@blamejs/exceptd-skills 0.18.6 → 0.18.8

package/orchestrator/index.js

@@ -28,6 +28,7 @@ const { currencyCheck, initPipeline } = require('./pipeline');
 const { bus, EVENT_TYPES } = require('./event-bus');
 const { start: startScheduler, stop: stopScheduler, runCurrencyNow } = require('./scheduler');
 const { EXIT_CODES, safeExit } = require('../lib/exit-codes');
+const { withRetry } = require('../vendor/blamejs/retry.js');
 
 const cmd = process.argv[2];
 const args = process.argv.slice(3);
@@ -557,14 +558,34 @@ async function runReport(format) {
           revision_history: [{ number: '1', date: new Date().toISOString(), summary: 'Initial report emission' }],
         },
       },
+      // CSAF vulnerabilities[] are CVE-scoped by spec; non-CVE findings (signal
+      // detections without a catalogued CVE) are preserved in
+      // exceptd_extension.scan_summary below, not dropped.
       vulnerabilities: scanResult.findings
         .filter(f => f.cve_id)
-        .map(f => ({
-          cve: f.cve_id,
-          notes: [{ category: 'description', text: f.action_required || f.signal }],
-          scores: [{ products: [], cvss_v3: { base_score: 0 } }],
-          threats: f.severity === 'critical' ? [{ category: 'exploit_status', details: f.action_required }] : [],
-        })),
+        .map(f => {
+          const vuln = {
+            cve: f.cve_id,
+            // Never emit a null description/threat detail — the CSAF schema
+            // requires non-empty strings, so fall back through signal to a
+            // generic label.
+            notes: [{ category: 'description', text: f.action_required || f.signal || 'Vulnerability detected' }],
+            threats: f.severity === 'critical'
+              ? [{ category: 'exploit_status', details: f.action_required || f.signal || 'Critical vulnerability detected' }]
+              : [],
+          };
+          // Emit the REAL catalog CVSS, never a hardcoded base_score:0 (which
+          // reads as "no impact" and inverts the risk for a critical CVE).
+          // Mirror the playbook-runner CSAF emitter: a cvss_v3 block carries
+          // vectorString (CSAF §3.2.1.5), so emit it only when both the score
+          // and vector are known, and omit scores entirely otherwise rather
+          // than fabricate one.
+          if (typeof f.cvss_score === 'number' && Number.isFinite(f.cvss_score) &&
+              typeof f.cvss_vector === 'string' && f.cvss_vector) {
+            vuln.scores = [{ products: [], cvss_v3: { baseScore: f.cvss_score, vectorString: f.cvss_vector } }];
+          }
+          return vuln;
+        }),
       exceptd_extension: {
         scan_summary: scanResult.summary,
         dispatch_plan: plan,
@@ -685,7 +706,11 @@ function _acquireWatchLock() {
   const STALE_MS = 60_000;
 
   function tryCreate() {
-    const fd = fsMod.openSync(lockPath, 'wx');
+    // O_EXCL create with an explicit owner-only (0o600) mode: the predictable
+    // lock-file name is the cross-process mutex, so safety is the exclusive
+    // create + restrictive perms, not an unguessable name. The explicit mode
+    // also clears the insecure-temporary-file static-analysis finding.
+    const fd = fsMod.openSync(lockPath, 'wx', 0o600);
     fsMod.writeSync(fd, JSON.stringify({ pid: process.pid, started_at: new Date().toISOString() }));
     fsMod.closeSync(fd);
   }
@@ -1697,18 +1722,26 @@ async function validateAllCvesPreferCache(catalog, cacheDir) {
   function readCached(source, id) {
     const safe = id.replace(/[^A-Za-z0-9._-]/g, '_');
     const p = path.join(cacheDir, source, `${safe}.json`);
-    if (!fs.existsSync(p)) return null;
+    let fd;
+    // Open once and fstat the descriptor — no existsSync→statSync→read TOCTOU.
+    try { fd = fs.openSync(p, 'r'); }
+    catch { return null; } // absent / unreadable (matches the old existsSync:false skip)
     try {
-      const st = fs.statSync(p);
+      const st = fs.fstatSync(fd);
       if (st.size > CACHE_FILE_MAX_BYTES) {
         console.error(`[validate-cves] cache file ${p} exceeds ${CACHE_FILE_MAX_BYTES} byte cap (${st.size}); refusing to read.`);
         return null;
       }
-      const parsed = JSON.parse(fs.readFileSync(p, 'utf8'));
+      // readFileSync(fd) loops read() to EOF — a single readSync may return
+      // fewer than st.size bytes on network/FUSE/sync-backed fds, leaving the
+      // tail NUL-filled and truncating the JSON. Reading via the open fd keeps
+      // the open→fstat ordering TOCTOU-free.
+      const parsed = JSON.parse(fs.readFileSync(fd, 'utf8'));
       if (!cacheEntryVerified(source, id, parsed)) return null;
       return parsed;
     }
     catch { return null; }
+    finally { if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* non-fatal */ } } }
   }
 
