@blamejs/exceptd-skills 0.18.6 → 0.18.8

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 0.18.8 — 2026-06-20
+
+Signature verification now fails closed on the two states an attacker with write access to `keys/` can engineer: a missing `keys/public.pem` makes `loadManifestValidated()` throw rather than return an unverified manifest, and a missing `keys/EXPECTED_FINGERPRINT` makes the manifest-signature check refuse rather than verify against a possibly-swapped key. The pin ships in the tarball and is committed, so its absence is treated as tampering. A missing pin fails closed unconditionally and the error directs you to restore the committed pin; `KEYS_ROTATED=1` governs a key-fingerprint mismatch (a deliberate rotation), which is the only state it applies to — a rotation updates the pin in place, it never removes it.
+
+The compliance close phase no longer crashes when a jurisdiction obligation entry is malformed: a null/non-object entry is skipped during notification enrichment and synthesis instead of throwing; an obligation whose `window_hours` is not a finite number falls back to the pending-clock sentinel instead of computing an invalid date and aborting the phase; a `notification_action` whose `obligation_ref` resolves to nothing is dropped (the unmatched ref is surfaced as a diagnostic) rather than emitted with null jurisdiction/regulation; and a notify obligation with a non-number `window_hours` is surfaced as a diagnostic and skipped rather than synthesized into a malformed record. The threat-currency gate hard-blocks a non-numeric `threat_currency_score` (absent / null / NaN) instead of letting it slip past as "not less than 50"; `forceStale` still overrides. Air-gap mode flags an artifact that has no `air_gap_alternative` so its fall-back to the original (possibly network-bound) source is visible instead of a silent bypass. A CVE marked both `not_affected` and `fixed` in a VEX statement no longer appears as fixed while absent from the matched/baseline sets.
+
+The `theater_score` exposed to `feeds_into` / escalation conditions now follows the same direction as the rest of the engine — a `theater` verdict (a compliance gap exists) scores high and a clear verdict scores low — so a condition such as `theater_score >= 50` chains exactly when a gap is found rather than the reverse.
+
+RWEP scoring is consistent across its three surfaces: the derived score counts the `reboot_required` / `patch_required_reboot` alias once (no double-count), `validateFactors` normalizes `active_exploitation` and accepts the `patch_required_reboot` alias (matching the scorer), and the `compare()` explanation lists the AI factor for `ai_assisted_weaponization`, a stray-cased confirmed exploitation, and the reboot alias.
+
+The orchestrator CSAF report emits a real `cvss_v3` block (base score + vector) for a catalogued CVE instead of a hardcoded `base_score: 0`, and never emits a null description or threat detail. The dispatch plan omits the per-entry `evidence` object when it has no content rather than emitting a bare `{}`, and it now keeps a plan entry for every distinct finding that routes to a skill — two different CVEs that route to the same skill each appear with their own evidence instead of all but the first being silently dropped; a parse-error finding routes directly to its skill rather than relying solely on the domain table. `attest diff`'s human output classifies the sidecar by tamper class first, so an unsigned-substitution attestation is not mislabeled as benign explicitly-unsigned, and prints `(no detail)` instead of `(null)` for an absent timestamp.
+
+Empty-string flag values are rejected instead of silently degrading the command: `--mode ""`, `brief --phase ""`, and `--playbook ""` error rather than running with no scope. The catalog and playbook validators fail loud when a reference catalog or the playbook schema is absent, instead of silently skipping the framework-control, attack-ref, clock-start, and frameworks-in-scope checks — a partial tree can no longer pass an unresolvable reference or an invalid closed-vocabulary value.
