vendored_sha256.slice(0, 12)}… — forged or inconsistent upstream pin`
+        );
+      }
+    }
     // Smoke-check the vendored module loads.
     try {
       require(p);
@@ -69,6 +110,26 @@ function main() {
     }
   }
 
+  // On-disk inventory cross-check (BJS-04): the loop above is one-directional
+  // (manifest → disk). A .js file PRESENT in vendor/blamejs/ but ABSENT from
+  // _PROVENANCE.json would ship in the tarball and be require()'d by lib code
+  // while NOTHING verifies its integrity — an unregistered or smuggled-in
+  // vendored module. Flag every on-disk .js that the manifest does not record.
+  const registered = new Set(
+    Object.values(prov.files || {}).map((info) => path.basename(info.vendored_path))
+  );
+  const vendorDir = path.join(ROOT, "vendor", "blamejs");
+  try {
+    for (const f of fs.readdirSync(vendorDir)) {
+      if (!f.endsWith(".js")) continue;
+      if (!registered.has(f)) {
+        issues.push(`unregistered vendored file: vendor/blamejs/${f} is on disk but absent from _PROVENANCE.json — its integrity is not verified`);
+      }
+    }
+  } catch (err) {
+    issues.push(`cannot read vendor/blamejs/ for the inventory cross-check: ${err.message}`);
+  }
+
   if (issues.length === 0) {
     const fileCount = Object.keys(prov.files || {}).length;
     console.log(`[validate-vendor] vendor tree current — ${fileCount} file(s) validated against pin ${prov.pinned_commit?.slice(0, 12) || "?"}.`);