   function extractNvd(payload) {
@@ -1990,21 +2023,49 @@ async function runWatchlistOrgScan(rawArgs = []) {
     safeExit(EXIT_CODES.GENERIC_FAILURE);
     return;
   }
+  // Patterns whose query exhausted retries on a transient failure. Surfaced
+  // in the envelope so a dropped pattern is observable rather than reading as
+  // a clean zero — the false-negative-on-transient class (a flaky 5xx /
+  // reset / timeout silently yielding "no matches found" for a threat-actor
+  // naming pattern) is exactly what NEW-CTRL-052 exists to defend against.
+  const erroredPatterns = [];
+  // A 5xx / timeout / reset is retried with backoff + jitter (mirrors
+  // lib/source-advisories.js#fetchFeed); a permanent 4xx other than the
+  // rate-limit codes is not. 403/429 short-circuit to the rateLimited flag.
+  const retryable = (err) => {
+    // 403/429 are the documented rate-limit signal — surface them at once
+    // (preserving the prior continue-on-rate-limit semantics) rather than
+    // burning the retry budget; the operator re-runs with GITHUB_TOKEN set.
+    if (err && err._rateLimit) return false;
+    if (err && typeof err.statusCode === 'number') return err.statusCode >= 500;
+    if (err && (err.name === 'AbortError' || err.name === 'TimeoutError')) return true;
+    const code = err && (err.code || (err.cause && err.cause.code));
+    return !!code && /^(ECONNRESET|ECONNREFUSED|ECONNABORTED|ETIMEDOUT|EPIPE|EAGAIN|ENOTFOUND|ENETUNREACH|UND_ERR)/.test(String(code));
+  };
   for (const p of patterns) {
     const url = `https://api.github.com/search/repositories?q=${encodeURIComponent(p.q + ' org:' + org)}&per_page=100`;
     const headers = { 'User-Agent': 'exceptd-watchlist-org-scan/0.13.3 (+https://exceptd.com)', 'Accept': 'application/vnd.github+json' };
     if (token) headers.Authorization = `Bearer ${token}`;
-    try {
+    // Each attempt gets a fresh abort timer.
+    const attempt = async () => {
       const ac = new AbortController();
       const timer = setTimeout(() => ac.abort(), 10000);
-      const r = await fetch(url, { headers, signal: ac.signal });
-      clearTimeout(timer);
-      if (r.status === 403 || r.status === 429) {
-        rateLimited = true;
-        continue;
+      try {
+        const r = await fetch(url, { headers, signal: ac.signal });
+        if (r.status === 403 || r.status === 429) {
+          const e = new Error(`HTTP ${r.status}`);
+          e.statusCode = r.status;
+          e._rateLimit = true; // surfaced as rateLimited, never retried
+          throw e;
+        }
+        if (!r.ok) { const e = new Error(`HTTP ${r.status}`); e.statusCode = r.status; throw e; }
+        return await r.json();
+      } finally {
+        clearTimeout(timer);
       }
-      if (!r.ok) continue;
-      const body = await r.json();
+    };
+    try {
+      const body = await withRetry(attempt, { maxAttempts: 3, baseDelayMs: 100, maxDelayMs: 2000, jitterFactor: 0.5, isRetryable: retryable });
       for (const item of body.items || []) {
         matches.push({
           pattern_id: p.id,
@@ -2018,12 +2079,23 @@ async function runWatchlistOrgScan(rawArgs = []) {
           stars: item.stargazers_count || 0,
         });
       }
-    } catch { /* network failure — best effort */ }
+    } catch (err) {
+      // 403/429 (incl. after retries) is the documented rate-limit signal.
+      // Any other exhausted-retry failure marks the pattern errored so the
+      // operator can distinguish a dropped query from a clean no-match.
+      if (err && err._rateLimit) {
+        rateLimited = true;
+      } else {