+
+`refresh --network`'s upstream prefetch retries a timed-out request (re-classified as a retryable network error) instead of dropping it, so a slow or rate-limiting upstream no longer pushes the scheduled refresh past its error budget. The tarball fetch builds its destination from the canonical npm URL plus a strict-semver-validated version rather than the registry-supplied `dist.tarball`, so a tampered metadata response cannot steer the download's host or path (content trust is unchanged: SHA-512/SRI + shasum + Ed25519); the vendor-source online check likewise validates every URL component (owner/repo shape, hex commit, traversal-free path) before fetching.
+
+The publish-workflow audit now flags a floating (non-SHA) action reference even when the `uses:` line carries a trailing YAML comment — previously such refs were silently missed, reading as compliant.
+
+The index gates fail closed on a degraded tree: a source that vanished between discovery and hashing, or a corrupted hash entry, is reported rather than crashing the validation; and `build-indexes --only` preserves the prior source hashes so a partial rebuild can no longer record stale outputs as fresh. Index files are written atomically.
+
+Internal: the host OS-release lookup reads the file directly instead of spawning `cat`; the orchestrator watch-lock and the playbook mutex lock files are created with an explicit owner-only mode; the evidence-dir entry is opened through a single no-follow descriptor and validated on that descriptor (no check-then-reopen window); the index-output validator and a lock-reentrancy test read through a single descriptor; and a help-text assertion uses a literal substring instead of a partially-escaped regex.
+
+## 0.18.7 — 2026-06-20
+
+Escalation and feeds_into conditions that use an `any`/`all` quantifier prefix, a quoted `matches '…'` pattern, or a quoted `contains` member now evaluate instead of silently failing closed. Several catalog chains that depended on these forms — most visibly the compliance-theater → SBOM correlation — were dead and now fire; the feeds_into evaluation context also exposes the bare `blast_radius_score`, `theater_verdict`, and `compliance_theater_check` tokens the catalog references, so an engine-computed value is no longer lost to a `null` lookup. The SBOM → kernel / MCP / AI-API follow-ups now fire too: a matched CVE carries an `attack_class`, the analyze and close contexts expose the matched-CVE array the `any matched_cve.attack_class == …` rules quantify over, and the CVEs that map unambiguously to one of those deep-dive classes are tagged in the catalog — so an SBOM scan that surfaces an MCP-server RCE or a prompt-injection-to-RCE routes the operator into the matching deep dive, while an unclassified match routes nowhere rather than guessing. `IN […]` member lists, AND/OR joins, and outer parentheses are parsed quote-aware, so a comma, bracket, or operator inside a quoted value no longer tears the clause, and a `contains`/`IN` against a path that doesn't resolve records a diagnostic instead of evaluating to an invisible false.
+
+RWEP scoring no longer silently drops the active-exploitation weight when a CVE's `active_exploitation` value is outside the recognised vocabulary or merely stray-cased (`Confirmed`, ` CONFIRMED `): canonical values are case-normalised, and a genuinely unrecognised value contributes zero **and** emits a warning so the dropped weight is visible rather than quietly lowering the priority. Curation now rejects a mixed-shape `rwep_factors` block (post-weight integers with a stray non-numeric value) at apply time instead of letting it route through the wrong scoring path and write a silently-wrong RWEP to the catalog. The scorer's two factor shapes no longer disagree on that block — the derive path applies the same mixed-shape guard the validator does, so it can't fall back to the boolean path and under-score — the Shape-B sum clamps each weight to its ceiling, and an SLA timeline is derived only from a real number rather than treating a NaN as the least-urgent tier.
+
+`attest diff` no longer manufactures phantom drift when one attestation carries real evidence and the other is empty — the full-catalog placeholder now stands in only when both sides are empty, so a populated side diffs against nothing and yields the genuine added/removed instead of every catalog id reading as drift. It also no longer masks a real change when an artifact's secret or path is carried under a key other than `value`: that evidence is preserved through capture and compared, so two attestations recording different secrets at different paths no longer diff as unchanged.
+
+An empty-string flag value is rejected rather than silently degrading the command. `--evidence ""`, `--evidence-dir ""`, `--phase ""`, `--against ""`, `--playbook ""`, and `--session-id ""` now error instead of running with no scope or bypassing their phase / target / dispatcher validation, and `attest export` redacts `signal_overrides` in its labeled output instead of emitting them verbatim.
+
+The secrets collector no longer double-reports an Anthropic `sk-ant-…` key as both an OpenAI and an Anthropic key, and now surfaces subtrees skipped for exceeding the depth cap instead of leaving them silently unscanned. The collectors and the CVE-cache reader read each file through to end-of-file, so a key or misconfiguration sitting past a short-read boundary on a network or sync-backed filesystem is no longer dropped and the scan no longer reports clean over content it never decoded. The library-author collector no longer flags npm-workspaces lockfile links (`link: true`) as missing integrity — a false positive on every workspaces monorepo. The CI/CD collector matches the GitHub OIDC issuer and a `GITHUB_TOKEN` secret name exactly, so a look-alike issuer host or a custom `GITHUB_TOKEN_*` secret is no longer mis-handled.
+
+The network-backed pollers (OSV, GHSA, the Datatracker freshness probe, the package prefetch, and the watchlist org scan) retry transient failures with backoff and cap response size instead of buffering an unbounded body into memory; the prefetch retry classifier reads the error status under the field the retry helper sets, so a 429/5xx is retried rather than treated as fatal. The vendored-tree integrity check fails closed when a license hash or a per-file hash is absent — a stripped hash no longer reads as verified.
+
+CVE-catalog validation rejects impossible calendar dates (for example `2026-02-30`, or Feb 29 in a non-leap year) on KEV deadline fields instead of letting them roll over to a valid-looking date, and the public-exploit URL classifier is anchored so a look-alike host such as `exploit-db.com.attacker.example` is no longer treated as a public-exploit source.
+
+The index-freshness gate now verifies that every derived index file still exists and parses, not only that the source hashes match — a deleted or truncated index no longer passes as current. `refresh --network` and the vendored-file online validator pin their fetches to the npm registry / GitHub hosts, so a tampered metadata response or redirect cannot steer a download at an arbitrary address. `refresh --network` additionally verifies the npm registry's signature over the fetched tarball and authenticates the `data/` tree and manifest snapshot before swapping them in, so a forged metadata response that recomputes the transport hashes is still refused. The live CVE-validation downgrade guard now reads the upstream metric's declared CVSS version, so a legacy v2 score NVD returns without a vector string is still recognised as a downgrade and held back from a curated v3.x entry — matching the cached refresh path, which already used the declared version.
+
+Internal: the diff-coverage export extractor and the codebase-pattern detectors are now string-aware, so a brace or `//` inside a string literal can no longer hide a new export from the coverage gate or disarm the process-exit / dynamic-regex detectors. Temp files in the test suite are created inside owner-only directories. The signing-key bootstrap creates each key with an exclusive (`O_EXCL`) open so an existing key is refused atomically rather than via a separate existence check, and the index validator opens derived files with `O_NOFOLLOW` and reads them through the descriptor, removing the check-then-read windows static analysis flagged. The signer schema-validates the manifest before writing a signature, so it can no longer bless a manifest the verifier would reject at install time. Several gate detectors close blind spots: the test-count gate ignores `test(` inside a multiline template literal, the export extractor sees method-shorthand and single-identifier `module.exports`, the process-exit detector covers `scripts/` and `bin/`, the version-tag detector no longer counts an IPv4 octet run, and `build-indexes --changed` regenerates a deleted index instead of trusting a clean source hash and no longer rewrites a timestamp on a no-op run.
+
 ## 0.18.6 — 2026-06-14
 
 `attest prune` now ages out sessions that hold only replay records (whose attestation was removed). Such a session had no datable timestamp, so it was kept indefinitely and the attestation store could grow without bound; it is now dated by its newest replay timestamp and pruned past the cutoff like any other session.