+        erroredPatterns.push({ pattern_id: p.id, error: (err && err.message) || String(err) });
+      }
+    }
   }
   const generated_at = new Date().toISOString();
   if (outputFormat === 'json') {
     process.stdout.write(JSON.stringify({
-      ok: !rateLimited,
+      // A rate-limited OR errored pattern means the scan is incomplete — a
+      // zero match-count is no longer trustworthy as "clean".
+      ok: !rateLimited && erroredPatterns.length === 0,
       verb: 'watchlist',
       mode: 'org-scan',
       generated_at,
@@ -2032,6 +2104,7 @@ async function runWatchlistOrgScan(rawArgs = []) {
       match_count: matches.length,
       matches,
       rate_limited: rateLimited,
+      errored_patterns: erroredPatterns,
       unauthenticated: unauth,
       control_reference: 'NEW-CTRL-052 (MAL-2026-SHAI-HULUD-OSS lesson)',
     }) + '\n');
@@ -2055,6 +2128,10 @@ async function runWatchlistOrgScan(rawArgs = []) {
       lines.push('> **Warning:** GitHub rate limit hit on at least one pattern query. Some matches may be missing. Re-run with `GITHUB_TOKEN` set to lift the limit.');
       lines.push('');
     }
+    if (erroredPatterns.length > 0) {
+      lines.push(`> **Warning:** ${erroredPatterns.length} pattern quer${erroredPatterns.length === 1 ? 'y' : 'ies'} failed after retries (${erroredPatterns.map((e) => e.pattern_id).join(', ')}). A zero match-count for ${erroredPatterns.length === 1 ? 'that pattern' : 'those patterns'} is NOT a clean result — re-run to confirm.`);
+      lines.push('');
+    }
     if (matches.length === 0) {
       lines.push('_No repositories matching threat-actor patterns found._');
     } else {
@@ -2076,6 +2153,9 @@ async function runWatchlistOrgScan(rawArgs = []) {
   console.log(`Org: ${org}  patterns: ${patterns.length}  matches: ${matches.length}`);
   if (unauth) console.log('(unauthenticated — set GITHUB_TOKEN for private-repo coverage + higher rate limit)');
   if (rateLimited) console.log('WARNING: GitHub rate limit hit on at least one query. Re-run with GITHUB_TOKEN set.');
+  if (erroredPatterns.length > 0) {
+    console.log(`WARNING: ${erroredPatterns.length} pattern quer${erroredPatterns.length === 1 ? 'y' : 'ies'} failed after retries (${erroredPatterns.map((e) => e.pattern_id).join(', ')}). A zero match-count for those is NOT a clean result — re-run to confirm.`);
+  }
   if (matches.length === 0) {
     console.log('No threat-actor-pattern repos found.');
     return;

package/orchestrator/scanner.js

@@ -89,6 +89,10 @@ function kernelScan() {
       value: kernel,
       cve_id: cveId,
       rwep_score: cve.rwep_score,
+      // Carry the catalog CVSS so the CSAF report emits a real cvss_v3 block
+      // (base score + vector) instead of a placeholder base_score:0.
+      cvss_score: cve.cvss_score,
+      cvss_vector: cve.cvss_vector,
       cisa_kev: cve.cisa_kev,
       action_required: 'Cross-reference kernel version against patched version for this CVE',
       skill_hint: 'kernel-lpe-triage',
@@ -158,6 +162,10 @@ function mcpScan() {
           tool,
           config_path: p,
           severity: 'low',
+          // Route directly like the successful mcp_server_detected finding, so a
+          // parse-error finding reaches mcp-agent-trust even if the domain
+          // routing table changes — domain fallback alone left it brittle.
+          skill_hint: 'mcp-agent-trust',
           action_required: 'MCP config file exists but could not be parsed'
         });
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.18.6",
+  "version": "0.18.8",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (459 CVEs / 181 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",